ShellJS version 0.8.4 introduces a subtle but important update compared to its predecessor, version 0.8.3, for developers leveraging portable Unix shell commands within Node.js environments. While the core dependencies on packages like glob, rechoir, and interpret remain consistent between both versions, indicating a stable foundation for core functionality, the key distinction lies in the release date and the unpacked size of the distribution. Version 0.8.4 was released on April 25, 2020, a significant time jump from version 0.8.3 released in November 2018. Although the file count remains at 42, the unpacked size has increased from 211205 bytes to 211220 bytes, which may hint at internal improvements, bug fixes, or minor feature enhancements aimed at improving performance or stability. Developers should investigate the changelog or release notes, if available, to understand the specific changes introduced. For developers already using ShellJS, consider upgrading to 0.8.4 to benefit from potential optimizations. For new adopters, ShellJS provides a powerful way to execute common shell commands from within JavaScript, ideal for automating tasks, building command-line tools, and scripting build processes. The continued use of testing frameworks and utilities within the devDependencies (like ava,nyc,eslint) emphasizes the package's commitment to quality and reliability.
All the vulnerabilities related to the version 0.8.4 of the package
Improper Privilege Management in shelljs
shelljs is vulnerable to Improper Privilege Management
Improper Privilege Management in shelljs
Output from the synchronous version of shell.exec() may be visible to other users on the same system. You may be affected if you execute shell.exec() in multi-user Mac, Linux, or WSL environments, or if you execute shell.exec() as the root user.
Other shelljs functions (including the asynchronous version of shell.exec()) are not impacted.
Patched in shelljs 0.8.5
Recommended action is to upgrade to 0.8.5.
https://huntr.dev/bounties/50996581-c08e-4eed-a90e-c0bac082679c/
If you have any questions or comments about this advisory:
