All nconf versions

[email protected] rejected Risk: 43 MIT

nconf @0.6.9

rejected
This version was rejected. It did not pass GreenFlagged's security review and is not served by the registry. The findings and risk dispositions below explain why.
npm Repository Tarball
43
Risk Score
MIT
License
No
Install Scripts
3
Dependencies
1
Dev Dependencies
34.5 KB
Package Size
Published

Hierarchical node.js configuration with files, environment variables, command-line arguments, and atomic object merging.

Maintainers

indexzerommaleckijcrugzz

Keywords

configurationkey value storeplugabble

Dependencies (3)

PackageConstraintRegistry Status
ini 1.x.x auto_approved
async 0.2.9 auto_approved
optimist 0.6.0 auto_approved

Dev Dependencies (1)

PackageConstraintRegistry Status
vows 0.7.x auto_approved

Transitive Dependency Tree

5 transitive deps max depth 2
  ├─ async 0.2.9 → 0.2.9
  ├─ ini 1.x.x → 1.3.8
├─ optimist 0.6.0 → 0.6.0
  ├─ minimist ~0.0.1
  ├─ wordwrap ~0.0.2 → 0.0.2

Risk Dispositions (1 applicable to this version, 0 other)

Accepted rules are downgraded to INFO on future analyses; rejected rules escalate to CRITICAL.

Rule Source Disposition Author Reason
osv:GHSA-6xwr-q98w-rvg7 osv reject AI AI (osv): Prototype Pollution vulnerability affects all nconf versions < 0.11.4; fix is available. This advisory generalizes to every version in the affected range, including 0.6.1.

SAST Findings (2)

CRITICAL GHSA-6xwr-q98w-rvg7: Prototype Pollution in nconf osv

[Always reject] CVSS 7.3 (HIGH) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L nconf before 0.11.4. When using the memory engine, it is possible to store a nested JSON representation of the configuration. The .set() function, that is responsible for setting the configuration properties, is vulnerable to Prototype Pollution. By providing a crafted property, it is possible to modify the properties on the Object.prototype.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Review Summary

Risk score: 43. Findings: 1 critical (+40), 1 low (+3), 2 info (+0).

Published to npm: