You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The walletconnect dependencies on ethersproject inherit vulnerabilities from elliptic
npm upgrade and npm audit fix cannot clear them.
# npm audit report
elliptic <=6.5.7
Elliptic's EDDSA missing signature length check - https://github.com/advisories/GHSA-f7q4-pwc6-w24p
Elliptic's ECDSA missing check for whether leading bit of r and s is zero - https://github.com/advisories/GHSA-977x-g7h5-7qgw
Elliptic allows BER-encoded signatures - https://github.com/advisories/GHSA-49q7-c7j4-3p7m
Valid ECDSA signatures erroneously rejected in Elliptic - https://github.com/advisories/GHSA-fc9h-whq2-v747
Elliptic's verify function omits uniqueness validation - https://github.com/advisories/GHSA-434g-2637-qmqr
fix available via `npm audit fix`
node_modules/@ethersproject/signing-key/node_modules/elliptic
@ethersproject/signing-key <=5.7.0
Depends on vulnerable versions of elliptic
node_modules/@ethersproject/signing-key
@ethersproject/transactions <=5.7.0
Depends on vulnerable versions of @ethersproject/signing-key
node_modules/@ethersproject/transactions
@ethersproject/abstract-provider *
Depends on vulnerable versions of @ethersproject/transactions
node_modules/@ethersproject/abstract-provider
@ethersproject/abstract-signer *
Depends on vulnerable versions of @ethersproject/abstract-provider
node_modules/@ethersproject/abstract-signer
@ethersproject/hash 5.0.6 - 5.7.0
Depends on vulnerable versions of @ethersproject/abstract-signer
node_modules/@ethersproject/hash
@walletconnect/utils >=2.17.1-canary-0
Depends on vulnerable versions of @ethersproject/hash
Depends on vulnerable versions of @ethersproject/transactions
node_modules/@walletconnect/utils
@walletconnect/core >=2.17.1-canary-0
Depends on vulnerable versions of @walletconnect/utils
node_modules/@walletconnect/core
@walletconnect/sign-client >=2.17.1-canary-0
Depends on vulnerable versions of @walletconnect/core
Depends on vulnerable versions of @walletconnect/utils
node_modules/@walletconnect/sign-client
9 low severity vulnerabilities
The expected behavior
A clean audit. Wow. Of almost 1500 packages.
The text was updated successfully, but these errors were encountered:
Steps To Reproduce
The current behavior
The
walletconnect
dependencies onethersproject
inherit vulnerabilities fromelliptic
npm upgrade
andnpm audit fix
cannot clear them.The expected behavior
A clean audit. Wow. Of almost 1500 packages.
The text was updated successfully, but these errors were encountered: