Coder Social home page Coder Social logo

gulp-watch's Introduction

gulp-watch Build Status

File watcher that uses super-fast chokidar and emits vinyl objects.

Usage

var gulp = require('gulp'),
    watch = require('gulp-watch');

gulp.task('stream', function () {
	// Endless stream mode
    return watch('css/**/*.css', { ignoreInitial: false })
        .pipe(gulp.dest('build'));
});

gulp.task('callback', function () {
	// Callback mode, useful if any plugin in the pipeline depends on the `end`/`flush` event
    return watch('css/**/*.css', function () {
        gulp.src('css/**/*.css')
            .pipe(gulp.dest('build'));
    });
});

Protip: until gulpjs 4.0 is released, you can use gulp-plumber to prevent stops on errors.

More examples can be found in docs/readme.md.

API

watch(glob, [options, callback])

Creates a watcher that will spy on files that are matched by glob which can be a glob string or array of glob strings.

Returns a pass through stream that will emit vinyl files (with additional event property) that corresponds to event on file-system.

Callback function(vinyl)

This function is called when events happen on the file-system. All incoming files that are piped in are grouped and passed to the events stream as is.

  • vinyl — is vinyl object that corresponds to the file that caused the event. Additional event field is added to determine what caused changes.

Possible events:

  • add - file was added to watch or created
  • change - file was changed
  • unlink - file was deleted

Options

This object is passed to the chokidar options directly. Options for gulp.src are also available. If you do not want content from watch, then add read: false to the options object.

Type: Boolean
Default: true

Indicates whether chokidar should ignore the initial add events or not.

options.events

Type: Array
Default: ['add', 'change', 'unlink']

List of events, that should be watched by gulp-watch. Contains event names from chokidar.

options.base

Type: String
Default: undefined

Use explicit base path for files from glob. Read more about base and cwd in gulpjs docs.

options.name

Type: String
Default: undefined

Name of the watcher. If it is present in options, you will get more readable output.

options.verbose

Type: Boolean
Default: false

This option will enable verbose output.

options.readDelay

Type: Number
Default: 10

Wait for readDelay milliseconds before reading the file.

options.read

Type: Boolean
Default: true

Setting this to false will return file.contents as null and not read the file at all. Most useful as an optimization if your plugins pipeline doesn't make use of the file contents (e.g. gulp-clean), or to avoid reading the file twice if you use gulp.src() inside the callback instead of the file object that is passed as argument.

Methods

Returned Stream from constructor has some useful methods:

  • add(path / paths)
  • unwatch(path / paths)
  • close()

Events

All events from chokidar:

  • add, change, unlink, addDir, unlinkDir, error, ready, raw

License

MIT (c) 2014 Vsevolod Strukchinsky ([email protected])

gulp-watch's People

Contributors

dependabot[bot] avatar jshep89 avatar mend-bolt-for-github[bot] avatar zyc0r3 avatar

Watchers

 avatar  avatar  avatar

gulp-watch's Issues

WS-2019-0032 (Medium) detected in js-yaml-3.6.1.tgz, js-yaml-3.4.5.tgz

WS-2019-0032 - Medium Severity Vulnerability

Vulnerable Libraries - js-yaml-3.6.1.tgz, js-yaml-3.4.5.tgz

js-yaml-3.6.1.tgz

YAML 1.2 parser and serializer

Library home page: https://registry.npmjs.org/js-yaml/-/js-yaml-3.6.1.tgz

Path to dependency file: /gulp-watch/package.json

Path to vulnerable library: /tmp/git/gulp-watch/node_modules/js-yaml/package.json

Dependency Hierarchy:

  • coveralls-2.13.3.tgz (Root Library)
    • js-yaml-3.6.1.tgz (Vulnerable Library)
js-yaml-3.4.5.tgz

YAML 1.2 parser and serializer

Library home page: https://registry.npmjs.org/js-yaml/-/js-yaml-3.4.5.tgz

Path to dependency file: /gulp-watch/package.json

Path to vulnerable library: /tmp/git/gulp-watch/node_modules/eslint/node_modules/js-yaml/package.json

Dependency Hierarchy:

  • xo-0.10.1.tgz (Root Library)
    • eslint-1.10.3.tgz
      • js-yaml-3.4.5.tgz (Vulnerable Library)

Found in HEAD commit: 14c9d9c0e1ba810c3787a5d145cf1f2cf12c312e

Vulnerability Details

Versions js-yaml prior to 3.13.0 are vulnerable to Denial of Service. By parsing a carefully-crafted YAML file, the node process stalls and may exhaust system resources leading to a Denial of Service.

