Package
gitlab-rails-ce-assets-19.5
Component
npm
Latest update
7.8
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Justification
Impact
CVE-2018-7408 affects the npm command-line package. The file matched is the manifest of the VS Code built-in npm extension (publisher vscode, version 1.0.1), which adds npm task and script support to the editor. The extension ships its own JavaScript, a small browser bundle (dist/browser/npmBrowserMain.js), that contains no code from the npm CLI package, and scanners match it only because the names are identical.
Status