@@ -1,697 +0,0 @@
1−# npm audit report
2−
3−@babel/helpers <7.26.10
4−Severity: moderate
5−Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups - https://github.com/advisories/GHSA-968p-4wvh-cqc8
6−fix available via `npm audit fix`
7−node_modules/@babel/helpers
8−
9−@babel/runtime-corejs3 <7.26.10
10−Severity: moderate
11−Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups - https://github.com/advisories/GHSA-968p-4wvh-cqc8
12−fix available via `npm audit fix`
13−node_modules/@babel/runtime-corejs3
14−
15−@babel/traverse <7.23.2
16−Severity: critical
17−Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code - https://github.com/advisories/GHSA-67hx-6x53-jw92
18−fix available via `npm audit fix`
19−node_modules/@babel/traverse
20−
21−ajv <6.12.3
22−Severity: moderate
23−Prototype Pollution in Ajv - https://github.com/advisories/GHSA-v88g-cgmw-v5xw
24−fix available via `npm audit fix --force`
25−Will install serve@14.2.5, which is a breaking change
26−node_modules/serve/node_modules/ajv
27− serve 5.0.4 - 14.2.4
28− Depends on vulnerable versions of ajv
29− Depends on vulnerable versions of boxen
30− Depends on vulnerable versions of clipboardy
31− Depends on vulnerable versions of compression
32− Depends on vulnerable versions of serve-handler
33− node_modules/serve
34−
35−ansi-regex 3.0.0
36−Severity: high
37−Inefficient Regular Expression Complexity in chalk/ansi-regex - https://github.com/advisories/GHSA-93q8-gq69-wqmw
38−fix available via `npm audit fix`
39−node_modules/ansi-align/node_modules/ansi-regex
40−node_modules/boxen/node_modules/ansi-regex
41−node_modules/widest-line/node_modules/ansi-regex
42−
43−axios 1.0.0 - 1.11.0
44−Severity: high
45−Axios Cross-Site Request Forgery Vulnerability - https://github.com/advisories/GHSA-wf5p-g6vw-rhxx
46−Server-Side Request Forgery in axios - https://github.com/advisories/GHSA-8hc4-vh64-cxmj
47−axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL - https://github.com/advisories/GHSA-jr5f-v2jv-69x6
48−Axios is vulnerable to DoS attack through lack of data size check - https://github.com/advisories/GHSA-4hjh-wcwx-xvwj
49−fix available via `npm audit fix --force`
50−Will install truffle@5.5.7, which is a breaking change
51−node_modules/axios
52− @truffle/dashboard-message-bus-client >=0.1.10
53− Depends on vulnerable versions of axios
54− node_modules/@truffle/dashboard-message-bus-client
55− @truffle/events >=0.1.21
56− Depends on vulnerable versions of @truffle/dashboard-message-bus-client
57− node_modules/@truffle/events
58− @truffle/config *
59− Depends on vulnerable versions of @truffle/events
60− Depends on vulnerable versions of @truffle/provider
61− node_modules/@truffle/config
62− @truffle/db >=2.0.13
63− Depends on vulnerable versions of @truffle/config
64− node_modules/@truffle/db
65− @truffle/db-loader >=0.2.13
66− Depends on vulnerable versions of @truffle/db
67− node_modules/@truffle/db-loader
68− truffle 5.1.9-nodeLTS.0 || 5.1.14-alphaTez.0 - 5.1.14-truffleLogger.0 || >=5.1.66
69− Depends on vulnerable versions of @truffle/db
70− Depends on vulnerable versions of @truffle/db-loader
71− Depends on vulnerable versions of @truffle/debugger
72− Depends on vulnerable versions of ganache
73− Depends on vulnerable versions of mocha
74− node_modules/truffle
75−
76−babel-traverse *
77−Severity: critical
78−Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code - https://github.com/advisories/GHSA-67hx-6x53-jw92
79−fix available via `npm audit fix --force`
80−Will install azimuth-js@0.15.0, which is a breaking change
81−node_modules/babel-traverse
82− babel-core 5.8.20 - 7.0.0-beta.3
83− Depends on vulnerable versions of babel-helpers
84− Depends on vulnerable versions of babel-register
85− Depends on vulnerable versions of babel-template
86− Depends on vulnerable versions of babel-traverse
87− Depends on vulnerable versions of json5
88− node_modules/babel-core
89− babel-register *
90− Depends on vulnerable versions of babel-core
91− node_modules/babel-register
92− azimuth-solidity *
93− Depends on vulnerable versions of babel-register
94− node_modules/azimuth-solidity
95− azimuth-js *