Publish Date: 2019-03-26

URL: WS-2019-0032

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/788/versions

Release Date: 2019-03-26

Fix Resolution: 3.13.0


Step up your Open Source Security Game with WhiteSource here

WS-2017-0236 (Medium) detected in growl-1.9.2.tgz

WS-2017-0236 - Medium Severity Vulnerability

Vulnerable Library - growl-1.9.2.tgz

Growl unobtrusive notifications

Library home page: https://registry.npmjs.org/growl/-/growl-1.9.2.tgz

Path to dependency file: /gulp-watch/package.json

Path to vulnerable library: /tmp/git/gulp-watch/node_modules/growl/package.json

Dependency Hierarchy:

  • mocha-2.5.3.tgz (Root Library)
    • growl-1.9.2.tgz (Vulnerable Library)

Found in HEAD commit: 14c9d9c0e1ba810c3787a5d145cf1f2cf12c312e

Vulnerability Details

Affected versions of the package are vulnerable to Arbitrary Code Injection.

Publish Date: 2017-05-01

URL: WS-2017-0236

CVSS 2 Score Details (5.6)

Base Score Metrics not available

Suggested Fix

Type: Change files

Origin: tj/node-growl@d9f6ea2

Release Date: 2016-09-05

Fix Resolution: Replace or update the following files: package.json, growl.js


Step up your Open Source Security Game with WhiteSource here

CVE-2018-16487 (High) detected in lodash-3.10.1.tgz

CVE-2018-16487 - High Severity Vulnerability

Vulnerable Library - lodash-3.10.1.tgz

The modern build of lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-3.10.1.tgz

Path to dependency file: /gulp-watch/package.json

Path to vulnerable library: /tmp/git/gulp-watch/node_modules/lodash/package.json

Dependency Hierarchy:

  • xo-0.10.1.tgz (Root Library)
    • babel-eslint-4.1.8.tgz
      • babel-core-5.8.38.tgz
        • lodash-3.10.1.tgz (Vulnerable Library)

Found in HEAD commit: 14c9d9c0e1ba810c3787a5d145cf1f2cf12c312e

Vulnerability Details

A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.

Publish Date: 2019-02-01

URL: CVE-2018-16487

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16487

Release Date: 2019-02-01

Fix Resolution: 4.17.11


Step up your Open Source Security Game with WhiteSource here

test/test-stream

× 3:1 Unexpected var, use let or const instead. no-var
× 3:13 .. import should occur after import of rimraf import/order
× 4:1 Unexpected var, use let or const instead. no-var
× 4:5 Use object destructuring. prefer-destructuring
× 5:1 Unexpected var, use let or const instead. no-var
× 5:13 ./util/touch import should occur after import of rimraf import/order
× 6:1 Unexpected var, use let or const instead. no-var
× 7:1 Unexpected var, use let or const instead. no-var
× 8:1 Imported module should be assigned import/no-unassigned-import
× 14:20 Unexpected function expression. prefer-arrow-callback
× 15:2 Unexpected var, use let or const instead. no-var
× 17:12 Unexpected function expression. prefer-arrow-callback
× 18:15 Unexpected function expression. prefer-arrow-callback
× 25:34 Unexpected function expression. prefer-arrow-callback
× 27:17 Unexpected function expression. prefer-arrow-callback
× 32:31 Unexpected function expression. prefer-arrow-callback
× 34:16 Unexpected function expression. prefer-arrow-callback
× 41:48 Unexpected function expression. prefer-arrow-callback
× 44:16 Unexpected function expression. prefer-arrow-callback
× 50:54 Unexpected function expression. prefer-arrow-callback
× 52:16 Unexpected function expression. prefer-arrow-callback
× 58:44 Unexpected function expression. prefer-arrow-callback
× 60:16 Unexpected function expression. prefer-arrow-callback
× 66:49 Unexpected function expression. prefer-arrow-callback
× 67:33 Unexpected function expression. prefer-arrow-callback
× 69:17 Unexpected function expression. prefer-arrow-callback
× 72:19 Unexpected function expression. prefer-arrow-callback

