Library is Vulnerable Due To Unneeded Dependency

Describe the bug

Please move dependency on:

        "decompress": "4.2.x",
        "decompress-targz": "4.1.x",

from:

    "dependencies": {

to:

    "devDependencies": {

Reasons:

1. They are only used in prepublish.js
2. Any product that includes zookeeper is vulnerable due to dependency on decompress.

To Reproduce Steps to reproduce the behavior:

1. Create a Docker Image with zookeeper dependency
2. Run X-Ray scanner

Expected behavior

1. Dependencies only used in build environment should be in devDependecies
2. zookeeper should not depend on vulnerable packages

Screenshots Found by X-Ray in JFrog.

Desktop (please complete the following information):

• OS: Linux
• Node.js version: v14.16.1
• C/C++ compiler and version: n/a

[DavidVujic]

I’m closing this issue, since the original question about vulnerability is ✔️

Please reopen if you think it need any actions.

[DavidVujic]

Sorry, my bad. But is that npm install or npm run install? Normally npm install does not include buld, so I’m confused. I’ll have to check, what really happens…

No worries!

The zookeeper build command is just an internally used script, and it is triggered by the “official” install script used by the ones that has added it as a dependency.

So, when you install the dependencies of your app, each one of them will run their own install behind the scenes.