96− Depends on vulnerable versions of azimuth-solidity
97− Depends on vulnerable versions of web3
98− node_modules/azimuth-js
99− babel-template *
100− Depends on vulnerable versions of babel-traverse
101− node_modules/babel-template
102− babel-helpers *
103− Depends on vulnerable versions of babel-template
104− node_modules/babel-helpers
105−
106−base-x <=3.0.10
107−Severity: high
108−Homograph attack allows Unicode lookalike characters to bypass validation. - https://github.com/advisories/GHSA-xq7p-g2vc-g82p
109−fix available via `npm audit fix`
110−node_modules/base-x
111−
112−brace-expansion 1.0.0 - 1.1.11
113−brace-expansion Regular Expression Denial of Service vulnerability - https://github.com/advisories/GHSA-v6h2-p8h4-qcjw
114−fix available via `npm audit fix`
115−node_modules/brace-expansion
116−node_modules/ganache/node_modules/brace-expansion
117−node_modules/truffle/node_modules/ganache/node_modules/brace-expansion
118−
119−braces <3.0.3
120−Severity: high
121−Uncontrolled resource consumption in braces - https://github.com/advisories/GHSA-grv7-fg5c-xmjg
122−fix available via `npm audit fix`
123−node_modules/braces
124−node_modules/ganache/node_modules/braces
125−node_modules/truffle/node_modules/ganache/node_modules/braces
126−
127−browserify-sign 2.6.0 - 4.2.1
128−Severity: high
129−browserify-sign upper bound check issue in `dsaVerify` leads to a signature forgery attack - https://github.com/advisories/GHSA-x9w5-v3q2-3rhw
130−fix available via `npm audit fix`
131−node_modules/browserify-sign
132−node_modules/ganache/node_modules/browserify-sign
133−node_modules/truffle/node_modules/ganache/node_modules/browserify-sign
134−
135−cipher-base <=1.0.4
136−Severity: critical
137−cipher-base is missing type checks, leading to hash rewind and passing on crafted data - https://github.com/advisories/GHSA-cpq7-6gpm-g9rc
138−fix available via `npm audit fix`
139−node_modules/cipher-base
140−node_modules/ganache/node_modules/cipher-base
141−node_modules/truffle/node_modules/ganache/node_modules/cipher-base
142−
143−cross-spawn <6.0.6 || >=7.0.0 <7.0.5
144−Severity: high
145−Regular Expression Denial of Service (ReDoS) in cross-spawn - https://github.com/advisories/GHSA-3xgq-45jj-v275
146−Regular Expression Denial of Service (ReDoS) in cross-spawn - https://github.com/advisories/GHSA-3xgq-45jj-v275
147−fix available via `npm audit fix --force`
148−Will install serve@14.2.5, which is a breaking change
149−node_modules/clipboardy/node_modules/cross-spawn
150−node_modules/cross-spawn
151−node_modules/eslint/node_modules/cross-spawn
152−node_modules/ganache/node_modules/cross-spawn
153−node_modules/term-size/node_modules/cross-spawn
154−node_modules/truffle/node_modules/ganache/node_modules/cross-spawn
155− execa 0.5.0 - 0.9.0
156− Depends on vulnerable versions of cross-spawn
157− node_modules/clipboardy/node_modules/execa
158− node_modules/term-size/node_modules/execa
159− clipboardy <=1.2.3
160− Depends on vulnerable versions of execa
161− node_modules/clipboardy
162− term-size 1.0.0 - 1.2.0
163− Depends on vulnerable versions of execa
164− node_modules/term-size
165− boxen 1.2.0 - 3.2.0
166− Depends on vulnerable versions of term-size
167− node_modules/boxen
168−
169−crypto-js <4.2.0
170−Severity: critical
171−crypto-js PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard - https://github.com/advisories/GHSA-xwcq-pm8m-c4vf
172−fix available via `npm audit fix --force`
173−Will install secure-ls@2.0.0, which is a breaking change
174−node_modules/crypto-js
175− secure-ls <=1.2.6
176− Depends on vulnerable versions of crypto-js
177− node_modules/secure-ls
178−
179−ejs <=3.1.9
180−Severity: critical
181−ejs template injection vulnerability - https://github.com/advisories/GHSA-phwq-j96m-2c2q
182−ejs lacks certain pollution protection - https://github.com/advisories/GHSA-ghr5-ch3p-vcr6
183−fix available via `npm audit fix`
184−node_modules/source-map-explorer/node_modules/ejs
185−
186−elliptic <=6.6.0
187−Severity: critical
188−Elliptic's verify function omits uniqueness validation - https://github.com/advisories/GHSA-434g-2637-qmqr
