readable-stream@2 mutates core-util-is

[kumavis]

The current used version of readable-stream (v2) mutates the exports of core-util-is.

This is likely not intentional, but the side effect of a poorly constructed polyfill

/*<replacement>*/
var util = require('core-util-is');
util.inherits = require('inherits');
/*</replacement>*/

I'm building a plugin for browserify to reduce the risk of software supplychain attacks from the dependency graph. One of its protections is that is prevents the module.exports being mutated externally.

While I have seen this pattern with modules within a package, I haven't seen this pattern across packages, with the exception of this old version of readable-stream

I have verified this is resolved in v3

[kumavis]

here it is in the most recent v2 commit (2018) https://github.com/nodejs/readable-stream/blob/b3cf9b1f46eaa1865930ae03b96d7a4a570746f0/lib/_stream_readable.js#L66-L69

[kumavis]

relevant PR for readable-stream@2 nodejs/readable-stream#423

[idpaterson]

Pull request nodejs/readable-stream#423 has been released in readable-stream@2.3.7