代码之家  ›  专栏  ›  技术社区  ›  Prafulla Kumar Sahu umang naik

显示严重漏洞的npm

  •  0
  • Prafulla Kumar Sahu umang naik  · 技术社区  · 6 年前

    npm显示严重漏洞,但使用

    npm chache clear
    npm cache clear --force
    npm audit fix
    npm install
    

    我试过所有的方法,但没有一个能解决我的问题,请告诉我怎样才能解决它?

    npm WARN optional SKIPPING OPTIONAL DEPENDENCY: fsevents@1.2.4 (node_modules\fsevents):
    npm WARN notsup SKIPPING OPTIONAL DEPENDENCY: Unsupported platform for fsevents@1.2.4: wanted {"os":"darwin","arch":"any"} (current: {"os":"win32","arch":"x64"})
    
    added 1505 packages from 755 contributors and audited 18951 packages in 378.007s
    found 11 moderate severity vulnerabilities
      run `npm audit fix` to fix them, or `npm audit` for details
    

    跑步 npm audit fix 结果

    >npm audit fix npm WARN ajv-keywords@3.2.0 requires a peer of ajv@^6.0.0 but none is installed. You must install peer dependencies yourself. npm WARN optional SKIPPING OPTIONAL DEPENDENCY: fsevents@1.2.4 (node_modules\fsevents): npm WARN notsup SKIPPING OPTIONAL DEPENDENCY: Unsupported platform for fsevents@1.2.4: wanted {"os":"darwin","arch":"any"} (current: {"os":"win32","arch":"x64"}) up to date in 118.757s fixed 0 of 11 vulnerabilities in 18990 scanned packages 11 vulnerabilities required manual review and could not be updated
    

    还有我的package.json

    {
        "private": true,
        "scripts": {
            "dev": "npm run development",
            "development": "cross-env NODE_ENV=development node_modules/webpack/bin/webpack.js --progress --hide-modules --config=node_modules/laravel-mix/setup/webpack.config.js",
            "watch": "npm run development -- --watch",
            "watch-poll": "npm run watch -- --watch-poll",
            "hot": "cross-env NODE_ENV=development node_modules/webpack-dev-server/bin/webpack-dev-server.js --inline --hot --config=node_modules/laravel-mix/setup/webpack.config.js",
            "prod": "npm run production",
            "production": "cross-env NODE_ENV=production node_modules/webpack/bin/webpack.js --no-progress --hide-modules --config=node_modules/laravel-mix/setup/webpack.config.js"
        },
        "devDependencies": {
            "axios": "^0.18",
            "babel-preset-react": "^6.24.1",
            "bootstrap": "^4.0.0",
            "cross-env": "^5.1",
            "jquery": "^3.2",
            "laravel-mix": "^2.0",
            "lodash": "^4.17.4",
            "popper.js": "^1.12",
            "vue": "^2.5.7"
        },
        "dependencies": []
    }
    
    2 回复  |  直到 6 年前
        1
  •  1
  •   Prafulla Kumar Sahu umang naik    6 年前

    当前的Laravel package.json存在此漏洞,因为 hoek tunnel-agent . laravel-mix 正在使用包并通过其package.json加载它们。

    有关这些问题的详细信息,请参见: https://nodesecurity.io/advisories/566
    https://nodesecurity.io/advisories/598

    如果你移除 "laravel-mix": "^2.0" ,漏洞已经消失,但不能再使用Laravel Mix。

    根据讨论 here ,我想问题已经解决了。

        2
  •  0
  •   floflock    6 年前

    这意味着,您的下载包中有11个严重性漏洞。

    跑步 npm audit 它将显示哪些包受到影响。然后检查清楚,如果作者提供了更新。如果不是,你可以自己解决,这可能是非常困难的,因为你不深入他们的来源。。。

    然而,大多数最新的软件包在较新的版本中提供了固定的。