StackPrism

npm package

ip vulnerabilities by version

The latest release, 2.0.1 (Feb 19, 2024), has 1 known vulnerability. 100% of last week’s 8M downloads went to versions with known vulnerabilities. OSV.dev lists 2 advisories for ip; the newest was published on Jun 2, 2024.

npm (opens in a new tab) describes it as “[![](https://badge.fury.io/js/ip.svg)](https://www.npmjs.com/package/ip)”

Latest release
2.0.1
Feb 19, 2024, 1 known vulnerabilities
Downloads last week
8M
All versions, from npm
Advisories on OSV.dev
2
Newest Jun 2, 2024
Licence
MIT
OpenSSF Scorecard
2.6/10
indutny/node-ip (opens in a new tab)

Most-downloaded versions last week

From npm’s per-version download counts for the last 7 days, each checked against OSV.dev. Open a version for its advisories and what to upgrade to.

VersionKnown vulnerabilitiesDownloads
1.1.5Mar 4, 20172 known vulnerabilities, worst rated critical2.9M
1.1.9Feb 19, 20241 known vulnerability, worst rated critical2M
2.0.0May 10, 20222 known vulnerabilities, worst rated critical1.3M
2.0.1latestFeb 19, 20241 known vulnerability, worst rated critical1M
1.1.8May 11, 20222 known vulnerabilities, worst rated critical789.9K
1.0.1Sep 10, 20152 known vulnerabilities, worst rated critical25.8K
0.3.3Jun 1, 20152 known vulnerabilities, worst rated critical5K
1.1.4Oct 31, 20162 known vulnerabilities, worst rated critical4.1K

Who is still on a vulnerable ip

100% of last week’s 8M ip downloads went to versions with known vulnerabilities.

From npm’s per-version download counts for the last 7 days, each version checked against OSV.dev. The versions checked cover over 99% of downloads.

Release lines

The newest release of each major line, from the registry. ip doesn’t publish support dates we can check.

LineNewest releaseReleased
22.0.1Feb 19, 2024
11.1.9Feb 19, 2024
0.30.3.3Jun 1, 2015
0.20.2.0Jan 18, 2014
0.10.1.0May 29, 2013
0.00.0.5Feb 20, 2013

Newest advisories

The 2 most recently published, with the versions each one affects.

  1. CriticalCVE-2024-29415 on OSV.dev (opens in a new tab)GHSA-2p57-rm9w-gvfp

    ip SSRF improper categorization in isPublic

    Affects <= 2.0.1. Published Jun 2, 2024.

  2. LowCVE-2023-42282 on OSV.dev (opens in a new tab)GHSA-78xj-cgh5-2h22

    NPM IP package incorrectly identifies some private IP addresses as public

    Affects >= 2.0.0, < 2.0.1; < 1.1.9. Published Feb 8, 2024.

Which ip do you have?

Paste a public GitHub repo or drop your package.json and see every vulnerable, end-of-life or deprecated dependency, with one fix task for your coding agent. Free, no sign-up.

Check your whole repo

How this page is checked

StackPrism reads every OSV.dev advisory for ip, merges duplicates filed under several ids, and asks OSV.dev which ones affect each version listed. Releases and their dates come from deps.dev, downloads from npm. No AI writes this page: every sentence comes from that data, refreshed every few hours.

Last checked against OSV.dev, CISA KEV, npm and deps.dev.