title: NPM-AUDIT find to high vulnerabilities. What am I supposed to do?
body: <p><code>npm audit</code> run on my project and got me this</p>
  
  <blockquote>
    <p>High            Command Injection<br>
    Dependency of   @angular-devkit/build-angular [dev]                   </p>
    
    <p>Path            @angular-devkit/build-angular > @ngtools/webpack >
    tree-kill  </p>
    
    <p>More info       <a href="https://npmjs.com/advisories/1432" rel="noreferrer">https://npmjs.com/advisories/1432</a>                   </p>
    
    <p>High            Command Injection                                   </p>
    
    <p>Package         tree-kill                                           </p>
    
    <p>Patched in      >=1.2.2                                             </p>
    
    <p>Dependency of   @angular-devkit/build-angular [dev]                 </p>
    
    <p>Path            @angular-devkit/build-angular > tree-kill           </p>
    
    <p>More info       <a href="https://npmjs.com/advisories/1432" rel="noreferrer">https://npmjs.com/advisories/1432</a></p>
  </blockquote>
  
  <p><strong>Tree-kill</strong> needs to be updated, but is a dep of angular, not mine. So what? Need to wait that angular-team update its own package.json to a newer version of tree-kill?</p>