NPM vulnerabilities - requires manual review

user_8958754 0
Viewed 6042

Whilst starting a new project and running npm install I got a couple of vulnerabilities w.r.t http and https proxy. Running npm audit fix doesn't appear to fix them.

I have also tried manually updating to the latest version available such as npm install https-proxy-agent@2.2.1 which successfully adds package (with no repo field warning) yet when i run npm audit the 2 vulnerabilities persist. Is this potentially down to multiple copies of http-proxy?

Many thanks in advance

npm vunerabilities

node-http-proxy npm node.js
1 Answers

The warnings about the vulnerabilities are caused by the deprecated typings package because it has a dependency on popsicle-proxy-agent which uses an old version of https-proxy-agent (The warnings give you those information under the Dependency of and Path labels). Remove the deprecated package and install your typings via npm install @types/<package>.

user_74977630
Related