npm audit complains about a security vulnerability in hoek

[jfly]

• Platform: Arch Linux

Details:

$ node --version
v10.6.0
$ nvm --version
0.33.11
$ mkdir hoeking
$ cd hoeking
$ npm init
$ npm install --save-dev node-gyp
$ npm audit
                       === npm audit security report ===                        
                                                                                
┌──────────────────────────────────────────────────────────────────────────────┐
│                                Manual Review                                 │
│            Some vulnerabilities require your attention to resolve            │
│                                                                              │
│         Visit https://go.npm.me/audit-guide for additional guidance          │
└──────────────────────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate      │ Prototype pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ hoek                                                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ > 4.2.0 < 5.0.0 || >= 5.0.3                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ node-gyp [dev]                                               │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ node-gyp > request > hawk > boom > hoek                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/566                       │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate      │ Prototype pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ hoek                                                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ > 4.2.0 < 5.0.0 || >= 5.0.3                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ node-gyp [dev]                                               │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ node-gyp > request > hawk > cryptiles > boom > hoek          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/566                       │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate      │ Prototype pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ hoek                                                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ > 4.2.0 < 5.0.0 || >= 5.0.3                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ node-gyp [dev]                                               │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ node-gyp > request > hawk > hoek                             │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/566                       │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate      │ Prototype pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ hoek                                                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ > 4.2.0 < 5.0.0 || >= 5.0.3                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ node-gyp [dev]                                               │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ node-gyp > request > hawk > sntp > hoek                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/566                       │
└───────────────┴──────────────────────────────────────────────────────────────┘
found 4 moderate severity vulnerabilities in 188 scanned packages
  4 vulnerabilities require manual review. See the full report for details.
$ npm ls hoek
hoeking@1.0.0 /home/jeremy/tmp/hoeking
└─┬ node-gyp@3.7.0
  └─┬ request@2.81.0
    └─┬ hawk@3.1.3
      ├─┬ boom@2.10.1
      │ └── hoek@2.16.3  deduped
      ├── hoek@2.16.3 
      └─┬ sntp@1.0.9
        └── hoek@2.16.3  deduped

I dug into this, and the reason why we're pulling in an old version of hoek is because node-gyp@3.7.0 depends on request@>=2.9.0 <2.82.0 (introduced in 7900122). I checked, and request@2.87.0 doesn't even depend on hawk anymore, which completely removes hoek from our dependencies.

If node-gyp could upgrade the version of request that it depends on, I believe this whole problem would go away.

Thanks!

[richardlau]

See #1492 and #1471.

[brodycj]

See #1492 and #1471.

What is holding up the merge?

[conways-glider]

@brodybits one of the contributors is looking now

https://twitter.com/Fishrock123/status/1019798741707116549

Should be only a couple of days now.

[brodycj]

Thanks @Fishrock123 @Fluffy-Samurai, looking forward to the fix (badly needed to cleanup npm audit noise ref: npm/cli#20)

/cc @zkat @rankida

[josheigel]

Hey guys, really not trying to be a pain here, but is there any update or idea of when a fix will be available? Maybe I'm missing something or there's another way around this, but just thought I'd ask. Thanks!

[brodycj]

FYI discussion seems to have moved to #1521 (continuation of #1492) to solve this by bumping request to 2.87.0. @rvagg seems to be working on it now.

[Croydon]

Fixed. 3.8.0 is out.