{"action":"created","issue":{"url":"https://api.github.com/repos/yarnpkg/yarn/issues/5808","repository_url":"https://api.github.com/repos/yarnpkg/yarn","labels_url":"https://api.github.com/repos/yarnpkg/yarn/issues/5808/labels{/name}","comments_url":"https://api.github.com/repos/yarnpkg/yarn/issues/5808/comments","events_url":"https://api.github.com/repos/yarnpkg/yarn/issues/5808/events","html_url":"https://github.com/yarnpkg/yarn/issues/5808","id":322265433,"node_id":"MDU6SXNzdWUzMjIyNjU0MzM=","number":5808,"title":"[feat] yarn audit","user":{"login":"rally25rs","id":38535,"node_id":"MDQ6VXNlcjM4NTM1","avatar_url":"https://avatars3.githubusercontent.com/u/38535?v=4","gravatar_id":"","url":"https://api.github.com/users/rally25rs","html_url":"https://github.com/rally25rs","followers_url":"https://api.github.com/users/rally25rs/followers","following_url":"https://api.github.com/users/rally25rs/following{/other_user}","gists_url":"https://api.github.com/users/rally25rs/gists{/gist_id}","starred_url":"https://api.github.com/users/rally25rs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rally25rs/subscriptions","organizations_url":"https://api.github.com/users/rally25rs/orgs","repos_url":"https://api.github.com/users/rally25rs/repos","events_url":"https://api.github.com/users/rally25rs/events{/privacy}","received_events_url":"https://api.github.com/users/rally25rs/received_events","type":"User","site_admin":false},"labels":[{"id":446993282,"node_id":"MDU6TGFiZWw0NDY5OTMyODI=","url":"https://api.github.com/repos/yarnpkg/yarn/labels/cat-compatibility","name":"cat-compatibility","color":"77543b","default":false},{"id":313603439,"node_id":"MDU6TGFiZWwzMTM2MDM0Mzk=","url":"https://api.github.com/repos/yarnpkg/yarn/labels/cat-feature","name":"cat-feature","color":"84b6eb","default":false},{"id":594039992,"node_id":"MDU6TGFiZWw1OTQwMzk5OTI=","url":"https://api.github.com/repos/yarnpkg/yarn/labels/high-priority","name":"high-priority","color":"5b1616","default":false}],"state":"open","locked":false,"assignee":{"login":"rally25rs","id":38535,"node_id":"MDQ6VXNlcjM4NTM1","avatar_url":"https://avatars3.githubusercontent.com/u/38535?v=4","gravatar_id":"","url":"https://api.github.com/users/rally25rs","html_url":"https://github.com/rally25rs","followers_url":"https://api.github.com/users/rally25rs/followers","following_url":"https://api.github.com/users/rally25rs/following{/other_user}","gists_url":"https://api.github.com/users/rally25rs/gists{/gist_id}","starred_url":"https://api.github.com/users/rally25rs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rally25rs/subscriptions","organizations_url":"https://api.github.com/users/rally25rs/orgs","repos_url":"https://api.github.com/users/rally25rs/repos","events_url":"https://api.github.com/users/rally25rs/events{/privacy}","received_events_url":"https://api.github.com/users/rally25rs/received_events","type":"User","site_admin":false},"assignees":[{"login":"rally25rs","id":38535,"node_id":"MDQ6VXNlcjM4NTM1","avatar_url":"https://avatars3.githubusercontent.com/u/38535?v=4","gravatar_id":"","url":"https://api.github.com/users/rally25rs","html_url":"https://github.com/rally25rs","followers_url":"https://api.github.com/users/rally25rs/followers","following_url":"https://api.github.com/users/rally25rs/following{/other_user}","gists_url":"https://api.github.com/users/rally25rs/gists{/gist_id}","starred_url":"https://api.github.com/users/rally25rs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rally25rs/subscriptions","organizations_url":"https://api.github.com/users/rally25rs/orgs","repos_url":"https://api.github.com/users/rally25rs/repos","events_url":"https://api.github.com/users/rally25rs/events{/privacy}","received_events_url":"https://api.github.com/users/rally25rs/received_events","type":"User","site_admin":false}],"milestone":null,"comments":38,"created_at":"2018-05-11T11:35:56Z","updated_at":"2018-09-12T20:32:58Z","closed_at":null,"author_association":"CONTRIBUTOR","body":"<!-- *Before creating an issue please make sure you are using the latest version of yarn.* -->\r\n\r\n**Do you want to request a *feature* or report a *bug*?**\r\n\r\nfeature\r\n\r\n**What is the current behavior?