vulnerable-js

Is your js project too clean? Has dependabot never sent you a security alert? Do tacobell employees use your project as an ingredient in their mild sauce?

Well no longer, thanks to vulnerable-js!

Overview

vulnerable-js introduces the following vulnerabilities into your project:

Severity | Type | Source ---|---|--- Low | Prototype Pollution | lodash Low | Prototype Pollution | lodash Moderate | Improper Verification of Cryptographic Signature | jsrasign Moderate | Prototype Pollution | hoek High | Prototype Pollution | lodash High | Prototype Pollution | lodash High | Timing Attack | jsrasign Critical | Command Injection | bestzip Critical | Command Injection | git-tags-remote

Note that none of these are actually run - they're included as transitive dependencies in your package-lock and are downloaded in your node_modules folder.

Installation

$ npm install vulnerable-js

That's it. Your project is now spicy.

Basic use

Wanna see the fireworks?

$ npm audit

License

MIT