189−Elliptic's private key extraction in ECDSA upon signing a malformed input (e.g. a string) - https://github.com/advisories/GHSA-vjh7-7g9h-fjfh
190−Valid ECDSA signatures erroneously rejected in Elliptic - https://github.com/advisories/GHSA-fc9h-whq2-v747
191−Elliptic's EDDSA missing signature length check - https://github.com/advisories/GHSA-f7q4-pwc6-w24p
192−Elliptic's ECDSA missing check for whether leading bit of r and s is zero - https://github.com/advisories/GHSA-977x-g7h5-7qgw
193−Elliptic allows BER-encoded signatures - https://github.com/advisories/GHSA-49q7-c7j4-3p7m
194−fix available via `npm audit fix --force`
195−Will install truffle@5.5.7, which is a breaking change
196−node_modules/elliptic
197−node_modules/ganache/node_modules/elliptic
198−node_modules/truffle/node_modules/ganache/node_modules/elliptic
199− ethers 3.0.0 - 4.0.49
200− Depends on vulnerable versions of elliptic
201− node_modules/@truffle/interface-adapter/node_modules/ethers
202− @truffle/interface-adapter *
203− Depends on vulnerable versions of ethers
204− Depends on vulnerable versions of web3
205− node_modules/@truffle/interface-adapter
206− @truffle/provider *
207− Depends on vulnerable versions of @truffle/interface-adapter
208− Depends on vulnerable versions of web3
209− node_modules/@truffle/provider
210−
211−esbuild <=0.24.2
212−Severity: moderate
213−esbuild enables any website to send any requests to the development server and read the response - https://github.com/advisories/GHSA-67mh-4wv8-2f99
214−fix available via `npm audit fix --force`
215−Will install vite@3.2.11, which is outside the stated dependency range
216−node_modules/esbuild
217− vite <=6.1.6
218− Depends on vulnerable versions of esbuild
219− Depends on vulnerable versions of rollup
220− node_modules/vite
221−
222−fast-redact *
223−fast-redact vulnerable to prototype pollution - https://github.com/advisories/GHSA-ffrw-9mx8-89p8
224−fix available via `npm audit fix`
225−node_modules/fast-redact
226− pino 5.0.0-rc.1 - 9.11.0
227− Depends on vulnerable versions of fast-redact
228− node_modules/pino
229− @walletconnect/logger <=2.1.3
230− Depends on vulnerable versions of pino
231− node_modules/@walletconnect/logger
232− @walletconnect/core 2.0.0-2.0.0-beta.102 - 2.22.2
233− Depends on vulnerable versions of @walletconnect/logger
234− Depends on vulnerable versions of @walletconnect/types
235− Depends on vulnerable versions of @walletconnect/utils
236− node_modules/@walletconnect/sign-client/node_modules/@walletconnect/core
237− @walletconnect/sign-client <=2.22.2
238− Depends on vulnerable versions of @walletconnect/core
239− Depends on vulnerable versions of @walletconnect/logger
240− Depends on vulnerable versions of @walletconnect/types
241− Depends on vulnerable versions of @walletconnect/utils
242− node_modules/@walletconnect/sign-client
243− @walletconnect/types 2.1.2-eaa4818c - 2.22.2
244− Depends on vulnerable versions of @walletconnect/logger
245− node_modules/@walletconnect/types
246− @walletconnect/utils 2.1.2-eaa4818c - 2.22.2
247− Depends on vulnerable versions of @walletconnect/types
248− node_modules/@walletconnect/sign-client/node_modules/@walletconnect/utils
249−
250−form-data <2.5.4
251−Severity: critical
252−form-data uses unsafe random function in form-data for choosing boundary - https://github.com/advisories/GHSA-fjxv-7rqg-78g4
253−fix available via `npm audit fix`
254−node_modules/form-data
255− request *
256− Depends on vulnerable versions of form-data
257− Depends on vulnerable versions of tough-cookie
258− node_modules/request
259− jsdom 0.1.20 || 0.2.0 - 16.5.3
260− Depends on vulnerable versions of request
261− Depends on vulnerable versions of tough-cookie
262− node_modules/jsdom
263− servify *
264− Depends on vulnerable versions of request
265− node_modules/servify
266− eth-lib <=0.1.29
267− Depends on vulnerable versions of servify
268− Depends on vulnerable versions of ws
269− node_modules/eth-lib
270− swarm-js >=0.1.36
271− Depends on vulnerable versions of eth-lib
272− Depends on vulnerable versions of tar
273− node_modules/swarm-js
274− web3-bzz *
275− Depends on vulnerable versions of swarm-js
