Vulnerabilities

DepShield reports that this application's usage of growl:1.9.2 results in the following vulnerability(s):

• (CVSS 8.8) CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
• (CVSS 8.8) CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Occurrences

growl:1.9.2 is a transitive dependency introduced by the following direct dependency(s):

• mocha:3.5.3
        └─ growl:1.9.2

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

In lib/proto_function.js (as compiled in the published npm module), the following use of eval is dangerous:

function makeFunction(arg1, arg2, funcBody) {
    var name = this, count = arguments.length - 1, funcBody = arguments[count], func, code = '';
    for (var i = 0; i < count; i++)
        code += ', ' + arguments[i];
    code = [
        'func = function ',
        name,
        '(',
        code.slice(2),
        ') {\n',
        funcBody,
        '\n}'
    ].join('');
    eval(code);
    return func;
}

As opposed to new Function(), your code do not validate the arguments. Please validate the argument names and the function name by using some regular expression or some more heavy-weighted sanitization like:
https://www.npmjs.com/package/eval-sanitizer

A similar case is createSubclass method in lib/proto_prototype.js.

Vulnerabilities

DepShield reports that this application's usage of acorn:5.7.4 results in the following vulnerability(s):

• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

Occurrences

acorn:5.7.4 is a transitive dependency introduced by the following direct dependency(s):

• browserify:14.5.0
        └─ module-deps:4.1.1
              └─ detective:4.7.1
                    └─ acorn:5.7.4

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of debug:2.6.8 results in the following vulnerability(s):

• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')
• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

Occurrences

debug:2.6.8 is a transitive dependency introduced by the following direct dependency(s):

• mocha:3.5.3
        └─ debug:2.6.8

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Depshield will be deprecated on Monday December 12th

Please install our new product, Sonatype Lift with advanced features

Please enable master protection

Vulnerabilities

DepShield reports that this application's usage of lodash.isarray:3.0.4 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)

Occurrences

lodash.isarray:3.0.4 is a transitive dependency introduced by the following direct dependency(s):

• mocha:3.5.3
        └─ lodash.create:3.1.1
              └─ lodash._baseassign:3.2.0
                    └─ lodash.keys:3.1.2
                          └─ lodash.isarray:3.0.4

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of lodash._baseassign:3.2.0 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)

Occurrences

lodash._baseassign:3.2.0 is a transitive dependency introduced by the following direct dependency(s):

• mocha:3.5.3
        └─ lodash.create:3.1.1
              └─ lodash._baseassign:3.2.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of lodash.isarguments:3.1.0 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)

Occurrences

lodash.isarguments:3.1.0 is a transitive dependency introduced by the following direct dependency(s):

• mocha:3.5.3
        └─ lodash.create:3.1.1
              └─ lodash._baseassign:3.2.0
                    └─ lodash.keys:3.1.2
                          └─ lodash.isarguments:3.1.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of debug:2.6.9 results in the following vulnerability(s):

• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

Occurrences

debug:2.6.9 is a transitive dependency introduced by the following direct dependency(s):

• grunt-browserify:5.3.0
        └─ watchify:3.11.1
              └─ anymatch:2.0.0
                    └─ micromatch:3.1.10
                          └─ extglob:2.0.4
                                └─ expand-brackets:2.1.4
                                      └─ debug:2.6.9
                          └─ snapdragon:0.8.2
                                └─ debug:2.6.9

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of lodash._basecreate:3.0.3 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)

Occurrences

lodash._basecreate:3.0.3 is a transitive dependency introduced by the following direct dependency(s):

• mocha:3.5.3
        └─ lodash.create:3.1.1
              └─ lodash._basecreate:3.0.3

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of lodash.create:3.1.1 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)

Occurrences

lodash.create:3.1.1 is a transitive dependency introduced by the following direct dependency(s):

• mocha:3.5.3
        └─ lodash.create:3.1.1

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Please use semantic commit names

Vulnerabilities

DepShield reports that this application's usage of lodash.keys:3.1.2 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)

Occurrences

lodash.keys:3.1.2 is a transitive dependency introduced by the following direct dependency(s):

• mocha:3.5.3
        └─ lodash.create:3.1.1
              └─ lodash._baseassign:3.2.0
                    └─ lodash.keys:3.1.2

