18 of 26 Node.js starters ship unfixable high-severity flaws

A scan of 26 popular public Node.js starters found that 18 (69%) carry at least one high or critical advisory that npm install or npm update cannot fix, because the patched version falls outside the range declared in package.json. In 17 of the 18 the issue sits in production dependencies, and half the projects rely on deprecated packages.

• 18 of 26 starters (69%) carry unfixable high or critical advisories
• In 17 of 18 the flaws affect production dependencies, not dev tooling
• 13 of 26 projects (50%) depend on deprecated packages, 62 in total
• 34% of 858 direct dependencies had no release in over two years