npm-registry-fetch@8.0.3 vulnerabilities

Fetch-based http client for use with npm registry APIs

Direct Vulnerabilities

Known vulnerabilities in the npm-registry-fetch package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
Insertion of Sensitive Information into Log File

npm-registry-fetch is a Fetch-based http client for use with npm registry APIs

Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File through log files. The package supports URLs like <protocol>://[<user>[:<password>]@]<hostname>[:<port>][:][/]<path>. The password value is not redacted and is printed to stdout and also to any generated log files.

How to fix Insertion of Sensitive Information into Log File?

Upgrade npm-registry-fetch to version 4.0.5, 8.1.1 or higher.

<4.0.5 >=5.0.0 <8.1.1