Importance of NPM vulnerabilities for build processes

Question

I may be a little bit behind, but I just upgraded NPM yesterday and now I'm getting all sorts of vulnerabilities with module dependencies like, prototype pollution, memory exposure and regular expression denial of service.

All I'm using the packages for is compiling, renaming, "uglifying" and compressing my assets using a build process like gulp or webpack.

So, I guess I'm wondering how important it is to fix these vulnerabilities or how relevant they are to my process given they are only used locally to build my assets (scss -> css, babel and image compression).

My hunch is that while you always want to error on the side of caution, since they're not being used on a node server or any live process, user input, etc...it may not matter as much as I had originally thought. Am I way off?

Answer 1

Your hunch is right ...but be cautious.

Use NPM's cli command, npm-audit to run a security audit and check each of the listed vulnerabilities in order to conclude the dangers according to your situation.

You can try to fix these vulnerabilities by running:

npm audit fix

...but often times, this will resolve only some of your vulnerability warnings by trying to updating these dependencies in question to the next possible semver version without breaking functionality.

Basically, UNTIL you have these packages with notices and cautions running as just generator scripts, build tasks, and automations, you'll be fine.

But as soon as possible, update them to their latest versions. I would recommend npm-check-updates for checking more recent versions of the installed packages.