Empresas
Empregos
  • Sobre nós
  • Soluções
    • Publicação de vagas
      Publique sua vaga e receba candidatos qualificados em 48h.
    • Avaliações de candidatos
      Mais de 500 testes técnicos e psicológicos, mais anti-fraude.
    • Headhunting
      Busca executiva personalizada do início ao fim.
    • Folha de Pagamento + EOR
      Dispersão de folha e EOR em mais de 15 países da LATAM.
  • Preços
  • Empregos

0

273
Visualizações
NPM-AUDIT find to high vulnerabilities. What am I supposed to do?

npm audit run on my project and got me this

High Command Injection
Dependency of @angular-devkit/build-angular [dev]

Path @angular-devkit/build-angular > @ngtools/webpack > tree-kill

More info https://npmjs.com/advisories/1432

High Command Injection

Package tree-kill

Patched in >=1.2.2

Dependency of @angular-devkit/build-angular [dev]

Path @angular-devkit/build-angular > tree-kill

More info https://npmjs.com/advisories/1432

Tree-kill needs to be updated, but is a dep of angular, not mine. So what? Need to wait that angular-team update its own package.json to a newer version of tree-kill?

over 4 years ago · Santiago Trujillo
3 Respostas
Responde à pergunta

0

You can fix this without waiting for a new version of the package @angular-devkit/build-angular.

Just do the following steps:

  1. Update your package.json file by adding resolutions section with proper version of package tree-kill:
"resolutions": {
  "tree-kill": "1.2.2"
}
  1. Update your package-lock.json by running command:
npx npm-force-resolutions
  1. Reinstall NPM packages in your project:
rm -r node_modules
npm install

Run npm audit to check that your project does not have anymore this problem. And don't forget to commit modified files package.json and package-lock.json.

More information about NPM Force Resolutions.

over 4 years ago · Santiago Trujillo Relatório

0

I was having the same problem today and I fixed it by:

  1. delete the tree-kill package from the node_modules folder.
  2. delete the package-lock.json file.
  3. go to the @angular-devkit/build-angular folder in the node_modules folder and edit the package.json file; change tree-kill version from 1.2.1 to 1.2.2
  4. go to @ngtools/webpack folder in the node_modules folder and do the same as step 3.

run npm install after that.

over 4 years ago · Santiago Trujillo Relatório

0

I just had this problem too and after some researchs, i found something:

NPM throws error on "audit fix" - Configured registry is not supported

Of course, it's about an other problem but, by adapting the solution given there, it resolved my problem.

So :

  • Delete the node_modules folder of tree-kill
  • Edit package-lock.json file like it's done but with tree-kill module instead.
  • Don't forget to run npm install at the end

I hope i've been clear enough.

over 4 years ago · Santiago Trujillo Relatório
Responde à pergunta
Encontrar trabalhos remotos

Descubra a nova forma de encontrar um emprego!

melhores empregos
Principais categorias de trabalho
Empresas
Postar vaga Preços Comercial
Jurídico
Termos e Condições Política de privacidade
© 2026 PeakU Inc. All Rights Reserved.
Andres GPT
Recomende algumas ofertas para mim
Preciso de ajuda