release 1.2.0: npm detects 17 vulnerabilities, of those 4 high, 1 critical about vdhcoapp

[kopp]

Here is the output of npm audit:
vdhcoapp_1.2.0_npm_audit.txt

[ford--prefect]

As of 1.4.0 we have now 20 vulns, 10 of which rank high:

npm WARN deprecated [email protected]: gulp-util is deprecated - replace it, following the guidelines at https://medium.com/gulpjs/gulp-util-ca3b1f9f9ac5
npm WARN deprecated [email protected]: CircularJSON is in maintenance only, flatted is its successor.
npm WARN deprecated [email protected]: All versions below 4.0.1 of Nodemailer are deprecated. See https://nodemailer.com/status/
npm WARN deprecated [email protected]: Legacy versions of mkdirp are no longer supported. Please update to mkdirp 1.x. (Note that the API surface has changed to use Promises in 1.x.)
npm WARN deprecated [email protected]: request has been deprecated, see https://github.com/request/request/issues/3142
npm WARN deprecated [email protected]: Legacy versions of mkdirp are no longer supported. Please update to mkdirp 1.x. (Note that the API surface has changed to use Promises in 1.x.)
npm WARN deprecated [email protected]: request has been deprecated, see https://github.com/request/request/issues/3142
npm WARN deprecated [email protected]: This project is unmaintained
npm WARN deprecated [email protected]: If using 2.x branch, please upgrade to at least 2.1.6 to avoid a serious bug with socket data flow and an import issue introduced in 2.1.0
npm WARN deprecated [email protected]: Please update to minimatch 3.0.2 or higher to avoid a RegExp DoS issue
npm WARN deprecated [email protected]: This module relies on Node.js's internals and will break at some point. Do not use it, and update to [email protected].
npm WARN deprecated [email protected]: Use uuid module instead
npm WARN deprecated [email protected]: This module moved to @hapi/hawk. Please make sure to switch over as this distribution is no longer supported and may contain bugs and critical security issues.
npm WARN deprecated [email protected]: This project is unmaintained
npm WARN deprecated [email protected]: This version has been deprecated in accordance with the hapi support policy (hapi.im/support). Please upgrade to the latest version to get the best features, bug fixes, and security patches. If you are unable to upgrade at this time, paid support is available for older versions (hapi.im/commercial).
npm WARN deprecated [email protected]: This version has been deprecated in accordance with the hapi support policy (hapi.im/support). Please upgrade to the latest version to get the best features, bug fixes, and security patches. If you are unable to upgrade at this time, paid support is available for older versions (hapi.im/commercial).
npm WARN deprecated [email protected]: This module moved to @hapi/sntp. Please make sure to switch over as this distribution is no longer supported and may contain bugs and critical security issues.
npm WARN deprecated [email protected]: This version has been deprecated in accordance with the hapi support policy (hapi.im/support). Please upgrade to the latest version to get the best features, bug fixes, and security patches. If you are unable to upgrade at this time, paid support is available for older versions (hapi.im/commercial).
npm WARN deprecated [email protected]: Please update to minimatch 3.0.2 or higher to avoid a RegExp DoS issue
npm WARN deprecated [email protected]: Please see https://github.com/lydell/urix#deprecated
npm WARN deprecated [email protected]: https://github.com/lydell/resolve-url#deprecated
npm WARN deprecated [email protected]: please upgrade to graceful-fs 4 for compatibility with current and future versions of Node.js

The lack of action in this thread as well as the piling amount of vulns really speaks for itself…

[ford--prefect]

It seems indeed like every of these vulnerabilities was pulled in as a dependency of a dependency, and not directly, meaning that the dependencies need fixing.
In my view, a developer is responsible for the code stack released, so also for chosen dependencies. If fixing these (e.g. by moving to another version) is not possible, one has to find another (safer?) library to do the job, IMHO.
Don't get me wrong, this is not a demand to anyone (let alone the developer here), but a basic philosophy about responsibility in coding.
Feel free to close the ticket, but the issue raised is definitely not solved: when building the project as-is you get a result with know vulnerabilities.

[xuiqzy]

for version 1.3.0 there are 17 vulnerabilites and 3 low, 6 moderate, 8 high:

npm WARN deprecated [email protected]: gulp-util is deprecated - replace it, following the guidelines at https://medium.com/gulpjs/gulp-util-ca3b1f9f9ac5
npm WARN deprecated [email protected]: All versions below 4.0.1 of Nodemailer are deprecated. See https://nodemailer.com/status/
npm WARN deprecated [email protected]: gulp-util is deprecated - replace it, following the guidelines at https://medium.com/gulpjs/gulp-util-ca3b1f9f9ac5
npm WARN deprecated [email protected]: This project is unmaintained
npm WARN deprecated [email protected]: If using 2.x branch, please upgrade to at least 2.1.6 to avoid a serious bug with socket data flow and an import issue introduced in 2.1.0
npm WARN deprecated [email protected]: please upgrade to graceful-fs 4 for compatibility with current and future versions of Node.js
npm WARN deprecated [email protected]: Use uuid module instead
npm WARN deprecated [email protected]: This module moved to @hapi/hawk. Please make sure to switch over as this distribution is no longer supported and may contain bugs and critical security issues.
npm WARN deprecated [email protected]: This project is unmaintained
npm WARN deprecated [email protected]: Please update to minimatch 3.0.2 or higher to avoid a RegExp DoS issue
npm WARN deprecated [email protected]: This module relies on Node.js's internals and will break at some point. Do not use it, and update to [email protected].
npm WARN deprecated [email protected]: This module moved to @hapi/sntp. Please make sure to switch over as this distribution is no longer supported and may contain bugs and critical security issues.
npm WARN deprecated [email protected]: This version has been deprecated in accordance with the hapi support policy (hapi.im/support). Please upgrade to the latest version to get the best features, bug fixes, and security patches. If you are unable to upgrade at this time, paid support is available for older versions (hapi.im/commercial).
npm WARN deprecated [email protected]: This version has been deprecated in accordance with the hapi support policy (hapi.im/support). Please upgrade to the latest version to get the best features, bug fixes, and security patches. If you are unable to upgrade at this time, paid support is available for older versions (hapi.im/commercial).
npm WARN deprecated [email protected]: This version has been deprecated in accordance with the hapi support policy (hapi.im/support). Please upgrade to the latest version to get the best features, bug fixes, and security patches. If you are unable to upgrade at this time, paid support is available for older versions (hapi.im/commercial).
npm WARN deprecated [email protected]: Please update to minimatch 3.0.2 or higher to avoid a RegExp DoS issue
npm WARN deprecated [email protected]: please upgrade to graceful-fs 4 for compatibility with current and future versions of Node.js
npm notice created a lockfile as package-lock.json. You should commit this file.
added 838 packages from 450 contributors and audited 3965 packages in 22.618s
found 17 vulnerabilities (3 low, 6 moderate, 8 high)
  run `npm audit fix` to fix them, or `npm audit` for details```

[callmenemo491]

mates, not sure what u want the guy to do.... all the things you listed are from your Linux distribution..., there is nothing in the code, where he provides , say the "mailcomposer" package, and other packages that are listed !

so as the printout tells you run: "npm audit fix"

[ford--prefect]

I'm far from being an npm expert, but I'm pretty sure this has nothing to do with the distribution. As far as I understand it, the developers state in package.json which dependencies and versions they expect to be installed, and npm audit checks for known vulns in these modules and reports. These modules are pulled from npm directly and have nothing to do with the linux distributions packages.
If it is indeed as I laid out, the developers are using vulnerable outdated npm modules and it is totally on their side to migrate their code to a fixed version.
Running npm audit fix is a crotch of npm to find hopefully matching versions that don't have the same reported vulnerabilities.
Correct me if I'm wrong, but thats the way I understood it so far.

[callmenemo491]

am looking where in code it has "package.json"
https://github.com/mi-g/vdhcoapp/search?q=package.json&unscoped_q=package.json

he doesn't provide any package.json...
it comes from NPM, so NPM developers would need to update their "package.json" file to not to use the vulnerable (outdated) packages.

[ford--prefect]

What about this one?
(I think you were searching in files, not for files)

[callmenemo491]

ah thanks! i looked at the file/link you provided:
my previous comment still stands...
his 'package.json' lists which packages it depends on from NPM... none of the packages listed in that package.json are in the 'vulnerability printouts'

so it is the base NPM packages that need to be updated/ take care of those vulnerabilities.

these are the listed in the vul. report:

• boom
• buildmail
• circular-json
• cryptiles
• graceful-fs
• gulp-util
• hawk
• hoek
• mailcomposer
• minimatch
• mkdirp
• natives
• nodemailer
• node-uuid
• request
• resolve-url
• sntp
• socks
• urix

these are what is listed in the tools package.json

• appdmg
• download
• fs.extra
• fs-extra
• got
• gulp
• gulp-clean
• gulp-deb
• gulp-debug
• gulp-ejs
• gulp-gzip
• gulp-if
• gulp-rename
• gulp-tar
• log4js
• opn
• pkg
• regedit
• run-sequence
• tmp
• vinyl-fs
• which
• yargs

if u can find a package listed in the vul. report and the developer's use, then i will 110% agree developer needs to update the code to not use the vul. package.

but, if you cannot find...
then the developer (@mi-g ) does not have to modify one character in the code.
and the ticket should be closed.

[xuiqzy]

Maybe these vulnerabilites come mostly from one or a few dependencies? That would make fixing it easier.
Is there a nice way to check for that with npm?

[mi-g]

Version 1.6.0 contains 1 vulnerability and it is low severity. At this point we cannot do better.

[ford--prefect]

Thanks for taking care of this!