使用“ npm install”的漏洞问题

Question

我已经使用express coserver命令安装了快速服务器，然后使用.npm install'命令来安装其他节点程序包/依赖项，但是得到了以下结果：

                       === npm audit security report ===


                                 Manual Review
             Some vulnerabilities require your attention to resolve

          Visit https://go.npm.me/audit-guide for additional guidance


  Low             Incorrect Handling of Non-Boolean Comparisons During
                  Minification

  Package         uglify-js

  Patched in      >= 2.4.24

  Dependency of   jade

  Path            jade > transformers > uglify-js

  More info       https://nodesecurity.io/advisories/39


  Low             Regular Expression Denial of Service

  Package         uglify-js

  Patched in      >=2.6.0

  Dependency of   jade

  Path            jade > transformers > uglify-js

  More info       https://nodesecurity.io/advisories/48


  Critical        Sandbox Bypass Leading to Arbitrary Code Execution

  Package         constantinople

  Patched in      >=3.1.1

  Dependency of   jade

  Path            jade > constantinople

  More info       https://nodesecurity.io/advisories/568


  Low             Regular Expression Denial of Service

  Package         clean-css

  Patched in      >=4.1.11

  Dependency of   jade

  Path            jade > clean-css

  More info       https://nodesecurity.io/advisories/785

found 4 vulnerabilities (3 low, 1 critical) in 194 scanned packages
  4 vulnerabilities require manual review. See the full report for details.

我的node --version是v10.15.0，express --version是4.16.1，并且我使用Windows10。我不知道是否需要在此处放置其他信息，但如果需要，请告诉我。

Answer 1

即使我尝试使用“ npx express-generator myapp”命令安装Express时，也遇到了完全相同的错误。

要解决此错误，请执行以下步骤：1.删​​除了我要安装Express的文件夹（myapp）。2.重新开始。3.按照https://expressjs.com/en/starter/generator.html中的分步说明进行操作4.“ npm安装”引发了1个严重性较低的漏洞，该漏洞随后通过“ npm审核修复”得到修复。5.您的express js应该已成功安装。