Potential security issue with dependency, underlying maintainers seem unresponsive.

[parktheredcar]

There seems to be something suspicious going on in your dependency chain, and maintainers down the line aren't being super responsive. Just wanted to get this on your radar.

`-- [email protected]
  `-- [email protected]
    `-- [email protected]
      `-- [email protected]
        `-- [email protected]

indexzero/ps-tree#33

dominictarr/event-stream#116

[cnorthwood]

Think this is a dupe of #1451

[parktheredcar]

You're right, it was just still hanging around in my package-lock.json for some reason. Reinstalling nodemon cleared it out.

[indexzero]

FYI [email protected] locked to [email protected] (which if I read this thread correctly pre-dates the questionable changes).

Thanks to folks for bringing it to my attention: indexzero/ps-tree#34

[gftea]

also found by Symantec
Scan type: Scheduled Scan
Event: Security Risk Found!
Security risk detected: Trojan.Malscript
File: .....node_modules\flatmap-stream\index.min.js
Location: Deleted or access blocked

[remy]

@gftea upgrade to the patched/latest nodemon, it would have saved you from posting