test/test-cwd.js

× 3:1 Unexpected var, use let or const instead. no-var
× 3:13 .. import should occur after import of ./util/touch import/order
× 4:1 Unexpected var, use let or const instead. no-var
× 5:1 Unexpected var, use let or const instead. no-var
× 6:1 Imported module should be assigned import/no-unassigned-import
× 12:17 Unexpected function expression. prefer-arrow-callback
× 13:2 Unexpected var, use let or const instead. no-var
× 15:12 Unexpected function expression. prefer-arrow-callback
× 20:32 Unexpected function expression. prefer-arrow-callback
× 21:46 Unexpected function expression. prefer-arrow-callback
× 27:62 Unexpected function expression. prefer-arrow-callback
× 28:55 Unexpected function expression. prefer-arrow-callback
× 35:62 Unexpected function expression. prefer-arrow-callback
× 36:62 Unexpected function expression. prefer-arrow-callback
× 43:98 Unexpected function expression. prefer-arrow-callback
× 44:65 Unexpected function expression. prefer-arrow-callback
× 50:98 Unexpected function expression. prefer-arrow-callback
× 51:75 Unexpected function expression. prefer-arrow-callback
× 57:96 Unexpected function expression. prefer-arrow-callback
× 58:3 Unexpected var, use let or const instead. no-var
× 60:37 Unexpected function expression. prefer-arrow-callback
× 67:96 Unexpected function expression. prefer-arrow-callback
× 68:3 Unexpected var, use let or const instead. no-var
× 70:75 Unexpected function expression. prefer-arrow-callback

CVE-2016-10540 (High) detected in minimatch-0.3.0.tgz, minimatch-2.0.10.tgz

CVE-2016-10540 - High Severity Vulnerability

Vulnerable Libraries - minimatch-0.3.0.tgz, minimatch-2.0.10.tgz

minimatch-0.3.0.tgz

a glob matcher in javascript

Library home page: https://registry.npmjs.org/minimatch/-/minimatch-0.3.0.tgz

Path to dependency file: /gulp-watch/package.json

Path to vulnerable library: /tmp/git/gulp-watch/node_modules/mocha/node_modules/minimatch/package.json

Dependency Hierarchy:

  • mocha-2.5.3.tgz (Root Library)
    • glob-3.2.11.tgz
      • minimatch-0.3.0.tgz (Vulnerable Library)
minimatch-2.0.10.tgz

a glob matcher in javascript

Library home page: https://registry.npmjs.org/minimatch/-/minimatch-2.0.10.tgz

Path to dependency file: /gulp-watch/package.json

Path to vulnerable library: /tmp/git/gulp-watch/node_modules/minimatch/package.json

Dependency Hierarchy:

  • istanbul-0.3.22.tgz (Root Library)
    • fileset-0.2.1.tgz
      • minimatch-2.0.10.tgz (Vulnerable Library)

Found in HEAD commit: 14c9d9c0e1ba810c3787a5d145cf1f2cf12c312e

Vulnerability Details

Minimatch is a minimal matching utility that works by converting glob expressions into JavaScript RegExp objects. The primary function, minimatch(path, pattern) in Minimatch 3.0.1 and earlier is vulnerable to ReDoS in the pattern parameter.

Publish Date: 2018-05-31

URL: CVE-2016-10540

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nodesecurity.io/advisories/118

Release Date: 2016-06-20

Fix Resolution: Update to version 3.0.2 or later.


Step up your Open Source Security Game with WhiteSource here

CVE-2017-16137 (Medium) detected in debug-2.2.0.tgz

CVE-2017-16137 - Medium Severity Vulnerability

Vulnerable Library - debug-2.2.0.tgz

small debugging utility

Library home page: https://registry.npmjs.org/debug/-/debug-2.2.0.tgz

Path to dependency file: /gulp-watch/package.json

Path to vulnerable library: /tmp/git/gulp-watch/node_modules/mocha/node_modules/debug/package.json

Dependency Hierarchy:

  • mocha-2.5.3.tgz (Root Library)
    • debug-2.2.0.tgz (Vulnerable Library)

Found in HEAD commit: 14c9d9c0e1ba810c3787a5d145cf1f2cf12c312e

Vulnerability Details

The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue.

Publish Date: 2018-06-07

URL: CVE-2017-16137

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Change files

Origin: debug-js/debug@42a6ae0

Release Date: 2017-09-21

Fix Resolution: Replace or update the following file: node.js


Step up your Open Source Security Game with WhiteSource here

Dependency xo

figure out how to upgrade xo to the latest version

WS-2018-0590 (High) detected in diff-1.4.0.tgz

WS-2018-0590 - High Severity Vulnerability

Vulnerable Library - diff-1.4.0.tgz

A javascript text diff implementation.

Library home page: https://registry.npmjs.org/diff/-/diff-1.4.0.tgz

Path to dependency file: /gulp-watch/package.json

Path to vulnerable library: /tmp/git/gulp-watch/node_modules/diff/package.json

Dependency Hierarchy:

  • mocha-2.5.3.tgz (Root Library)
    • diff-1.4.0.tgz (Vulnerable Library)

Found in HEAD commit: 14c9d9c0e1ba810c3787a5d145cf1f2cf12c312e

Vulnerability Details

A vulnerability was found in diff before v3.5.0, the affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) attacks.

Publish Date: 2019-06-11

URL: WS-2018-0590

CVSS 2 Score Details (7.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: kpdecker/jsdiff@2aec429

Release Date: 2019-06-11

Fix Resolution: 3.5.0


Step up your Open Source Security Game with WhiteSource here

CVE-2019-1010266 (Medium) detected in lodash-3.10.1.tgz

CVE-2019-1010266 - Medium Severity Vulnerability

Vulnerable Library - lodash-3.10.1.tgz

The modern build of lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-3.10.1.tgz

Path to dependency file: /gulp-watch/package.json

Path to vulnerable library: /tmp/git/gulp-watch/node_modules/lodash/package.json

Dependency Hierarchy:

  • xo-0.10.1.tgz (Root Library)
    • babel-eslint-4.1.8.tgz
      • babel-core-5.8.38.tgz
        • lodash-3.10.1.tgz (Vulnerable Library)

Found in HEAD commit: 14c9d9c0e1ba810c3787a5d145cf1f2cf12c312e

Vulnerability Details

lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regular expression. The fixed version is: 4.17.11.

Publish Date: 2019-07-17

URL: CVE-2019-1010266

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1010266

Release Date: 2019-07-17

Fix Resolution: 4.17.11


Step up your Open Source Security Game with WhiteSource here

WS-2018-0076 (Medium) detected in tunnel-agent-0.4.3.tgz

WS-2018-0076 - Medium Severity Vulnerability

Vulnerable Library - tunnel-agent-0.4.3.tgz

HTTP proxy tunneling agent. Formerly part of mikeal/request, now a standalone module.

Library home page: https://registry.npmjs.org/tunnel-agent/-/tunnel-agent-0.4.3.tgz

Path to dependency file: /gulp-watch/package.json

Path to vulnerable library: /tmp/git/gulp-watch/node_modules/tunnel-agent/package.json

Dependency Hierarchy:

  • coveralls-2.13.3.tgz (Root Library)
    • request-2.79.0.tgz
      • tunnel-agent-0.4.3.tgz (Vulnerable Library)

Found in HEAD commit: 14c9d9c0e1ba810c3787a5d145cf1f2cf12c312e

Vulnerability Details

Versions of tunnel-agent before 0.6.0 are vulnerable to memory exposure.

This is exploitable if user supplied input is provided to the auth value and is a number.

Publish Date: 2018-04-25

URL: WS-2018-0076

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://nodesecurity.io/advisories/598

Release Date: 2018-01-27

Fix Resolution: 0.6.0


Step up your Open Source Security Game with WhiteSource here

WS-2018-0347 (Medium) detected in eslint-1.10.3.tgz

WS-2018-0347 - Medium Severity Vulnerability

Vulnerable Library - eslint-1.10.3.tgz

An AST-based pattern checker for JavaScript.

Library home page: https://registry.npmjs.org/eslint/-/eslint-1.10.3.tgz

Path to dependency file: /gulp-watch/package.json

Path to vulnerable library: /tmp/git/gulp-watch/node_modules/eslint/package.json

Dependency Hierarchy:

  • xo-0.10.1.tgz (Root Library)
    • eslint-1.10.3.tgz (Vulnerable Library)

Found in HEAD commit: 14c9d9c0e1ba810c3787a5d145cf1f2cf12c312e

Vulnerability Details

A vulnerability was descovered in eslint before 4.18.2. One of the regexes in eslint is vulnerable to catastrophic backtracking.

Publish Date: 2018-02-27

URL: WS-2018-0347

CVSS 3 Score Details (4.0)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: High
    • Privileges Required: High
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: eslint/eslint#10002

Release Date: 2019-06-16

Fix Resolution: 4.18.2


Step up your Open Source Security Game with WhiteSource here

test/test-log.js

× 3:1 Unexpected var, use let or const instead. no-var
× 3:1 Expected 1 empty line after require statement not followed by another require. import/newline-after-import
× 4:1 Unexpected var, use let or const instead. no-var
× 5:2 Expected method shorthand. object-shorthand
× 7:1 Unexpected var, use let or const instead. no-var
× 10:1 Unexpected var, use let or const instead. no-var
× 12:1 Unexpected var, use let or const instead. no-var
× 12:12 path import should occur before import of proxyquire import/order
× 13:1 Unexpected var, use let or const instead. no-var
× 14:1 Unexpected var, use let or const instead. no-var
× 14:13 strip-ansi import should occur before import of ./util/touch import/order
× 16:1 Imported module should be assigned import/no-unassigned-import
× 22:17 Unexpected function expression. prefer-arrow-callback
× 23:2 Unexpected var, use let or const instead. no-var
× 25:13 Unexpected function expression. prefer-arrow-callback
× 29:12 Unexpected function expression. prefer-arrow-callback
× 35:31 Unexpected function expression. prefer-arrow-callback
× 37:18 Unexpected function expression. prefer-arrow-callback
× 44:40 Unexpected function expression. prefer-arrow-callback
× 46:18 Unexpected function expression. prefer-arrow-callback
× 52:41 Unexpected function expression. prefer-arrow-callback
× 54:18 Unexpected function expression. prefer-arrow-callback

CVE-2018-3721 (Medium) detected in lodash-3.10.1.tgz

CVE-2018-3721 - Medium Severity Vulnerability

Vulnerable Library - lodash-3.10.1.tgz

The modern build of lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-3.10.1.tgz

Path to dependency file: /gulp-watch/package.json

Path to vulnerable library: /tmp/git/gulp-watch/node_modules/lodash/package.json

Dependency Hierarchy:

  • xo-0.10.1.tgz (Root Library)
    • babel-eslint-4.1.8.tgz
      • babel-core-5.8.38.tgz
        • lodash-3.10.1.tgz (Vulnerable Library)

Found in HEAD commit: 14c9d9c0e1ba810c3787a5d145cf1f2cf12c312e

Vulnerability Details

lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existing property that will exist on all objects.

Publish Date: 2018-06-07

URL: CVE-2018-3721

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-3721

Release Date: 2018-06-07

Fix Resolution: 4.17.5


Step up your Open Source Security Game with WhiteSource here

WS-2019-0184 (High) detected in lodash.merge-3.3.2.tgz

WS-2019-0184 - High Severity Vulnerability

Vulnerable Library - lodash.merge-3.3.2.tgz

The modern build of lodash’s `_.merge` as a module.

Library home page: https://registry.npmjs.org/lodash.merge/-/lodash.merge-3.3.2.tgz

Path to dependency file: /gulp-watch/package.json

Path to vulnerable library: /tmp/git/gulp-watch/node_modules/lodash.merge/package.json

Dependency Hierarchy:

  • xo-0.10.1.tgz (Root Library)
    • eslint-1.10.3.tgz
      • lodash.merge-3.3.2.tgz (Vulnerable Library)

Found in HEAD commit: 14c9d9c0e1ba810c3787a5d145cf1f2cf12c312e

Vulnerability Details

lodash.merge before 4.6.1 is vulnerable to Prototype Pollution. The function merge() may allow a malicious user to modify the prototype of Object via proto causing the addition or modification of an existing property that will exist on all objects.

Publish Date: 2019-08-14

URL: WS-2019-0184

CVSS 2 Score Details (7.5)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1067

Release Date: 2019-08-14

Fix Resolution: 4.6.1


Step up your Open Source Security Game with WhiteSource here

CVE-2018-1000620 (High) detected in cryptiles-2.0.5.tgz

CVE-2018-1000620 - High Severity Vulnerability

Vulnerable Library - cryptiles-2.0.5.tgz

General purpose crypto utilities

Library home page: https://registry.npmjs.org/cryptiles/-/cryptiles-2.0.5.tgz

Path to dependency file: /gulp-watch/package.json

Path to vulnerable library: /tmp/git/gulp-watch/node_modules/cryptiles/package.json

Dependency Hierarchy:

  • coveralls-2.13.3.tgz (Root Library)
    • request-2.79.0.tgz
      • hawk-3.1.3.tgz
        • cryptiles-2.0.5.tgz (Vulnerable Library)

Found in HEAD commit: 14c9d9c0e1ba810c3787a5d145cf1f2cf12c312e

Vulnerability Details

Eran Hammer cryptiles version 4.1.1 earlier contains a CWE-331: Insufficient Entropy vulnerability in randomDigits() method that can result in An attacker is more likely to be able to brute force something that was supposed to be random.. This attack appear to be exploitable via Depends upon the calling application.. This vulnerability appears to have been fixed in 4.1.2.

Publish Date: 2018-07-09

URL: CVE-2018-1000620

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-1000620

Release Date: 2019-04-08

Fix Resolution: 4.1.2


Step up your Open Source Security Game with WhiteSource here

WS-2019-0185 (High) detected in lodash.merge-3.3.2.tgz

WS-2019-0185 - High Severity Vulnerability

Vulnerable Library - lodash.merge-3.3.2.tgz

The modern build of lodash’s `_.merge` as a module.

Library home page: https://registry.npmjs.org/lodash.merge/-/lodash.merge-3.3.2.tgz

Path to dependency file: /gulp-watch/package.json

Path to vulnerable library: /tmp/git/gulp-watch/node_modules/lodash.merge/package.json

Dependency Hierarchy:

  • xo-0.10.1.tgz (Root Library)
    • eslint-1.10.3.tgz
      • lodash.merge-3.3.2.tgz (Vulnerable Library)

Found in HEAD commit: 14c9d9c0e1ba810c3787a5d145cf1f2cf12c312e

Vulnerability Details

lodash.merge before 4.6.2 is vulnerable to prototype pollution. The function merge() may allow a malicious user to modify the prototype of Object via {constructor: {prototype: {...}}} causing the addition or modification of an existing property that will exist on all objects.

