Hold on, we're currently generating a fresh version of this report

Generated on Apr 15, 2024 via pnpm

openid-connect 1.2.4

This is an fully functional OAuth 2 server implementation, with support for OpenID Connect specification. Based on https://github.com/ammmir/node-oauth2-provider.

oauth2 provider

identity provider

Package summary

34

issues

6

licenses

Package created

31 Jul 2013

Version published

28 Sep 2015

Maintainers

2

Total deps

162

Direct deps

8

License

UNKNOWN

Issues

34

13 critical severity issues

lodash@3.10.1

Prototype Pollution in lodash

Recommendation: Upgrade to version 4.17.12 or later

via: lodash@3.10.1 & others

underscore@1.6.0

Arbitrary Code Execution in underscore

Recommendation: Upgrade to version 1.12.1 or later

via: modelling@0.0.3

minimist@1.2.0

Prototype Pollution in minimist

Recommendation: Upgrade to version 1.2.6 or later

via: modelling@0.0.3

clean-obj@0.1.2

Package has no specified license

Recommendation: Check the package code and files for license information

via: clean-obj@0.1.2

colors@0.6.2

Package has no specified license

Recommendation: Check the package code and files for license information

via: modelling@0.0.3

cycle@1.0.3

Package has no specified license

Recommendation: Check the package code and files for license information

via: modelling@0.0.3

jsonlint-lines@1.7.1

Package has no specified license

Recommendation: Check the package code and files for license information

via: modelling@0.0.3

modelling@0.0.3

Package has no specified license

Recommendation: Check the package code and files for license information

via: modelling@0.0.3

nomnom@1.8.1

Package has no specified license

Recommendation: Check the package code and files for license information

via: modelling@0.0.3

prompt@0.2.14

Package has no specified license

Recommendation: Check the package code and files for license information

via: modelling@0.0.3

redis@0.12.1

Package has no specified license

Recommendation: Check the package code and files for license information

via: sails-redis@0.10.7

trim@0.0.1

Package has no specified license

Recommendation: Check the package code and files for license information

via: modelling@0.0.3

utile@0.2.1

Package has no specified license

Recommendation: Check the package code and files for license information

via: modelling@0.0.3

10 high severity issues

jwt-simple@0.3.1

Signature Verification Bypass in jwt-simple

Recommendation: Upgrade to version 0.5.3 or later

via: jwt-simple@0.3.1

trim@0.0.1

Regular Expression Denial of Service in trim

Recommendation: Upgrade to version 0.0.3 or later

via: modelling@0.0.3

lodash@3.10.1

Prototype Pollution in lodash

Recommendation: Upgrade to version 4.17.11 or later

via: lodash@3.10.1 & others

lodash@3.10.1

Prototype Pollution in lodash

Recommendation: Upgrade to version 4.17.19 or later

via: lodash@3.10.1 & others

lodash@3.10.1

Command Injection in lodash

Recommendation: Upgrade to version 4.17.21 or later

via: lodash@3.10.1 & others

JSV@4.0.2

Package uses an invalid SPDX license ("FreeBSD")

Recommendation: Validate that the package complies with your license policy

via: modelling@0.0.3

revalidator@0.1.8

Package uses an invalid SPDX license ("Apache 2.0")

Recommendation: Validate that the package complies with your license policy

via: modelling@0.0.3

@mapbox/geojsonhint@2.0.1

Deprecated package

via: modelling@0.0.3

nomnom@1.8.1

Deprecated package

via: modelling@0.0.3

trim@0.0.1

Deprecated package

via: modelling@0.0.3

8 moderate severity issues

lodash@3.10.1

Regular Expression Denial of Service (ReDoS) in lodash

Recommendation: Upgrade to version 4.17.11 or later

via: lodash@3.10.1 & others

base64url@1.0.6

Out-of-bounds Read in base64url

Recommendation: Upgrade to version 3.0.0 or later

via: base64url@1.0.6

lodash@3.10.1

Regular Expression Denial of Service (ReDoS) in lodash

Recommendation: Upgrade to version 4.17.21 or later

via: lodash@3.10.1 & others

validator@4.4.0

Inefficient Regular Expression Complexity in validator.js

Recommendation: Upgrade to version 13.7.0 or later

via: modelling@0.0.3

minimist@1.2.0

Prototype Pollution in minimist

Recommendation: Upgrade to version 1.2.3 or later

via: modelling@0.0.3

JSV@4.0.2

Package has no specified source code repository

via: modelling@0.0.3

eyes@0.1.8

Package has no specified source code repository

via: modelling@0.0.3

trim@0.0.1

Package has no specified source code repository

via: modelling@0.0.3

3 low severity issues

lodash@3.10.1

Prototype Pollution in lodash

Recommendation: Upgrade to version 4.17.5 or later

via: lodash@3.10.1 & others

JSV@4.0.2

Package uses a license that is not OSI approved ("FreeBSD")