276− node_modules/@truffle/debugger/node_modules/web3-bzz
277− node_modules/@truffle/interface-adapter/node_modules/web3-bzz
278− node_modules/@truffle/provider/node_modules/web3-bzz
279− node_modules/web3-bzz
280−
281−get-func-name <2.0.1
282−Severity: high
283−Chaijs/get-func-name vulnerable to ReDoS - https://github.com/advisories/GHSA-4q6p-r6v2-jvc5
284−fix available via `npm audit fix`
285−node_modules/get-func-name
286−
287−js-yaml <3.14.2 || >=4.0.0 <4.1.1
288−Severity: moderate
289−js-yaml has prototype pollution in merge (<<) - https://github.com/advisories/GHSA-mh29-5h37-fv8m
290−js-yaml has prototype pollution in merge (<<) - https://github.com/advisories/GHSA-mh29-5h37-fv8m
291−fix available via `npm audit fix --force`
292−Will install truffle@5.5.7, which is a breaking change
293−node_modules/@eslint/eslintrc/node_modules/js-yaml
294−node_modules/eslint/node_modules/js-yaml
295−node_modules/ganache/node_modules/js-yaml
296−node_modules/js-yaml
297−node_modules/mocha/node_modules/js-yaml
298−node_modules/truffle/node_modules/ganache/node_modules/js-yaml
299− mocha 5.1.0 - 10.5.2
300− Depends on vulnerable versions of js-yaml
301− Depends on vulnerable versions of minimatch
302− Depends on vulnerable versions of nanoid
303− Depends on vulnerable versions of serialize-javascript
304− node_modules/ganache/node_modules/mocha
305− node_modules/mocha
306− node_modules/truffle/node_modules/ganache/node_modules/mocha
307−
308−json-schema <0.4.0
309−Severity: critical
310−json-schema is vulnerable to Prototype Pollution - https://github.com/advisories/GHSA-896r-f27r-55mw
311−fix available via `npm audit fix`
312−node_modules/json-schema
313− jsprim 0.3.0 - 1.4.1 || 2.0.0 - 2.0.1
314− Depends on vulnerable versions of json-schema
315− node_modules/jsprim
316−
317−json5 <1.0.2 || >=2.0.0 <2.2.2
318−Severity: high
319−Prototype Pollution in JSON5 via Parse Method - https://github.com/advisories/GHSA-9c47-m6qq-7p4h
320−Prototype Pollution in JSON5 via Parse Method - https://github.com/advisories/GHSA-9c47-m6qq-7p4h
321−fix available via `npm audit fix --force`
322−Will install azimuth-js@0.15.0, which is a breaking change
323−node_modules/@babel/core/node_modules/json5
324−node_modules/ganache/node_modules/json5
325−node_modules/json5
326−node_modules/truffle/node_modules/ganache/node_modules/json5
327−node_modules/vite-plugin-comlink/node_modules/json5
328− vite-plugin-comlink 3.0.3 - 3.0.5
329− Depends on vulnerable versions of json5
330− node_modules/vite-plugin-comlink
331−
332−jszip <3.8.0
333−Severity: moderate
334−JSZip contains Path Traversal via loadAsync - https://github.com/advisories/GHSA-36fh-84j7-cv5h
335−fix available via `npm audit fix`
336−node_modules/jszip
337−
338−markdown-to-jsx <7.4.0
339−Severity: moderate
340−Cross site scripting in markdown-to-jsx - https://github.com/advisories/GHSA-4wx3-54gh-9fr9
341−fix available via `npm audit fix`
342−node_modules/markdown-to-jsx
343−
344−micromatch <4.0.8
345−Severity: moderate
346−Regular Expression Denial of Service (ReDoS) in micromatch - https://github.com/advisories/GHSA-952p-6rrq-rcjv
347−fix available via `npm audit fix`
348−node_modules/ganache/node_modules/micromatch
349−node_modules/micromatch
350−node_modules/truffle/node_modules/ganache/node_modules/micromatch
351−
352−minimatch <3.0.5
353−Severity: high
354−minimatch ReDoS vulnerability - https://github.com/advisories/GHSA-f8q6-p94x-37v3
355−fix available via `npm audit fix --force`
356−Will install truffle@5.5.7, which is a breaking change
357−node_modules/ganache/node_modules/minimatch
358−node_modules/minimatch
359−node_modules/truffle/node_modules/ganache/node_modules/minimatch
360− serve-handler <=6.1.5
361− Depends on vulnerable versions of minimatch
362− Depends on vulnerable versions of path-to-regexp
363− node_modules/serve-handler
364−
365−nanoid <=3.3.7
366−Severity: moderate
367−Predictable results in nanoid generation when given non-integer values - https://github.com/advisories/GHSA-mwcw-c2x4-8c55
368−Exposure of Sensitive Information to an Unauthorized Actor in nanoid - https://github.com/advisories/GHSA-qrpm-p2h7-hrv2
