One of the nested dependencies "elliptic" has security vulnerability

[tanmayghosh2507]

The karma-typescript package has been flagged in my organization's compliance report since the elliptic npm package that it uses, is not recommended.

Description Provided: all versions of elliptic are vulnerable to Timing Attack through side-channels.

Hence wondering, if there is any plan to fix the vulnerability.

[erikbarke]

This is a tough one, since elliptic is a sub dependency:

[email protected]
└─┬ [email protected]
  ├─┬ [email protected]
    └── [email protected]

And the elliptic dev seems to be aware of the issue but has no plans to fix it: indutny/elliptic#128.

Removing the crypto-browserify isn't feasible, it would break a lot of backwards compatibility, and alternatives like brix/crypto-jsseems to have the same vulnerability: brix/crypto-js#88 😞