Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Backdoored sub-dependency? flatmap-stream-0.1.1 and flatmap-stream-0.1.2 #1451

Closed
NewEraCracker opened this issue Nov 19, 2018 · 0 comments · Fixed by DavidKindler/mysql-registration-passport#2 or yowainwright/Advanced-React#26 · May be fixed by mjohnson9/twitch-markov-bot#248, LibreTubeApp/LibreTube#264 or project-accelerate/accelerate#300
Closed

Backdoored sub-dependency? flatmap-stream-0.1.1 and flatmap-stream-0.1.2 #1451

NewEraCracker opened this issue Nov 19, 2018 · 0 comments · Fixed by DavidKindler/mysql-registration-passport#2 or yowainwright/Advanced-React#26 · May be fixed by mjohnson9/twitch-markov-bot#248, LibreTubeApp/LibreTube#264 or project-accelerate/accelerate#300

Comments

@NewEraCracker
Copy link

nodemon requires pstree.remy (^1.1.0 - installed 1.1.0) -> ps-tree (^1.1.0 - installed 1.1.0) -> event-stream (~3.3.0 - installed 3.3.6) -> flatmap-stream (^0.1.0 - npm installs 0.1.2).

This last one is very suspicious.
See: dominictarr/event-stream#115

Please either force version 0.1.0 of flatmap-stream or update event-stream to latest version (which no longer requires the affected module).

Regards.
@FallingSnow FallingSnow mentioned this issue Nov 20, 2018
Closed
FallingSnow added a commit to FallingSnow/nodemon that referenced this issue Nov 21, 2018
@FallingSnow
fix: Update audit dependencies and remove pstree.remy
438f6cc 
pstree.remy has a dependency with a compromised dependency

Fixes: remy#1442
Fixes: remy#1451
@remy remy closed this as completed in b35c532 Nov 22, 2018
@cnorthwood cnorthwood mentioned this issue Nov 26, 2018
Closed
wiese added a commit to wmde/wikibase-termbox that referenced this issue Nov 27, 2018
@wiese
nodemon: update to lose malicious package
ac855ac 
nodemon is a tool that helps develop node.js based applications by
automatically restarting the node application when files change.
This updates it to the latest version to fix a security problem
remy/nodemon#1451

Dependency tree before was:
$ docker-compose run --rm node npm ls flatmap-stream
wikibase-termbox@0.1.0 /app
`-- nodemon@1.18.4
  `-- pstree.remy@1.1.0
    `-- ps-tree@1.1.0
      `-- event-stream@3.3.6
        `-- flatmap-stream@0.1.1      <- https://www.npmjs.com/advisories/737
@wiese wiese mentioned this issue Nov 27, 2018
Merged
This was referenced Nov 27, 2018
Open
Open
@Songkunda Songkunda mentioned this issue Nov 28, 2018
Closed
@andres-valdes andres-valdes mentioned this issue Nov 29, 2018
Merged
@dependencies dependencies bot mentioned this issue Dec 1, 2018
Open
This was referenced Dec 3, 2018
Closed
Merged
@morphatic morphatic mentioned this issue Dec 14, 2018
Merged
@snyk-bot snyk-bot mentioned this issue Jan 10, 2020
Merged
This was referenced Feb 12, 2020
Open
Open
This was referenced Apr 8, 2020
Open
Merged
Open
This was referenced Apr 19, 2020
Open
Open
@snyk-bot snyk-bot mentioned this issue Apr 30, 2020
Closed
@snyk-bot snyk-bot mentioned this issue May 7, 2020
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

[Snyk] Upgrade nodemon from 1.18.7 to 1.19.4 DavidKindler/mysql-registration-passport
[Snyk] Upgrade nodemon from 1.18.4 to 1.19.4 yowainwright/Advanced-React
Update nodemon in / from 1.12.1 to 1.18.7 mjohnson9/twitch-markov-bot
Update nodemon in / from 1.12.1 to 1.18.7 LibreTubeApp/LibreTube
Update nodemon in / from 1.17.3 to 1.18.7 project-accelerate/accelerate
[Snyk] Upgrade nodemon from 1.18.3 to 1.19.4 georgismitev/multi-kubernetes
[Snyk] Upgrade nodemon from 1.18.3 to 1.19.4 georgismitev/multi-container-setup-elasticbeanstalk
[Snyk] Upgrade nodemon from 1.18.3 to 1.19.4 civilizador/TripleTrip
[Snyk] Upgrade nodemon from 1.18.3 to 1.19.4 longguodev/docker-node-react-mysql-boilerplate
[Snyk] Upgrade nodemon from 1.18.7 to 1.19.4 inovramadani/bistrip
1 participant
@NewEraCracker