when run
npm fund git:google-login*
my-website
├── https://tidelift.com/funding/github/npm/autoprefixer
│ └── [email protected]
├── https://opencollective.com/postcss/
│ └── [email protected], [email protected], [email protected], [email protected]
├── https://github.com/sponsors/ljharb
│ └── [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected]
├── https://github.com/sponsors/RubenVerborgh
│ └── [email protected]
├─┬ https://github.com/chalk/chalk?sponsor=1
│ │ └── [email protected]
│ └── https://github.com/chalk/ansi-styles?sponsor=1
│ └── [email protected]
├─┬ https://paulmillr.com/funding/
│ │ └── [email protected]
│ └── https://github.com/sponsors/jonschlinkert
│ └── [email protected]
├── https://opencollective.com/ua-parser-js
│ └── [email protected]
├── https://github.com/chalk/wrap-ansi?sponsor=1
│ └── [email protected]
├── https://github.com/sponsors/sindresorhus
│ └── [email protected], [email protected]
└── https://github.com/sponsors/feross
└── [email protected], [email protected]
and when run
npm audit fix git:google-login*
up to date, audited 576 packages in 1s
35 packages are looking for funding
run `npm fund` for details
# npm audit report
lodash <=4.17.20
Severity: critical
Regular Expression Denial of Service (ReDoS) in lodash - https://github.com/advisories/GHSA-x5rq-j2xg-h7qm
Prototype Pollution in lodash - https://github.com/advisories/GHSA-4xc9-xhrj-v574
Prototype Pollution in lodash - https://github.com/advisories/GHSA-fvqr-27wr-82fm
Regular Expression Denial of Service (ReDoS) in lodash - https://github.com/advisories/GHSA-29mw-wpgm-hmr9
Prototype Pollution in lodash - https://github.com/advisories/GHSA-jf85-cpcp-j695
Command Injection in lodash - https://github.com/advisories/GHSA-35jh-r3h4-6jhm
Prototype Pollution in lodash - https://github.com/advisories/GHSA-p6mc-m468-83gw
fix available via `npm audit fix`
node_modules/globule/node_modules/lodash
globule <=1.1.0
Depends on vulnerable versions of glob
Depends on vulnerable versions of lodash
Depends on vulnerable versions of minimatch
node_modules/globule
gaze 0.4.0 - 1.0.0
Depends on vulnerable versions of globule
node_modules/gaze
glob-watcher <=2.0.0
Depends on vulnerable versions of gaze
node_modules/glob-watcher
lodash.template <4.5.0
Severity: critical
Prototype Pollution in lodash - https://github.com/advisories/GHSA-jf85-cpcp-j695
fix available via `npm audit fix --force`
Will install [email protected], which is a breaking change
node_modules/lodash.template
gulp-util >=1.1.0
Depends on vulnerable versions of lodash.template
node_modules/gulp-util
gulp 2.6.1 - 3.9.1
Depends on vulnerable versions of gulp-util
Depends on vulnerable versions of vinyl-fs
node_modules/gulp
minimatch <=3.0.4
Severity: high
Regular Expression Denial of Service in minimatch - https://github.com/advisories/GHSA-hxm2-r34f-qmc5
minimatch ReDoS vulnerability - https://github.com/advisories/GHSA-f8q6-p94x-37v3
fix available via `npm audit fix --force`
Will install [email protected], which is a breaking change
node_modules/glob-stream/node_modules/minimatch
node_modules/glob/node_modules/minimatch
node_modules/globule/node_modules/minimatch
glob 3.0.0 - 5.0.14
Depends on vulnerable versions of minimatch
node_modules/glob
node_modules/globule/node_modules/glob
glob-stream 0.2.0 - 5.2.0
Depends on vulnerable versions of glob
Depends on vulnerable versions of minimatch
node_modules/glob-stream
vinyl-fs <=1.0.0
Depends on vulnerable versions of glob-stream
Depends on vulnerable versions of glob-watcher
node_modules/vinyl-fs
11 vulnerabilities (7 high, 4 critical)
To address issues that do not require attention, run:
npm audit fix
To address all issues (including breaking changes), run:
npm audit fix --force