HAP-NodeJS 0.10.3 npm package vulnerabilities

[n0rt0nthec4t]

Analysis

After installing released 0.10.0, npm audit reports the following issues with package dependancies:

**npm audit fix

up to date, audited 95 packages in 2s

36 packages are looking for funding
run npm fund for details

npm audit report

minimist <0.2.1
Severity: moderate
Prototype Pollution in minimist - GHSA-vh95-rmgr-6w4m
fix available via npm audit fix
node_modules/optimist/node_modules/minimist
optimist >=0.6.0
Depends on vulnerable versions of minimist
node_modules/optimist

put *
Sensitive Data Exposure in put - GHSA-v6gv-fg46-h89j
fix available via npm audit fix --force
Will install hap-nodejs@0.9.8, which is a breaking change
node_modules/put
@homebridge/dbus-native *
Depends on vulnerable versions of put
node_modules/@homebridge/dbus-native
hap-nodejs 0.10.0-beta.0 - 0.10.1-beta.0
Depends on vulnerable versions of @homebridge/dbus-native
node_modules/hap-nodejs

5 vulnerabilities (3 low, 2 moderate)

To address issues that do not require attention, run:
npm audit fix

To address all issues (including breaking changes), run:
npm audit fix --force**

Expected Behavior

depend packages need to be updated to use non-vulnerable versions

Steps To Reproduce

.

Logs

.

Configuration

.

Environment

• OS:
• Software:
• Node:
• npm:

Process Supervisor

not applicable

Additional Context

.

[github-actions]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[n0rt0nthec4t]

its not stale

[n0rt0nthec4t]

@Supereg is anything being done to address this?!?!

[github-actions]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[n0rt0nthec4t]

Any movement on this issue?? Seems stalled project atm?

[n0rt0nthec4t]

Still issues with 0.10.3.

npm audit
                                                                                
                       === npm audit security report ===                        
                                                                                



┌──────────────────────────────────────────────────────────────────────────────┐
│                                Manual Review                                 │
│            Some vulnerabilities require your attention to resolve            │
│                                                                              │
│         Visit https://go.npm.me/audit-guide for additional guidance          │
└──────────────────────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Critical      │ Prototype Pollution in minimist                              │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ minimist                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=1.2.6                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ hap-nodejs                                                   │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ hap-nodejs > @homebridge/dbus-native > optimist > minimist   │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://github.com/advisories/GHSA-xvch-5gv4-984h            │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate      │ Prototype Pollution in minimist                              │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ minimist                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=0.2.1                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ hap-nodejs                                                   │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ hap-nodejs > @homebridge/dbus-native > optimist > minimist   │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://github.com/advisories/GHSA-vh95-rmgr-6w4m            │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low           │ Sensitive Data Exposure in put                               │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ put                                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ No patch available                                           │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ hap-nodejs                                                   │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ hap-nodejs > @homebridge/dbus-native > put                   │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://github.com/advisories/GHSA-v6gv-fg46-h89j            │
└───────────────┴──────────────────────────────────────────────────────────────┘
found 4 vulnerabilities (1 low, 2 moderate, 1 critical) in 98 scanned packages
  run `npm audit fix` to fix 1 of them.
  3 vulnerabilities require manual review. See the full report for details.

[Supereg]

The reported vulnerabilities didn't actually affect any users.

• Vulnerabilities in optimist and minimist were in code files never actually executed by hap-nodejs (used for command-line interface of dbus-native)
• put is only affected when running nodejs versions older than v6 which is not supported by HAP-NodeJS.

Since both packages are abandoned by their maintainers, I stilled addressed those issues, by updating the dbus-native package (that introduced those dependencies). This way we get rid of the vulnerability warnings.

This fixes will be part of the upcoming v0.10.4 release.

[n0rt0nthec4t]

Thanks for addressing the issue in an upcoming release.