**\r\n\r\nnpm added `audit` to warn about packages with known security issues. There was some conversation about this previously and one of the core npm folks said the API was likely to be open/public to pull this info. Therefore, yarn should be able to add this feature.\r\n\r\n**What is the expected behavior?**\r\n\r\n* Add a `yarn audit` command that mimics `npm audit`\r\n* Add warnings when adding/installing packages with known issues.\r\n\r\n**Please mention your node.js, yarn and operating system version.**\r\n\r\nThis would be a minor version bump, so likely target yarn v1.7.0 or v1.8.0 depending on timing.\r\nThis is probably too important to wait for v2.0."},"comment":{"url":"https://api.github.com/repos/yarnpkg/yarn/issues/comments/420787503","html_url":"https://github.com/yarnpkg/yarn/issues/5808#issuecomment-420787503","issue_url":"https://api.github.com/repos/yarnpkg/yarn/issues/5808","id":420787503,"node_id":"MDEyOklzc3VlQ29tbWVudDQyMDc4NzUwMw==","user":{"login":"dj-hedgehog","id":7140800,"node_id":"MDQ6VXNlcjcxNDA4MDA=","avatar_url":"https://avatars1.githubusercontent.com/u/7140800?v=4","gravatar_id":"","url":"https://api.github.com/users/dj-hedgehog","html_url":"https://github.com/dj-hedgehog","followers_url":"https://api.github.com/users/dj-hedgehog/followers","following_url":"https://api.github.com/users/dj-hedgehog/following{/other_user}","gists_url":"https://api.github.com/users/dj-hedgehog/gists{/gist_id}","starred_url":"https://api.github.com/users/dj-hedgehog/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dj-hedgehog/subscriptions","organizations_url":"https://api.github.com/users/dj-hedgehog/orgs","repos_url":"https://api.github.com/users/dj-hedgehog/repos","events_url":"https://api.github.com/users/dj-hedgehog/events{/privacy}","received_events_url":"https://api.github.com/users/dj-hedgehog/received_events","type":"User","site_admin":false},"created_at":"2018-09-12T20:32:58Z","updated_at":"2018-09-12T20:32:58Z","author_association":"NONE","body":"@Phylu No problem. NSP (which became `npm audit` supported custom reporters. There is a owasp reporter. Sadly NSP is shutting down on the 30th of September so I won't be able to use it much longer.\r\n\r\nHere is a quick example:\r\nI just executed this in a Node.js project:\r\n\r\n```\r\nnpm i -g nsp nsp-reporter-owasp\r\nnsp check --reporter owasp\r\n```\r\n\r\nThe output is:\r\n\r\n```\r\n<?xml version=\"1.0\" encoding=\"utf-8\"?>\r\n<analysis xmlns=\"https://jeremylong.github.io/DependencyCheck/dependency-check.1.6.xsd\">\r\n  <scanInfo>\r\n    <engineVersion>3.0.1</engineVersion>\r\n  </scanInfo>\r\n  <projectInfo>\r\n    <name>faktoora-frontend@0.1.0</name>\r\n    <reportDate>2018-9-12 22:31:38</reportDate>\r\n    <credits>nsp</credits>\r\n  </projectInfo>\r\n  <dependencies>\r\n    <dependency isVirtual=\"false\">\r\n      <fileName>lodash@2.4.2</fileName>\r\n      <filePath>lodash@2.4.2</filePath>\r\n      <md5/>\r\n      <sha1/>\r\n      <description>Prototype Pollution</description>\r\n      <identifiers>\r\n        <identifier type=\"nsp\">\r\n          <name>lodash</name>\r\n        </identifier>\r\n      </identifiers>\r\n      <vulnerabilities>\r\n        <vulnerability source=\"NSP\">\r\n          <name>https://nodesecurity.io/advisories/577</name>\r\n          <cvssScore>2</cvssScore>\r\n          <cvssAccessVector/>\r\n          <cvssAccessComplexity>LOW</cvssAccessComplexity>\r\n          <cvssAuthenticationr>NONE</cvssAuthenticationr>\r\n          <cvssConfidentialImpact>NONE</cvssConfidentialImpact>\r\n          <cvssIntegrityImpact>NONE</cvssIntegrityImpact>\r\n          <cvssAvailabilityImpact>PARTIAL</cvssAvailabilityImpact>\r\n          <severity>Low</severity>\r\n          <description>Versions of `lodash` before 4.17.5 are vulnerable to prototype pollution.\r\n\r\nThe vulnerable functions are &amp;#39;defaultsDeep&amp;#39;, &amp;#39;merge&amp;#39;, and &amp;#39;mergeWith&amp;#39; which allow a malicious user to modify the prototype of `Object` via `__proto__` causing the addition or modification of an existing property that will exist on all objects.\r\n\r\n||Update to version 4.17.5 or later. vulnerable versions: &amp;lt;4.17.5 patched_versions: &amp;gt;=4.17.5</description>\r\n        </vulnerability>\r\n      </vulnerabilities>\r\n    </dependency>\r\n  </dependencies>\r\n</analysis>\r\n```"}}
{"actor":{"display_login":"dj-hedgehog"}}