Hold on, we're currently generating a fresh version of this report

Generated on May 17, 2024 via pnpm

gulp-iconfont 3.0.0

Create icon fonts from several SVG icons

Package summary

20

issues

11

licenses

Package created

7 Jan 2014

Version published

20 Jun 2015

Maintainers

4

Total deps

164

Direct deps

11

License

UNKNOWN

Issues

20

2 critical severity issues

xmldom@0.1.31

xmldom allows multiple root nodes in a DOM

Recommendation: None

via: gulp-svg2ttf@1.1.1

lodash@3.10.1

Prototype Pollution in lodash

Recommendation: Upgrade to version 4.17.12 or later

via: gulp-svg2ttf@1.1.1

10 high severity issues

lodash@3.10.1

Prototype Pollution in lodash

Recommendation: Upgrade to version 4.17.11 or later

via: gulp-svg2ttf@1.1.1

trim-newlines@1.0.0

Uncontrolled Resource Consumption in trim-newlines

Recommendation: Upgrade to version 3.0.1 or later

via: gulp-clone@1.1.4 & others

lodash@3.10.1

Prototype Pollution in lodash

Recommendation: Upgrade to version 4.17.19 or later

via: gulp-svg2ttf@1.1.1

lodash.template@2.4.1

Command Injection in lodash

Recommendation: None

via: gulp-clone@1.1.4 & others

lodash@3.10.1

Command Injection in lodash

Recommendation: Upgrade to version 4.17.21 or later

via: gulp-svg2ttf@1.1.1

duplexer2@0.0.2

Package uses an invalid SPDX license ("BSD")

Recommendation: Validate that the package complies with your license policy

via: gulp-clone@1.1.4 & others

spdx-exceptions@2.5.0

Package uses an atypical license ("CC-BY-3.0")

Recommendation: Read and validate the license terms

via: gulp-clone@1.1.4 & others

gulp-util@2.2.20

Deprecated package

via: gulp-clone@1.1.4 & others

gulp-util@3.0.8

Deprecated package

via: gulp-svg2ttf@1.1.1 & others

xmldom@0.1.31

Deprecated package

via: gulp-svg2ttf@1.1.1

5 moderate severity issues

lodash@3.10.1

Regular Expression Denial of Service (ReDoS) in lodash

Recommendation: Upgrade to version 4.17.11 or later

via: gulp-svg2ttf@1.1.1

xmldom@0.1.31

Misinterpretation of malicious XML input

Recommendation: Upgrade to version 0.5.0 or later

via: gulp-svg2ttf@1.1.1

lodash@3.10.1

Regular Expression Denial of Service (ReDoS) in lodash

Recommendation: Upgrade to version 4.17.21 or later

via: gulp-svg2ttf@1.1.1

xmldom@0.1.31

Misinterpretation of malicious XML input

Recommendation: None

via: gulp-svg2ttf@1.1.1

lodash@3.10.1

Prototype Pollution in lodash

Recommendation: Upgrade to version 4.17.5 or later

via: gulp-svg2ttf@1.1.1

3 low severity issues

duplexer2@0.0.2

Package uses a license that is not OSI approved ("BSD")

Recommendation: Read and validate the license terms

via: gulp-clone@1.1.4 & others

spdx-exceptions@2.5.0

Package uses a license that is not OSI approved ("CC-BY-3.0")

Recommendation: Read and validate the license terms

via: gulp-clone@1.1.4 & others

spdx-license-ids@3.0.17

Package uses a license that is not OSI approved ("CC0-1.0")

Recommendation: Read and validate the license terms

via: gulp-clone@1.1.4 & others

Licenses

MIT License

Permissive

OSI Approved

This is a human-readable summary of (and not a substitute for) the license. Disclaimer.

