You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
react depends on "loose-envify": "^1.1.0", a package which owned by one person. Last update of it was 5 years ago.
If the persons NPM credentials or token are leaked, and a new malwared version of loose-envify is published, all react users will instantly receive malware.
Moreover, same can happen to envify's dependency: js-tokens.
Ways to mitigate:
Lock version to 1.1.0
Better: ask person (fb employee) to release new loose-envify with locked-down version of js-tokens, then lock envify version in react
Is it even needed in dependencies (not devDeps)? Maybe remove altogether