Generated on May 19, 2024 via pnpm

Npm

Home

okta-for-static-site 1.0.32

Use this npm module to serve your static site behind Okta Single Sign On

okta

static

site

server

cli

saml

Package summary

issues

licenses

Package created

3 Apr 2016

Version published

27 Dec 2017

Maintainers

Total deps

151

Direct deps

License

MIT

Issues

3 critical severity issues

critical

ejs@2.7.4

ejs template injection vulnerability

Recommendation: Upgrade to version 3.1.7 or later

via: passport-saml@0.31.0

xmldom@0.1.19

xmldom allows multiple root nodes in a DOM

Recommendation: None

via: passport-saml@0.31.0

pause@0.0.1

Package has no specified license

Recommendation: Check the package code and files for license information

via: passport@0.4.1

Collapse

Expand

11 high severity issues

high

xml-crypto@0.10.1

xml-crypto's HMAC-SHA1 signatures can bypass validation via key confusion

Recommendation: Upgrade to version 2.0.0 or later

via: passport-saml@0.31.0

passport-saml@0.31.0

Signature bypass via multiple root elements

Recommendation: Upgrade to version 3.2.2 or later

via: passport-saml@0.31.0

redis@2.8.0

Node-Redis potential exponential regex in monitor mode

Recommendation: Upgrade to version 3.1.1 or later

via: connect-redis@3.4.2

node-forge@0.7.6

Prototype Pollution in node-forge

Recommendation: Upgrade to version 0.10.0 or later

via: passport-saml@0.31.0

node-forge@0.7.6

Improper Verification of Cryptographic Signature in node-forge

Recommendation: Upgrade to version 1.3.0 or later

via: passport-saml@0.31.0

node-forge@0.7.6

Improper Verification of Cryptographic Signature in node-forge

Recommendation: Upgrade to version 1.3.0 or later

via: passport-saml@0.31.0

xmldom@0.1.19

Package uses an invalid SPDX license ("LGPL")

Recommendation: Validate that the package complies with your license policy

via: passport-saml@0.31.0

ejs@2.7.4

Package uses postinstall script: "node ./postinstall.js"

via: passport-saml@0.31.0

passport-saml@0.31.0

Deprecated package

via: passport-saml@0.31.0

xmldom@0.1.19

Deprecated package

via: passport-saml@0.31.0

xmldom@0.1.31

Deprecated package

via: passport-saml@0.31.0

Collapse

Expand

11 moderate severity issues

moderate

mem@1.1.0

Denial of Service in mem

Recommendation: Upgrade to version 4.0.0 or later

via: yargs@10.1.2

node-forge@0.7.6

Improper Verification of Cryptographic Signature in `node-forge`

Recommendation: Upgrade to version 1.3.0 or later

via: passport-saml@0.31.0

yargs-parser@8.1.0

yargs-parser Vulnerable to Prototype Pollution

Recommendation: Upgrade to version 13.1.2 or later

via: yargs@10.1.2

xmldom@0.1.19

Misinterpretation of malicious XML input

Recommendation: Upgrade to version 0.5.0 or later

via: passport-saml@0.31.0

passport@0.4.1

Passport vulnerable to session regeneration when a users logs in or out

Recommendation: Upgrade to version 0.6.0 or later

via: passport@0.4.1

node-forge@0.7.6

Open Redirect in node-forge

Recommendation: Upgrade to version 1.0.0 or later

via: passport-saml@0.31.0

passport-saml@0.31.0

Unlimited transforms allowed for signed nodes

Recommendation: Upgrade to version 3.1.0 or later

via: passport-saml@0.31.0

xmldom@0.1.19

Misinterpretation of malicious XML input

Recommendation: None

via: passport-saml@0.31.0

xml2js@0.4.23

xml2js is vulnerable to prototype pollution

Recommendation: Upgrade to version 0.5.0 or later

via: passport-saml@0.31.0

ejs@2.7.4

ejs lacks certain pollution protection

Recommendation: Upgrade to version 3.1.10 or later

via: passport-saml@0.31.0

pause@0.0.1

Package has no specified source code repository

via: passport@0.4.1

Collapse

Expand

4 low severity issues

low

node-forge@0.7.6

Prototype Pollution in node-forge debug API.

Recommendation: Upgrade to version 1.0.0 or later

via: passport-saml@0.31.0

node-forge@0.7.6

Prototype Pollution in node-forge util.setPath API

Recommendation: Upgrade to version 0.10.0 or later

via: passport-saml@0.31.0

node-forge@0.7.6

URL parsing in node-forge could lead to undesired behavior.

