Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

High severity vulnerability found in fsevents >node-pre-gyp >tar

See original GitHub issue

Using Synk, I found security vulnerability from package node-pre-gyp in the package tar. This was discovered on Synk April 4 2019. Please see Synk screenshots Screen Shot 2019-04-10 at 9 55 58 AM

You can see details about this vulnerability here https://snyk.io/vuln/SNYK-JS-TAR-174125

Screen Shot 2019-04-10 at 10 00 30 AM

Because, I imagine many teams will not be able to use React Scripts. What is the best way to go about this? I filed an issue with the node-pre-gyp team but it seems like to fix this we will need fsevents to be updated as well. Any ideas?

Issue Analytics

State:
Created 4 years ago
Reactions:9
Comments:23 (3 by maintainers)

Top GitHub Comments

4reactions

iansucommented, Apr 19, 2019

Yes, like I said, we will update these packages. A new version of fsevents has been released and there is already a PR updating our dependencies.

2reactions

HarisSpahijacommented, Apr 18, 2019

Updating all "tar" locations in package-lock.json to use "tar": "^4.4.8" manually solved my issue.

Top Results From Across the Web

How to fix NPM package Tar, with high vulnerability about ...

From the SASS github issue: open package-lock.json Find "tar" Which should look like this:

create-react-app > tar-pack > tar@2.2.2: this version of tar is ...

2 high severity vulnerabilities. Some issues need review, and may require choosing a different dependency. Run npm audit for details.".

@acalcutt/node-pre-gyp - npm Package Health Analysis | Snyk

Based on project statistics from the GitHub repository for the npm package @acalcutt/node-pre-gyp, we found that it has been starred 1,025 times ...

August 31 2021 Security Releases - Node.js

The 12.x release line of Node.js is vulnerable to three high severity issues, and two moderate severity issues. Release timing. Releases will be ......

Npm audit Package tar - Questions / Help - Elixir Forum

So I made the steps for run and when I run the npm… ... found 1 high severity vulnerability in 6579 scanned packages...