| Package | Affected versions | Patched versions |
|---|---|---|
| npm-lockfile | = 2.0.3= 2.0.4 | |
| npm-lockfile | ≥ 2.0.3, < 2.0.5 | 2.0.5 |
npm-lockfile safely generates an npm lockfile and output it to the filename of your choice. npm-lockfile before 2.0.4 does not santize unsafe external input and invoke sensitive command execution API with the input, causing command injection vulnerability. A fix was released in version 2.0.5.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free