Bundled node_modules ships vulnerable fast-uri 3.1.5 (high, 4 GHSAs) and qs 6.15.2 (moderate, 2 GHSAs)

Summary

The npm tarball of @companion-ai/[email protected] ships a bundled node_modules/ inside the package (332 nested entries under node_modules/@companion-ai/feynman/node_modules/). Two of the bundled copies are in vulnerable ranges, and because they are bundled (shipped inside the tarball), consumers cannot fix them with npm audit fix, npm update, or overrides — npm audit keeps flagging the install no matter what the consumer tries.

Vulnerable bundled dependencies

fast-uri 3.1.5 — Severity: HIGH (vulnerable range 3.0.0–3.1.5, patched ≥ 3.1.6)

Advisories:

• https://github.com/advisories/GHSA-5jgf-p345-68v8 — host confusion via skipped IDN canonicalization on scheme-relative references
• https://github.com/advisories/GHSA-f65p-4m7j-42xc — SSRF via malformed IPv6 normalization
• https://github.com/advisories/GHSA-fph4-wmhf-6fwf — SSRF via repeated hostname percent-decoding
• https://github.com/advisories/GHSA-jqff-g426-hqxp — host confusion via percent-encoded scheme normalization

Pulled in by bundled [email protected] (fast-uri: ^3.0.1) → 3.1.6+ is a drop-in within the declared range.

qs 6.15.2 — Severity: MODERATE (vulnerable range 2.2.5–6.15.3, patched 6.16.0)

Advisories:

• https://github.com/advisories/GHSA-x5fp-wj9c-mxmx — array-limit bypass via bracket-key comma parsing
• https://github.com/advisories/GHSA-4mjr-xmp4-gh2g — DoS via attacker-controlled isBuffer

Pulled in by bundled express@^6.14.0 / body-parser@^6.15.2 → 6.16.0 is a drop-in within the declared ranges.

Why this matters for Feynman specifically

Feynman is a web-research agent that fetches arbitrary URLs and runs a local workbench server. Host-confusion/SSRF flaws in URI parsing and a DoS in query parsing are directly relevant to that threat surface.

Steps to reproduce

npm install @companion-ai/feynman   # or: pi install npm:@companion-ai/feynman
npm audit
# → 2 vulnerabilities (1 moderate, 1 high), both pointing at
#    node_modules/@companion-ai/feynman/node_modules/{fast-uri,qs}

# confirm the bundled copies:
grep '"version"' node_modules/@companion-ai/feynman/node_modules/fast-uri/package.json  # 3.1.5
grep '"version"' node_modules/@companion-ai/feynman/node_modules/qs/package.json        # 6.15.2

# consumer-side fixes all fail:
npm audit fix           # → still 2 vulnerabilities
npm update fast-uri qs  # → still 2 vulnerabilities
# overrides in package.json → applied to manifests but bundled copies still win
# even deleting node_modules + package-lock.json and reinstalling → same bundled 3.1.5/6.15.2

Current workaround (fragile)

Hand-replace the two directories inside node_modules/@companion-ai/feynman/node_modules/ with the patched versions and hand-edit package-lock.json to match. This is reverted on every reinstall/update of feynman.

Suggested fix

Bump the bundled fast-uri to ≥ 3.1.6 and qs to ≥ 6.16.0 before publishing (both are same-major drop-ins for the current consumers), or stop bundling node_modules/ in the published tarball so security fixes can flow through the normal dependency resolution.

Environment

• @companion-ai/feynman 0.3.47 (installed as a pi package via pi install npm:@companion-ai/feynman)
• Node v26.8.1, npm 12.0.2, Linux (WSL2)

Reported by @NgThachThanh