Security vulnerability of a dependency (macaddress)

[Legend96th]

Version

4.2.2

Test Case

Steps to reproduce

Simply by installing the package

Expected Behavior

Actual Behavior

While installing the react-router-dom I had the following error message:

+ react-router-dom@4.2.2
added 205 packages from 159 contributors, removed 157 packages and updated 1071 packages in 116.886s
[!] 1 vulnerability found [14452 packages audited]
    Severity: 1 critical
    Run `npm audit` for more detail

The result of npm audit

 === npm audit security report ===                        
                                                                                



┌──────────────────────────────────────────────────────────────────────────────┐
│                                Manual Review                                 │
│            Some vulnerabilities require your attention to resolve            │
│                                                                              │
│         Visit https://go.npm.me/audit-guide for additional guidance          │
└──────────────────────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ critical      │ Command Injection                                            │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ macaddress                                                   │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ react-scripts                                                │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ react-scripts > css-loader > cssnano >                       │
│               │ postcss-filter-plugins > uniqid > macaddress                 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/654                       │
└───────────────┴──────────────────────────────────────────────────────────────┘

[!] 1 vulnerability found - Packages audited: 14452 (0 dev, 335 optional)
    Severity: 1 critical

As the audit report said, more info in https://nodesecurity.io/advisories/654

[timdorr]

We don't depend on react-scripts. That's coming from some other dependency.

[rwschmitz]

@Legend96th -- Take a look at the following two links. Those may help.

• Running "npx create-react-app my-app" fails caused by found vulnerability facebook/create-react-app#4487
• Arbitrary Command Injection scravy/node-macaddress#19

[rwschmitz]

@Legend96th -- Also looks like Dan Abramov addressed this:

• Vulnerable Dependency: macaddress facebook/create-react-app#4479 (comment)

[Legend96th]

Thank you guys for the clarification!
(sorry for the late answer)