Publish Date: 2019-08-14

URL: WS-2019-0185

CVSS 2 Score Details (7.5)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1066

Release Date: 2019-08-14

Fix Resolution: 4.6.2


Step up your Open Source Security Game with WhiteSource here

test/test-api.js

× 4:1 Unexpected var, use let or const instead. no-var
× 5:1 Unexpected var, use let or const instead. no-var
× 5:13 .. import should occur after import of rimraf import/order
× 6:1 Unexpected var, use let or const instead. no-var
× 6:5 Use object destructuring. prefer-destructuring
× 7:1 Unexpected var, use let or const instead. no-var
× 7:13 ./util/touch import should occur after import of rimraf import/order
× 8:1 Unexpected var, use let or const instead. no-var
× 9:1 Imported module should be assigned import/no-unassigned-import
× 15:17 Unexpected function expression. prefer-arrow-callback
× 16:2 Unexpected var, use let or const instead. no-var
× 18:12 Unexpected function expression. prefer-arrow-callback
× 19:15 Unexpected function expression. prefer-arrow-callback
× 26:34 Unexpected function expression. prefer-arrow-callback
× 27:94 Unexpected function expression. prefer-arrow-callback
× 28:44 Unexpected function expression. prefer-arrow-callback
× 34:94 Unexpected function expression. prefer-arrow-callback
× 35:48 Unexpected function expression. prefer-arrow-callback
× 41:93 Unexpected function expression. prefer-arrow-callback
× 42:50 Unexpected function expression. prefer-arrow-callback
× 43:45 Unexpected function expression. prefer-arrow-callback
× 46:20 Unexpected function expression. prefer-arrow-callback
× 52:93 Unexpected function expression. prefer-arrow-callback
× 53:50 Unexpected function expression. prefer-arrow-callback
× 54:49 Unexpected function expression. prefer-arrow-callback
× 57:20 Unexpected function expression. prefer-arrow-callback
× 64:18 Unexpected function expression. prefer-arrow-callback
× 65:32 Unexpected function expression. prefer-arrow-callback
× 68:17 Unexpected function expression. prefer-arrow-callback
× 75:49 Unexpected function expression. prefer-arrow-callback
× 79:17 Unexpected function expression. prefer-arrow-callback

WS-2019-0063 (High) detected in js-yaml-3.6.1.tgz, js-yaml-3.4.5.tgz

WS-2019-0063 - High Severity Vulnerability

Vulnerable Libraries - js-yaml-3.6.1.tgz, js-yaml-3.4.5.tgz

js-yaml-3.6.1.tgz

YAML 1.2 parser and serializer

Library home page: https://registry.npmjs.org/js-yaml/-/js-yaml-3.6.1.tgz

Path to dependency file: /gulp-watch/package.json

Path to vulnerable library: /tmp/git/gulp-watch/node_modules/js-yaml/package.json

Dependency Hierarchy:

  • coveralls-2.13.3.tgz (Root Library)
    • js-yaml-3.6.1.tgz (Vulnerable Library)
js-yaml-3.4.5.tgz

YAML 1.2 parser and serializer

Library home page: https://registry.npmjs.org/js-yaml/-/js-yaml-3.4.5.tgz

Path to dependency file: /gulp-watch/package.json

Path to vulnerable library: /tmp/git/gulp-watch/node_modules/eslint/node_modules/js-yaml/package.json

Dependency Hierarchy:

  • xo-0.10.1.tgz (Root Library)
    • eslint-1.10.3.tgz
      • js-yaml-3.4.5.tgz (Vulnerable Library)

Found in HEAD commit: 14c9d9c0e1ba810c3787a5d145cf1f2cf12c312e

Vulnerability Details

Js-yaml prior to 3.13.1 are vulnerable to Code Injection. The load() function may execute arbitrary code injected through a malicious YAML file.

