[email protected] rejected Risk: 43 ISC 2012-12-28

fstream @0.1.21

rejected

This version was rejected. It did not pass GreenFlagged's security review and is not served by the registry. The findings and risk dispositions below explain why.

npm Repository Tarball

Risk Score

ISC

License

Install Scripts

Dependencies

Dev Dependencies

16.9 KB

Package Size

2012-12-28

Published

Advanced file system stream things

Maintainers

isaacs

Dependencies (4)

Package	Constraint	Registry Status
mkdirp	0.3	auto_approved
rimraf	2	auto_approved
inherits	~1.0.0	auto_approved
graceful-fs	~1.1.2	auto_approved

Dev Dependencies (1)

Package	Constraint	Registry Status
tap		auto_approved

Transitive Dependency Tree

14 transitive deps max depth 5

├─ graceful-fs ~1.1.2 → 1.1.14

├─ inherits ~1.0.0 → 1.0.2

├─ mkdirp 0.3 → 0.3.5

├─ rimraf 2 → 2.7.1

├─ glob ^7.1.3 → 7.1.7

├─ fs.realpath ^1.0.0

├─ inflight ^1.0.4

├─ inherits 2 → 2.0.4

├─ minimatch ^3.0.4 → 3.1.5

├─ once ^1.3.0 → 1.4.0

├─ path-is-absolute ^1.0.0 → 1.0.1

├─ brace-expansion ^1.1.7 → 1.1.15

├─ wrappy 1 → 1.0.2

├─ balanced-match ^1.0.0 → 1.0.2

├─ concat-map 0.0.1 → 0.0.1

Risk Dispositions (1 applicable to this version, 0 other)

Accepted rules are downgraded to INFO on future analyses; rejected rules escalate to CRITICAL.

Rule	Source	Disposition	Author	Reason
`osv:GHSA-xf7w-r453-m56c`	osv	reject	AI	AI (osv): HIGH severity arbitrary file overwrite; affected range < 1.0.12 covers this version; fix available in 1.0.12.

SAST Findings (2)

CRITICAL GHSA-xf7w-r453-m56c: Arbitrary File Overwrite in fstream osv

[Always reject] CVSS 7.5 (HIGH) — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Versions of `fstream` prior to 1.0.12 are vulnerable to Arbitrary File Overwrite. Extracting tarballs containing a hardlink to a file that already exists in the system and a file that matches the hardlink will overwrite the system's file with the contents of the extracted file. The `fstream.DirWriter()` function is vulnerable. ## Recommendation Upgrade to version 1.0.12 or later.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Review Summary

Risk score: 43. Findings: 1 critical (+40), 1 low (+3), 1 info (+0).

Published to npm: 2012-12-28