Issue with executing arbitrary code found in the underscore npm package

https://i.stack.imgur.com/VpE13.png

Upon running npm install, a total of 1596 vulnerabilities were detected (comprising of 20 low-risk, 51 moderate, and 1525 high-risk vulnerabilities). The suggested course of action is to execute npm audit fix to address the issues immediately. Alternatively, you can run npm audit for a detailed report.

Executing npm audit produces a summary list as shown below:

┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High          │ Arbitrary Code Execution                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ underscore                                                   │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=1.12.1                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ @alch/alchemy-web3                                           │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ @alch/alchemy-web3 > web3 > web3-shh > web3-net >            │
│               │ web3-core-method > underscore                                │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1674                            │
└───────────────┴──────────────────────────────────────────────────────────────┘

(Additional entries omitted for brevity)

Answer №1

Alchemy recently addressed an issue where their @alch/alchemy-web3 package dependency was not updated to utilize the patched version of "Underscore".

After a prompt upgrade, the issue has been resolved as of 7 hours ago with version "^1.0,3" available on @alch/alchemy-web3;

To implement the fix, please execute npm update @alch/alchemy-web3

Similar questions

If you have not found the answer to your question or you are interested in this topic, then look at other similar questions below or use the search

Tips for generating offline installer packages for node applications:

Is it feasible to install a package globally (such as ExpressJS) and then simply use a copy of it from the global installation when needed for a specific folder or project, instead of downloading it again from the internet each time? I came across a sugge ...

Having trouble installing npm packages after adding the private `.npmrc` file to Azure

Having some trouble installing npm packages due to a .npmrc file set up for a private library hosted on Azure workspace. After creating a new config file, everything works smoothly in localhost. How can I include two registries in the .npmrc file, one for ...

Avoid combining all CSS files into one app.css file; instead, include specific files manually as required

In my Elixir/Phoenix application, I utilize brunch and npm for handling CSS files. Rather than compiling all CSS files into app.css, I am interested in selectively compiling only some of them and manually including the ones that are not compiled on speci ...

Coverage testing is not embracing all aspects

Currently, I am tackling an Angular 2 project and in the process of writing test cases for the services. It's odd that previously everything was working flawlessly, but now I'm encountering some "no provider" errors such as (No provider for AppSe ...

Is it possible to import a package from a monorepo located in a different repository?

Currently, I have successfully set up a create-react-app and a storybook packages in a lerna monorepo. My goal now is to utilize the components created within the storybook package in an entirely fresh repository. I attempted using npm install git://githu ...

NodeJs took an unexpected turn

I’m encountering an issue with an http request to forecast.io. When I make a normal request using $.ajax, everything works fine. However, when I try using the ajax-request module, I receive the following output: SyntaxError: Unexpected token u in JSON at ...

Issue encountered while generating a package using npm init in Node.js

I am currently in the learning process of NodeJs from tutorialspoint(TP). Following instructions provided in this link, I tried to create a package by running the following command: C:\Program Files (x86)\nodejs>npm init This utility will w ...

Error: internalBinding function is not recognized

Encountering a problem in ASP.NET Zero 5.x where npm run create-bundles fails to execute. Currently working on an existing licensed project using the ASP.NET Zero's ASP.NET Core MVC + jQuery base solution, built on the ASP.NET Boilerplate framework. ...

Leveraging the SNAPSHOT feature in a personal NPM repository, resembling the functionality

I currently have a basic setup that is working smoothly: Library A Library B publishing 1.0.0-SNAPSHOT -> Private Repository -> npm install Note that A and B are located on separate machines (imagine ...

Yeoman encountered an unhandled template rendering error while trying to generate an Angular app

I encountered an error while trying to utilize yeoman for creating an angular app structure. yo-->Angular Bootstrap-->more options--> An error occurred: Possibly unhandled Template render error: (unknown path) [Line 3, Column 90] expected var ...

Upgrade to the most recent version of Polymer and npm

It seems like this question is more related to npm rather than Polymer. I have been working on a substantial Polymer project, currently at version 1.3.0 as indicated in the bower.json file within the Polymer directory. After being away from the project fo ...

Leveraging environment variables within package.json

Working on an older application, I've encountered a challenge where the API endpoint URL varies depending on the system. Currently, my package.json file looks like this: "start": "cross-env API_ENDPOINT=http://localhost:5000/api/v1 react-scripts sta ...

Node is currently posing a challenge for the installation of packages

I am currently facing an issue while setting up my raspberry pi 3. I am attempting to install and execute a node code, but I encountered a problem during the installation of packages using npm. After trying multiple times with different versions of node ( ...

Strategies for Handling Various Versions of npm Modules within a Project when Multiple Packages Depend on Specific Versions Internally

I find myself in a predicament with my main React project using version "1.5.1" of "@material-ui/core", while attempting to build a new component that requires version "3.2.1" of "#@rjsf/material-ui" which internally relies on the latest version of "@mater ...

Error encountered while running npm on Windows 7

I am assisting someone with running npm on a Windows 7 system. After executing npm update, an error (ENOENT, scandir) is returned even though the folder that npm couldn't find has been confirmed to exist. The user running npm also has full permissions ...

Gulp encountered an issue - TypeError: When attempting to call the 'match' method, it was found to be undefined

Currently, I'm attempting to utilize Gulp alongside BrowserSync for a website that is being hosted on MAMP and proxied through localhost:8888. Unfortunately, upon running gulp, I encounter the following error: [17:38:48] Starting 'browser-sync& ...

Package name "@nx-cloud" is invalid as it does not meet the requirements for Nx 16

Whenever I attempt to install a package in my project, I encounter the following error message: Invalid package name "@nx-cloud" of package "@[email protected]": name can only contain URL-friendly characters. Could this issue be ...

TurboRepo initiates the web server and promptly closes down without any issues

I have a turbo-repo set up using pnpm, and I am attempting to launch the React frontend for one of my clients with the following command: npx turbo run start --filter=testclient When executing this command, the output is as follows: • Packages in scope: ...

Combining Typescript files with identical namespaces into a single file using Webpack 2

Recently, I've started using Webpack and bundling typescript files into a single file. Below is the setup I have where I aim to create a single JS file with all my typescript bundled together. tsconfig.json: { "compilerOptions": { "allowSynthe ...

Tips for resolving issues with pipelines in GitHub Actions

I have minimal experience with creating pipelines in GitHub Actions, but I was tasked with setting up a pipeline for a pull request. Here is what I came up with: # This is a simple workflow to help you get started with Actions name: pipeline_action_on_pull ...