Publish Date: 2019-04-30

URL: WS-2019-0063

CVSS 2 Score Details (8.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/813

Release Date: 2019-04-30

Fix Resolution: 3.13.1


Step up your Open Source Security Game with WhiteSource here

CVE-2019-10744 (High) detected in lodash-3.10.1.tgz

CVE-2019-10744 - High Severity Vulnerability

Vulnerable Library - lodash-3.10.1.tgz

The modern build of lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-3.10.1.tgz

Path to dependency file: /gulp-watch/package.json

Path to vulnerable library: /tmp/git/gulp-watch/node_modules/lodash/package.json

Dependency Hierarchy:

  • xo-0.10.1.tgz (Root Library)
    • babel-eslint-4.1.8.tgz
      • babel-core-5.8.38.tgz
        • lodash-3.10.1.tgz (Vulnerable Library)

Found in HEAD commit: 14c9d9c0e1ba810c3787a5d145cf1f2cf12c312e

Vulnerability Details

Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

Publish Date: 2019-07-26

URL: CVE-2019-10744

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: lodash/lodash@a01e4fa

Release Date: 2019-07-08

Fix Resolution: 4.17.12


Step up your Open Source Security Game with WhiteSource here

WS-2019-0019 (Medium) detected in braces-1.8.5.tgz

WS-2019-0019 - Medium Severity Vulnerability

Vulnerable Library - braces-1.8.5.tgz

Fastest brace expansion for node.js, with the most complete support for the Bash 4.3 braces specification.

Library home page: https://registry.npmjs.org/braces/-/braces-1.8.5.tgz

Path to dependency file: /gulp-watch/package.json

Path to vulnerable library: /tmp/git/gulp-watch/node_modules/braces/package.json

Dependency Hierarchy:

  • anymatch-1.3.2.tgz (Root Library)
    • micromatch-2.3.11.tgz
      • braces-1.8.5.tgz (Vulnerable Library)

Found in HEAD commit: 14c9d9c0e1ba810c3787a5d145cf1f2cf12c312e

Vulnerability Details

Version of braces prior to 2.3.1 are vulnerable to Regular Expression Denial of Service (ReDoS). Untrusted input may cause catastrophic backtracking while matching regular expressions. This can cause the application to be unresponsive leading to Denial of Service.

Publish Date: 2019-03-25

URL: WS-2019-0019

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/786

Release Date: 2019-02-21

Fix Resolution: 2.3.1


Step up your Open Source Security Game with WhiteSource here

WS-2017-0247 (Low) detected in ms-0.7.1.tgz

WS-2017-0247 - Low Severity Vulnerability

Vulnerable Library - ms-0.7.1.tgz

Tiny ms conversion utility

Library home page: https://registry.npmjs.org/ms/-/ms-0.7.1.tgz

Path to dependency file: /gulp-watch/package.json

Path to vulnerable library: /tmp/git/gulp-watch/node_modules/mocha/node_modules/ms/package.json

Dependency Hierarchy:

  • mocha-2.5.3.tgz (Root Library)
    • debug-2.2.0.tgz
      • ms-0.7.1.tgz (Vulnerable Library)

Found in HEAD commit: 14c9d9c0e1ba810c3787a5d145cf1f2cf12c312e

Vulnerability Details

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS).

Publish Date: 2017-05-15

URL: WS-2017-0247

CVSS 2 Score Details (3.4)

Base Score Metrics not available

Suggested Fix

Type: Change files

Origin: vercel/ms@305f2dd

Release Date: 2017-04-12

Fix Resolution: Replace or update the following file: index.js


Step up your Open Source Security Game with WhiteSource here

test/test-callback.js

× 3:1 Unexpected var, use let or const instead. no-var
× 3:13 .. import should occur after import of ./util/touch import/order
× 4:1 Unexpected var, use let or const instead. no-var
× 5:1 Unexpected var, use let or const instead. no-var
× 6:1 Unexpected var, use let or const instead. no-var
× 7:1 Unexpected var, use let or const instead. no-var
× 8:1 Imported module should be assigned import/no-unassigned-import
× 14:22 Unexpected function expression. prefer-arrow-callback
× 15:2 Unexpected var, use let or const instead. no-var
× 17:12 Unexpected function expression. prefer-arrow-callback
× 18:15 Unexpected function expression. prefer-arrow-callback
× 25:38 Unexpected function expression. prefer-arrow-callback
× 26:31 Unexpected function expression. prefer-arrow-callback
× 33:45 Unexpected function expression. prefer-arrow-callback
× 34:35 Unexpected function expression. prefer-arrow-callback
× 41:55 Unexpected function expression. prefer-arrow-callback
× 42:34 Unexpected function expression. prefer-arrow-callback
× 45:18 Unexpected function expression. prefer-arrow-callback
× 51:64 Unexpected function expression. prefer-arrow-callback
× 53:38 Unexpected function expression. prefer-arrow-callback
× 54:54 Unexpected function expression. prefer-arrow-callback
× 57:19 Unexpected function expression. prefer-arrow-callback
× 63:64 Unexpected function expression. prefer-arrow-callback
× 65:38 Unexpected function expression. prefer-arrow-callback
× 66:58 Unexpected function expression. prefer-arrow-callback
× 69:19 Unexpected function expression.

