Hold on, we're currently generating a fresh version of this report

Generated on Mar 30, 2024 via pnpm

cylon 0.11.1

A JavaScript robotics framework using Node.js

Package summary

87

issues

5

licenses

Package created

18 Oct 2013

Version published

12 Mar 2014

Maintainers

3

Total deps

60

Direct deps

9

License

UNKNOWN

Issues

87

35 critical severity issues

ejs@0.8.8

ejs template injection vulnerability

Recommendation: Upgrade to version 3.1.7 or later

via: ejs@0.8.8

uglify-js@1.2.5

Incorrect Handling of Non-Boolean Comparisons During Minification in uglify-js

Recommendation: Upgrade to version 2.4.24 or later

via: express.io@1.1.13

ejs@0.8.8

ejs is vulnerable to remote code execution due to weak input validation

Recommendation: Upgrade to version 2.5.5 or later

via: ejs@0.8.8

lodash@2.4.2

Prototype Pollution in lodash

Recommendation: Upgrade to version 4.17.12 or later

via: globule@0.2.0

xmlhttprequest@1.4.2

xmlhttprequest and xmlhttprequest-ssl vulnerable to Arbitrary Code Injection

Recommendation: Upgrade to version 1.7.0 or later

via: express.io@1.1.13

underscore@1.4.3

Arbitrary Code Execution in underscore

Recommendation: Upgrade to version 1.12.1 or later

via: express.io@1.1.13

active-x-obfuscator@0.0.1

Package has no specified license

Recommendation: Check the package code and files for license information

via: express.io@1.1.13

base64id@0.1.0

Package has no specified license

Recommendation: Check the package code and files for license information

via: express.io@1.1.13

batch@0.5.0

Package has no specified license

Recommendation: Check the package code and files for license information

via: express.io@1.1.13

buffer-crc32@0.2.1

Package has no specified license

Recommendation: Check the package code and files for license information

via: express.io@1.1.13

bytes@0.2.1

Package has no specified license

Recommendation: Check the package code and files for license information

via: express.io@1.1.13

commander@1.3.2

Package has no specified license

Recommendation: Check the package code and files for license information

via: express.io@1.1.13

commander@2.1.0

Package has no specified license

Recommendation: Check the package code and files for license information

via: commander@2.1.0 & others

cookie-signature@1.0.1

Package has no specified license

Recommendation: Check the package code and files for license information

via: express.io@1.1.13

cookie@0.1.0

Package has no specified license

Recommendation: Check the package code and files for license information

via: express.io@1.1.13

debug@0.8.1

Package has no specified license

Recommendation: Check the package code and files for license information

via: express.io@1.1.13

ejs@0.8.8

Package has no specified license

Recommendation: Check the package code and files for license information

via: ejs@0.8.8

express.io@1.1.13

Package has no specified license

Recommendation: Check the package code and files for license information

via: express.io@1.1.13

fresh@0.2.0

Package has no specified license

Recommendation: Check the package code and files for license information

via: express.io@1.1.13

mime@1.2.11

Package has no specified license

Recommendation: Check the package code and files for license information

via: express.io@1.1.13

node-namespace@1.0.0

Package has no specified license

Recommendation: Check the package code and files for license information

via: node-namespace@1.0.0

options@0.0.6

Package has no specified license

Recommendation: Check the package code and files for license information

via: express.io@1.1.13

pause@0.0.1

Package has no specified license

Recommendation: Check the package code and files for license information

via: express.io@1.1.13

qs@0.6.6

Package has no specified license

Recommendation: Check the package code and files for license information

via: express.io@1.1.13

range-parser@0.0.4

Package has no specified license

Recommendation: Check the package code and files for license information

via: express.io@1.1.13

redis@0.7.3

Package has no specified license

Recommendation: Check the package code and files for license information

via: express.io@1.1.13

send@0.1.4

Package has no specified license

Recommendation: Check the package code and files for license information

via: express.io@1.1.13

socket.io-client@0.9.16

Package has no specified license

