Too many vulnerabilities

Question

Too many vulnerabilities

jmeyers91 opened this issue 5 years ago · comments

When I install npx or run npm install in a project with npx installed, NPM spits out this:

found 36 vulnerabilities (6 low, 22 moderate, 8 high)
  run `npm audit fix` to fix them, or `npm audit` for details

Every one of my project's "vulnerabilities" are coming from NPX. Why does NPX rely on so many dependencies with known vulnerabilities? I tend to avoid global dependencies, so I've been removing NPX from all my projects because our clients don't like seeing dozens of vulnerabilities. Should I only use NPX during development and install it globally or as a dev dependency? Should I just ignore NPM telling me I have 36 vulnerabilities?

Frédéric Harper · Answer 1 · Thu Mar 07 2019 02:56:52 GMT+0800 (China Standard Time)

We are looking at updating some of the dependencies.

Eric Holmes · Answer 2 · Wed Mar 20 2019 21:18:30 GMT+0800 (China Standard Time)

Any movement on this @fharper ? I'm only seeing one vulnerability, specifically with yargs has several releases since v11 as used in this. :)

Frédéric Harper · Answer 3 · Thu Mar 21 2019 01:32:14 GMT+0800 (China Standard Time)

@ewholmes : worst case, by the end of the week I'll merge a PR.

Frédéric Harper · Answer 4 · Fri Mar 22 2019 22:55:32 GMT+0800 (China Standard Time)

My modifications were merged, I'll also release a new version of npx.