3 ms·
A large number of packages may be using it but the actual danger posed is very much dependent on the application using the library. That's a little hard to asse
by sumanthvepa 6y ago
A large number of packages may be using it but the actual danger posed is very much dependent on the application using the library. That's a little hard to assess.
- stefan_ 6y agoThis is nodes contribution to the world - now every npm package bug is hyped as a security issue instead of, well, this IP input field doesn't handle octal IPs correctly. Bonus points for security scanners that diagnose grave vulnerabilities in frontend bundles but the backend is some Python/Ruby/guaranteed-no-npm API.
- Vinnl 6y agoThe same would hold true if it was a single function part of a big single-package framework though.