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of lodash._getnative:3.9.1 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)

Occurrences

lodash._getnative:3.9.1 is a transitive dependency introduced by the following direct dependency(s):

• mocha:3.5.3
        └─ lodash.create:3.1.1
              └─ lodash._baseassign:3.2.0
                    └─ lodash.keys:3.1.2
                          └─ lodash._getnative:3.9.1

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of kind-of:4.0.0 results in the following vulnerability(s):

• (CVSS 5.3) CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Occurrences

kind-of:4.0.0 is a transitive dependency introduced by the following direct dependency(s):

• grunt-browserify:5.3.0
        └─ watchify:3.11.1
              └─ anymatch:2.0.0
                    └─ micromatch:3.1.10
                          └─ snapdragon:0.8.2
                                └─ base:0.11.2
                                      └─ cache-base:1.0.1
                                            └─ has-value:1.0.0
                                                  └─ has-values:1.0.0
                                                        └─ kind-of:4.0.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of lodash._basecopy:3.0.1 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)

Occurrences

lodash._basecopy:3.0.1 is a transitive dependency introduced by the following direct dependency(s):

• mocha:3.5.3
        └─ lodash.create:3.1.1
              └─ lodash._baseassign:3.2.0
                    └─ lodash._basecopy:3.0.1

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of lodash._isiterateecall:3.0.9 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)

Occurrences

lodash._isiterateecall:3.0.9 is a transitive dependency introduced by the following direct dependency(s):

• mocha:3.5.3
        └─ lodash.create:3.1.1
              └─ lodash._isiterateecall:3.0.9

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of lodash.memoize:3.0.4 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)

Occurrences

lodash.memoize:3.0.4 is a transitive dependency introduced by the following direct dependency(s):

• browserify:14.5.0
        └─ browser-pack:6.1.0
              └─ combine-source-map:0.8.0
                    └─ lodash.memoize:3.0.4

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of kind-of:3.2.2 results in the following vulnerability(s):

• (CVSS 5.3) CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Occurrences

kind-of:3.2.2 is a transitive dependency introduced by the following direct dependency(s):

• grunt-browserify:5.3.0
        └─ watchify:3.11.1
              └─ anymatch:2.0.0
                    └─ micromatch:3.1.10
                          └─ snapdragon:0.8.2
                                └─ base:0.11.2
                                      └─ cache-base:1.0.1
                                            └─ to-object-path:0.3.0
                                                  └─ kind-of:3.2.2
                                      └─ class-utils:0.3.6
                                            └─ static-extend:0.1.2
                                                  └─ object-copy:0.1.0
                                                        └─ kind-of:3.2.2
                                └─ define-property:0.2.5
                                      └─ is-descriptor:0.1.6
                                            └─ is-accessor-descriptor:0.1.6
                                                  └─ kind-of:3.2.2
                                            └─ is-data-descriptor:0.1.4
                                                  └─ kind-of:3.2.2
              └─ chokidar:2.1.8
                    └─ braces:2.3.2
                          └─ fill-range:4.0.0
                                └─ is-number:3.0.0
                                      └─ kind-of:3.2.2
                          └─ snapdragon-node:2.1.1
                                └─ snapdragon-util:3.0.1
                                      └─ kind-of:3.2.2

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Please ask for PR reviews

Vulnerabilities

DepShield reports that this application's usage of mocha:3.5.3 results in the following vulnerability(s):

• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of kind-of:5.1.0 results in the following vulnerability(s):

• (CVSS 5.3) CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Occurrences

kind-of:5.1.0 is a transitive dependency introduced by the following direct dependency(s):

• grunt-browserify:5.3.0
        └─ watchify:3.11.1
              └─ anymatch:2.0.0
                    └─ micromatch:3.1.10
                          └─ snapdragon:0.8.2
                                └─ define-property:0.2.5
                                      └─ is-descriptor:0.1.6
                                            └─ kind-of:5.1.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of minimist:0.0.8 results in the following vulnerability(s):

• (CVSS 8.8) CWE-94: Improper Control of Generation of Code ('Code Injection')

Occurrences

minimist:0.0.8 is a transitive dependency introduced by the following direct dependency(s):

• mocha:3.5.3
        └─ mkdirp:0.5.1
              └─ minimist:0.0.8

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}