369−fix available via `npm audit fix --force`
370−Will install truffle@5.5.7, which is a breaking change
371−node_modules/ganache/node_modules/nanoid
372−node_modules/nanoid
373−node_modules/truffle/node_modules/ganache/node_modules/nanoid
374−node_modules/vite/node_modules/nanoid
375−
376−on-headers <1.1.0
377−on-headers is vulnerable to http response header manipulation - https://github.com/advisories/GHSA-76c9-3jph-rj3q
378−fix available via `npm audit fix --force`
379−Will install serve@14.2.5, which is a breaking change
380−node_modules/on-headers
381− compression 1.0.3 - 1.8.0
382− Depends on vulnerable versions of on-headers
383− node_modules/serve/node_modules/compression
384−
385−path-to-regexp 2.0.0 - 3.2.0
386−Severity: high
387−path-to-regexp outputs backtracking regular expressions - https://github.com/advisories/GHSA-9wv6-86v2-598j
388−fix available via `npm audit fix --force`
389−Will install serve@14.2.5, which is a breaking change
390−node_modules/serve-handler/node_modules/path-to-regexp
391−
392−pbkdf2 <=3.1.2
393−Severity: critical
394−pbkdf2 silently disregards Uint8Array input, returning static keys - https://github.com/advisories/GHSA-v62p-rq8g-8h59
395−pbkdf2 returns predictable uninitialized/zero-filled memory for non-normalized or unimplemented algos - https://github.com/advisories/GHSA-h7cp-r72f-jxh6
396−fix available via `npm audit fix`
397−node_modules/ganache/node_modules/pbkdf2
398−node_modules/pbkdf2
399−node_modules/truffle/node_modules/ganache/node_modules/pbkdf2
400−
401−postcss <8.4.31
402−Severity: moderate
403−PostCSS line return parsing error - https://github.com/advisories/GHSA-7fh5-64p2-3v2j
404−fix available via `npm audit fix`
405−node_modules/vite/node_modules/postcss
406−
407−qs 6.5.0 - 6.5.2
408−Severity: high
409−qs vulnerable to Prototype Pollution - https://github.com/advisories/GHSA-hrpp-h998-j3pp
410−fix available via `npm audit fix`
411−node_modules/request/node_modules/qs
412−
413−
414−rollup <2.79.2
415−Severity: high
416−DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS - https://github.com/advisories/GHSA-gcx4-mw62-g8wm
417−fix available via `npm audit fix --force`
418−Will install vite@3.2.11, which is outside the stated dependency range
419−node_modules/vite/node_modules/rollup
420−
421−secp256k1 <=3.8.0 || 4.0.0 - 4.0.3
422−Severity: high
423−secp256k1-node allows private key extraction over ECDH - https://github.com/advisories/GHSA-584q-6j8j-r5pm
424−secp256k1-node allows private key extraction over ECDH - https://github.com/advisories/GHSA-584q-6j8j-r5pm
425−fix available via `npm audit fix --force`
426−Will install ganache@6.4.5, which is a breaking change
427−node_modules/ganache/node_modules/secp256k1
428−node_modules/secp256k1
429−node_modules/truffle/node_modules/ganache/node_modules/secp256k1
430−node_modules/urbit-key-generation/node_modules/secp256k1
431− ganache <=3.0.0-internal.16 || >=7.0.0-alpha.0
432− Depends on vulnerable versions of @trufflesuite/uws-js-unofficial
433− Depends on vulnerable versions of secp256k1
434− node_modules/ganache
435− node_modules/truffle/node_modules/ganache
436− keythereum 1.2.0
437− Depends on vulnerable versions of secp256k1
438− node_modules/keythereum
439−
440−semver <=5.7.1 || 6.0.0 - 6.3.0 || 7.0.0 - 7.5.1
441−Severity: high
442−semver vulnerable to Regular Expression Denial of Service - https://github.com/advisories/GHSA-c2qf-rxjj-qqgw
443−semver vulnerable to Regular Expression Denial of Service - https://github.com/advisories/GHSA-c2qf-rxjj-qqgw
444−semver vulnerable to Regular Expression Denial of Service - https://github.com/advisories/GHSA-c2qf-rxjj-qqgw
445−fix available via `npm audit fix`
446−node_modules/@babel/core/node_modules/semver
447−node_modules/cross-spawn/node_modules/semver
448−node_modules/ganache/node_modules/semver
449−node_modules/normalize-package-data/node_modules/semver
450−node_modules/truffle/node_modules/ganache/node_modules/semver
451− @microsoft/api-extractor 7.9.1 - 7.36.2
452− Depends on vulnerable versions of @microsoft/api-extractor-model
453− Depends on vulnerable versions of @rushstack/node-core-library
454− Depends on vulnerable versions of semver
455− node_modules/ganache/node_modules/@microsoft/api-extractor
456− node_modules/truffle/node_modules/ganache/node_modules/@microsoft/api-extractor
457− @rushstack/node-core-library 3.25.0 - 3.59.5
458− Depends on vulnerable versions of semver
459− node_modules/ganache/node_modules/@rushstack/node-core-library
460− node_modules/truffle/node_modules/ganache/node_modules/@rushstack/node-core-library
461− @microsoft/api-extractor-model 7.8.12 - 7.27.4
462− Depends on vulnerable versions of @rushstack/node-core-library
463− node_modules/ganache/node_modules/@microsoft/api-extractor-model
464− node_modules/truffle/node_modules/ganache/node_modules/@microsoft/api-extractor-model
465−
466−serialize-javascript 6.0.0 - 6.0.1
467−Severity: moderate
468−Cross-site Scripting (XSS) in serialize-javascript - https://github.com/advisories/GHSA-76p7-773f-r4q5
469−fix available via `npm audit fix --force`
470−Will install truffle@5.5.7, which is a breaking change
471−node_modules/ganache/node_modules/serialize-javascript
472−node_modules/serialize-javascript
473−node_modules/truffle/node_modules/ganache/node_modules/serialize-javascript
474−
475−sha.js <=2.4.11
476−Severity: critical
477−sha.js is missing type checks leading to hash rewind and passing on crafted data - https://github.com/advisories/GHSA-95m3-7q98-8xr5
478−fix available via `npm audit fix`
479−node_modules/ganache/node_modules/sha.js
480−node_modules/sha.js
481−node_modules/truffle/node_modules/ganache/node_modules/sha.js
482−
483−shell-quote 1.6.3 - 1.7.2
484−Severity: critical
485−Improper Neutralization of Special Elements used in a Command in Shell-quote - https://github.com/advisories/GHSA-g4rg-993r-mgx7
486−fix available via `npm audit fix`
487−node_modules/shell-quote
488−
489−tar <6.2.1
490−Severity: moderate
491−Denial of service while parsing a tar file due to lack of folders count validation - https://github.com/advisories/GHSA-f5x3-32g6-xq36
492−fix available via `npm audit fix`
493−node_modules/tar
494−
495−tiny-secp256k1 <=1.1.6
496−Severity: high
497−tiny-secp256k1 allows for verify() bypass when running in bundled environment - https://github.com/advisories/GHSA-5vhg-9xg4-cv9m
498−tiny-secp256k1 vulnerable to private key extraction when signing a malicious JSON-stringifyable message in bundled environment - https://github.com/advisories/GHSA-7mc2-6phr-23xc
499−fix available via `npm audit fix`
500−node_modules/tiny-secp256k1
501−
502−tough-cookie <4.1.3
503−Severity: moderate
504−tough-cookie Prototype Pollution vulnerability - https://github.com/advisories/GHSA-72xf-g2v4-qvf3
505−fix available via `npm audit fix`
506−node_modules/tough-cookie
507−
508−validator <13.15.20
509−Severity: moderate
510−validator.js has a URL validation bypass vulnerability in its isURL function - https://github.com/advisories/GHSA-9965-vmph-33xx
511−fix available via `npm audit fix`
512−node_modules/ganache/node_modules/validator
513−node_modules/truffle/node_modules/ganache/node_modules/validator
514−
515−
516−web3-core-method <=2.0.0-alpha.1
517−web3-core-method is vulnerable to prototype pollution - https://github.com/advisories/GHSA-2j4c-9qqq-896r
518−Depends on vulnerable versions of web3-core-subscriptions
519−fix available via `npm audit fix --force`
520−Will install web3-core@4.7.1, which is a breaking change
521−node_modules/@truffle/debugger/node_modules/web3-core-method
522−node_modules/@truffle/interface-adapter/node_modules/web3-core-method
523−node_modules/@truffle/provider/node_modules/web3-core-method
524−node_modules/web3-core-method
525− web3-core <=2.0.0-alpha.1
526− Depends on vulnerable versions of web3-core-method
527− Depends on vulnerable versions of web3-core-method
528− node_modules/@truffle/debugger/node_modules/web3-core
529− node_modules/@truffle/interface-adapter/node_modules/web3-core
530− node_modules/@truffle/provider/node_modules/web3-core
531− node_modules/web3-core
532− web3-eth-ens <=2.0.0-alpha.1
533− Depends on vulnerable versions of web3-core
534− Depends on vulnerable versions of web3-core
535− Depends on vulnerable versions of web3-eth-contract
536− Depends on vulnerable versions of web3-eth-contract
537− node_modules/@truffle/debugger/node_modules/web3-eth-ens
538− node_modules/@truffle/interface-adapter/node_modules/web3-eth-ens
539− node_modules/@truffle/provider/node_modules/web3-eth-ens
540− node_modules/web3-eth-ens
541− web3-eth-personal <=2.0.0-alpha.1 || 4.0.9-dev.408125.0
542− Depends on vulnerable versions of web3-core
543− Depends on vulnerable versions of web3-core
544− Depends on vulnerable versions of web3-core-method
545− Depends on vulnerable versions of web3-core-method
546− Depends on vulnerable versions of web3-net
547− Depends on vulnerable versions of web3-net
548− node_modules/@truffle/debugger/node_modules/web3-eth-personal
549− node_modules/@truffle/interface-adapter/node_modules/web3-eth-personal
550− node_modules/@truffle/provider/node_modules/web3-eth-personal
551− node_modules/web3-eth-personal
552− web3-net 1.2.0 - 2.0.0-alpha.1 || 4.0.8-dev.408125.0
553− Depends on vulnerable versions of web3-core
554− Depends on vulnerable versions of web3-core
555− Depends on vulnerable versions of web3-core-method
556− Depends on vulnerable versions of web3-core-method
557− node_modules/@truffle/debugger/node_modules/web3-net
558− node_modules/@truffle/interface-adapter/node_modules/web3-net
559− node_modules/@truffle/provider/node_modules/web3-net
560− node_modules/web3-net
561− web3 1.0.0-beta.1 - 3.0.0-rc.0
562− Depends on vulnerable versions of web3-bzz
563− Depends on vulnerable versions of web3-core
564− Depends on vulnerable versions of web3-core
565− Depends on vulnerable versions of web3-eth
566− Depends on vulnerable versions of web3-eth
567− Depends on vulnerable versions of web3-eth-personal
568− Depends on vulnerable versions of web3-eth-personal
569− Depends on vulnerable versions of web3-net
570− Depends on vulnerable versions of web3-net
571− Depends on vulnerable versions of web3-shh
572− Depends on vulnerable versions of web3-shh
573− node_modules/@truffle/debugger/node_modules/web3
574− node_modules/@truffle/interface-adapter/node_modules/web3
575− node_modules/@truffle/provider/node_modules/web3
576− node_modules/web3
577− @truffle/debugger *
578− Depends on vulnerable versions of @ensdomains/ensjs
579− Depends on vulnerable versions of web3
580− node_modules/@truffle/debugger
581− web3-eth <=2.0.0-alpha.1
582− Depends on vulnerable versions of web3-core
583− Depends on vulnerable versions of web3-core
584− Depends on vulnerable versions of web3-core-method
585− Depends on vulnerable versions of web3-core-method
586− Depends on vulnerable versions of web3-core-subscriptions
587− Depends on vulnerable versions of web3-eth-accounts
588− Depends on vulnerable versions of web3-eth-accounts
589− Depends on vulnerable versions of web3-eth-contract
590− Depends on vulnerable versions of web3-eth-contract
591− Depends on vulnerable versions of web3-eth-ens
592− Depends on vulnerable versions of web3-eth-ens
593− Depends on vulnerable versions of web3-eth-personal
594− Depends on vulnerable versions of web3-eth-personal
595− Depends on vulnerable versions of web3-net
596− Depends on vulnerable versions of web3-net
597− node_modules/@truffle/debugger/node_modules/web3-eth
598− node_modules/@truffle/interface-adapter/node_modules/web3-eth
599− node_modules/@truffle/provider/node_modules/web3-eth
600− node_modules/web3-eth
601− web3-shh *
602− Depends on vulnerable versions of web3-core
603− Depends on vulnerable versions of web3-core
604− Depends on vulnerable versions of web3-core-method
605− Depends on vulnerable versions of web3-core-method
606− Depends on vulnerable versions of web3-core-subscriptions
607− Depends on vulnerable versions of web3-net
608− Depends on vulnerable versions of web3-net
609− node_modules/@truffle/debugger/node_modules/web3-shh
610− node_modules/@truffle/interface-adapter/node_modules/web3-shh
611− node_modules/@truffle/provider/node_modules/web3-shh
612− node_modules/web3-shh
613− web3-eth-accounts <=2.0.0-alpha.1
614− Depends on vulnerable versions of web3-core
615− Depends on vulnerable versions of web3-core
616− Depends on vulnerable versions of web3-core-method
