Hacker News Reader

-name "*coa*" is a bit too eager. It will flag other packages too, like the fairly popular babel-plugin-nullish-coalescing

View on HN

If you have an index for the locate command it's probably easier to do:

locate "/coa/package.json" | xargs -I {} jq .version {} 2>/dev/null

maybe print the command (`-t`) xargs executes, to make identification easier.

It's sort of a moot point since if you have an affected version you have to assume your whole system is compromised anyway in the case of this type of issue.

Reply on news.ycombinator.com