{"action":"created","issue":{"url":"https://api.github.com/repos/nodesecurity/nsp/issues/67","repository_url":"https://api.github.com/repos/nodesecurity/nsp","labels_url":"https://api.github.com/repos/nodesecurity/nsp/issues/67/labels{/name}","comments_url":"https://api.github.com/repos/nodesecurity/nsp/issues/67/comments","events_url":"https://api.github.com/repos/nodesecurity/nsp/issues/67/events","html_url":"https://github.com/nodesecurity/nsp/issues/67","id":120572747,"number":67,"title":"Packages themselves aren't checked, only dependencies","user":{"login":"pcorey","id":3384035,"avatar_url":"https://avatars.githubusercontent.com/u/3384035?v=3","gravatar_id":"","url":"https://api.github.com/users/pcorey","html_url":"https://github.com/pcorey","followers_url":"https://api.github.com/users/pcorey/followers","following_url":"https://api.github.com/users/pcorey/following{/other_user}","gists_url":"https://api.github.com/users/pcorey/gists{/gist_id}","starred_url":"https://api.github.com/users/pcorey/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pcorey/subscriptions","organizations_url":"https://api.github.com/users/pcorey/orgs","repos_url":"https://api.github.com/users/pcorey/repos","events_url":"https://api.github.com/users/pcorey/events{/privacy}","received_events_url":"https://api.github.com/users/pcorey/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/nodesecurity/nsp/labels/bug","name":"bug","color":"fc2929"}],"state":"closed","locked":false,"assignee":{"login":"nlf","id":424045,"avatar_url":"https://avatars.githubusercontent.com/u/424045?v=3","gravatar_id":"","url":"https://api.github.com/users/nlf","html_url":"https://github.com/nlf","followers_url":"https://api.github.com/users/nlf/followers","following_url":"https://api.github.com/users/nlf/following{/other_user}","gists_url":"https://api.github.com/users/nlf/gists{/gist_id}","starred_url":"https://api.github.com/users/nlf/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nlf/subscriptions","organizations_url":"https://api.github.com/users/nlf/orgs","repos_url":"https://api.github.com/users/nlf/repos","events_url":"https://api.github.com/users/nlf/events{/privacy}","received_events_url":"https://api.github.com/users/nlf/received_events","type":"User","site_admin":false},"milestone":null,"comments":5,"created_at":"2015-12-05T17:11:21Z","updated_at":"2016-02-22T22:03:40Z","closed_at":"2016-01-08T17:08:47Z","body":"When running `nsp check` on a clone of a vulnerable package, only the package's dependencies are checked for vulnerabilities, not the package itself.\r\n\r\nFor example, watch what happens when we check a vulnerable version of `send`:\r\n\r\n~~~\r\ngit clone https://github.com/pillarjs/send.git\r\ncd send/\r\ngit checkout tags/0.1.4\r\nnsp check\r\n~~~\r\n\r\nReturns no vulnerabilities. Ideally, it should return two vulnerabilities found for this version of `send`."},"comment":{"url":"https://api.github.com/repos/nodesecurity/nsp/issues/comments/187407693","html_url":"https://github.com/nodesecurity/nsp/issues/67#issuecomment-187407693","issue_url":"https://api.github.com/repos/nodesecurity/nsp/issues/67","id":187407693,"user":{"login":"nlf","id":424045,"avatar_url":"https://avatars.githubusercontent.com/u/424045?v=3","gravatar_id":"","url":"https://api.github.com/users/nlf","html_url":"https://github.com/nlf","followers_url":"https://api.github.com/users/nlf/followers","following_url":"https://api.github.com/users/nlf/following{/other_user}","gists_url":"https://api.github.com/users/nlf/gists{/gist_id}","starred_url":"https://api.github.com/users/nlf/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nlf/subscriptions","organizations_url":"https://api.github.com/users/nlf/orgs","repos_url":"https://api.github.com/users/nlf/repos","events_url":"https://api.github.com/users/nlf/events{/privacy}","received_events_url":"https://api.github.com/users/nlf/received_events","type":"User","site_admin":false},"created_at":"2016-02-22T22:03:40Z","updated_at":"2016-02-22T22:03:40Z","body":"the fix was in the API rather than the client, so a new release shouldn't be necessary. let me know if you're still seeing issues though"}}