Unclear behaviour with vulnerabilities when using cwd

[mbalabash]

Hey!
I found unclear behaviour with vulnerabilities reporting when using cwd.

With this package.json:

{
  "private": true,
  "dependencies": {
    "classnames": "^2.1.5",
    "director": "^1.2.0",
    "react": "^0.13.3",
    "todomvc-app-css": "^2.0.0",
    "todomvc-common": "^1.0.1"
  },
  "devDependencies": {
    "bin-up": "^1.1.0"
  }
}

I do npm audit and get this output:

# npm audit report

react  >=0.0.1 <0.14.0
Severity: high
Cross-Site Scripting in react - https://github.com/advisories/GHSA-hg79-j56m-fxgv
fix available via `npm audit fix --force`
Will install react@18.0.0, which is a breaking change
node_modules/react

1 high severity vulnerability

To address all issues (including breaking changes), run:
  npm audit fix --force

but when I use cwd:

await cwd(path, {
    vulnerabilityStrategy: "npm",
    fullLockMode: true
  })

I get vulnerabilities: [].

What am I doing wrong? Could you please clarify how this work?

[fraxken]

Hi @mbalabash

Can you try to run cwd with includeDevDeps options set to true ? (just to be sure even if doesn't seem to be related to devDeps).

Or maybe there is something wrong with the way we check SemVer (possible). You can always take a look here:

• https://github.com/NodeSecure/scanner/blob/master/src/depWalker.js#L285

After this it use the npm strategy for Vuln package:

• https://github.com/NodeSecure/vuln/blob/main/src/strategies/npm-audit.js#L16

I'm going to take a look too.

[fraxken]

Hmm i failed to reproduce on my side with the package.json you provided

[mbalabash]

Hmm i failed to reproduce on my side with the package.json you provided

That’s strange. I tried with includeDevDeps: true and still get same vulnerabilities: [] output.

What kind of npm token should I use?
I've set npm readonly token into env var NODE_SECURE_TOKEN. Is it correct?

[fraxken]

Ok i think i found what's wrong: #39

[fraxken]

Ok release 3.4.1 available: https://github.com/NodeSecure/scanner/releases/tag/v3.4.1 (could you check if everything ok now ?).

[mbalabash]

Yep, now it works perfectly 👍
Thank you!