How to get rid of the ‘hoek’ vulnerabilities

Question

I recently pushed an Angular CLI 5 application to GitHub and it indicated the following:

We found a potential security vulnerability in one of your dependencies.
A dependency defined in net-incident/package-lock.json has known security vulnerabilities and should be updated.
Dependencies defined in net-incident/package-lock.json 816
hapijs / hoek Known security vulnerability in 2.16.3

I have gone through the output from ‘npm audit’ and executed the various updates, including the following (which was not suggested):

npm install --save-dev request@2.86.0

The ‘request’ package contains ‘hawk’ which contains ‘hoek’. When I look at the ‘request’ package in node_modules the version has changed. But the following two updates from ‘npm audit’ do not seem to do anything:

npm update fsevents --depth 4 npm update stringstream --depth 5

And I am left with the following:

[!] 33 vulnerabilities found [12201 packages audited]
    Severity: 5 Low | 24 Moderate | 4 High
    Run `npm audit` for more detail

And many of the vulnerabilities are like the following:

Moderate        Prototype pollution
Package         hoek
Patched in      > 4.2.0 < 5.0.0 || >= 5.0.3
Dependency of   karma
Path            karma > log4js > loggly > request > hawk > boom > hoek
More info       https://nodesecurity.io/advisories/566

In the end, the application would not compile, so I replaced the the package and lock files, and now I am back to the beginning. I really want to fix the security issues. How do I get rid of the pesky ‘hoek’ vulnerabilities?

Answer 1

I was patient and they fixed the problem:

npm update karma@latest

should work.

Answer 2

You should runrm package-lock.json && npm update && npm install, if this still doesn't fix your issue, you can then continue by running npm ls hoek, which should gave you:

├─┬ fuse-box@3.3.0
│ └─┬ request@2.81.0
│   └─┬ hawk@3.1.3
│     ├─┬ boom@2.10.1
│     │ └── hoek@2.16.3
│     ├── hoek@2.16.3
│     └─┬ sntp@1.0.9
│       └── hoek@2.16.3
└── hoek@5.0.3

Check the version of hawk against the one on npm hawk, if it doesn't tally, run npm i hawk --save or npm i hoek@latest --save, then you should also run: npm i karma@latest --save, then npm audit After which I again ran my normal git commands:

git add .
git commit -m 'whatever_message'
git push 

Then you can go back to Github, the security vulnerability should be fixed.

Answer 3

This answer addresses similar hoek problem, and this answer explains non-vulnerability audit reports in detail.

npm audit reports possible problems. It's unnecessary that they are real problems that should be solved.

A nested dependency like karma > log4js > loggly > request > hawk > boom > hoek may require to fork numerous packages in dependency chain in case it has to be fixed.

Prototype pollution diagnosis indicates code smell. The reason why prototype pollution smells is that it can cause security problems. This is the reason why it's labeled as Moderate. It's unlikely that it causes any security risks in hoek package due to how it works, regardless of how the package is used (that's important as well).

Additionally, karma > log4js > loggly > request > hawk > boom > hoek dependency chain means that the problem occurs in development dependency. Most security problems are primarily applicable to dependencies that are used in production. This problem is specific to tests and Karma. It's virtually impossible it is a threat.

TL;DR: this is not a vulnerability. It has to be ignored. Any npm audit report should pass sanity check before any efforts to fix it will be made.