title: Running suggested command doesn't fix NPM Vulnerability
body: <p>After each installation of a new NPM module in my project I get the following error : </p>
  
  <pre><code>[!] 40 vulnerabilities found - Packages audited: 5840 (0 dev, 299 optional)
      Severity: 8 Low | 24 Moderate | 8 High
  </code></pre>
  
  <p>So then I run <code>npm audit</code> and I get the details for each of the 40 vulnerabilities such as :</p>
  
  <pre><code># Run  npm install npm@6.0.1  to resolve 22 vulnerabilities
  SEMVER WARNING: Recommended action is a potentially breaking change
  ┌───────────────┬──────────────────────────────────────────────────────────────┐
  │ Moderate      │ Prototype pollution                                          │
  ├───────────────┼──────────────────────────────────────────────────────────────┤
  │ Package       │ hoek                                                         │
  ├───────────────┼──────────────────────────────────────────────────────────────┤
  │ Dependency of │ npm                                                          │
  ├───────────────┼──────────────────────────────────────────────────────────────┤
  │ Path          │ npm &gt; libcipm &gt; npm-lifecycle &gt; node-gyp &gt; request &gt; hawk &gt;  │
  │               │ boom &gt; hoek                                                  │
  ├───────────────┼──────────────────────────────────────────────────────────────┤
  │ More info     │ https://nodesecurity.io/advisories/566                       │
  └───────────────┴──────────────────────────────────────────────────────────────┘
  </code></pre>
  
  <p>or this :</p>
  
  <pre><code># Run  npm update fsevents --depth 2  to resolve 3 vulnerabilities
  ┌───────────────┬──────────────────────────────────────────────────────────────┐
  │ Low           │ Regular Expression Denial of Service                         │
  ├───────────────┼──────────────────────────────────────────────────────────────┤
  │ Package       │ debug                                                        │
  ├───────────────┼──────────────────────────────────────────────────────────────┤
  │ Dependency of │ chokidar                                                     │
  ├───────────────┼──────────────────────────────────────────────────────────────┤
  │ Path          │ chokidar &gt; fsevents &gt; node-pre-gyp &gt; tar-pack &gt; debug        │
  ├───────────────┼──────────────────────────────────────────────────────────────┤
  │ More info     │ https://nodesecurity.io/advisories/534                       │
  └───────────────┴──────────────────────────────────────────────────────────────┘
  </code></pre>
  
  <p>So I run <code>npm install npm@6.0.1</code> (even though I already had 6.0.1) then <code>npm update fsevents --depth 2</code> But after that I re-run <code>npm audit</code> and nothing has changed, I still have the same 40 vulnerabilities and some of them are really scary. What should I do ?</p>