Badabinski

Sheesh, it’s 5 GB with pnpm. Isn’t that meant to deduplicate dependencies?

Anywho, it looks like --prod isn’t being set in the Dockerfile, so dev dependencies are being included. I’m no node dev, but I remember this being something that people needed to set to shrink node_modules with npm. That might be an easy win.

Here’s the CVE author’s post on the issue if you’d like a more thorough explanation: https://maccarita.com/posts/idesaster/

Relevant XKCD.

Yeah, Pokemon cards were like beanie babies back in the very late nineties and early aughts. People were OBSESSED with the value of their collections.