One way to view it is that someone writes a package that their expected usage is as a build tool. It uses a library that has a input validation vulnerability.

One way to view it is that someone writes a package that their expected usage is as a build tool. It uses a library that has a input validation vulnerability. Since they view their tool as build tooling they mark their package as not impacted. Npm audit no longer shows the vulnerability. Someone uses that build tool in a production system in a way the maintainer never even considered. Npm audit shows nothing to that end user. They are vulnerable. People will say they misused the tool. But either way, shit gets compromised and it is something could have been prevented if you take the stance that the end user was paying attention to audit findings. And yes, many corporations and govt agencies take audit findings seriously. Hiding this because a maintainer said not impacted is scary IMO