Proxies are complicated: RCE vulnerability in a 3 million downloads/week NPM package

Pac-Resolver , a widely used NPM dependency, had a high-severity RCE (Remote Code Execution) vulnerability that could allow network administrators or other malicious actors on your local network to remotely run arbitrary code inside your Node.js process whenever you tried to send an HTTP request. This is bad! This package is used for PAC file support in Pac-Proxy-Agent , which is used in turn in Proxy-Agent , which then used all over the place as the standard go-to package for HTTP proxy autodetection & configuration in Node.js.