hoek node module vulnerability (CVE-2018-3728) defined in jane/package-lock.json

[ghost]

https://nvd.nist.gov/vuln/detail/CVE-2018-3728

hoek node module before 4.2.0 and 5.0.x before 5.0.3 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via 'merge' and 'applyToDefaults' functions, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existing property that will exist on all objects.

file jane/package-lock.json

    "hoek": {
      "version": "2.16.3",
      "resolved": "http://registry.npm.taobao.org/hoek/download/hoek-2.16.3.tgz",
      "integrity": "sha1-ILt0A9POo5jpHcRxCo/xuCdKJe0=",
      "dev": true
    }

[xianmin]

I have updated the npm packages and package-lock.json. I'm not sure if this problem is fixed.

[Zebradil]

Still have

        "hoek": {
          "version": "2.16.3",
          "resolved": "https://registry.npmjs.org/hoek/-/hoek-2.16.3.tgz",
          "integrity": "sha1-ILt0A9POo5jpHcRxCo/xuCdKJe0=",
          "dev": true
        },

This version is required by hawk, sntp and boom packages. Not sure if we really can avoid these dependencies.

[xianmin]

Related issue:

sass/node-sass#2355