在安装 firebase-tools npm 的漏洞圈子里走来走去

Question

I'm trying to install firebase tools. However I am presented with this error:

# npm audit report

express  <=4.17.2 || 5.0.0-alpha.1 - 5.0.0-alpha.8
Severity: high
qs vulnerable to Prototype Pollution - https://github.com/advisories/GHSA-hrpp-h998-j3pp
Depends on vulnerable versions of qs
fix available via `npm audit fix`
node_modules/firebase-tools/node_modules/express

got  <11.8.5
Severity: moderate
Got allows a redirect to a UNIX socket - https://github.com/advisories/GHSA-pfrx-2q88-qq97
fix available via `npm audit fix --force`
Will install firebase-tools@1.2.0, which is a breaking change
node_modules/firebase-tools/node_modules/got
  package-json  <=6.5.0
  Depends on vulnerable versions of got
  node_modules/firebase-tools/node_modules/package-json
    latest-version  0.2.0 - 5.1.0
    Depends on vulnerable versions of package-json
    node_modules/firebase-tools/node_modules/latest-version
      update-notifier  0.2.0 - 5.1.0
      Depends on vulnerable versions of latest-version
      node_modules/firebase-tools/node_modules/superstatic/node_modules/update-notifier
      node_modules/firebase-tools/node_modules/update-notifier
        firebase-tools  >=2.0.0
        Depends on vulnerable versions of update-notifier
        node_modules/firebase-tools
        superstatic  >=0.12.11
        Depends on vulnerable versions of update-notifier
        node_modules/firebase-tools/node_modules/superstatic

minimatch  <3.0.5
Severity: high
minimatch ReDoS vulnerability - https://github.com/advisories/GHSA-f8q6-p94x-37v3
fix available via `npm audit fix`
node_modules/firebase-tools/node_modules/minimatch

qs  6.5.0 - 6.5.2 || 6.7.0 - 6.7.2
Severity: high
qs vulnerable to Prototype Pollution - https://github.com/advisories/GHSA-hrpp-h998-j3pp
qs vulnerable to Prototype Pollution - https://github.com/advisories/GHSA-hrpp-h998-j3pp
fix available via `npm audit fix`
node_modules/firebase-tools/node_modules/qs
node_modules/firebase-tools/node_modules/request/node_modules/qs
  body-parser  1.19.0
  Depends on vulnerable versions of qs
  node_modules/firebase-tools/node_modules/body-parser
  express  <=4.17.2 || 5.0.0-alpha.1 - 5.0.0-alpha.8
  Depends on vulnerable versions of qs
  node_modules/firebase-tools/node_modules/express

10 vulnerabilities (6 moderate, 4 high)

When I run:

npm audit fix // or
npm audit fix --force

I get the exact same error.

I then tried to see if updating the packages manually would help, for example by running:

npm install qs@latest

But I get the exact same issues.

I have also

• deleted my package.json-lock file and the nodule modules folder and tried a fresh install. still yada

Why can't I seem to break out of this loop?

Answer 1

SOLVED:

I managed to get around it by using the auto install script and not npm from https://firebase.google.com/docs/cli#mac-linux-auto-script :

curl -sL https://firebase.tools | bash

I am able now to use firebase init log in and deploy.... phew!