CVE-2016-3956: The CLI in npm before 2.15.1 and 3.x before 3.8.3, as used in Node.js 0.10 before 0.10.44, 0.12 before 0.12.13, 4 before 4.4.2, and 5 before 5.10.0, includes bearer tokens with arbitrary requests, which allows remote HTTP servers to obtain sensitive information by reading Authorization headers.
Please fix it.
The package has not entered testing even though the delay is over
normal
The package has not entered testing even though the 2-day delay is over.Check why.
The URL(s) for this package had some recent persistent issueslow
DUCK reports some issues concerning upstream URLs defined for this package.
CVE-2016-3956: The CLI in npm before 2.15.1 and 3.x before 3.8.3, as used in Node.js 0.10 before 0.10.44, 0.12 before 0.12.13, 4 before 4.4.2, and 5 before 5.10.0, includes bearer tokens with arbitrary requests, which allows remote HTTP servers to obtain sensitive information by reading Authorization headers.
Please fix it.
Standards version of the package is outdated.
wishlist
The package should be updated to follow the last version of Debian Policy
(Standards-Version 4.2.0 instead of
4.1.0).
![[bug history graph]](https://qa.debian.org/data/bts/graphs/n/npm.png){kind=link}