This repo contains the following package.json
and can be installed with the npm install github:<username>/<repository>
command
{
"name": "debug",
"version": "1.0.0",
"description": "",
"main": "index.js",
"scripts": {
"test": "echo \"Error: no test specified\" && exit 1"
},
"repository": {
"type": "git",
"url": "git+https://github.com/PierreJeanjacquot/my-custom-debug.git"
},
"author": "",
"license": "ISC",
"bugs": {
"url": "https://github.com/PierreJeanjacquot/my-custom-debug/issues"
},
"homepage": "https://github.com/PierreJeanjacquot/my-custom-debug#readme"
}
Note that the name
used in the package.json
is the same than the existing npm package debug.
npm audit features incorrectly resolve this package as the debug package hosted on npmjs.com
install this package from the github repository
npm i github:PierreJeanjacquot/my-custom-debug#main
npm install reports 1 low severity vulnerability
the custom debug
package is correctly installed from github
npm ls debug
install-test@ /home/pierre/install-test
└── [email protected] (git+ssh://[email protected]/PierreJeanjacquot/my-custom-debug.git#abfeeee014c6cfc6a3a11beec5595a18c31f6704)
however audit resolves the custom package as debug.
npm audit
# npm audit report
debug <2.6.9
Regular Expression Denial of Service in debug - https://github.com/advisories/GHSA-gxpj-cx7g-858c
No fix available
node_modules/debug
1 low severity vulnerability
Some issues need review, and may require choosing
a different dependency.