Project Dead? Does it need more maintainers?

[OffensiveBias-08-145]

Project Dead? Does it need more maintainers?

[taylorjdawson]

This is now more important than ever. Someone needs to get in and fix this SSRF attack vulnerability

[x3cion]

To be fair, if your only means of protecting unsecured or vulnerable local resources from being access is a thin veil of node-ip this sounds like a much bigger institutional problem with the software depending on this.

I'm not panicked, but I can tell you that many IT projects do dependency checks as a first line of defense (e.g. npm audit). Being a base package to over 3k packages, this issue is blocking a lot of people. That's why the pressure is so high. I don't want to know how many are silently subscribed to #136, just to see when its fixed. :)

[indutny]

I'd be happy to give contributor bits and npm ownership to a person who has a track of maintaining some packages with reasonable download count. Thanks so much for raising this topic!

[alexporto2200]

Hey!
Is anyone helping you with this project? I was worried about some issues and saw that they are no longer accepting pr. I would like to help in some way.

[DevBrent]

This is now more important than ever. Someone needs to get in and fix this SSRF attack vulnerability

To be fair, if your only means of protecting unsecured or vulnerable local resources from being access is a thin veil of node-ip this sounds like a much bigger institutional problem with the software depending on this.

Does no one use AWS Security Groups? If you know you have potentially vulnerable or intentionally unauthenticated local services why would you use policies like GCP's default-allow-internal? Does no one understand their attack vectors?

Concerning that anyone is panicked about this one.