New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

event-stream@3.3.6 依赖包中存在漏洞 #45

Closed

unmec opened this issue Dec 3, 2018 · 0 comments

unmec commented Dec 3, 2018

首先感谢作者的开源与维护。

昨天刚刚发现这个项目，在安装时，提示 404 event-stream@3.3.6。后证实是因为 event-stream 被某位协作人员插入恶意代码，npm 撤下避免更广的影响导致。

目前可以强制声明使用 event-stream@3.3.4，无漏洞。已部署的项目建议回滚至 3.3.4，同时删除 flatmap-stream@0.1.1

更多相关信息：
dominictarr/event-stream#116
dominictarr/event-stream#115

unmec closed this as completed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment