[email protected] was compromised.

[ttahmouch]

Having written all of this, it looks like npmjs.org revoked 0.7.29 from even being available for download and 0.7.30 and 0.8.1 were both published on October 22, 2021. So it likely won't cause future issues because it won't even be possible to download the dependency, but some people may have had 0.7.29 on their machines and may have been compromised. I can remove this PR. I'm just not sure if it makes sense to leave it up for a while just for awareness.

---

[email protected] was compromised yesterday, October 22, 2021, because the author didn't have 2FA enabled. I think that npm dependency was targeted because it's one of the more popular dependencies and the attacker was leveraging it for crypto mining and environment stealing. I noticed a few of our transitive dependencies depend on "ua-parser-js": "^0.7.x" in gutenberg/trunk (and probably other repositories). Luckily, it's currently locked to 0.7.[23|28] in package-lock.json, but it may just be a matter of time before an npm update inadvertently updates the lock file.

0. If it is feasible, it looks like we may be able to leverage the package.json to only resolve "resolutions": { "**/ua-parser-js": "0.7.28" } from all transitive dependencies in the meantime. That is what is done in this commit.
1. It doesn't appear that @types/ua-parser-js is resolving to 0.7.28. I'm unsure at the moment if it is even being used, and what dependency would even need the TypeScript types since presumably all of them should be exporting JavaScript modules that don't need compilation(?). Does someone else possibly know if the types are used, or if they even need to match the version of their counterpart JavaScript module?
2. Presumably, we'd want to remove the resolutions field from the package.json when appium and fbjs bump their, or transitive, package.jsons to ^0.7.30.

---

Security issue: compromised npm packages of ua-parser-js (0.7.29, 0.8.0, 1.0.0) - Questions about deprecated npm package ua-parser-js #536
Issue Comment
fbjs > [email protected]: this package has been hijacked #464

$ npm ls ua-parser-js
[email protected] /Users/ttahmouch/Desktop/src/gutenberg
├─┬ @wordpress/[email protected] -> /Users/ttahmouch/Desktop/src/gutenberg/packages/react-native-editor
│ ├─┬ UNMET PEER DEPENDENCY [email protected]
│ │ └─┬ [email protected]
│ │   └── [email protected]
│ └─┬ [email protected]
│   └─┬ [email protected]
│     └── [email protected]  deduped
└─┬ [email protected]
  └─┬ [email protected]
    └─┬ [email protected]
      └─┬ [email protected]
        └── [email protected]

Description

How has this been tested?

Screenshots

Types of changes

Checklist:

• My code is tested.
• My code follows the WordPress code style.
• My code follows the accessibility standards.
• I've tested my changes with keyboard and screen readers.
• My code has proper inline documentation.
• I've included developer documentation if appropriate.
• I've updated all React Native files affected by any refactorings/renamings in this PR (please manually search all *.native.js files for terms that need renaming or removal).

[gziolo]

Thank you for the report. It looks like the issue was resolved on the npm side so it should no longer be a concern for the repository. I see the version is pinned to 0.7.28 in the package-lock.json file so we are all good. The compromised version 0.7.29 is no longer available and 0.7.30 would get picked if we update the lock file with a newer version. @wordpress/react-native-editor is marked as a private package and it isn't published to npm so there isn't risk there, too.