Can

commercial-use

modify

distribute

sublicense

private-use

Cannot

hold-liable

Must

include-copyright

include-license

147 Packages, Including:

ansi-gray@0.1.1

ansi-regex@0.2.1

ansi-regex@2.1.1

ansi-styles@1.1.0

ansi-styles@2.2.1

ansi-wrap@0.1.0

argparse@1.0.10

array-differ@1.0.0

array-find-index@1.0.2

array-uniq@1.0.3

beeper@1.1.1

bufferstreams@1.0.1

camelcase-keys@2.1.0

camelcase@2.1.1

chalk@0.5.1

chalk@1.1.3

clone-stats@0.0.1

clone@1.0.4

commander@2.20.3

core-util-is@1.0.3

currently-unhandled@0.4.1

dateformat@1.0.12

dateformat@2.2.0

decamelize@1.2.0

error-ex@1.3.2

escape-string-regexp@1.0.5

fancy-log@1.3.3

find-up@1.1.2

function-bind@1.1.2

get-stdin@4.0.1

glogg@1.0.2

gulp-clone@1.1.4

gulp-cond@0.0.2

gulp-iconfont@3.0.0

gulp-rename@1.4.0

gulp-spawn@0.3.0

gulp-svg2ttf@1.1.1

gulp-svgicons2svgfont@2.1.0

gulp-ttf2eot@1.0.2

gulp-ttf2woff@1.0.2

gulp-util@2.2.20

gulp-util@3.0.8

gulplog@1.0.0

has-ansi@0.1.0

has-ansi@2.0.0

has-gulplog@0.1.0

hasown@2.0.2

indent-string@2.1.0

is-arrayish@0.2.1

is-core-module@2.13.1

ISC License

Permissive

OSI Approved

This is a human-readable summary of (and not a substitute for) the license. Disclaimer.

Can

commercial-use

modify

distribute

Cannot

hold-liable

Must

include-copyright

include-license

7 Packages, Including:

color-support@1.1.3

graceful-fs@4.2.11

hosted-git-info@2.8.9

inherits@2.0.4

sax@1.1.6

semver@5.7.2

signal-exit@3.0.7

Apache License 2.0

Permissive

OSI Approved

This is a human-readable summary of (and not a substitute for) the license. Disclaimer.

Can

commercial-use

modify

distribute

sublicense

private-use

use-patent-claims

place-warranty

Cannot

hold-liable

use-trademark

Must

include-copyright

include-license

state-changes

include-notice

2 Packages, Including:

spdx-correct@3.2.0

validate-npm-package-license@3.0.4

Python License 2.0

Permissive

OSI Approved

This is a human-readable summary of (and not a substitute for) the license. Disclaimer.

Can

commercial-use

modify

distribute

Cannot

use-trademark

hold-liable

Must

include-copyright

include-license

state-changes

1 Packages, Including:

argparse@2.0.1

BSD

Invalid

Not OSI Approved

1 Packages, Including:

duplexer2@0.0.2

BSD 2-Clause "Simplified" License

Permissive

OSI Approved

This is a human-readable summary of (and not a substitute for) the license. Disclaimer.

Can

commercial-use

modify

distribute

place-warranty

Cannot

hold-liable

Must

include-copyright

include-license

1 Packages, Including:

normalize-package-data@2.5.0

(MIT AND Zlib)

Permissive

1 Packages, Including:

pako@1.0.11

Creative Commons Attribution 3.0 Unported

Uncategorized

Not OSI Approved

This is a human-readable summary of (and not a substitute for) the license. Disclaimer.

Can

Cannot

Must

1 Packages, Including:

spdx-exceptions@2.5.0

Creative Commons Zero v1.0 Universal

Public Domain

Not OSI Approved

This is a human-readable summary of (and not a substitute for) the license. Disclaimer.

Can

Cannot

Must

1 Packages, Including:

spdx-license-ids@3.0.17

BSD 3-Clause "New" or "Revised" License

Permissive

OSI Approved

This is a human-readable summary of (and not a substitute for) the license. Disclaimer.

Can

commercial-use

modify

distribute

place-warranty

Cannot

use-trademark

hold-liable

Must

include-copyright

include-license

1 Packages, Including:

sprintf-js@1.0.3

(LGPL-2.0 or MIT)

Permissive

1 Packages, Including:

xmldom@0.1.31

Direct Dependencies

11

All Dependencies CSV

ⓘ This is a list of gulp-iconfont 's direct dependencies. Data on all dependencies, including transitive ones, is available via CSV download.

Name	Version	Size	License	Type	Vulnerabilities
gulp-clone	1.1.4	2.82 kB	MIT	prod	5 3
gulp-cond	0.0.2	3.3 kB	MIT	prod
gulp-rename	1.4.0	2.7 kB	MIT	prod
gulp-spawn	0.3.0	4.1 kB	MIT	prod	5 3
gulp-svg2ttf	1.1.1	10.3 kB	MIT	prod	2 7 5 1
gulp-svgicons2svgfont	2.1.0	10.65 kB	MIT	prod	3 1
gulp-ttf2eot	1.0.2	5.26 kB	MIT	prod	3 1
gulp-ttf2woff	1.0.2	6.56 kB	MIT	prod	3 1
gulp-util	3.0.8	5.36 kB	MIT	prod	3 1
plexer	0.0.3	4.17 kB	MIT	prod
streamfilter	1.0.7	6.31 kB	MIT	prod

Recent Versions