3 ms·
npm audit is pretty damn meaningless at the moment. Creating a bog-standard react app with create-react-app (`npx create-react-app my-app`) right now results in
by oefrha 5y ago
npm audit is pretty damn meaningless at the moment. Creating a bog-standard react app with create-react-app (`npx create-react-app my-app`) right now results in
> 68 vulnerabilities (21 moderate, 45 high, 2 critical)
Even installing the latest npm itself (`npm install -g npm@8.1.1`) results in
> 3 moderate severity vulnerabilities
- bjornstar 5y agocreate-react-app made their own security problems by bringing in the entire world, npm audit just makes that clear. npm itself having vulnerabilities is a more serious problem and it's not clear that they're taking it seriously.