Report vulnerabilities privately to the maintainer (see package.json repository → Issues, or email the npm account owner). Do not open public issues for undisclosed vulnerabilities.

• Advisory: GHSA-5v7r-6r5c-r473 — infinite loop in the ASF parser on malformed input with a zero-size sub-header (moderate). Surfaces as ~8 entries in npm audit (the chain plus its parents).
• Path: @nut-tree-fork/nut-js → jimp@0.22 → @jimp/core → file-type@16.5.4.
• Why unpatched downstream:
  • @nut-tree-fork/nut-js@4.2.6 is the latest release and hard-pins jimp@0.22.10.
  • Every jimp@0.22.x (incl. the latest 0.22.12) pins file-type ^16.5.4; the entire 16.x line is in the vulnerable range. There is no patch-level escape.
  • The patched file-type (>= 21.3.2) only arrives with jimp@1.x, a breaking rewrite that nut-js@4.2.6 is not built against.
  • npm honors the overrides field only from the root project, so an overrides entry shipped inside regaos (a dependency) cannot force a consumer's nested file-type.
• Reachability in regaos: none. jimp is used solely by nut-js for on-screen image matching of regaos-captured PNG screenshots. regaos never parses untrusted ASF (Windows Media audio) input, so the vulnerable code path is never executed.
• Decision: accepted. The risk is a self-inflicted DoS only, on input regaos does not handle. Forking and migrating nut-js to jimp@1.x is disproportionate to the risk.

If you build or audit from this repo, the root overrides block in package.json pins file-type to a patched release, so npm audit / pnpm audit against the workspace reports clean:

"overrides": { "file-type": "22.0.1" }

This will be removed once @nut-tree-fork/nut-js ships a release built on jimp@1.x.