Found 4 vulnerabilities on npm install

Question

I am just getting started with react-native. On installing this package

npm install --save react-native-validator-form 

https://github.com/NewOldMax/react-native-validator-form/issues/3

I was prompted to npm audit and I was shown 4 vulnerabilities (listed above)

After running the 2 helper commands, I was prompted with another 2 vulnerabilities (see link)

How can I fix the remaining issues?

Updating the respective npm packages didn't work.

Not sure how to proceed?

Answer 1

This is a result of the new npm version including the audit command.

It isn't some new issue with the Angular CLI, npm just introduced new functionality in npm to warn users about vulnerabilities in the packages they're installing - so there's no "new" vulnerability in Angular, it's just that now npm is now warning you about vulnerabilities that already existed:

https://blog.npmjs.org/

Most of the issues stem from Karma, so it'd need to be fixed there for the Angular team to pull in a new Karma version karma-runner/karma#2994

Answer 2

If you have ran npm audit and got vulnerabilities, then you can have different scenarios:

Security vulnerabilities found with suggested updates

• Run the npm audit fix subcommand to automatically install compatible updates to vulnerable dependencies.

• Run the recommended commands individually to install updates to vulnerable dependencies. (Some updates may be semver-breaking changes; for more information, see "SEMVER warnings".)

Security vulnerabilities found requiring manual review

• If security vulnerabilities are found, but no patches are available, the audit report will provide information about the vulnerability so you can investigate further.

Source: Reviewing and acting on the security audit report