Hold on, we're currently generating a fresh version of this report

Generated on Feb 19, 2024 via pnpm

cote 0.15.1

A Node.js library for building zero-configuration microservices.

zero-configuration

Package summary

34

issues

4

licenses

Package created

28 Apr 2013

Version published

9 Jul 2017

Maintainers

1

Total deps

66

Direct deps

9

License

MIT

Issues

34

13 critical severity issues

lodash@4.17.4

Prototype Pollution in lodash

Recommendation: Upgrade to version 4.17.12 or later

via: lodash@4.17.4

xmlhttprequest-ssl@1.5.5

xmlhttprequest and xmlhttprequest-ssl vulnerable to Arbitrary Code Injection

Recommendation: Upgrade to version 1.6.2 or later

via: socket.io@2.0.3

xmlhttprequest-ssl@1.5.5

Improper Certificate Validation in xmlhttprequest-ssl

Recommendation: Upgrade to version 1.6.1 or later

via: socket.io@2.0.3

socket.io-parser@3.1.3

Insufficient validation when decoding a Socket.IO packet

Recommendation: Upgrade to version 3.3.3 or later

via: socket.io@2.0.3

@dashersw/node-discover@0.7.1

Package has no specified license

Recommendation: Check the package code and files for license information

via: @dashersw/node-discover@0.7.1

better-assert@1.0.2

Package has no specified license

Recommendation: Check the package code and files for license information

via: socket.io@2.0.3

callsite@1.0.0

Package has no specified license

Recommendation: Check the package code and files for license information

via: socket.io@2.0.3

component-bind@1.0.0

Package has no specified license

Recommendation: Check the package code and files for license information

via: socket.io@2.0.3

component-inherit@0.0.3

Package has no specified license

Recommendation: Check the package code and files for license information

via: socket.io@2.0.3

configurable@0.0.1

Package has no specified license

Recommendation: Check the package code and files for license information

via: @dashersw/axon@2.0.5

escape-regexp@0.0.1

Package has no specified license

Recommendation: Check the package code and files for license information

via: @dashersw/axon@2.0.5

indexof@0.0.1

Package has no specified license

Recommendation: Check the package code and files for license information

via: socket.io@2.0.3

object-component@0.0.3

Package has no specified license

Recommendation: Check the package code and files for license information

via: socket.io@2.0.3

10 high severity issues

redis@2.8.0

Node-Redis potential exponential regex in monitor mode

Recommendation: Upgrade to version 3.1.1 or later

via: @dashersw/node-discover@0.7.1

engine.io@3.1.5

Resource exhaustion in engine.io

Recommendation: Upgrade to version 3.6.0 or later

via: socket.io@2.0.3

socket.io-parser@3.1.3

Resource exhaustion in socket.io-parser

Recommendation: Upgrade to version 3.3.2 or later

via: socket.io@2.0.3

lodash@4.17.4

Prototype Pollution in lodash

Recommendation: Upgrade to version 4.17.11 or later

via: lodash@4.17.4

lodash@4.17.4

Prototype Pollution in lodash

Recommendation: Upgrade to version 4.17.19 or later

via: lodash@4.17.4

lodash@4.17.4

Command Injection in lodash

Recommendation: Upgrade to version 4.17.21 or later

via: lodash@4.17.4

node-uuid@1.4.8

Deprecated package

via: @dashersw/node-discover@0.7.1

uuid@3.4.0

Deprecated package

via: uuid@3.4.0

uws@9.14.0

Deprecated package

via: socket.io@2.0.3

uws@9.14.0

Package uses install script: "node-gyp rebuild > build_log.txt 2>&1 || exit 0"

via: socket.io@2.0.3

10 moderate severity issues

lodash@4.17.4

Regular Expression Denial of Service (ReDoS) in lodash

Recommendation: Upgrade to version 4.17.11 or later

via: lodash@4.17.4

engine.io@3.1.5

Uncaught exception in engine.io

Recommendation: Upgrade to version 3.6.1 or later

via: socket.io@2.0.3

socket.io@2.0.3

CORS misconfiguration in socket.io

Recommendation: Upgrade to version 2.4.0 or later

via: socket.io@2.0.3

lodash@4.17.4

Regular Expression Denial of Service (ReDoS) in lodash

Recommendation: Upgrade to version 4.17.21 or later

via: lodash@4.17.4

callsite@1.0.0

Package has no specified source code repository

via: socket.io@2.0.3

configurable@0.0.1

Package has no specified source code repository

via: @dashersw/axon@2.0.5

escape-regexp@0.0.1

Package has no specified source code repository

via: @dashersw/axon@2.0.5

has-binary2@1.0.3

Package has no specified source code repository

via: socket.io@2.0.3

indexof@0.0.1

Package has no specified source code repository

via: socket.io@2.0.3

object-component@0.0.3

Package has no specified source code repository

via: socket.io@2.0.3

1 low severity issue

lodash@4.17.4

Prototype Pollution in lodash

Recommendation: Upgrade to version 4.17.5 or later

via: lodash@4.17.4

Licenses

MIT License

Permissive

OSI Approved

This is a human-readable summary of (and not a substitute for) the license. Disclaimer.

Can

commercial-use

modify

distribute

sublicense

private-use

Cannot

hold-liable

Must

include-copyright

include-license

55 Packages, Including:

@dashersw/axon@2.0.5

accepts@1.3.8

after@0.8.2

amp-message@0.1.2

amp@0.3.1

arraybuffer.slice@0.0.7

async-limiter@1.0.1

async@1.5.2

backo2@1.0.2

base64-arraybuffer@0.1.5

base64id@1.0.0

blob@0.0.5

charm@1.0.2

colors@1.1.2

component-emitter@1.2.1

cookie@0.3.1

cote@0.15.1

debug@2.6.9

debug@3.1.0

debug@4.3.4

double-ended-queue@2.1.0-0

engine.io-client@3.1.6

engine.io-parser@2.1.3

engine.io@3.1.5

eventemitter2@4.1.0

has-binary2@1.0.3

has-cors@1.1.0

isarray@2.0.1

lodash@4.17.4

mime-db@1.52.0

mime-types@2.1.35

minimist@1.2.8

mkdirp@0.5.6

ms@2.0.0

ms@2.1.2

negotiator@0.6.3

node-uuid@1.4.8

object-assign@4.1.1

parseqs@0.0.5

parseuri@0.0.5

portfinder@1.0.13

redis-commands@1.7.0

redis-parser@2.6.0

redis@2.8.0

safe-buffer@5.1.2

socket.io-adapter@1.1.2

socket.io-client@2.0.4

socket.io-parser@3.1.3

socket.io@2.0.3

to-array@0.1.4

N/A

N/A

9 Packages, Including:

@dashersw/node-discover@0.7.1

better-assert@1.0.2

callsite@1.0.0

component-bind@1.0.0

component-inherit@0.0.3

configurable@0.0.1

escape-regexp@0.0.1

indexof@0.0.1

object-component@0.0.3

ISC License

Permissive

OSI Approved

This is a human-readable summary of (and not a substitute for) the license. Disclaimer.

Can

commercial-use

modify

distribute

Cannot

hold-liable

Must

include-copyright

include-license

1 Packages, Including:

inherits@2.0.4

zlib License

Permissive

OSI Approved

This is a human-readable summary of (and not a substitute for) the license. Disclaimer.

Can

Cannot

Must

1 Packages, Including:

uws@9.14.0

Direct Dependencies

9

All Dependencies CSV

ⓘ This is a list of cote 's direct dependencies. Data on all dependencies, including transitive ones, is available via CSV download.

Name	Version	Size	License	Type	Vulnerabilities
@dashersw/axon	2.0.5	12.01 kB	MIT	prod	2 2
@dashersw/node-discover	0.7.1	13.77 kB	UNKNOWN	prod	1 2
charm	1.0.2	5.18 kB	MIT	prod
colors	1.1.2	8.02 kB	MIT	prod
eventemitter2	4.1.0	9.59 kB	MIT	prod
lodash	4.17.4	303.39 kB	MIT	prod	1 3 2 1
portfinder	1.0.13	5.76 kB	MIT	prod
socket.io	2.0.3	19.89 kB	MIT	prod	9 4 6
uuid	3.4.0	11.87 kB	MIT	prod	1

Recent Versions