News for hackers. Stuff that matters.

A comment on Critical vulnerability of NPM package macaddress. Parent comment

Re:Critical vulnerability of NPM package macaddress by bpicolo on Monday June 11, 2018 @09:29AM (#17283980)
> biting a lot of people

In what sense? I doubt there are many apps (if any) out there that actually have a vulnerability here, because it's unlikely that a web app out there is going to be passing random user input to a mac address package.

[ Parent | on HN ]
Re:Critical vulnerability of NPM package macaddress by evan_ on Monday June 11, 2018 @09:49AM (#17284132)
Add to that that cssnano is unlikely to even be present in deployed code, it’s a build tool.
[ Parent | on HN ]
Re:Critical vulnerability of NPM package macaddress by bpicolo on Monday June 11, 2018 @09:52AM (#17284159)
cssnano doesn't even use the package directly, doubt you could find a path where it passes any cssnano calls down to it
[ Parent | on HN ]