Should I be concerned about the vulnerabilities NPM shows during npm install?

user_11815188 0
Viewed 360

I have installed node-cron and after installation, it shows a bunch of warnings and some vulnerabilities.

npm WARN optional SKIPPING OPTIONAL DEPENDENCY: fsevents@2.1.3 (node_modules\fsevents):
npm WARN notsup SKIPPING OPTIONAL DEPENDENCY: Unsupported platform for fsevents@2.1.3: wanted {"os":"darwin","arch":"any"} (current: {"os":"win32","arch":"x64"})

+ node-cron@2.0.3
added 3 packages from 3 contributors and audited 414 packages in 12.837s
found 28 vulnerabilities (5 low, 16 moderate, 7 high)

So, should I be concerned about the vulnerabilities for production environment?

node.js production-environment javascript
1 Answers

Yes and No,

Vulnerabilities can create a loophole in your application to be easily targetted by malicious users and hackers,

What you can do is ignore in most of the cases, but if your application is dealing with sensitive content for which security is top priority try to find packages with 0 or fewer vulnerabilities, and try to solve those vulnerabilities by hiding your system behind a firewall or taking other security measures.

This is one of the great tools which can help

https://snyk.io/blog/ten-npm-security-best-practices/

user_71938380
Related