Trying to build from source threw a security advisory

Development
1

OS: Artix Linux 64-bit (kernel: 5.4.12-artix1-1)
Node: 13.6.0
Yarn: 1.21.1
Npm: 6.13.6

Upon following the build instructions in the Build.md and running cd Tools && npm install, I received a security advisory for one of the dependencies. The information from the terminal is shown below.

[I] ⋊> ~/S/g/j/Tools on master ⨯ npm audit 02:30:14

                       === npm audit security report ===                        
                                                                                
┌──────────────────────────────────────────────────────────────────────────────┐
│                                Manual Review                                 │
│            Some vulnerabilities require your attention to resolve            │
│                                                                              │
│         Visit https://go.npm.me/audit-guide for additional guidance          │
└──────────────────────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High          │ Insufficient Entropy                                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ cryptiles                                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=3.1.3 <4.0.0 || >=4.1.2                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ request                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ request > hawk > cryptiles                                   │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/720                          │
└───────────────┴──────────────────────────────────────────────────────────────┘
found 1 high severity vulnerability in 178 scanned packages
  1 vulnerability requires manual review. See the full report for details.

The reason that I included yarn here is partly because it recommended I have a newer version in the build instructions and also yarn does not throw this security warning when on the Tools build step. Npm is the only one that does. Now, using yarn also doesn’t seem to install all of the dependencies either that npm pulls.

Tools directory node_modules folder results:

  1. NPM: npm_deps.txt (1.4 KB)

  2. Yarn: yarn_deps.txt (1.4 KB)

Other information

Cryptfiles version pulled: 3.1.2

Running npm audit fix threw this:

[I] ⋊> ~/S/g/j/Tools on master ⨯ npm audit fix
npm WARN tools@1.0.0 No description
npm WARN tools@1.0.0 No repository field.

up to date in 0.658s
fixed 0 of 1 vulnerability in 178 scanned packages
  1 vulnerability required manual review and could not be updated
2

I run npm audit fix now and then so it should be fixed at some point.

1 Like
4

I tried updating cryptiles and it requires request to be updated to version 2.88.0 but then throws several warnings about breaking other dependencies that must be either updated to a new version or the repository has been moved elsewhere. I’m new to node dependencies but this sounds like a big rabbit hole of mess. Ha