Potential security issue: npm install reaching out outside npm registry or github

[irae]

While using an application level firewall (Little Snitch) I had an issue installing dependencies for this package.

It has dig.js as devDependency and dig.js has pinned dependencies to an external git repo.

As shown here:

$ npm info dig.js
...
dependencies:
cli: ^1.0.1
hexdump.js: git+https://git.coolaj86.com/coolaj86/hexdump.js#v1.0.4
dns-suite: git+https://git.coolaj86.com/coolaj86/dns-suite.js#v1.2
...

It seems to me that dig.js could be using the newer @root/[email protected] and [email protected] that are existing and won't cause the issue.

As evidenced by the dependency tree:

$ npm ls -a
@root/[email protected] /Users/irae/code/acme.js
...
│ ├─┬ [email protected] (git+https://git.coolaj86.com/coolaj86/dns-suite.js#092008f766540909d27c934211495c9e03705bf3)
│ │ ├── [email protected]
│ │ └── [email protected] deduped
│ └── [email protected] (git+https://git.coolaj86.com/coolaj86/hexdump.js#222fa7de5036a16397de2fe703c35ac54a3d8d0c)
├─┬ [email protected]
│ └── @root/[email protected]
├── [email protected]
└── [email protected]

Can you kindly update dig.js to remove the hardcoded git URLs, and then update acme.js to force the newer version?

Reasoning:

• Going outside of registry.npmjs.org avoids caching
• registry.npmjs.org is constantly patched for security vulnerabilities and is extensively under audit but a number of independent developers
• Higher security models will block external domains and install of this library could bail (highly reduced due to this being a dev dependency)
• No one knows the maintenance and security level of git.coolaj86.com, and all registrations are closed there (hence my issue on GitHub instead)
• since newer versions exist and if semver was followed there are no breaking changes, so the effort is likely very small
• acme.js is (an all of the greenlock related sub-projects are) a very sensitive project, as SSL key exfiltration being a critical security threat, not a small one
• Since it is all self hosted, it is not easy for the project to add new contributors who could fix security issues or regular maintenance tasks, such as consolidating sub-dependencies, as exemplified here.

@coolaj86 could you spend a little time just making sure everything is on the latest version, and on npm instead even if you don't change any code?