Recommendation: Check the package code and files for license information

via: express.io@1.1.13

socket.io@0.9.19

Package has no specified license

Recommendation: Check the package code and files for license information

via: express.io@1.1.13

tinycolor@0.0.1

Package has no specified license

Recommendation: Check the package code and files for license information

via: express.io@1.1.13

uglify-js@1.2.5

Package has no specified license

Recommendation: Check the package code and files for license information

via: express.io@1.1.13

uid2@0.0.3

Package has no specified license

Recommendation: Check the package code and files for license information

via: express.io@1.1.13

underscore@1.4.3

Package has no specified license

Recommendation: Check the package code and files for license information

via: express.io@1.1.13

ws@0.4.32

Package has no specified license

Recommendation: Check the package code and files for license information

via: express.io@1.1.13

zeparser@0.0.5

Package has no specified license

Recommendation: Check the package code and files for license information

via: express.io@1.1.13

28 high severity issues

qs@0.6.6

Prototype Pollution Protection Bypass in qs

Recommendation: Upgrade to version 6.0.4 or later

via: express.io@1.1.13

ws@0.4.32

DoS due to excessively large websocket message in ws

Recommendation: Upgrade to version 1.1.1 or later

via: express.io@1.1.13

qs@0.6.6

Denial-of-Service Extended Event Loop Blocking in qs

Recommendation: Upgrade to version 1.0.0 or later

via: express.io@1.1.13

negotiator@0.3.0

Regular Expression Denial of Service in negotiator

Recommendation: Upgrade to version 0.6.1 or later

via: express.io@1.1.13

ws@0.4.32

Denial of Service in ws

Recommendation: Upgrade to version 1.1.5 or later

via: express.io@1.1.13

qs@0.6.6

Denial-of-Service Memory Exhaustion in qs

Recommendation: Upgrade to version 1.0.0 or later

via: express.io@1.1.13

uglify-js@1.2.5

Regular Expression Denial of Service in uglify-js

Recommendation: Upgrade to version 2.6.0 or later

via: express.io@1.1.13

ejs@0.8.8

ejs vulnerable to DoS due to weak input validation

Recommendation: Upgrade to version 2.5.5 or later

via: ejs@0.8.8

fresh@0.2.0

Regular Expression Denial of Service in fresh

Recommendation: Upgrade to version 0.5.2 or later

via: express.io@1.1.13

minimatch@0.3.0

Regular Expression Denial of Service in minimatch

Recommendation: Upgrade to version 3.0.2 or later

via: glob@3.2.11 & others

mime@1.2.11

mime Regular Expression Denial of Service when MIME lookup performed on untrusted user input

Recommendation: Upgrade to version 1.4.1 or later

via: express.io@1.1.13

debug@0.8.1

debug Inefficient Regular Expression Complexity vulnerability

Recommendation: Upgrade to version 2.6.9 or later

via: express.io@1.1.13

lodash@2.4.2

Prototype Pollution in lodash

Recommendation: Upgrade to version 4.17.11 or later

via: globule@0.2.0

qs@0.6.6

qs vulnerable to Prototype Pollution

Recommendation: Upgrade to version 6.2.4 or later

via: express.io@1.1.13

minimatch@0.3.0

minimatch ReDoS vulnerability

Recommendation: Upgrade to version 3.0.5 or later

via: glob@3.2.11 & others

lodash@2.4.2

Command Injection in lodash

Recommendation: Upgrade to version 4.17.21 or later

via: globule@0.2.0

cylon@0.11.1

Package uses an invalid SPDX license ("Apache 2.0")

Recommendation: Validate that the package complies with your license policy

via: cylon@0.11.1

robeaux@0.5.1

Package uses an invalid SPDX license ("Apache 2.0")

Recommendation: Validate that the package complies with your license policy

via: robeaux@0.5.1

glob@3.2.11

Package uses an invalid SPDX license ("BSD")

Recommendation: Validate that the package complies with your license policy

via: glob@3.2.11 & others

stream-counter@0.2.0

Package uses an invalid SPDX license ("BSD")

Recommendation: Validate that the package complies with your license policy

via: express.io@1.1.13

coffee-script@1.4.0

Deprecated package

via: express.io@1.1.13

connect@2.12.0

Deprecated package

via: express.io@1.1.13

ejs@0.8.8

Deprecated package

via: ejs@0.8.8

minimatch@0.2.14

Deprecated package

via: globule@0.2.0

minimatch@0.3.0

Deprecated package

via: glob@3.2.11 & others

mkdirp@0.3.5

Deprecated package

via: express.io@1.1.13

wrench@1.5.9

Deprecated package

via: wrench@1.5.9

ws@0.4.32

Package uses install script: "(node-gyp rebuild 2> builderror.log) || (exit 0)"

via: express.io@1.1.13

16 moderate severity issues

lodash@2.4.2

Regular Expression Denial of Service (ReDoS) in lodash

Recommendation: Upgrade to version 4.17.11 or later

via: globule@0.2.0

cookie-signature@1.0.1

cookie-signature Timing Attack

Recommendation: Upgrade to version 1.0.4 or later

via: express.io@1.1.13

express@3.4.8

No Charset in Content-Type Header in express

Recommendation: Upgrade to version 3.11.0 or later

via: express.io@1.1.13

connect@2.12.0

Cross-Site Scripting in connect

Recommendation: Upgrade to version 2.14.0 or later

via: express.io@1.1.13

ejs@0.8.8

mde ejs vulnerable to XSS

Recommendation: Upgrade to version 2.5.5 or later

via: ejs@0.8.8

socket.io@0.9.19

CORS misconfiguration in socket.io

Recommendation: Upgrade to version 2.4.0 or later

via: express.io@1.1.13

lodash@2.4.2

Regular Expression Denial of Service (ReDoS) in lodash

Recommendation: Upgrade to version 4.17.21 or later

via: globule@0.2.0

send@0.1.4

Root Path Disclosure in send

Recommendation: Upgrade to version 0.11.1 or later

via: express.io@1.1.13

express@3.4.8

Express.js Open Redirect in malformed URLs

Recommendation: Upgrade to version 4.19.2 or later

via: express.io@1.1.13

batch@0.5.0

Package has no specified source code repository

via: express.io@1.1.13

bytes@0.2.1

Package has no specified source code repository

via: express.io@1.1.13

cookie-signature@1.0.1

Package has no specified source code repository

via: express.io@1.1.13

pause@0.0.1

Package has no specified source code repository

via: express.io@1.1.13

policyfile@0.0.4

Package has no specified source code repository

via: express.io@1.1.13

range-parser@0.0.4

Package has no specified source code repository

via: express.io@1.1.13

uid2@0.0.3

Package has no specified source code repository

via: express.io@1.1.13

8 low severity issues

lodash@2.4.2

Prototype Pollution in lodash

Recommendation: Upgrade to version 4.17.5 or later

via: globule@0.2.0

send@0.1.4

Directory Traversal in send

Recommendation: Upgrade to version 0.8.4 or later

via: express.io@1.1.13

ws@0.4.32

Remote Memory Disclosure in ws

Recommendation: Upgrade to version 1.0.1 or later

via: express.io@1.1.13

debug@0.8.1

Regular Expression Denial of Service in debug

Recommendation: Upgrade to version 2.6.9 or later

via: express.io@1.1.13

cylon@0.11.1

Package uses a license that is not OSI approved ("Apache 2.0")

Recommendation: Read and validate the license terms

via: cylon@0.11.1

robeaux@0.5.1

Package uses a license that is not OSI approved ("Apache 2.0")

Recommendation: Read and validate the license terms

via: robeaux@0.5.1

glob@3.2.11

Package uses a license that is not OSI approved ("BSD")

Recommendation: Read and validate the license terms

via: glob@3.2.11 & others

stream-counter@0.2.0

Package uses a license that is not OSI approved ("BSD")

Recommendation: Read and validate the license terms

via: express.io@1.1.13

Licenses

N/A

N/A

29 Packages, Including:

active-x-obfuscator@0.0.1

base64id@0.1.0

batch@0.5.0

buffer-crc32@0.2.1

bytes@0.2.1

commander@1.3.2

commander@2.1.0

cookie-signature@1.0.1

cookie@0.1.0

debug@0.8.1

ejs@0.8.8

express.io@1.1.13

fresh@0.2.0

mime@1.2.11

node-namespace@1.0.0

options@0.0.6

pause@0.0.1

qs@0.6.6

range-parser@0.0.4

redis@0.7.3

send@0.1.4

socket.io-client@0.9.16

socket.io@0.9.19

tinycolor@0.0.1

uglify-js@1.2.5

uid2@0.0.3

underscore@1.4.3

ws@0.4.32

zeparser@0.0.5

MIT License

Permissive

OSI Approved

This is a human-readable summary of (and not a substitute for) the license. Disclaimer.

Can

commercial-use

modify

distribute

sublicense

private-use

Cannot

hold-liable

Must

include-copyright

include-license

24 Packages, Including:

async@0.1.22

async@0.2.10

coffee-script@1.4.0

connect@2.12.0

core-util-is@1.0.3

express@3.4.8

globule@0.2.0

isarray@0.0.1

keypress@0.1.0

lodash@2.4.2

merge-descriptors@0.0.1

methods@0.1.0

minimatch@0.2.14

minimatch@0.3.0

mkdirp@0.3.5

multiparty@2.2.0

nan@1.0.0

negotiator@0.3.0

policyfile@0.0.4

raw-body@1.1.2

readable-stream@1.1.14

string_decoder@0.10.31

wrench@1.5.9

xmlhttprequest@1.4.2

ISC License

Permissive

OSI Approved

This is a human-readable summary of (and not a substitute for) the license. Disclaimer.

Can

commercial-use

modify

distribute

Cannot

hold-liable

Must

include-copyright

include-license

3 Packages, Including:

inherits@2.0.4

lru-cache@2.7.3

sigmund@1.0.1

Apache 2.0

Invalid

Not OSI Approved

2 Packages, Including:

cylon@0.11.1

robeaux@0.5.1

BSD

Invalid

Not OSI Approved

2 Packages, Including:

glob@3.2.11

stream-counter@0.2.0

Direct Dependencies

9

All Dependencies CSV

ⓘ This is a list of cylon 's direct dependencies. Data on all dependencies, including transitive ones, is available via CSV download.

Name	Version	Size	License	Type	Vulnerabilities
async	0.2.10	15.4 kB	MIT	prod
commander	2.1.0	7.66 kB	UNKNOWN	prod	1
ejs	0.8.8	17.68 kB	UNKNOWN	prod	3 2 1
express.io	1.1.13	801.7 kB	UNKNOWN	prod	30 16 13 4
glob	3.2.11	16.2 kB	BSD	prod	4 1
globule	0.2.0	8.7 kB	MIT	prod	1 7 2 2
node-namespace	1.0.0	1.72 kB	UNKNOWN	prod	1
robeaux	0.5.1	539.79 kB	Apache 2.0	prod	1 1
wrench	1.5.9	9.03 kB	MIT	prod	1

Recent Versions