Fixing Vulnerability in My Package

I found vulnerability in my repository from the github notifications.

According to this this tweet, the original maintainer transferred ownership to someone they didn't trust.

Now I know what is the vulnerable package, but still have no idea which dependency is the problem. Let's see what npm audit gives us. I found nodemon uses malicious dependency package.

nodemon already updated new version vulnerableility fixed! So we can download the latest version of it.

With npm outdated command, can check if there's an update for the installed packages.

• The Current column means the version installed locally.
• The Wanted colomn tell us the latest version of the package we can upgrade to without breaking our existing code.

If you want to latest version, type npm install [PACKAGE-NAME]@latest and add an option --save for updating only this package.

Awesome! Now we removed vulnerabilities from our packages!