How to get rid of the ‘hoek’ vulnerabilities

Question

I recently pushed an Angular CLI 5 application to GitHub and it indicated the following:

We found a potential security vulnerability in one of your dependencies.         


        

Answer 1

I was patient and they fixed the problem:

npm update karma@latest

should work.

Answer 2

You should runrm package-lock.json && npm update && npm install, if this still doesn't fix your issue, you can then continue by running npm ls hoek, which should gave you:

├─┬ fuse-box@3.3.0
│ └─┬ request@2.81.0
│   └─┬ hawk@3.1.3
│     ├─┬ boom@2.10.1
│     │ └── hoek@2.16.3
│     ├── hoek@2.16.3
│     └─┬ sntp@1.0.9
│       └── hoek@2.16.3
└── hoek@5.0.3

Check the version of hawk against the one on npm hawk, if it doesn't tally, run npm i hawk --save or npm i hoek@latest --save, then you should also run: npm i karma@latest --save, then npm audit After which I again ran my normal git commands:

git add .
git commit -m 'whatever_message'
git push 

Then you can go back to Github, the security vulnerability should be fixed.

Answer 3

This answer addresses similar hoek problem, and this answer explains non-vulnerability audit reports in detail.

npm audit reports possible problems. It's unnecessary that they are real problems that should be solved.

A nested dependency like karma > log4js > loggly > request > hawk > boom > hoek may require to fork numerous packages in dependency chain in case it has to be fixed.

Prototype pollution diagnosis indicates code smell. The reason why prototype pollution smells is that it can cause security problems. This is the reason why it's labeled as Moderate. It's unlikely that it causes any security risks in hoek package due to how it works, regardless of how the package is used (that's important as well).

Additionally, karma > log4js > loggly > request > hawk > boom > hoek dependency chain means that the problem occurs in development dependency. Most security problems are primarily applicable to dependencies that are used in production. This problem is specific to tests and Karma. It's virtually impossible it is a threat.

TL;DR: this is not a vulnerability. It has to be ignored. Any npm audit report should pass sanity check before any efforts to fix it will be made.