Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

NPM Severity Incorrect

See original GitHub issue

NPM severity appears incorrect for some dependencies. For example, minimatch@3.0.0 is showing with high severity at https://www.npmjs.com/advisories/118 while Dependency Check is reporting it as a low severity.

A minimal example can be found at https://github.com/jvmccarthy/npm-severity-example. I’ve posted a log on gist (with system-specific information changed to environment variables).

Here’s the info produced by Dependency Check for this dependency (with evidence removed for brevity),

{
      "isVirtual": false,
      "fileName": "minimatch:3.0.0",
      "filePath": "%WORKSPACE%\\npm-severity-example\\node_modules\\minimatch\\package.json",
      "md5": "d82a41a3a35aca433eb965141f59f371",
      "sha1": "583bdf29fab3bcdb18128eda2fe0cf6b48e5f223",
      "sha256": "154c6266c7b13f0dfe7d9ffc5b8577c2a64656e6df674c59b3e1f26ebc46b932",
      "description": "a glob matcher in javascript",
      "license": "ISC",
      "projectReferences": [
        "npm-severity-example:1.0.0"
      ],
      "evidenceCollected": {
        ...
      },
      "identifiers": [
        {
          "name": "minimatch:3.0.0",
          "type": "npm",
          "confidence": "HIGHEST"
        }
      ],
      "vulnerabilities": [
        {
          "source": "NPM",
          "name": "118",
          "cvssScore": "0.0",
          "severity": "Low",
          "cwe": "",
          "description": "Affected versions of `minimatch` are vulnerable to regular expression denial of service attacks when user input is passed into the `pattern` argument of `minimatch(path, pattern)`.\n\n\n## Proof of Concept\n```\nvar minimatch = require(“minimatch”);\n\n// utility function for generating long strings\nvar genstr = function (len, chr) {\n  var result = “”;\n  for (i=0; i<=len; i++) {\n    result = result + chr;\n  }\n  return result;\n}\n\nvar exploit = “[!” + genstr(1000000, “\\\\”) + “A”;\n\n// minimatch exploit.\nconsole.log(“starting minimatch”);\nminimatch(“foo”, exploit);\nconsole.log(“finishing minimatch”);\n```",
          "notes": "",
          "references": [
            {
              "source": "NPM",
              "url": "",
              "name": "Advisory 118: Regular Expression Denial of Service"
            }
          ],
          "vulnerableSoftware": [
            {
              "software": "minimatch:<=3.0.1"
            }
          ]
        }
      ]
    }

Thank you for your time and efforts on Dependency Check. It’s a great help!