Modernizr npm published package points to wrong lodash

Created on 11 Nov 2018 · 12Comments · Source: Modernizr/Modernizr

Similar to #2313, retire-js notes that lodash 4.17.4 has a vulnerability. I was about to submit a PR to update to lodash 4.17.11, and it seems this was already done in the package.json but not submitted as a new version to npm. Can you publish a 3.6.1 with the latest so the following errors are not generated?

node_modules/modernizr/node_modules/lodash/package.json
 ↳ lodash 4.17.4
lodash 4.17.4 has known vulnerabilities: severity: low; summary: Prototype pollution attack; https://hackerone.com/reports/380873

Source

yleviel-notarize

👍5

Most helpful comment

Hi @all I published the current master under this package https://www.npmjs.com/package/modernizr-next if you are willing to try that out ;-)

rejas on 19 Feb 2019

👍2

All 12 comments

@patrickkettner simply publishing the latest master as 3.6.1 would fix this issue.

yleviel-notarize on 11 Nov 2018

3.6.1 from master would be a little more than just this npm update. i'd love to get v3.7 though @patrickkettner

rejas on 11 Nov 2018

👍2

Unfortunately, this is preventing me from using Modernizr at my company. Is there a timescale for a this to be published? I'm also getting a moderate vulnerability when running npm audit - please see output:

=== npm audit security report ===


                                 Manual Review
             Some vulnerabilities require your attention to resolve

          Visit https://go.npm.me/audit-guide for additional guidance


  Moderate        Regular Expression Denial of Service

  Package         underscore.string

  Patched in      >=3.3.5

  Dependency of   modernizr [dev]

  Path            modernizr > remarkable > argparse > underscore.string

  More info       https://nodesecurity.io/advisories/745


  Low             Prototype Pollution

  Package         lodash

  Patched in      >=4.17.5

  Dependency of   modernizr [dev]

  Path            modernizr > lodash

  More info       https://nodesecurity.io/advisories/577

owensgit on 14 Dec 2018

Sorry, cant help you as long as @patrickkettner is not resurfacing and getting the releases back on track. Neither do I have publishing rights, nor access to website etc which would need to be updated :-(

rejas on 14 Dec 2018

There are 5 other people who have access to publish this on npm. I don't want to @ spam a bunch of people here but also am not sure what the correct protocol is on an issue like this.

According to npm info modernizr these people have npm publish rights to this package. (These are npm usernames)

maintainers:
- kurafire
- patrickkettner
- paulirish
- ryanseddon
- slexaxton
- stucox

wraithgar on 14 Dec 2018

👍1

Not sure if @ ping would trigger a reaction of half of those from the list. Looking at their github timeline some havent done anything the last year, some at least show up, some half better things to do. Lets just hope patrickkettner comes back during the holidays for some cleanups....

rejas on 16 Dec 2018

Same issue here, hope it will be fixed soon

ghost on 28 Jan 2019

👍1

hi, @patrickkettner, we got the same issue. Hope it can be published soon to resolve the prototype pollution vulnerability came from the npm audit.
thx~