Skip to content

fix: resolve critical/high security vulnerabilities via npm overrides#140

Open
thebookofiz wants to merge 1 commit intomainfrom
fix/security-vulnerabilities
Open

fix: resolve critical/high security vulnerabilities via npm overrides#140
thebookofiz wants to merge 1 commit intomainfrom
fix/security-vulnerabilities

Conversation

@thebookofiz
Copy link
Copy Markdown
Collaborator

Summary

Resolved critical and high severity security vulnerabilities in intuition-beta-contracts by adding npm overrides.

Changes

  • Added overrides field to package.json to force elliptic >=6.5.8
  • This resolves the elliptic private key extraction vulnerability and related issues

Vulnerability Reduction

  • Before: 6 vulnerabilities (1 moderate, 2 high, 3 critical)
  • After: 15 vulnerabilities (all low severity)

The remaining low severity issues would require migrating to ethers v6 (breaking change).

Testing

  • npm audit now shows only low severity vulnerabilities
  • Build tools (forge) not affected as these are dev dependencies

- Added overrides to force elliptic >=6.5.8
- Reduced vulnerabilities from 6 (1 moderate, 2 high, 3 critical) to 15 (all low severity)
- Remaining low severity issues would require ethers v6 migration (breaking change)
@github-actions
Copy link
Copy Markdown

github-actions Bot commented Mar 2, 2026

Summary of Test Results if Merged To Main:

  • Full logs & artifacts are available in the Actions tab
  • This comment will update automatically with new CI runs

⚠️ No test results found

🔒 Security Analysis

⚠️ No security analysis results found

⛽ Gas Analysis

⚠️ No gas snapshot generated

@Hashlock-Auditing
Copy link
Copy Markdown

Hey Team! Came across your work on this project while browsing Github. What your team is doing looks interesting to us and our clients. Did you want to jump on a call to discuss? My TG is @Hashlocked

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants