如何修复@vue/cli漏洞？

Question

我有vuejs-3项目，我正在寻找0漏洞。当我安装npm时，我得到了48个当前版本节点和npm的漏洞。即使我尝试过npm审计，修正--强制问题仍然是一样的。有人能帮帮我吗？

C:\Users\achalapa\git\cnsr-odrplat-wcm-cld-vue\mcafee-consumer-wcm-cld-vue.lib> npm install

-npm WARN deprecated @hapi/bourne@1.3.2: This version has been deprecated and is no longer supported or maintained

-npm WARN deprecated @hapi/topo@3.1.6: This version has been deprecated and is no longer supported or maintained

-npm WARN deprecated har-validator@5.1.5: this library is no longer supported

-npm WARN deprecated chokidar@2.1.8: Chokidar 2 will break on node v14+. Upgrade to chokidar 3 with 15x less dependencies.

-npm WARN deprecated chokidar@2.1.8: Chokidar 2 will break on node v14+. Upgrade to chokidar 3 with 15x less dependencies.

-npm WARN deprecated html-webpack-plugin@3.2.0: 3.x is no longer supported

-npm WARN deprecated uuid@3.4.0: Please upgrade  to version 7 or higher.  Older versions may use Math.random() in certain circumstances, which is known to be problematic.  See https://v8.dev/blog/math-random for details.

-npm WARN deprecated request@2.88.2: request has been deprecated, see https://github.com/request/request/issues/3142

-npm WARN deprecated @hapi/hoek@8.5.1: This version has been deprecated and is no longer supported or maintained

-npm WARN deprecated @hapi/joi@15.1.1: Switch to 'npm install joi'

-added 923 packages, and audited 1694 packages in 4m

-105 packages are looking for funding
  run `npm fund` for details

-48 moderate severity vulnerabilities

-To address issues that do not require attention, run:
  npm audit fix

-To address all issues (including breaking changes), run:
  npm audit fix --force

当我们在下面添加包时，出现了48个漏洞

*"@vue/cli-plugin-babel": "~4.5.13",
"@vue/cli-plugin-typescript": "~4.5.13",
"@vue/cli-plugin-vuex": "~4.5.13",
"@vue/cli-service": "4.5.13",*

，可以继续了吗？这对我的项目有害吗？

package.json

{
  "name": "mcafee-consumer-wcm-cld-vue.lib",
  "version": "1.0.0",
  "private": true,
  "sideEffects": false,
  "scripts": {
    "bundle": "set NODE_ENV=production && npm run lint && webpack --config webpack.dlp.js --progress --mode=production",
    "bundle-dev": "set NODE_ENV=development && npm run lint && webpack --config webpack.dlp.js --progress --mode=development",
    "lint": "eslint . --ext .ts,.js --ignore-pattern src/**/*.d.ts",
    "lint-and-fix": "eslint . --ext .ts --fix"
  },
  "dependencies": {
    "@vuelidate/core": "^2.0.0-alpha.18",
    "bootstrap": "^5.0.1",
    "core-js": "^3.13.0",
    "intersection-observer": "^0.12.0",
    "vue": "^3.0.0",
    "vuex": "^4.0.0-0",
    "whatwg-fetch": "^3.6.2"
  },
  "devDependencies": {
    "@babel/core": "^7.14.3",
    "@babel/plugin-syntax-dynamic-import": "^7.8.3",
    "@babel/plugin-transform-arrow-functions": "^7.13.0",
    "@babel/plugin-transform-runtime": "^7.14.3",
    "@babel/preset-env": "^7.14.2",
    "@babel/preset-typescript": "^7.13.0",
    "@types/bootstrap": "^5.0.15",
    "@types/core-js": "^2.5.4",
    "@types/lodash": "^4.14.170",
    "@typescript-eslint/eslint-plugin": "^4.25.0",
    "@typescript-eslint/eslint-plugin-tslint": "^4.25.0",
    "@typescript-eslint/parser": "^4.25.0",
    "@vue/cli-plugin-babel": "~4.5.13",
    "@vue/cli-plugin-typescript": "~4.5.13",
    "@vue/cli-plugin-vuex": "~4.5.13",
    "@vue/cli-service": "4.5.13",
    "@vue/compiler-sfc": "^3.0.11",
    "@vue/eslint-config-prettier": "^6.0.0",
    "@vue/eslint-config-typescript": "^7.0.0",
    "babel-loader": "^8.2.2",
    "babel-preset-typescript-vue3": "^2.0.12",
    "clean-webpack-plugin": "^3.0.0",
    "eslint": "^7.27.0",
    "eslint-config-prettier": "^8.3.0",
    "eslint-loader": "^4.0.2",
    "eslint-plugin-jsdoc": "^35.0.0",
    "eslint-plugin-prettier": "^3.4.0",
    "eslint-plugin-vue": "^7.9.0",
    "fork-ts-checker-webpack-plugin": "^3.1.1",
    "html-webpack-plugin": "^5.3.1",
    "prettier": "^2.3.0",
    "terser-webpack-plugin": "^5.1.2",
    "ts-loader": "^9.2.2",
    "tslint": "^6.1.3",
    "typescript": "^4.3.2",
    "typescript-tslint-plugin": "^1.0.1",
    "vue-loader": "^16.2.0",
    "webpack": "^5.37.1",
    "webpack-bundle-analyzer": "^4.4.2",
    "webpack-cli": "^4.7.0",
    "webpack-merge": "^4.1.4"
  }
}

Answer 1

如果所有的漏洞都来自这4个软件包--即。vue/cli，您可以安全地忽略它，因为在开发和构建过程中，只有在您自己的机器上才能执行这些代码。如果我们同意相信Vue CLI的创建者不会以对客户有害的方式使用这些易受攻击的包(使用Vue CLI的开发人员)，我们可以安全地忽略这些警告，因为这些包中的代码不会包含在应用程序包中。

你感兴趣的只是秃鹫。包含在dependencies中的包，package.json的一部分，因为这是代码，它将使它成为最终的应用程序包，并将由我们的用户/客户下载和执行。

使用以下命令：npm audit --only=prod

Answer 2

npm prune为我工作！

我安装了一个与npm install @vue/cli -g无关的包，名为subscriptions-transport-ws，它不再维护，并且使用了一堆不推荐的包。

修剪完之后，我检查了一下，它用npm ls subscriptions-transport-ws就不见了。我也不再有弱点了。

Answer 3

如果是这样的话，请检查windows中的系统环境变量，我的问题是只添加了一条路径，但需要两条路径。一个用户变体下的"YourUser“在path下。

C:\Program \nodejs\

系统变量下的第二条路径也在路径下

C:\Program \nodejs\

这为我解决了问题，希望能有所帮助！