{"action":"created","issue":{"url":"https://api.github.com/repos/npm/npm/issues/20586","repository_url":"https://api.github.com/repos/npm/npm","labels_url":"https://api.github.com/repos/npm/npm/issues/20586/labels{/name}","comments_url":"https://api.github.com/repos/npm/npm/issues/20586/comments","events_url":"https://api.github.com/repos/npm/npm/issues/20586/events","html_url":"https://github.com/npm/npm/issues/20586","id":322213898,"number":20586,"title":"npm audit reports uninstalled optional dependencies","user":{"login":"kolbma","id":5228369,"avatar_url":"https://avatars2.githubusercontent.com/u/5228369?v=4","gravatar_id":"","url":"https://api.github.com/users/kolbma","html_url":"https://github.com/kolbma","followers_url":"https://api.github.com/users/kolbma/followers","following_url":"https://api.github.com/users/kolbma/following{/other_user}","gists_url":"https://api.github.com/users/kolbma/gists{/gist_id}","starred_url":"https://api.github.com/users/kolbma/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kolbma/subscriptions","organizations_url":"https://api.github.com/users/kolbma/orgs","repos_url":"https://api.github.com/users/kolbma/repos","events_url":"https://api.github.com/users/kolbma/events{/privacy}","received_events_url":"https://api.github.com/users/kolbma/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-05-11T08:35:44Z","updated_at":"2018-05-11T10:52:03Z","closed_at":null,"author_association":"NONE","body":"#### I'm opening this issue because:\r\n\r\n  - [ ] npm is crashing.\r\n  - [ ] npm is producing an incorrect install.\r\n  - [ ] npm is doing something I don't understand.\r\n  - [X] npm is producing incorrect or undesirable behavior.\r\n  - [ ] Other (_see below for feature requests_):\r\n\r\n#### What's going wrong?\r\n\r\nnpm audit seems to not check if packages are really installed.\r\n\r\n#### How can the CLI team reproduce the problem?\r\n\r\nnpm i karma --no-optional && npm audit\r\n\r\nReports\r\n\r\n```\r\n  High            Denial of Service\r\n\r\n  Package         http-proxy-agent\r\n\r\n  Patched in      >=2.1.0\r\n\r\n  Dependency of   karma\r\n\r\n  Path            karma > log4js > mailgun-js > proxy-agent > pac-proxy-agent\r\n                  > http-proxy-agent\r\n\r\n  More info       https://nodesecurity.io/advisories/607\r\n```\r\n\r\nalthough `npm ls mailgun-js`:\r\n\r\n```\r\n`-- karma@2.0.2\r\n  `-- log4js@2.5.3\r\n    `-- UNMET OPTIONAL DEPENDENCY mailgun-js@0.7.15\r\n```\r\n\r\n### supporting information:\r\n\r\n - `npm -v` prints: 6.0.1\r\n - `node -v` prints: v8.11.1\r\n - `npm config get registry` prints: https://registry.npmjs.org/\r\n - Windows, OS X/macOS, or Linux?: Windows 10\r\n"},"comment":{"url":"https://api.github.com/repos/npm/npm/issues/comments/388330719","html_url":"https://github.com/npm/npm/issues/20586#issuecomment-388330719","issue_url":"https://api.github.com/repos/npm/npm/issues/20586","id":388330719,"user":{"login":"welwood08","id":377024,"avatar_url":"https://avatars3.githubusercontent.com/u/377024?v=4","gravatar_id":"","url":"https://api.github.com/users/welwood08","html_url":"https://github.com/welwood08","followers_url":"https://api.github.com/users/welwood08/followers","following_url":"https://api.github.com/users/welwood08/following{/other_user}","gists_url":"https://api.github.com/users/welwood08/gists{/gist_id}","starred_url":"https://api.github.com/users/welwood08/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/welwood08/subscriptions","organizations_url":"https://api.github.com/users/welwood08/orgs","repos_url":"https://api.github.com/users/welwood08/repos","events_url":"https://api.github.com/users/welwood08/events{/privacy}","received_events_url":"https://api.github.com/users/welwood08/received_events","type":"User","site_admin":false},"created_at":"2018-05-11T10:52:03Z","updated_at":"2018-05-11T10:52:03Z","author_association":"CONTRIBUTOR","body":"I noticed this too, but after consideration I think it's correct behaviour: you might not have installed the optional dependency but someone else might have, and therefore you would want to know that a vulnerability exists in your dependency tree even if your own installation isn't affected. Perhaps a `--no-optional` flag for the audit would be useful here, and borrowing an idea from a similar issue perhaps separating the report output?"}}
{"actor":{"display_login":"welwood08"}}