A vulnerable version of tar is used

[stof]

See https://www.npmjs.com/advisories/803

[iwaduarte]

What to expect from here? Are we going to have an update? Response? Anything?

[stof]

Well, I hope that node-gyp could migrate to tar v4.4.2+ (or could convince the tar maintainers to backport the fix to a 3.x release if that's infeasible).
I don't know the node-gyp codebase (I'm not even using it directly. I'm an indirect user through node-sass) so I'm not confident providing a patch myself. But as the advisory is now public, I wanted to raise awareness that node-gyp is impacted. The discussion in the hackerone report mentioned that some popular app (probably unpkg.com based on some later comments) were impacted and should be patched before making it public. It's too bad that node-gyp was not identified for that as well.

[stof]

It looks like #1713 is working on it

[refack]

Fixed by #1713

[laurenfrederick]

@refack Are you going to do a release with this update? Thanks!

[refack]

Refs: #1718
The @nodejs/node-gyp team needs to make an explicit decision to drop support for node<4 for the node-gyp@3 branch. Other wise this will need to wait for node-gyp@4 (which should be out soon. Hopefully in parallel to node@12)...

[stof]

well, waiting for node-gyp@4 would mean that the non-vulnerable version would reach out the ecosystem only after each package migrate as well, which would take a huge amount of time (and they would still have to drop 0.10 and 0.12 to get the patch anyway).

[pwnpsasin]

Why the current version 3.8.0 (npjs.org) still uses the package of tar in the version 2.0.0 instead of 4.4.2?

[stof]

@pwnpsasin see the comment above. Upgrading tar requires dropping support for node<4 (as tar dropped it in 3.x) and that requires a decision from the team.

[ChALkeR]

@stof The way to address this in a way that would not require semver-major bumps of everything is isaacs/node-tar#212 (i.e. backport the security patch/patches to node-tar@2). They are willing to accept a backported patch and cut a release in case if anyone is willing to do the backporting work.