Hold on, we're currently generating a fresh version of this report

Generated on Feb 18, 2024 via pnpm

excel4node 1.2.0

Library to create Formatted Excel Files.

Package summary

25

issues

10

licenses

Package created

2 Jul 2014

Version published

12 Jul 2016

Maintainers

3

Total deps

140

Direct deps

8

License

UNKNOWN

Issues

25

4 critical severity issues

nodemailer@2.7.2

Command injection in nodemailer

Recommendation: Upgrade to version 6.4.16 or later

via: sloth-logger@1.0.3

lodash@4.13.1

Prototype Pollution in lodash

Recommendation: Upgrade to version 4.17.12 or later

via: lodash@4.13.1 & others

underscore@1.7.0

Arbitrary Code Execution in underscore

Recommendation: Upgrade to version 1.12.1 or later

via: sloth-logger@1.0.3

ansi_up@1.3.0

Package has no specified license

Recommendation: Check the package code and files for license information

via: sloth-logger@1.0.3

13 high severity issues

lodash@4.13.1

Prototype Pollution in lodash

Recommendation: Upgrade to version 4.17.11 or later

via: lodash@4.13.1 & others

trim-newlines@1.0.0

Uncontrolled Resource Consumption in trim-newlines

Recommendation: Upgrade to version 3.0.1 or later

via: sloth-logger@1.0.3

lodash@4.13.1

Prototype Pollution in lodash

Recommendation: Upgrade to version 4.17.19 or later

via: lodash@4.13.1 & others

json5@0.5.1

Prototype Pollution in JSON5 via Parse Method

Recommendation: Upgrade to version 1.0.2 or later

via: babel-register@6.26.0

ip@1.1.8

NPM IP package vulnerable to Server-Side Request Forgery (SSRF) attacks

Recommendation: None

via: sloth-logger@1.0.3

lodash@4.13.1

Command Injection in lodash

Recommendation: Upgrade to version 4.17.21 or later

via: lodash@4.13.1 & others

spdx-exceptions@2.5.0

Package uses an atypical license ("CC-BY-3.0")

Recommendation: Read and validate the license terms

via: sloth-logger@1.0.3

buildmail@4.0.1

Deprecated package

via: sloth-logger@1.0.3

core-js@2.6.12

Deprecated package

via: babel-register@6.26.0

core-js@2.6.12

Package uses postinstall script: "node -e "try{require('./postinstall')}catch(e){}""

via: babel-register@6.26.0

mailcomposer@4.0.1

Deprecated package

via: sloth-logger@1.0.3

nodemailer@2.7.2

Deprecated package

via: sloth-logger@1.0.3

socks@1.1.9

Deprecated package

via: sloth-logger@1.0.3

5 moderate severity issues

lodash@4.13.1

Regular Expression Denial of Service (ReDoS) in lodash

Recommendation: Upgrade to version 4.17.11 or later

via: lodash@4.13.1 & others

nodemailer@2.7.2

Header injection in nodemailer

Recommendation: Upgrade to version 6.6.1 or later

via: sloth-logger@1.0.3

ansi_up@1.3.0

ansi_up cross-site scripting vulnerability

Recommendation: Upgrade to version 5.0.0 or later

via: sloth-logger@1.0.3

lodash@4.13.1

Regular Expression Denial of Service (ReDoS) in lodash

Recommendation: Upgrade to version 4.17.21 or later

via: lodash@4.13.1 & others

nodemailer@2.7.2

nodemailer ReDoS when trying to send a specially crafted email

Recommendation: Upgrade to version 6.9.9 or later

via: sloth-logger@1.0.3

3 low severity issues

lodash@4.13.1

Prototype Pollution in lodash

Recommendation: Upgrade to version 4.17.5 or later

via: lodash@4.13.1 & others

spdx-exceptions@2.5.0

Package uses a license that is not OSI approved ("CC-BY-3.0")

Recommendation: Read and validate the license terms

via: sloth-logger@1.0.3

spdx-license-ids@3.0.17

Package uses a license that is not OSI approved ("CC0-1.0")

Recommendation: Read and validate the license terms

via: sloth-logger@1.0.3

Licenses

MIT License

Permissive

OSI Approved

This is a human-readable summary of (and not a substitute for) the license. Disclaimer.

