DEV Community

Alex Spinov
Alex Spinov

Posted on

The npm Registry Has 2 Million Packages — 14% Have Known Vulnerabilities

#npm #security #javascript #webdev

I ran npm audit on 50 popular starter templates last week.

The results were shocking: 43 out of 50 had at least one known vulnerability. Seven had critical vulnerabilities that could allow remote code execution.

And these are templates that thousands of developers use as their project foundation.

The Scale of the Problem

npm has over 2 million packages. According to Snyk's State of Open Source Security report, roughly 14% of them contain at least one known vulnerability.

That's 280,000+ packages with security issues sitting in the registry right now.

I Audited 50 Popular Starter Templates

I picked the 50 most-starred React, Next.js, Express, and Node.js starter templates on GitHub and ran npm audit on each.

Results Summary

Category Templates With Vulns Critical High
React starters 15 13 (87%) 3 8
Next.js examples 10 7 (70%) 1 4
Express boilerplates 15 14 (93%) 2 9
Node.js tools 10 9 (90%) 1 6
Total 50 43 (86%) 7 27

The 5 Most Common Vulnerabilities

1. Prototype Pollution (found in 31 templates) 

Package: lodash < 4.17.21
Severity: Critical
CVE: CVE-2021-23337
Enter fullscreen mode Exit fullscreen mode

Attackers can modify Object.prototype, affecting all objects in your app.

2. Regular Expression Denial of Service (23 templates) 

Package: minimatch < 3.0.5
Severity: High
CVE: CVE-2022-3517
Enter fullscreen mode Exit fullscreen mode

Malicious glob patterns can freeze your application.

3. Cross-Site Scripting via template engines (18 templates) 

Package: ejs < 3.1.7
Severity: Critical
CVE: CVE-2022-29078
Enter fullscreen mode Exit fullscreen mode

Server-side template injection leading to RCE.

4. Path Traversal (15 templates) 

Package: serve-static < 1.16.0
Severity: High
CVE: CVE-2024-43800
Enter fullscreen mode Exit fullscreen mode

Attackers can read files outside the intended directory.

5. Denial of Service via nested objects (12 templates) 

Package: qs < 6.11.0
Severity: High
CVE: CVE-2022-24999
Enter fullscreen mode Exit fullscreen mode

Deeply nested query strings can crash your server.

A Quick Audit Script 

import subprocess
import json
import sys

def audit_project(path="."):
    result = subprocess.run(
        ["npm", "audit", "--json"],
        capture_output=True, text=True, cwd=path
    )

    data = json.loads(result.stdout)
    vulns = data.get("vulnerabilities", {})

    summary = {"critical": [], "high": [], "moderate": [], "low": []}

    for name, info in vulns.items():
        severity = info.get("severity", "low")
        summary[severity].append({
            "package": name,
            "fix_available": info.get("fixAvailable", False)
        })

    total = sum(len(v) for v in summary.values())
    print(f"Audit Results: {total} vulnerabilities")

    for severity in ["critical", "high", "moderate", "low"]:
        if summary[severity]:
            print(f"  {severity.upper()}: {len(summary[severity])}")
            for vuln in summary[severity]:
                fix = "(fix available)" if vuln["fix_available"] else "(no fix)"
                print(f"    - {vuln['package']} {fix}")

if __name__ == "__main__":
    audit_project(sys.argv[1] if len(sys.argv) > 1 else ".")
Enter fullscreen mode Exit fullscreen mode

How to Fix This

Step 1: Audit immediately 

npm audit
Enter fullscreen mode Exit fullscreen mode

Step 2: Auto-fix what you can 

npm audit fix
Enter fullscreen mode Exit fullscreen mode

Step 3: Add to CI/CD 

name: Security Audit
on: [push, pull_request]
jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
      - run: npm ci
      - run: npm audit --audit-level=high
Enter fullscreen mode Exit fullscreen mode

The Uncomfortable Truth

The npm ecosystem's strength (massive package count) is also its biggest weakness. Every npm install pulls in a tree of transitive dependencies you've never reviewed.

A typical React app has 1,200+ dependencies. You wrote zero of them. You reviewed zero of them. And 14% of them statistically have known vulnerabilities.

What's the worst thing you've found in your node_modules? Share your horror stories below.

I build security scanning tools — check out github-security-scanner and git-secrets-audit on GitHub.

Follow for weekly security deep-dives.

Top comments (0)