New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Remove backdoored dependency: flatmap-stream-0.1.1 and flatmap-stream-0.1.2 #1

Open

glensc wants to merge 2 commits into cliedeman:master from glensc:event-stream-hack

glensc commented Sep 6, 2021

event-stream@3.3.6 - this version has disappeared
flatmap-stream@^0.1.0 - this package has disappeared

removes backdoor from dependencies:

Backdoored dependency? flatmap-stream-0.1.1 and flatmap-stream-0.1.2 dominictarr/event-stream#115

as I didn't know how to resolve removed packages from yarn.lock, I've removed nodemon dependency and added it back again.

this means dependencies of nodemon were updated as well, hence the bigger yarn.lock diff.

glensc added 2 commits

September 6, 2021 15:07


          yarn remove nodemon --dev

2aa712f


          yarn add --dev nodemon@^1.18.4

cd91d99

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet