Node-gyp: `npm audit` complains about a security vulnerability in hoek

[jfly]

• Platform: Arch Linux

Details:

$ node --version
v10.6.0
$ nvm --version
0.33.11
$ mkdir hoeking
$ cd hoeking
$ npm init
$ npm install --save-dev node-gyp
$ npm audit
                       === npm audit security report ===                        

┌──────────────────────────────────────────────────────────────────────────────┐
│                                Manual Review                                 │
│            Some vulnerabilities require your attention to resolve            │
│                                                                              │
│         Visit https://go.npm.me/audit-guide for additional guidance          │
└──────────────────────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate      │ Prototype pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ hoek                                                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ > 4.2.0 < 5.0.0 || >= 5.0.3                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ node-gyp [dev]                                               │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ node-gyp > request > hawk > boom > hoek                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/566                       │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate      │ Prototype pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ hoek                                                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ > 4.2.0 < 5.0.0 || >= 5.0.3                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ node-gyp [dev]                                               │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ node-gyp > request > hawk > cryptiles > boom > hoek          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/566                       │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate      │ Prototype pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ hoek                                                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ > 4.2.0 < 5.0.0 || >= 5.0.3                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ node-gyp [dev]                                               │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ node-gyp > request > hawk > hoek                             │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/566                       │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate      │ Prototype pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ hoek                                                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ > 4.2.0 < 5.0.0 || >= 5.0.3                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ node-gyp [dev]                                               │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ node-gyp > request > hawk > sntp > hoek                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/566                       │
└───────────────┴──────────────────────────────────────────────────────────────┘
found 4 moderate severity vulnerabilities in 188 scanned packages
  4 vulnerabilities require manual review. See the full report for details.
$ npm ls hoek
[email protected] /home/jeremy/tmp/hoeking
└─┬ [email protected]
  └─┬ [email protected]
    └─┬ [email protected]
      ├─┬ [email protected]
      │ └── [email protected]  deduped
      ├── [email protected] 
      └─┬ [email protected]
        └── [email protected]  deduped

I dug into this, and the reason why we're pulling in an old version of hoek is because [email protected] depends on request@>=2.9.0 <2.82.0 (introduced in https://github.com/nodejs/node-gyp/commit/790012233753f2389ab0ff52aba5dfd22d14c028). I checked, and [email protected] doesn't even depend on hawk anymore, which completely removes hoek from our dependencies.

If node-gyp could upgrade the version of request that it depends on, I believe this whole problem would go away.

Thanks!

[richardlau]

See https://github.com/nodejs/node-gyp/pull/1492 and https://github.com/nodejs/node-gyp/pull/1471.

[brodybits]

See #1492 and #1471.

What is holding up the merge?

[fluffy-samurai]

@brodybits one of the contributors is looking now

https://twitter.com/Fishrock123/status/1019798741707116549

Should be only a couple of days now.

[brodybits]

Thanks @Fishrock123 @fluffy-samurai, looking forward to the fix (badly needed to cleanup npm audit noise ref: npm/cli#20)

/cc @zkat @rankida

[josheigel]

Hey guys, really not trying to be a pain here, but is there any update or idea of when a fix will be available? Maybe I'm missing something or there's another way around this, but just thought I'd ask. Thanks!

[brodybits]

FYI discussion seems to have moved to #1521 (continuation of #1492) to solve this by bumping request to 2.87.0. @rvagg seems to be working on it now.

[Croydon]

Fixed. 3.8.0 is out.