Low Severity Vulnerability : Prototype Pollution in minimist.

• Versions:
• nodemon -v: 2.0.15
• node: 14.15.4
• Operating system/terminal environment: Windows 10/ Vs code terminal (git bash in vs code)
• Using Docker? What image: none
• Command you ran: npm audit

Expected behaviour

found 0 vulnerabilities

Actual behaviour

found 2 vulnerabilities // I installed hbs (handlebars) package, after installing it, it directly showed two high vulnerabilities (one in hbs minimist, and one in nodemon minimist.

Steps to reproduce

---

If applicable, please append the --dump flag on your command and include the output here ensuring to remove any sensitive/personal details or tokens.

[remy]

The reality is that there is an exceptionally slim chance of this vuln affecting you - iirc it can only be exploited through nodemon if you’re using someone else’s required version of nodemon (which you’ve not reported - i.e. you’re probably running nodemon directly).

I suspect you’ll see a minor bump in update-notifier or one of the downstream deps - and an npm install will automatically jump over the vulnerable package.

All the same, I still want to remove update-notifier at some point soon.

[remy]

For others on this thread, it’s always worth completely removing your node_modules and running npm install (over npm ci) in this specific case (I’m not 100% sure, but I think with yarn it’s a straight forward yarn to do a clean reinstall). This will ensure you’re getting the latest requested nodemon deps, and should clear you out of the range where there’s a potential vulnerability in some deep dependency.