[Help needed]: Failed to install but seems to of installed ok? critical security issues

[dansonamission]

Your Current NRCHKB Plugin Version

1.6.1

Operating System

No response

How can we help?

Tried installing the pallet but it errored saying it couldnt be installed, but it seems like it has installed?

2024-04-02T13:01:00.729Z Install : node-red-contrib-homekit-bridged 1.6.1

2024-04-02T13:01:00.801Z npm install --no-audit --no-update-notifier --no-fund --save --save-prefix=~ --production --engine-strict node-red-contrib-homekit-bridged@1.6.1
2024-04-02T13:01:08.299Z [err] npm
2024-04-02T13:01:08.303Z [err]
2024-04-02T13:01:08.304Z [err] WARN config production Use --omit=dev instead.
2024-04-02T13:02:20.170Z [err] npm
2024-04-02T13:02:20.171Z [err] WARN deprecated vm2@3.9.19: The library contains critical security issues and should not be used for production! The maintenance of the project has been discontinued. Consider migrating your code to isolated-vm.
2024-04-02T13:02:52.251Z [out]
2024-04-02T13:02:52.251Z [out] added 260 packages in 2m
2024-04-02T13:02:52.346Z rc=0

Any more details?

If this is specific to some hardware or specific software version, please explain here.

Any code or functions to add?

No response

[caitken-com]

Hi @dansonamission,
I checked the dependencies of the project, it’s not directly required. Might be a dependency of another dependency?

It’s been depreciated for over a year now, not sure why no one else has had this issue though.
https://www.npmjs.com/package/vm2

Maybe see if you can remove vm2 package.

[Shaquu]

I do not see any vm2 here?

