When I run

yo @microsoft/sharepoint

and pick standard options for a SharePoint Online WebPart with No JavaScript framework, NPM shows 1956 vulnerabilities with 140 of them being high priority.

I don't understand why a fresh out of the box project would contain this many "issues".

I searched the internet and a few of the blogs I ran across seemed to imply these "vulnerabilities" were actually just with the build environment and would not be deployed to the server or client machines [1][2]. Indeed, I think many people have been ignoring these vulnerabilities for quite some time since today's vulnerability count seems much higher than the counts the authors were getting back when they originally published their posts.

To make matters even more confusing, while I think [2] does seem to indicate the problems are not going to be deployed, it still seems to indicate the "vulnerabilities" should be addressed. Also, [2] appears to be selling something so the author may be a little biased.

Running "npm audit" and checking the "Dependency Of" flag per [1] does seem imply that the vast majority of these vulnerabilities are specific to the development environment. It does in fact, seem to me that these problems will never make it into the SharePoint Online server or onto the machines of our end users.

Given the above, what should I do about this massive list of "vulnerabilities"?

[1] - http://www.andrewconnell.com/blog/don-t-be-alarmed-by-vulnerabilities-after-running-npm-install
[2] - https://rencore.com/blog/250-vulnerabilities-sharepoint-framework/

  • The vulnerability count appears to be growing. It's only been a week and now the count from microsoft/sharepoint generator is 2010 vs the 1956 that was coming up 7 days ago. In contrast, a simple Non-SharePoint HTTP/WebSockets server program I wrote "from scratch" in Node.js using just (superagent, ws and express) returns zero vulnerabilities. – Shawn Eary Jul 19 at 17:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.