The replace npm package offers a command-line utility for efficiently performing search and replace operations within files. Versions 1.1.3 and 1.1.4 share a common foundation, both utilizing chalk for colored output, minimatch for flexible file matching, and yargs for command-line argument parsing, making them capable and user-friendly. Both versions also have tape as a dev dependency that is used for testing. Both versions are licensed under the permissive MIT license and have the same author. Examining the package metadata reveals subtle yet potentially important distinctions. Version 1.1.4, released on January 9, 2020, exhibits a slightly smaller unpacked size of 22622 bytes compared to version 1.1.3's 22644 bytes, released on January 1, 2020. This size difference might indicate minor code optimizations, bug fixes, or alterations in included assets. Both have the same fileCount of 24. Developers considering an upgrade from 1.1.3 to 1.1.4 should investigate the changelog or commit history on the GitHub repository (https://github.com/ALMaclaine/replace.git) to understand the specific changes implemented between releases. While the core functionality remains consistent, understanding these nuanced differences can ensure a smooth and informed update, optimizing performance and stability in their projects. The tarball URLs in the dist object also allow direct access to the packaged source code for both versions.
All the vulnerabilities related to the version 1.1.4 of the package
minimatch ReDoS vulnerability
A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.
yargs-parser Vulnerable to Prototype Pollution
Affected versions of yargs-parser
are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of Object
, causing the addition or modification of an existing property that will exist on all objects.
Parsing the argument --foo.__proto__.bar baz'
adds a bar
property with value baz
to all objects. This is only exploitable if attackers have control over the arguments being passed to yargs-parser
.
Upgrade to versions 13.1.2, 15.0.1, 18.1.1 or later.