[BUG] npm audit does not show the package from package.json that depends on the vulnerable package

[dandv]

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

npm audit does not output which of the packages from the package.json dependencies depends on the detected vulnerable package(s).

Expected Behavior

npm should tell me which of the packages I'm using depend(s) on the vulnerable package(s), so that I can update or replace it/them.

Steps To Reproduce

1. git clone https://github.com/dandv/npm-audit-bug.git && cd npm-audit-bug
2. npm install
3. npm audit
4. Notice the output doesn't mention which of the user's packages from package.json depends on the vulnerable package.

Environment

• npm: 10.6.0
• Node.js: 18.19.0
• OS Name: Fedora Linux 38
• npm config:

; "global" config from /etc/npmrc

; prefix = "/usr/local" ; overridden by user
python = "/usr/bin/python3" 

; "user" config from /home/dandv/.npmrc

prefix = "/home/dandv/.local" 

; node bin location = /usr/bin/node-18
; node version = v18.19.0
; npm local prefix = /home/dandv/prg/npm-audit-bug
; npm version = 10.6.0
; cwd = /home/dandv/prg/npm-audit-bug
; HOME = /home/dandv
; Run `npm config ls -l` to show all defaults.

[leobalter]

Thanks for the report! Improvements to the audit experience are under consideration but we don't have a timeline to share at the moment.

[jepperaskdk]

I have the same issue. Ideally this should include the full link from the root package in package.json to the vulnerable package.

[everett1992]

I believe this can affect npm audit fix, as npm won't check for upgrades to the omitted packages.

$ npm explain google-gax
google-gax@3.6.1
node_modules/@google-cloud/pubsub/node_modules/google-gax
  google-gax@"^3.6.1" from @google-cloud/pubsub@3.7.5
  node_modules/@google-cloud/pubsub
    @google-cloud/pubsub@"^3.0.1" from firebase-tools@13.7.5
    node_modules/firebase-tools
      firebase-tools@"^13.6.0" from the root project

Npm won't check if google-gax can be avoided by installing a different version of firebase-tools.

[everett1992]

https://github.com/npm/cli/blob/latest/workspaces/arborist/lib/audit-report.js#L181

Here, while evaluating the edge dep=firebase-tools@13.7.5, spec=^3.0.1, node=@google-cloud/pubsub@3.7.5
meta.testVersion(dep.version, spec) returns false.

meta is calculated from this.calculator.calculate(dep.packageName, advisory), where the advisory is

# Adv
@google-cloud/pubsub 2.11.1-pre || 3.1.1 - 3.7.5
Depends on vulnerable versions of google-gax

# Meta
firebase-tools <0.0.0-0
Depends on vulnerable versions of @google-cloud/pubsub

That meta appears to be correct, ^3.0.1 could be resolved to 3.0.1, 3.0.3, or 3.1.0 which do not depend on google-gax.
Tho there are not upgrades that are not vulnerable.

$ npm info 'firebase-tools@^13.7.5' 'dependencies.@google-cloud/pubsub'
firebase-tools@13.7.5 '^3.0.1'

$ npm info '@google-cloud/pubsub@^3.0.1' version
@google-cloud/pubsub@3.0.1 '3.0.1'
@google-cloud/pubsub@3.0.3 '3.0.3'
@google-cloud/pubsub@3.1.0 '3.1.0'
@google-cloud/pubsub@3.1.1 '3.1.1'
...
@google-cloud/pubsub@3.7.5 '3.7.5'

Because firebase-tools@13.7.5 is 'not vulnerable' npm doesn't trace it to the root project, or consider upgrades to fix issue.

I think I agree with the choice (bug?) to not downgrade @google-cloud/pubsub to 3.0.1, because that could re-introduce bugs that were fixed in later versions, and would be 'reverted' the next time the package-lock is upgraded.
But npm should show the path thru firebase-tools, and consider upgrades. In this case audit fix should have
considered upgrading firebase-tools to 13.10.0/13.35.1 because that depends on @google-cloud/pubsub ^4.5.0 (not vuln) and matches the package's existing requirement of firebase-tools ^13.6.0