Your aws npm package has 8 vulnerabilities. Here's what's actually happening.

That GitHub issue you're looking at? aws-0.1.15.tgz with 8 vulnerabilities, highest severity 9.8. CVSS 9.8 is "critical" — the kind that wakes you up at 3 AM.

Here's the thing nobody tells you: that package hasn't been updated since 2016. It's a 300-line wrapper around the actual AWS SDK that someone published a decade ago and abandoned. But your dependency tree pulled it in anyway.

Why this keeps happening

Your package.json looks clean. You're using @aws-sdk/client-s3 v3.600.0. Everything's modern. Then you run npm ls aws and find this:

your-project@1.0.0
└─┬ some-old-tool@2.3.1
  └── aws@0.1.15

Some transitive dependency — probably a build tool someone added in 2019 and forgot about — depends on the ancient aws package. npm doesn't care. It installs what's asked.

The 8 vulnerabilities? They're in aws's dependency on xml2js v0.4.x, which has an XXE vulnerability (CVE-2023-0842, score 9.8). Attackers can send malicious XML payloads through your S3 operations and read arbitrary files from your server.

The manual fix (do this first)

# Find who's pulling it in
npm ls aws

# Force override the vulnerable dependency
# Add to package.json:
"overrides": {
  "aws": {
    "xml2js": "0.6.2"
  }
}

Or better — rip it out entirely:

# Check if anything actually uses it
grep -r "require('aws')" node_modules/ --include="*.js" | grep -v "aws-sdk"
grep -r "from 'aws'" node_modules/ --include="*.js" | grep -v "aws-sdk"

90% of the time, nothing imports it. The package is just sitting there, being vulnerable, doing nothing.

If it's truly unused:

# Delete it and pray nothing breaks
rm -rf node_modules/aws
npm install --no-save  # regenerates node_modules without it

If something breaks, you found the dead code. Time to update that old tool.

The real problem: dependency archaeology

This isn't about one npm package. It's about the fact that your dependency tree is a fossil record of every bad decision made in the last 5 years.

I've seen teams spend 3 days chasing a vulnerability in aws@0.1.15 only to discover it was pulled in by grunt-aws-s3 — a package last updated in 2017, used by one build script that hasn't run since 2020.

Sound familiar?

You need two things:

1. Visibility into why a dependency exists
2. The ability to trace the exact path

Here's where TracePilot comes in

Not for this specific npm problem — but for the same class of debugging hell. Your AI agents have the same issue. Something deep in the call chain fails, and you have no idea what happened.

// Before: blind agent
const response = await openai.chat.completions.create({
  model: 'gpt-4o',
  messages
});

// After: traced agent
import { TracePilot } from 'tracepilot-sdk';

const tp = new TracePilot('tp_live_YOUR_KEY');
await tp.startTrace('agent-debug');

const { result, spanId } = await tp.wrapOpenAI(
  () => openai.chat.completions.create({ model: 'gpt-4o', messages }),
  messages
);

One line change. Now every call is tracked. When something fails — and it will — you open the dashboard, find the failing span, and fork it. Change the prompt. Replay. Done.

No more guessing what happened inside your agent. No more "works on my machine." No more 3-day archaeology projects.

Just like you'd use npm ls to find where aws@0.1.15 came from, TracePilot shows you the exact execution path of every LLM call, tool invocation, and decision your agent made.

The npm problem taught us one thing: you can't fix what you can't see. Your AI agents deserve better.

---

Debugging AI agents shouldn't feel like reading The Matrix.
Join other engineers who are building reliable autonomous workflows in our community: TracePilot Discord