This is related to security concern how depedency management is handled in this library.
NPM packages in package.json aren't pinned to specific versions. Even though there is a package-lock.json file in the repo, it doesn't help the end-user since it isn't included in the final published package. This leaves the library wide open to the kind of supply chain attacks we recently saw with Axios, which this package relies on directly.
You can see the details of that specific incident here:
- https://www.trendmicro.com/en_us/research/26/c/axios-npm-package-compromised.html
- https://www.elastic.co/security-labs/axios-one-rat-to-rule-them-all
For an enterprise-grade library like this, security is a huge priority for those of us using it. Many developers install kiteconnectjs on VPS instances that hold sensitive cloud credentials or API keys. If a dependency is compromised, those credentials are at immediate risk.
My first hand experience - When I updated to the latest version recently, it pulled Axios 1.14.0. I realized afterward that I was just lucky with my timing. If I had run that update while Axios was compromised, it would have pulled version 1.14.1 and likely leaked my environment variables and keys.
This is related to security concern how depedency management is handled in this library.
NPM packages in
package.jsonaren't pinned to specific versions. Even though there is apackage-lock.jsonfile in the repo, it doesn't help the end-user since it isn't included in the final published package. This leaves the library wide open to the kind of supply chain attacks we recently saw withAxios, which this package relies on directly.You can see the details of that specific incident here:
For an enterprise-grade library like this, security is a huge priority for those of us using it. Many developers install kiteconnectjs on VPS instances that hold sensitive cloud credentials or API keys. If a dependency is compromised, those credentials are at immediate risk.
My first hand experience - When I updated to the latest version recently, it pulled Axios 1.14.0. I realized afterward that I was just lucky with my timing. If I had run that update while Axios was compromised, it would have pulled version 1.14.1 and likely leaked my environment variables and keys.