various ssl keys exposed while installing artillery

[meetveera]

I am running Aqua scan of my docker image where I also install artillery. But after the scan I am getting the following results and I am not able to push the image to my registry.
artillery/node_modules/hpagent/test/ssl.key
artillery/node_modules/node-gyp/test/fixtures/server.key
artillery/node_modules/proxy-agent/test/ssl-cert-snakeoil.key

Since we do not have control over packages that gets installed when used the npm command to install artillery. Due to this reason the aqua scans are unsuccessfull as it exposes some of the ssl keys which is not good.

Also some of the dependencies below are showing critical issues during the Aqua scan
/artillery/node_modules/formidable

[hassy]

Hi @meetveera! All of those look like keys used for automated tests of those dependencies. Unfortunately, none of them are optional for Artillery and there's no quick fix we can offer.

Not familiar with Aqua scanner, but I presume it has an option to ignore false-positives?

[hassy]

Do you have a CVE number for formidable?

We use Snyk and GitHub's security scanner and neither seem to be reporting an issue with it.

For ws we have an open PR here: #1502

[meetveera]

@hassy Below is the link to the CVE for formidable:
CVE for Formidable

[hassy]

Artillery v2 does not seem to depend on formidable. You can check yourself with npm ls | grep formidable. Which version of Artillery are you installing?

[meetveera]

I am install the latest version everytime using the below command
npm install -g artillery
And the scan always gives me the formidable package installed under node_modules of artillery

[hassy]

thank you @meetveera! I was wrong - formidable is indeed in the dependency tree (as a dependency of a dependency of `artillery-plugin-publish-metrics). We'll update it in the upcoming release.