Can

commercial-use

modify

distribute

sublicense

private-use

Cannot

hold-liable

Must

include-copyright

include-license

124 Packages, Including:

addressparser@1.0.1

ansi-regex@2.1.1

ansi-styles@2.2.1

array-find-index@1.0.2

babel-code-frame@6.26.0

babel-core@6.26.3

babel-generator@6.26.1

babel-helpers@6.24.1

babel-messages@6.23.0

babel-register@6.26.0

babel-runtime@6.26.0

babel-template@6.26.0

babel-traverse@6.26.0

babel-types@6.26.0

babylon@6.18.0

balanced-match@1.0.2

brace-expansion@1.1.11

buildmail@4.0.1

camelcase-keys@2.1.0

camelcase@2.1.1

chalk@1.1.3

colors@1.4.0

concat-map@0.0.1

convert-source-map@1.9.0

core-js@2.6.12

core-util-is@1.0.3

currently-unhandled@0.4.1

dateformat@1.0.12

debug@2.6.9

decamelize@1.2.0

detect-indent@4.0.0

error-ex@1.3.2

escape-string-regexp@1.0.5

excel4node@1.2.0

find-up@1.1.2

function-bind@1.1.2

get-stdin@4.0.1

globals@9.18.0

has-ansi@2.0.0

hasown@2.0.1

home-or-tmp@2.0.0

httpntlm@1.6.1

httpreq@1.1.1

iconv-lite@0.4.15

image-size@0.5.0

immediate@3.0.6

indent-string@2.1.0

invariant@2.2.4

ip@1.1.8

is-arrayish@0.2.1

ISC License

Permissive

OSI Approved

This is a human-readable summary of (and not a substitute for) the license. Disclaimer.

Can

commercial-use

modify

distribute

Cannot

hold-liable

Must

include-copyright

include-license

6 Packages, Including:

graceful-fs@4.2.11

hosted-git-info@2.8.9

inherits@2.0.4

minimatch@3.1.2

semver@5.7.2

signal-exit@3.0.7

BSD 2-Clause "Simplified" License

Permissive

OSI Approved

This is a human-readable summary of (and not a substitute for) the license. Disclaimer.

Can

commercial-use

modify

distribute

place-warranty

Cannot

hold-liable

Must

include-copyright

include-license

2 Packages, Including:

esutils@2.0.3

normalize-package-data@2.5.0

Apache License 2.0

Permissive

OSI Approved

This is a human-readable summary of (and not a substitute for) the license. Disclaimer.

Can

commercial-use

modify

distribute

sublicense

private-use

use-patent-claims

place-warranty

Cannot

hold-liable

use-trademark

Must

include-copyright

include-license

state-changes

include-notice

2 Packages, Including:

spdx-correct@3.2.0

validate-npm-package-license@3.0.4

N/A

N/A

1 Packages, Including:

ansi_up@1.3.0

(MIT OR GPL-3.0-or-later)

Permissive

1 Packages, Including:

jszip@3.10.1

(MIT AND Zlib)

Permissive

1 Packages, Including:

pako@1.0.11

BSD 3-Clause "New" or "Revised" License

Permissive

OSI Approved

This is a human-readable summary of (and not a substitute for) the license. Disclaimer.

Can

commercial-use

modify

distribute

place-warranty

Cannot

use-trademark

hold-liable

Must

include-copyright

include-license

1 Packages, Including:

source-map@0.5.7

Creative Commons Attribution 3.0 Unported

Uncategorized

Not OSI Approved

This is a human-readable summary of (and not a substitute for) the license. Disclaimer.

Can

Cannot

Must

1 Packages, Including:

spdx-exceptions@2.5.0

Creative Commons Zero v1.0 Universal

Public Domain

Not OSI Approved

This is a human-readable summary of (and not a substitute for) the license. Disclaimer.

Can

Cannot

Must

1 Packages, Including:

spdx-license-ids@3.0.17

Direct Dependencies

8

All Dependencies CSV

ⓘ This is a list of excel4node 's direct dependencies. Data on all dependencies, including transitive ones, is available via CSV download.

Name	Version	Size	License	Type	Vulnerabilities
babel-register	6.26.0	4.24 kB	MIT	prod	3
colors	1.4.0	11 kB	MIT	prod
image-size	0.5.0	6.35 kB	MIT	prod
jszip	3.10.1	190.51 kB	(MIT OR GPL-3.0-or-later)	prod
lodash	4.13.1	289.2 kB	MIT	prod	1 3 2 1
mime	1.6.0	15.32 kB	MIT	prod
sloth-logger	1.0.3	125.87 kB	MIT	prod	4 10 5 3
xmlbuilder	8.2.2	18.33 kB	MIT	prod

Recent Versions