-1

I am currently seeing a vulnerability reporting on my docker image for a package I do not want.

The package is found here: https://snyk.io/advisor/npm-package/monorepo-symlink-test

In my node_modules folder if I drill down from

app/node_modules/resolve/test/resolver/multirepo/package.json

It is listed.

I have a very bare bones package.json for an Angular front end.

Package.json shown below:

{
  "name": "main-angular",
  "version": "0.0.0",
  "license": "MIT",
  "scripts": {
    "ng": "ng",
    "start": "ng serve --host 0.0.0.0",
    "start-local": "ng serve -c localhot",
    "build": "ng build --prod",
    "test": "ng test",
    "lint": "ng lint",
    "e2e": "ng e2e"
  },
  "private": true,
  "dependencies": {
    "@angular/animations": "^15.2.9",
    "@angular/cdk": "^15.2.9",
    "@angular/common": "^15.2.9",
    "@angular/compiler": "^15.2.9",
    "@angular/core": "^15.2.9",
    "@angular/forms": "^15.2.9",
    "@angular/material": "^15.2.9",
    "@angular/platform-browser": "^15.2.9",
    "@angular/platform-browser-dynamic": "^15.2.9",
    "@angular/router": "^15.2.9",
    "@azure/msal-angular": "^2.5.11",
    "@azure/msal-browser": "^2.38.2",
    "@ng-bootstrap/ng-bootstrap": "^14.2.0",
    "@popperjs/core": "^2.11.6",
    "body-parser": "^1.20.1",
    "bootstrap": "^5.2.3",
    "cookie-parser": "^1.4.6",
    "core-js": "^3.27.1",
    "dom-parser": "^0.1.6",
    "express": "^4.18.2",
    "express-session": "^1.17.3",
    "file-saver": "^2.0.5",
    "jquery": "^3.6.3",
    "moment": "^2.29.4",
    "morgan": "^1.10.0",
    "ngx-mask": "^13.1.15",
    "ngx-pagination": "^3.1.1",
    "rxjs": "~7.5.0",
    "tslib": "^2.4.1",
    "zone.js": "~0.12.0"
  },
  "devDependencies": {
    "@angular-devkit/build-angular": "^15.2.9",
    "@angular/cli": "^15.2.9",
    "@angular/compiler-cli": "^15.2.9",
    "@angular/language-service": "^15.2.9",
    "@types/jasmine": "4.3.1",
    "@types/jasminewd2": "^2.0.10",
    "@types/node": "^12.20.55",
    "jasmine-core": "~4.5.0",
    "jasmine-spec-reporter": "^7.0.0",
    "karma": "~6.3.0",
    "karma-chrome-launcher": "~3.1.0",
    "karma-coverage": "~2.1.0",
    "karma-coverage-istanbul-reporter": "^3.0.3",
    "karma-jasmine": "~4.0.0",
    "karma-jasmine-html-reporter": "~1.7.0",
    "typescript": "~4.8.4"
  },
}

Truly would appreciate any advice!

user68288
  • 702
  • 2
  • 6
  • 27
  • can you give us the result of `npm ls monorepo-symlink-test` – Matthieu Riegler Sep 01 '23 at 17:03
  • Have the same issue, it's in my node_modules but not in package-json.lock, if I delete node_modules and reinstall it's still there, the output is ``` myapp@0.0.1 /home/alex/Projects/myapp └── (empty) `````` – alex88 Sep 01 '23 at 23:49
  • Turns out it has nothing to do with the vulnerable package https://github.com/browserify/resolve/issues/309 – alex88 Sep 02 '23 at 00:25

0 Answers0