{"action":"created","issue":{"url":"https://api.github.com/repos/ethereum/web3.js/issues/1142","repository_url":"https://api.github.com/repos/ethereum/web3.js","labels_url":"https://api.github.com/repos/ethereum/web3.js/issues/1142/labels{/name}","comments_url":"https://api.github.com/repos/ethereum/web3.js/issues/1142/comments","events_url":"https://api.github.com/repos/ethereum/web3.js/issues/1142/events","html_url":"https://github.com/ethereum/web3.js/issues/1142","id":268487617,"number":1142,"title":"Security warning when installing web3.js","user":{"login":"antoniocapelo","id":3236388,"avatar_url":"https://avatars0.githubusercontent.com/u/3236388?v=4","gravatar_id":"","url":"https://api.github.com/users/antoniocapelo","html_url":"https://github.com/antoniocapelo","followers_url":"https://api.github.com/users/antoniocapelo/followers","following_url":"https://api.github.com/users/antoniocapelo/following{/other_user}","gists_url":"https://api.github.com/users/antoniocapelo/gists{/gist_id}","starred_url":"https://api.github.com/users/antoniocapelo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/antoniocapelo/subscriptions","organizations_url":"https://api.github.com/users/antoniocapelo/orgs","repos_url":"https://api.github.com/users/antoniocapelo/repos","events_url":"https://api.github.com/users/antoniocapelo/events{/privacy}","received_events_url":"https://api.github.com/users/antoniocapelo/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2017-10-25T17:44:15Z","updated_at":"2017-11-28T11:44:02Z","closed_at":null,"author_association":"NONE","body":"When installing the newest version of `web3` — 1.0.0-beta.24 — with npm, it gives the following output\r\n\r\n```\r\nnpm WARN deprecated minimatch@0.3.0: Please update to minimatch 3.0.2 or higher to avoid a RegExp DoS issue\r\n```\r\n\r\nThe cause of this issue can be checked [here](https://nodesecurity.io/check/web3). \r\n\r\nIt seems like web3 is pushing a subdependency of a `minimatch` version which has a known Regular Expression Denial of Service.\r\n\r\nI'm not entirely inside the codebase to know if this is indeed a risk we're taking.\r\n\r\nSome urgent advise regarding this issue is appreciated.\r\n\r\nThanks in advance."},"comment":{"url":"https://api.github.com/repos/ethereum/web3.js/issues/comments/347498531","html_url":"https://github.com/ethereum/web3.js/issues/1142#issuecomment-347498531","issue_url":"https://api.github.com/repos/ethereum/web3.js/issues/1142","id":347498531,"user":{"login":"lukehedger","id":1913316,"avatar_url":"https://avatars1.githubusercontent.com/u/1913316?v=4","gravatar_id":"","url":"https://api.github.com/users/lukehedger","html_url":"https://github.com/lukehedger","followers_url":"https://api.github.com/users/lukehedger/followers","following_url":"https://api.github.com/users/lukehedger/following{/other_user}","gists_url":"https://api.github.com/users/lukehedger/gists{/gist_id}","starred_url":"https://api.github.com/users/lukehedger/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lukehedger/subscriptions","organizations_url":"https://api.github.com/users/lukehedger/orgs","repos_url":"https://api.github.com/users/lukehedger/repos","events_url":"https://api.github.com/users/lukehedger/events{/privacy}","received_events_url":"https://api.github.com/users/lukehedger/received_events","type":"User","site_admin":false},"created_at":"2017-11-28T11:44:02Z","updated_at":"2017-11-28T11:44:02Z","author_association":"NONE","body":"This is an issue with `xhr-request` not `web3`. The issue has been raised on that repo (https://github.com/Jam3/xhr-request/issues/3) so this can be closed."}}
{"actor":{"display_login":"lukehedger"}}