Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

npm audit is reporting a security vulnerability when installing amplitude-js

See original GitHub issue

$ npm audit
                                                                                
                       === npm audit security report ===                        
                                                                                
┌──────────────────────────────────────────────────────────────────────────────┐
│                                Manual Review                                 │
│            Some vulnerabilities require your attention to resolve            │
│                                                                              │
│         Visit https://go.npm.me/audit-guide for additional guidance          │
└──────────────────────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low           │ Regular Expression Denial of Service                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ debug                                                        │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >= 2.6.9 < 3.0.0 || >= 3.1.0                                 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ amplitude-js                                                 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ amplitude-js > @segment/top-domain > component-cookie >      │
│               │ debug                                                        │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/534                       │
└───────────────┴──────────────────────────────────────────────────────────────┘
found 1 low severity vulnerability in 55729 scanned packages
  1 vulnerability requires manual review. See the full report for details.

$ npm ls
...
├─┬ amplitude-js@4.5.1
│ ├─┬ @segment/top-domain@3.0.0
│ │ ├─┬ component-cookie@1.1.4
│ │ │ └─┬ debug@2.2.0
...

The @segment/top-domain package has not been updated in 2 years. I suggest switching to something else, or building that functionality yourself…