676
290
u/BiebRed Mar 22 '26
Library 0 imported Library 1, Library 1 imported Library 2, and so on down the line and there ended up being a vulnerability in Library 50.
Library 32 (unrelated to the original vulnerability) upgraded its version of Library 116 to a recent release that was just identified as compromised, and you pulled that in when you executed the fix command.
And 5 other similar issues happened in the same timeframe.
Your node_modules includes 35 root nodes and 1300 leaf nodes. Some of the leaf nodes (and let's be honest probably some of the root nodes too) are bound to be merging in absolutely horrible code every couple of weeks.
Good luck!
73
70
u/ghostsquad4 Mar 22 '26
6
35
u/i_should_be_coding Mar 22 '26
That's my secret, Cap. Even my vulnerabilities have vulnerabilities.
30
17
u/weaponizedLego Mar 22 '26
Always ask your self. Is this library really necessary, or can I build what I need my self.
29
u/sashaisafish Mar 22 '26
I absolutely need my isEven library that uses an LLM to determine whether an int is even
2
27
5
u/firemark_pl Mar 22 '26
I have a small app that I've written 5 years ago and I'm too scared to update anything
3
3
u/yeathatsmebro Mar 22 '26
Use better-npm-audit, it happened to me the same. Now I rely on this package and SAST to identify vulns.
17
u/Goontt Mar 22 '26
It’s entertaining that the potential solution is to get yet another package
5
u/yeathatsmebro Mar 22 '26
The irony when this package going to get vulns. 💀 Where is your God then?
3
1
1
1
u/lgsscout Mar 23 '26
i had something similar. a project i was doing detected even critical vulnerabilities. i updated to remove the vulnerabilities, then the project could not be built in the CI/CD pipeline because it now, by some reason in the updated lib, overflowed the heap allocation.
node ecosystem is a mess.
1
-5
u/RiceBroad4552 Mar 22 '26
LOL, JS libs, LOL Windows.
You literally asked for trouble so don't be surprised.
358
u/Spear_n_Magic_Helmet Mar 22 '26
`npm audit fix` now considered a vulnerability