NPM 6 - vulnerability - Memory Exposure

Moderate │ Memory Exposure │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ tunnel-agent │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in │ >=0.6.0 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ node-sass │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ node-sass > request > tunnel-agent │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://nodesecurity.io/advisories/598

[daniel-ac-martin]

Looks like this was fixed but the author neglected to publish v0.6.1 on NPM.

[thexpand]

When will v.0.6.1 be released on NPM?
https://www.npmjs.com/package/tunnel-agent

[igorescobar]

+1

[raitono]

I'm seeing the fix in my version I got from NPM. Just seems the version number wasn't updated to match. It was a simple one line change, so you should easily be able to see if you have the fix as well. Check line 131 of the index.js file. Link to commit

[mattjbrent]

its been almost a month. Can we please get the NPM package version updated please?

Please publish to NPM!?

[Pablo-Araya]

+1

[ianmubangizi]

Am totally new to the npm audit, I want to know if I can actually continue developing without applying this fix because I have tried updating to the latest 0.6.0 tunnel-agent package but it won't fix the warning.

Please run npm publish

[igorescobar]

Please run npm publish

[jasonkhanlar]

Is this safe to use without the npm publish ?