Recommendation: Upgrade to version 1.0.0 or later

via: passport-saml@0.31.0

xmldom@0.1.19

Package uses a license that is not OSI approved ("LGPL")

Recommendation: Read and validate the license terms

via: passport-saml@0.31.0

Collapse

Expand

Licenses

MIT License

Permissive

OSI Approved

This is a human-readable summary of (and not a substitute for) the license. Disclaimer.

Can

commercial-use

modify

distribute

sublicense

private-use

Cannot

hold-liable

Must

include-copyright

include-license

129 Packages, Including:

accepts@1.3.8

ansi-regex@2.1.1

ansi-regex@3.0.1

array-flatten@1.1.1

async@2.6.4

body-parser@1.20.2

bytes@3.0.0

bytes@3.1.2

call-bind@1.0.7

camelcase@4.1.0

code-point-at@1.1.0

compressible@2.0.18

compression@1.7.4

connect-redis@3.4.2

content-disposition@0.5.4

content-type@1.0.5

cookie-parser@1.4.6

cookie-signature@1.0.6

cookie-signature@1.0.7

cookie@0.4.1

cookie@0.6.0

cross-spawn@5.1.0

debug@2.6.9

debug@4.3.4

decamelize@1.2.0

define-data-property@1.1.4

depd@2.0.0

destroy@1.2.0

double-ended-queue@2.1.0-0

ee-first@1.1.1

encodeurl@1.0.2

es-define-property@1.0.0

es-errors@1.3.0

escape-html@1.0.3

etag@1.8.1

execa@0.7.0

express-session@1.18.0

express@4.19.2

finalhandler@1.2.0

find-up@2.1.0

forwarded@0.2.0

fresh@0.5.2

function-bind@1.1.2

get-intrinsic@1.2.4

get-stream@3.0.0

gopd@1.0.1

has-property-descriptors@1.0.2

has-proto@1.0.3

has-symbols@1.0.3

hasown@2.0.2

ISC License

Permissive

OSI Approved

This is a human-readable summary of (and not a substitute for) the license. Disclaimer.

Can

commercial-use

modify

distribute

Cannot

hold-liable

Must

include-copyright

include-license

16 Packages, Including:

cliui@4.1.0

get-caller-file@1.0.3

inherits@2.0.4

isexe@2.0.0

lru-cache@4.1.5

pseudomap@1.0.2

require-main-filename@1.0.1

sax@1.3.0

set-blocking@2.0.0

setprototypeof@1.2.0

signal-exit@3.0.7

which-module@2.0.1

which@1.3.1

y18n@3.2.2

yallist@2.1.2

yargs-parser@8.1.0

Apache License 2.0

Permissive

OSI Approved

This is a human-readable summary of (and not a substitute for) the license. Disclaimer.

Can

commercial-use

modify

distribute

sublicense

private-use

use-patent-claims

place-warranty

Cannot

hold-liable

use-trademark

Must

include-copyright

include-license

state-changes

include-notice

1 Packages, Including:

ejs@2.7.4

(BSD-3-Clause OR GPL-2.0)

Permissive

1 Packages, Including:

node-forge@0.7.6

N/A

1 Packages, Including:

pause@0.0.1

BSD 3-Clause "New" or "Revised" License

Permissive

OSI Approved

This is a human-readable summary of (and not a substitute for) the license. Disclaimer.

Can

commercial-use

modify

distribute

place-warranty

Cannot

use-trademark

hold-liable

Must

include-copyright

include-license

1 Packages, Including:

qs@6.11.0

LGPL

Invalid

Not OSI Approved

1 Packages, Including:

xmldom@0.1.19

(LGPL-2.0 or MIT)

Permissive

1 Packages, Including:

xmldom@0.1.31

Direct Dependencies

All Dependencies CSV

ⓘ This is a list of okta-for-static-site 's direct dependencies. Data on all dependencies, including transitive ones, is available via CSV download.

Name	Version	Size	License	Type	Vulnerabilities
body-parser	1.20.2	14.75 kB	MIT	prod
compression	1.7.4	7.64 kB	MIT	prod
connect-redis	3.4.2	7.99 kB	MIT	prod	1
cookie-parser	1.4.6	4.2 kB	MIT	prod
express-session	1.18.0	22.25 kB	MIT	prod
express	4.19.2	209.73 kB	MIT	prod
passport-saml	0.31.0	137.36 kB	MIT	prod	2 10 7 4
passport	0.4.1	12.67 kB	MIT	prod	1 2
yargs	10.1.2	57.68 kB	MIT	prod	2