Malware in dependency

[quaspar]

ua-parser-js has been hijacked and installs malware on your computer. Check it’s npm page.
fix dependency to version 0.7.28 as later versions are dangerous.

[duskload]

@quaspar Thanks for the report. I use 0.7.28 and never was updated to 0.7.29.

react-device-detect/package.json

Line 65 in ebd50cd

"ua-parser-js": "^0.7.28"

[quaspar]

But the carret means you will get 0.7.29 if you update now. Change to 0.7.28 (without carret).

[duskload]

But the carret means you will get 0.7.29 if you update now. Change to 0.7.28 (without carret).

Thanks for pointing this out, you are right. I will update and upload new version soon.

[duskload]

@quaspar Thanks again, new version already on npm.

[bpod]

Maybe this should be locked to the latest patch version that came out? 0.7.30.

https://us-cert.cisa.gov/ncas/current-activity/2021/10/22/malware-discovered-popular-npm-package-ua-parser-js