3 high severity vulnerabilities in this package

[pboymt]

I got a message 3 high severity vulnerabilities when I install this package.

# npm audit report

async  <2.6.4
Severity: high
Prototype Pollution in async - https://github.com/advisories/GHSA-fwr7-v2mv-hh25
No fix available
node_modules/async
  @devicefarmer/adbkit-monkey  *
  Depends on vulnerable versions of async
  node_modules/@devicefarmer/adbkit-monkey
    @devicefarmer/adbkit  *
    Depends on vulnerable versions of @devicefarmer/adbkit-monkey
    node_modules/@devicefarmer/adbkit

3 high severity vulnerabilities

Some issues need review, and may require choosing
a different dependency.

Seems like a very dangerous security problem in package async in @devicefarmer/adbkit-monkey. How to fix it?

[OxNinja]

This vulnerability is not related to this project, but about the async package, and as the line says, there is "No fix available" for the moment.

[UrielCh]

"No fix available" ?

I get:

pnpm audit  
No known vulnerabilities found

in @u4/adbkit-monkey
source: https://github.com/UrielCh/adbkit-monkey

Since I do not know what is the purpose of adbkit-monkey, I never promote it.

[OxNinja]

I think you might be using the wrong project @UrielCh
From a direct fork of the repo:

# npm audit report

async  <2.6.4
Severity: high
Prototype Pollution in async - https://github.com/advisories/GHSA-fwr7-v2mv-hh25
No fix available
node_modules/async
  @devicefarmer/adbkit-monkey  *
  Depends on vulnerable versions of async
  node_modules/@devicefarmer/adbkit-monkey
    @devicefarmer/adbkit  *
    Depends on vulnerable versions of @devicefarmer/adbkit-monkey
    node_modules/@devicefarmer/adbkit

nanoid  3.0.0 - 3.1.30
Severity: moderate
Exposure of Sensitive Information to an Unauthorized Actor in nanoid - https://github.com/advisories/GHSA-qrpm-p2h7-hrv2
fix available via `npm audit fix --force`
Will install mocha@10.0.0, which is a breaking change
node_modules/nanoid
  mocha  8.2.0 - 9.1.4
  Depends on vulnerable versions of nanoid
  node_modules/mocha

5 vulnerabilities (2 moderate, 3 high)

To address all issues possible (including breaking changes), run:
  npm audit fix --force

Some issues need review, and may require choosing
a different dependency.