Using outdated dependency flags dependency confusion attack [PR available]

[jackwhelpton]

Expected Behavior

Prior to v1.9.0, acorn-import-attributes (then called acorn-import-assertions) used an implicit/not fully qualified reference to a dependency (test262).

This causes security scanning tools to flag a possible dependency confusion attack.

Actual Behavior

No security warning

Steps to Reproduce the Problem

1. Run security scan (e.g. Orca) on code using this repo

Specifications

• Version: 1.7.3
• Platform: (all)
• Subsystem: (all)

[jackwhelpton]

I've raised a PR #70 that should resolve this, let me know what it would take to get this merged. My first contribution to this repo, so be gentle/let me know if edits are required.

[trentm]

Now that #70 is merged and 1.7.4 is released, I believe this can be closed?