Security vulnerabilities and automated fixes for node js issues
2 posts found
A Dependabot configuration file in a Node.js library was missing cooldown periods for both its `npm` and `github-actions` package ecosystem entries, meaning newly published (and potentially malicious) package versions could be proposed for immediate adoption. The fix adds a `cooldown` block with `default-days: 7` to each ecosystem entry, creating a critical 7-day buffer that allows the community to identify and flag compromised packages before they reach downstream consumers.
A high-severity misconfiguration in `.github/dependabot.yml` allowed Dependabot to propose updates to newly published package versions immediately—before the community has time to identify malicious or unstable releases. The fix adds a `cooldown` block with `default-days: 7` to both the `npm` and `github-actions` package ecosystem entries, creating a 7-day quarantine window that protects downstream consumers of this Node.js library.