Skip to content

NodeJS 0.12.13 does not seem to include npm LTS v2.15.1 #5985

Closed
Closed
NodeJS 0.12.13 does not seem to include npm LTS v2.15.1#5985
Labels
npmIssues and PRs related to the npm client dependency or the npm registry.questionIssues asking questions about Node.js.

Description

@elicwhite
elicwhite
opened on Apr 1, 2016

Per this post: https://nodejs.org/en/blog/vulnerability/npm-tokens-leak-march-2016/

Node 0.12.13 is supposed to include the patched npm version 2.15.1.

$ nvm install 0.12.13
######################################################################## 100.0%
Now using node v0.12.13
$ node -v
v0.12.13
$ npm -v
2.15.0

We confirmed this by compiling from source as well. Are we missing something?

Referencing this PR for more context: #5967

Activity

  1. mscdex
    added
    questionIssues asking questions about Node.js.
    npmIssues and PRs related to the npm client dependency or the npm registry.
    v0.12
    on Apr 1, 2016

  2. MylesBorins commented on Apr 1, 2016

    @MylesBorins
    MylesBorins
    on Apr 1, 2016
    Contributor

    @TheSavior thanks!

    I'm digging into this right now.

  3. elicwhite commented on Apr 1, 2016

    @elicwhite
    elicwhite
    on Apr 1, 2016
    Author

    From the email that just went out to nodejs-sec:

    Important note: Unfortunately the version of npm that was bundled with Node.js version v0.10.44, v0.12.13 and v4.4.2 did not include the correct version string, npm -v reports 2.15.0, however the code is v2.15.1 and includes the fix for the vulnerability.

  4. elicwhite commented on Apr 1, 2016

    @elicwhite
    elicwhite
    on Apr 1, 2016
    Author

    For those looking, see this PR for the fix: #5988

  5. Martii commented on Apr 1, 2016

    @Martii
    Martii
    on Apr 1, 2016

    Same with v4.4.2 ... guess I'll do $ sudo npm install npm@2.15.1 -g again. ;)

  6. jasnell commented on Jun 6, 2016

    @jasnell
    jasnell
    on Jun 6, 2016
    Member

    Looks like this was fixed.

  7. jasnell
    closed this as completedon Jun 6, 2016
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    npmIssues and PRs related to the npm client dependency or the npm registry.questionIssues asking questions about Node.js.

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions