Nodejs using vulnerable package for ip about node

[VoltrexKeyva]

If you use npm ls -g ip you can pinpoint exactly what depends on it, in this case npm depends on make-fetch-happen which in turn depends on @npmcli/agent which depends on socks-proxy-agent. socks-proxy-agent depends on socks but socks removed the ip package in JoshGlazebrook/socks@66b7f73, so to fix this the socks version must be bumped here in socks-proxy-agent and release an update, then @npmcli/agent must update to the new version of socks-proxy-agent and release an update, and then make-fetch-happen must update to the new version of @npmcli/agent and release an update, and finally npm must update to the new version of make-fetch-happen... 😅

[mhdawson]

Discussion on this issue in npm repo - npm/cli#7216

[mhdawson]

I think we should move this to https://github.com/nodejs/nodejs-dependency-vuln-assessments. Any concerns with moving it there?

[rovindra]

Yes agree with you its a very long chain. Lets see what we can do as it should be fixed.

[joyeecheung]

Or, it seems npm CLI is only using make-fetch-happen here: https://github.com/npm/cli/blob/95b505738a73ba740227a41b8c7c87013af5acaf/lib/commands/doctor.js#L197 which can be replaced with the global fetch since Node.js v18...

[sidewaiise]

This is causing some issues with our security scanner. We might need to delete the dependency as part of the build process until it's fixed in the base images.

using base image node:18-alpine

[michaelact]

This is causing some issues with our security scanner. We might need to delete the dependency as part of the build process until it's fixed in the base images.

using base image node:18-alpine

How did you manage to remove it?