+-- node-red-contrib-homekit-bridged@1.6.1
| +-- @nrchkb/logger@2.0.2
| | +-- @types/debug@4.1.12
| | | `-- @types/ms@0.7.34
| | `-- debug@4.3.5
| |   `-- ms@2.1.2
| +-- hap-nodejs@0.11.1
| | +-- @homebridge/ciao@1.2.0
| | | +-- debug@4.3.5 deduped
| | | +-- fast-deep-equal@3.1.3
| | | +-- source-map-support@0.5.21 deduped
| | | `-- tslib@2.6.3 deduped
| | +-- @homebridge/dbus-native@0.5.1
| | | +-- @homebridge/long@5.2.1
| | | +-- @homebridge/put@0.0.8
| | | +-- event-stream@4.0.1
| | | | +-- duplexer@0.1.2
| | | | +-- from@0.1.7
| | | | +-- map-stream@0.0.7
| | | | +-- pause-stream@0.0.11
| | | | | `-- through@2.3.8 deduped
| | | | +-- split@1.0.1
| | | | | `-- through@2.3.8 deduped
| | | | +-- stream-combiner@0.2.2
| | | | | +-- duplexer@0.1.2 deduped
| | | | | `-- through@2.3.8 deduped
| | | | `-- through@2.3.8
| | | +-- hexy@0.2.11
| | | +-- minimist@1.2.8
| | | +-- safe-buffer@5.2.1
| | | `-- xml2js@0.5.0
| | |   +-- sax@1.4.1
| | |   `-- xmlbuilder@11.0.1
| | +-- bonjour-hap@3.6.5
| | | +-- array-flatten@2.1.2
| | | +-- deep-equal@2.2.3
| | | | +-- array-buffer-byte-length@1.0.1
| | | | | +-- call-bind@1.0.7 deduped
| | | | | `-- is-array-buffer@3.0.4 deduped
| | | | +-- call-bind@1.0.7
| | | | | +-- es-define-property@1.0.0
| | | | | | `-- get-intrinsic@1.2.4 deduped
| | | | | +-- es-errors@1.3.0
| | | | | +-- function-bind@1.1.2
| | | | | +-- get-intrinsic@1.2.4 deduped
| | | | | `-- set-function-length@1.2.2
| | | | |   +-- define-data-property@1.1.4
| | | | |   | +-- es-define-property@1.0.0 deduped
| | | | |   | +-- es-errors@1.3.0 deduped
| | | | |   | `-- gopd@1.0.1 deduped
| | | | |   +-- es-errors@1.3.0 deduped
| | | | |   +-- function-bind@1.1.2 deduped
| | | | |   +-- get-intrinsic@1.2.4 deduped
| | | | |   +-- gopd@1.0.1 deduped
| | | | |   `-- has-property-descriptors@1.0.2
| | | | |     `-- es-define-property@1.0.0 deduped
| | | | +-- es-get-iterator@1.1.3
| | | | | +-- call-bind@1.0.7 deduped
| | | | | +-- get-intrinsic@1.2.4 deduped
| | | | | +-- has-symbols@1.0.3
| | | | | +-- is-arguments@1.1.1 deduped
| | | | | +-- is-map@2.0.3
| | | | | +-- is-set@2.0.3
| | | | | +-- is-string@1.0.7
| | | | | | `-- has-tostringtag@1.0.2 deduped
| | | | | +-- isarray@2.0.5 deduped
| | | | | `-- stop-iteration-iterator@1.0.0
| | | | |   `-- internal-slot@1.0.7
| | | | |     +-- es-errors@1.3.0 deduped
| | | | |     +-- hasown@2.0.2 deduped
| | | | |     `-- side-channel@1.0.6 deduped
| | | | +-- get-intrinsic@1.2.4
| | | | | +-- es-errors@1.3.0 deduped
| | | | | +-- function-bind@1.1.2 deduped
| | | | | +-- has-proto@1.0.3
| | | | | +-- has-symbols@1.0.3 deduped
| | | | | `-- hasown@2.0.2
| | | | |   `-- function-bind@1.1.2 deduped
| | | | +-- is-arguments@1.1.1
| | | | | +-- call-bind@1.0.7 deduped
| | | | | `-- has-tostringtag@1.0.2
| | | | |   `-- has-symbols@1.0.3 deduped
| | | | +-- is-array-buffer@3.0.4
| | | | | +-- call-bind@1.0.7 deduped
| | | | | `-- get-intrinsic@1.2.4 deduped
| | | | +-- is-date-object@1.0.5
| | | | | `-- has-tostringtag@1.0.2 deduped
| | | | +-- is-regex@1.1.4
| | | | | +-- call-bind@1.0.7 deduped
| | | | | `-- has-tostringtag@1.0.2 deduped
| | | | +-- is-shared-array-buffer@1.0.3
| | | | | `-- call-bind@1.0.7 deduped
| | | | +-- isarray@2.0.5
| | | | +-- object-is@1.1.6
| | | | | +-- call-bind@1.0.7 deduped
| | | | | `-- define-properties@1.2.1
| | | | |   +-- define-data-property@1.1.4 deduped
| | | | |   +-- has-property-descriptors@1.0.2 deduped
| | | | |   `-- object-keys@1.1.1 deduped
| | | | +-- object-keys@1.1.1
| | | | +-- object.assign@4.1.5
| | | | | +-- call-bind@1.0.7 deduped
| | | | | +-- define-properties@1.2.1 deduped
| | | | | +-- has-symbols@1.0.3 deduped
| | | | | `-- object-keys@1.1.1 deduped
| | | | +-- regexp.prototype.flags@1.5.2
| | | | | +-- call-bind@1.0.7 deduped
| | | | | +-- define-properties@1.2.1 deduped
| | | | | +-- es-errors@1.3.0 deduped
| | | | | `-- set-function-name@2.0.2
| | | | |   +-- define-data-property@1.1.4 deduped
| | | | |   +-- es-errors@1.3.0 deduped
| | | | |   +-- functions-have-names@1.2.3
| | | | |   `-- has-property-descriptors@1.0.2 deduped
| | | | +-- side-channel@1.0.6
| | | | | +-- call-bind@1.0.7 deduped
| | | | | +-- es-errors@1.3.0 deduped
| | | | | +-- get-intrinsic@1.2.4 deduped
| | | | | `-- object-inspect@1.13.1
| | | | +-- which-boxed-primitive@1.0.2
| | | | | +-- is-bigint@1.0.4
| | | | | | `-- has-bigints@1.0.2
| | | | | +-- is-boolean-object@1.1.2
| | | | | | +-- call-bind@1.0.7 deduped
| | | | | | `-- has-tostringtag@1.0.2 deduped
| | | | | +-- is-number-object@1.0.7
| | | | | | `-- has-tostringtag@1.0.2 deduped
| | | | | +-- is-string@1.0.7 deduped
| | | | | `-- is-symbol@1.0.4
| | | | |   `-- has-symbols@1.0.3 deduped
| | | | +-- which-collection@1.0.2
| | | | | +-- is-map@2.0.3 deduped
| | | | | +-- is-set@2.0.3 deduped
| | | | | +-- is-weakmap@2.0.2
| | | | | `-- is-weakset@2.0.3
| | | | |   +-- call-bind@1.0.7 deduped
| | | | |   `-- get-intrinsic@1.2.4 deduped
| | | | `-- which-typed-array@1.1.15
| | | |   +-- available-typed-arrays@1.0.7
| | | |   | `-- possible-typed-array-names@1.0.0
| | | |   +-- call-bind@1.0.7 deduped
| | | |   +-- for-each@0.3.3
| | | |   | `-- is-callable@1.2.7
| | | |   +-- gopd@1.0.1
| | | |   | `-- get-intrinsic@1.2.4 deduped
| | | |   `-- has-tostringtag@1.0.2 deduped
| | | +-- multicast-dns-service-types@1.1.0
| | | `-- multicast-dns@7.2.5
| | |   +-- dns-packet@5.6.1
| | |   | `-- @leichtgewicht/ip-codec@2.0.5
| | |   `-- thunky@1.1.0
| | +-- debug@4.3.5 deduped
| | +-- fast-srp-hap@2.0.4
| | +-- futoin-hkdf@1.4.3
| | +-- node-persist@0.0.11
| | | +-- mkdirp@0.5.6
| | | | `-- minimist@1.2.8 deduped
| | | `-- q@1.1.2
| | +-- source-map-support@0.5.21
| | | +-- buffer-from@1.1.2
| | | `-- source-map@0.6.1
| | +-- tslib@2.6.3 deduped
| | `-- tweetnacl@1.0.3
| +-- ip@2.0.1
| +-- node-persist@3.1.3
| +-- semver@7.6.2
| `-- uuid@9.0.1
`-- passkit-generator@3.1.11
  +-- do-not-zip@1.0.0
  +-- joi@17.4.2
  | +-- @hapi/hoek@9.3.0
  | +-- @hapi/topo@5.1.0
  | | `-- @hapi/hoek@9.3.0 deduped
  | +-- @sideway/address@4.1.5
  | | `-- @hapi/hoek@9.3.0 deduped
  | +-- @sideway/formula@3.0.1
  | `-- @sideway/pinpoint@2.0.0
  +-- node-forge@1.3.1
  `-- tslib@2.6.3