617− Depends on vulnerable versions of web3-core-method
618− node_modules/@truffle/debugger/node_modules/web3-eth-accounts
619− node_modules/@truffle/interface-adapter/node_modules/web3-eth-accounts
620− node_modules/@truffle/provider/node_modules/web3-eth-accounts
621− node_modules/web3-eth-accounts
622− web3-eth-contract <=2.0.0-alpha.1
623− Depends on vulnerable versions of web3-core
624− Depends on vulnerable versions of web3-core
625− Depends on vulnerable versions of web3-core-method
626− Depends on vulnerable versions of web3-core-method
627− Depends on vulnerable versions of web3-core-subscriptions
628− node_modules/@truffle/debugger/node_modules/web3-eth-contract
629− node_modules/@truffle/interface-adapter/node_modules/web3-eth-contract
630− node_modules/@truffle/provider/node_modules/web3-eth-contract
631− node_modules/web3-eth-contract
632−
633−web3-core-subscriptions <=2.0.0-alpha.1
634−web3-core-subscriptions has a Prototype Pollution vulnerability - https://github.com/advisories/GHSA-hhf6-3xpg-pggx
635−fix available via `npm audit fix --force`
636−Will install web3-core@4.7.1, which is a breaking change
637−node_modules/@truffle/debugger/node_modules/web3-core-subscriptions
638−node_modules/@truffle/interface-adapter/node_modules/web3-core-subscriptions
639−node_modules/@truffle/provider/node_modules/web3-core-subscriptions
640−node_modules/web3-core-subscriptions
641−
642−webpack 5.0.0-alpha.0 - 5.93.0
643−Severity: critical
644−Cross-realm object access in Webpack 5 - https://github.com/advisories/GHSA-hc6q-2mpp-qw7j
645−Webpack's AutoPublicPathRuntimeModule has a DOM Clobbering Gadget that leads to XSS - https://github.com/advisories/GHSA-4vvj-4cpr-p986
646−fix available via `npm audit fix`
647−node_modules/ganache/node_modules/webpack
648−node_modules/truffle/node_modules/ganache/node_modules/webpack
649−
650−word-wrap <1.2.4
651−Severity: moderate
652−word-wrap vulnerable to Regular Expression Denial of Service - https://github.com/advisories/GHSA-j8xg-fqg3-53r7
653−fix available via `npm audit fix`
654−node_modules/word-wrap
655−
656−ws 2.1.0 - 5.2.3 || 7.0.0 - 7.5.9 || 8.0.0 - 8.17.0
657−Severity: high
658−ws affected by a DoS when handling a request with many HTTP headers - https://github.com/advisories/GHSA-3h5v-q93c-6h6q
659−ws affected by a DoS when handling a request with many HTTP headers - https://github.com/advisories/GHSA-3h5v-q93c-6h6q
660−ws affected by a DoS when handling a request with many HTTP headers - https://github.com/advisories/GHSA-3h5v-q93c-6h6q
661−fix available via `npm audit fix --force`
662−Will install ganache@6.4.5, which is a breaking change
663−node_modules/eth-lib/node_modules/ws
664−node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/node_modules/ws
665−node_modules/truffle/node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/node_modules/ws
666−node_modules/ws
667− @trufflesuite/uws-js-unofficial *
668− Depends on vulnerable versions of ws
669− node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial
670− node_modules/truffle/node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial
671−
672−yargs-parser <=5.0.0
673−Severity: moderate
674−yargs-parser Vulnerable to Prototype Pollution - https://github.com/advisories/GHSA-p9pc-299p-vxgp
675−fix available via `npm audit fix --force`
676−Will install truffle@5.5.7, which is a breaking change
677−node_modules/solc/node_modules/yargs-parser
678− yargs 4.0.0-alpha1 - 7.0.0-alpha.3 || 7.1.1
679− Depends on vulnerable versions of yargs-parser
680− node_modules/solc/node_modules/yargs
681− solc 0.3.6 - 0.4.26
682− Depends on vulnerable versions of yargs
683− node_modules/solc
684− @ensdomains/ens *
685− Depends on vulnerable versions of solc
686− node_modules/@ensdomains/ens
687− @ensdomains/ensjs <=2.1.0
688− Depends on vulnerable versions of @ensdomains/ens
689− node_modules/@ensdomains/ensjs
690−
691−108 vulnerabilities (23 low, 25 moderate, 42 high, 18 critical)
692−
693−To address issues that do not require attention, run:
694− npm audit fix
695−
696−To address all issues (including breaking changes), run:
697− npm audit fix --force