All ip versions

[email protected] rejected Risk: 43 MIT

ip @1.1.4

rejected
This version was rejected. It did not pass GreenFlagged's security review and is not served by the registry. The findings and risk dispositions below explain why.
npm Repository Homepage Tarball
43
Risk Score
MIT
License
No
Install Scripts
0
Dependencies
3
Dev Dependencies
9.7 KB
Package Size
Published

[![](https://badge.fury.io/js/ip.svg)](https://www.npmjs.com/package/ip)

Maintainers

bcbaileyfedor.indutnyindexzeroindutnymmalecki

Dev Dependencies (3)

PackageConstraintRegistry Status
jscs ^2.1.1 auto_approved
mocha ~1.3.2 auto_approved
jshint ^2.8.0 auto_approved

Changes from v0.3.3

Dependency Changes

Script Changes

+ fix

File Changes

3 added 0 removed 4 modified size delta: +10.9 KB

Risk Dispositions (1 applicable to this version, 0 other)

Accepted rules are downgraded to INFO on future analyses; rejected rules escalate to CRITICAL.

Rule Source Disposition Author Reason
osv:GHSA-2p57-rm9w-gvfp osv reject AI AI (osv): HIGH severity SSRF vulnerability with no fix available; affected range covers all versions <= 2.0.1, generalizes to every published version of this package until a patched release appears.

SAST Findings (3)

CRITICAL GHSA-2p57-rm9w-gvfp: ip SSRF improper categorization in isPublic osv

[Always reject] CVSS 8.1 (HIGH) — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses (such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, and ::fFFf:127.0.0.1) are improperly categorized as globally routable via isPublic. NOTE: this issue exists because of an incomplete fix for CVE-2023-42282.

LOW GHSA-78xj-cgh5-2h22: NPM IP package incorrectly identifies some private IP addresses as public osv

The `isPublic()` function in the NPM package `ip` doesn't correctly identify certain private IP addresses in uncommon formats such as `0x7F.1` as private. Instead, it reports them as public by returning `true`. This can lead to security issues such as Server-Side Request Forgery (SSRF) if `isPublic()` is used to protect sensitive code paths when passed user input. Versions 1.1.9 and 2.0.1 fix the issue.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Review Summary

Risk score: 43. Findings: 1 critical (+40), 1 low (+3), 1 info (+0).

Commit: d413771ed749 Browse source

Published to npm: