Search code examples
node.jsnpmdependenciesnpm-installnpm-audit

npm install vulnaribilities are different for different projects

Why would installing the same node package on two different projects lead to two different audit results? One has no vulnerabilties, one has two.

I can edit this description with information about the projects as needed.

One project contains no other modules, one contains a load of them. They're being run on the same computer.

enter image description here

enter image description here

Solution

  • Every time you run npm install it collects a description of all the dependencies added to your project, sends it to the registry and asks for a report of known vulnerabilities. So the reason for different output is that in the second project you do have some vulnerable dependencies.

    You can run npm audit to see the details about vulnerable dependencies in the second project.

    If you do not want npm install to audit dependencies, you can run it with --no-audit argument.