Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS04Z3IzLTJnanctamo3Z80zOA

Hidden functionality in node-ipc

The package node-ipc version 9.2.2 is vulnerable to hidden functionality that was introduced by the maintainer. The package uses a dependency that writes a file to disk that does not pertain to the functionality of the package and is not included in versions < 9.2.2.

Permalink: https://github.com/advisories/GHSA-8gr3-2gjw-jj7g
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS04Z3IzLTJnanctamo3Z80zOA
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Low
Classification: General
Published: about 2 years ago
Updated: over 1 year ago

Identifiers: GHSA-8gr3-2gjw-jj7g
References:

• https://github.com/RIAEvangelist/node-ipc/releases/tag/9.2.2
• https://github.com/advisories/GHSA-8gr3-2gjw-jj7g

Repository: https://github.com/RIAEvangelist/node-ipc
Blast Radius: 0.0

Affected Packages