title: Vulnerabilities problem using "npm install"
body: <p>I have installed an express server using <code>express coserver</code> command, then I used .npm install' command to install other node packages/dependencies, but I got this result:</p>
  
  <pre><code>                       === npm audit security report ===
  
  
                                   Manual Review
               Some vulnerabilities require your attention to resolve
  
            Visit https://go.npm.me/audit-guide for additional guidance
  
  
    Low             Incorrect Handling of Non-Boolean Comparisons During
                    Minification
  
    Package         uglify-js
  
    Patched in      &gt;= 2.4.24
  
    Dependency of   jade
  
    Path            jade &gt; transformers &gt; uglify-js
  
    More info       https://nodesecurity.io/advisories/39
  
  
    Low             Regular Expression Denial of Service
  
    Package         uglify-js
  
    Patched in      &gt;=2.6.0
  
    Dependency of   jade
  
    Path            jade &gt; transformers &gt; uglify-js
  
    More info       https://nodesecurity.io/advisories/48
  
  
    Critical        Sandbox Bypass Leading to Arbitrary Code Execution
  
    Package         constantinople
  
    Patched in      &gt;=3.1.1
  
    Dependency of   jade
  
    Path            jade &gt; constantinople
  
    More info       https://nodesecurity.io/advisories/568
  
  
    Low             Regular Expression Denial of Service
  
    Package         clean-css
  
    Patched in      &gt;=4.1.11
  
    Dependency of   jade
  
    Path            jade &gt; clean-css
  
    More info       https://nodesecurity.io/advisories/785
  
  found 4 vulnerabilities (3 low, 1 critical) in 194 scanned packages
    4 vulnerabilities require manual review. See the full report for details.
  </code></pre>
  
  <p>My <code>node --version</code> is <code>v10.15.0</code> and <code>express --version</code> is <code>4.16.1</code> and I use Windows 10. I don't know if other information is needed to put here but let me know that if so.</p>