avwo / lack Goto Github PK

? Plugin Name: whistle.gar
? Select template: TypeScript
? Do you need uiServer? No
? Do you need auth function? No
? Do you need sniCallback function? No
? Select rules servers: (Press to select, to toggle all, to inve
rt selection)
? Select stats servers: (Press to select, to toggle all, to inve
rt selection)
? Select pipe servers: (Press to select, to toggle all, to inver
t selection)
? Select rules files: (Press to select, to toggle all, to invert
selection)
🔑  ~/work/whistle.gar  ls -al
total 0
drwxr-xr-x 2 bytedance staff 64 5 6 18:54 .
drwxr-xr-x 10 bytedance staff 320 5 6 18:54 ..

并没有监听bin下面的文件，但是能捕获到改动。

chokidar建议不使用raw，因为raw事件是原生的。估计有bug

用all就没有这个问题

检测到 avwo/lack 一共引入了218个开源组件，存在2个漏洞

漏洞标题：npm path-parse 安全漏洞
缺陷组件：[email protected]
漏洞编号：CVE-2021-23343
漏洞描述：npm path-parse是美国npm公司的一个应用插件。提供一个路径解析功能。
path-parse 存在安全漏洞，该漏洞源于受到通过splitDeviceRe、splitTailRe和splitPathRe正则表达式的正则表达式拒绝服务(ReDoS)的攻击。
影响范围：(∞, 1.0.7)
最小修复版本：1.0.7
缺陷组件引入路径：[email protected]>[email protected]>[email protected]>[email protected]>[email protected]
[email protected]>[email protected]>[email protected]>[email protected]
[email protected]>[email protected]>[email protected]>[email protected]>[email protected]>[email protected]
[email protected]>[email protected]>[email protected]>[email protected]>[email protected]

另外还有2个漏洞，详细报告：https://mofeisec.com/jr?p=a096ca