Recommendation: Read and validate the license terms

via: modelling@0.0.3

revalidator@0.1.8

Package uses a license that is not OSI approved ("Apache 2.0")

Recommendation: Read and validate the license terms

via: modelling@0.0.3

Licenses

MIT License

Permissive

OSI Approved

This is a human-readable summary of (and not a substitute for) the license. Disclaimer.

Can

commercial-use

modify

distribute

sublicense

private-use

Cannot

hold-liable

Must

include-copyright

include-license

138 Packages, Including:

@sailshq/lodash@3.10.6

anchor@0.11.6

ansi-regex@2.1.1

ansi-styles@1.0.0

ansi-styles@2.2.1

array-buffer-byte-length@1.0.1

async@0.2.10

async@1.2.1

async@1.5.2

available-typed-arrays@1.0.7

balanced-match@1.0.2

base64url@1.0.6

bindings@1.5.0

bluebird@2.9.34

brace-expansion@1.1.11

call-bind@1.0.7

camelcase-keys@1.0.0

camelcase@1.2.1

chalk@0.4.0

chalk@1.1.3

code-point-at@1.1.0

concat-map@0.0.1

concat-stream@1.4.11

concat-stream@1.5.2

core-util-is@1.0.3

deep-diff@0.3.8

deep-equal@2.2.3

define-data-property@1.1.4

define-properties@1.2.1

es-define-property@1.0.0

es-errors@1.3.0

es-get-iterator@1.1.3

escape-string-regexp@1.0.5

extend@3.0.2

eyes@0.1.8

file-uri-to-path@1.0.0

for-each@0.3.3

function-bind@1.1.2

functions-have-names@1.2.3

get-intrinsic@1.2.4

get-stdin@4.0.1

gopd@1.0.1

has-ansi@2.0.0

has-bigints@1.0.2

has-color@0.1.7

has-property-descriptors@1.0.2

has-proto@1.0.3

has-symbols@1.0.3

has-tostringtag@1.0.2

has@1.0.4

ISC License

Permissive

OSI Approved

This is a human-readable summary of (and not a substitute for) the license. Disclaimer.

Can

commercial-use

modify

distribute

Cannot

hold-liable

Must

include-copyright

include-license

11 Packages, Including:

@mapbox/geojsonhint@2.0.1

fs.realpath@1.0.0

glob@7.2.3

inflight@1.0.6

inherits@2.0.4

minimatch@3.1.2

mute-stream@0.0.8

once@1.4.0

read@1.0.7

rimraf@2.7.1

wrappy@1.0.2

N/A

N/A

10 Packages, Including:

clean-obj@0.1.2

colors@0.6.2

cycle@1.0.3

jsonlint-lines@1.7.1

modelling@0.0.3

nomnom@1.8.1

prompt@0.2.14

redis@0.12.1

trim@0.0.1

utile@0.2.1

FreeBSD

Invalid

Not OSI Approved

1 Packages, Including:

JSV@4.0.2

BSD 3-Clause "New" or "Revised" License

Permissive

OSI Approved

This is a human-readable summary of (and not a substitute for) the license. Disclaimer.

Can

commercial-use

modify

distribute

place-warranty

Cannot

use-trademark

hold-liable

Must

include-copyright

include-license

1 Packages, Including:

hiredis@0.4.1

Apache 2.0

Invalid

Not OSI Approved

1 Packages, Including:

revalidator@0.1.8

Direct Dependencies

8

All Dependencies CSV

ⓘ This is a list of openid-connect 's direct dependencies. Data on all dependencies, including transitive ones, is available via CSV download.

Name	Version	Size	License	Type	Vulnerabilities
base64url	1.0.6	91.2 kB	MIT	prod	1
clean-obj	0.1.2	3.05 kB	UNKNOWN	prod	1
extend	3.0.2	7.09 kB	MIT	prod
jwt-simple	0.3.1	4.67 kB	MIT	prod	1
lodash	3.10.1	169.48 kB	MIT	prod	1 3 2 1
modelling	0.0.3	5.08 kB	UNKNOWN	prod	11 9 7 3
q	1.5.1	35.95 kB	MIT	prod
sails-redis	0.10.7	14.49 kB	MIT	prod	2 3 2 1

All Versions