CVE-2017-16042 (High) detected in growl-1.9.2.tgz

CVE-2017-16042 - High Severity Vulnerability

Vulnerable Library - growl-1.9.2.tgz

Growl unobtrusive notifications

Library home page: https://registry.npmjs.org/growl/-/growl-1.9.2.tgz

Path to dependency file: /gulp-watch/package.json

Path to vulnerable library: /tmp/git/gulp-watch/node_modules/growl/package.json

Dependency Hierarchy:

  • mocha-2.5.3.tgz (Root Library)
    • growl-1.9.2.tgz (Vulnerable Library)

Found in HEAD commit: 14c9d9c0e1ba810c3787a5d145cf1f2cf12c312e

Vulnerability Details

Growl adds growl notification support to nodejs. Growl before 1.10.2 does not properly sanitize input before passing it to exec, allowing for arbitrary command execution.

Publish Date: 2018-06-04

URL: CVE-2017-16042

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2017-16042

Release Date: 2018-06-04

Fix Resolution: 1.10.2


Step up your Open Source Security Game with WhiteSource here

index.js:2:1

× 2:1 Unexpected var, use let or const instead. no-var
× 3:1 Unexpected var, use let or const instead. no-var
× 3:12 path import should occur before import of object-assign import/order
× 4:1 Unexpected var, use let or const instead. no-var
× 5:1 Unexpected var, use let or const instead. no-var
× 6:1 Unexpected var, use let or const instead. no-var
× 7:1 Unexpected var, use let or const instead. no-var
× 8:1 Unexpected var, use let or const instead. no-var
× 8:5 Use object destructuring. prefer-destructuring
× 9:1 Unexpected var, use let or const instead. no-var
× 10:1 Unexpected var, use let or const instead. no-var
× 11:1 Unexpected var, use let or const instead. no-var
× 12:1 Unexpected var, use let or const instead. no-var
× 13:1 Unexpected var, use let or const instead. no-var
× 14:1 Unexpected var, use let or const instead. no-var
× 33:2 Unexpected var, use let or const instead. no-var
× 48:3 Expected blank line before this statement. padding-line-between-statements
× 52:3 Unexpected var, use let or const instead. no-var
× 61:2 Expected blank line before this statement. padding-line-between-statements
× 63:2 Unexpected var, use let or const instead. no-var
× 64:2 Unexpected var, use let or const instead. no-var
× 66:24 Unexpected named function _write. func-names
× 72:23 Unexpected named function _read. func-names
× 74:2 Unexpected var, use let or const instead. no-var
× 76:22 Unexpected function expression. prefer-arrow-callback
× 81:12 Unexpected function expression. prefer-arrow-callback
× 85:21 Unexpected named function add. func-names
× 89:3 Use the spread operator instead of .apply(). prefer-spread
× 91:2 Expected blank line before this statement. padding-line-between-statements
× 99:3 Unexpected var, use let or const instead. no-var
× 101:3 Unexpected var, use let or const instead. no-var
× 102:3 Unexpected var, use let or const instead. no-var
× 103:140 Empty block statement. no-empty
× 103:166 no-empty-blocks/no-empty-blocks rule is disabled but never reported. eslint-comments/no-unused-disable
× 129:14 Unexpected function expression. prefer-arrow-callback
× 130:40 Unexpected function expression. prefer-arrow-callback
× 154:3 Unexpected var, use let or const instead. no-var

CVE-2018-3728 (High) detected in hoek-2.16.3.tgz

CVE-2018-3728 - High Severity Vulnerability

Vulnerable Library - hoek-2.16.3.tgz

General purpose node utilities

Library home page: https://registry.npmjs.org/hoek/-/hoek-2.16.3.tgz

Path to dependency file: /gulp-watch/package.json

Path to vulnerable library: /tmp/git/gulp-watch/node_modules/hoek/package.json

Dependency Hierarchy:

  • coveralls-2.13.3.tgz (Root Library)
    • request-2.79.0.tgz
      • hawk-3.1.3.tgz
        • hoek-2.16.3.tgz (Vulnerable Library)

Found in HEAD commit: 14c9d9c0e1ba810c3787a5d145cf1f2cf12c312e

Vulnerability Details

hoek node module before 4.2.0 and 5.0.x before 5.0.3 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via 'merge' and 'applyToDefaults' functions, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existing property that will exist on all objects.

Publish Date: 2018-03-30

URL: CVE-2018-3728

CVSS 3 Score Details (8.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-3728

Release Date: 2018-03-30

Fix Resolution: 4.2.1,5.0.3


Step up your Open Source Security Game with WhiteSource here

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.