Critical Security Vulnerability because of package-lock.json publishing

[natelaws]

The problem

The package-lock.json is being published and includes a reference to an old version of hoek which is considered to be a critical security vulnerability and is flagged as such in github.

Generally this is fixed by using newer version of the request library which no longer has this dependency. But there might be other things webdriverio uses that cause hoek to be included.

My recommendations are to either:

1. Stop publishing package-lock.json
2. Go through the dependencies and upgrade anything that is pulling in old hoek.

References:

• https://nvd.nist.gov/vuln/detail/CVE-2018-3728
• https://nodesecurity.io/advisories/566
• https://hackerone.com/reports/310439
• Removal from newer request: Replace hawk dependency with a local implemenation request/request#2943

I could do either just wondering what the project prefers.

[christian-bromann]

@natelaws thanks for letting me know. I thought package-lock would be ignored automatically but this was a false assumption since this project has a custom npmignore file.