Npm Audit: broken by design?
I found that much of the underlying cause is those mass reporting regex denial of services as being high severity bugs.<p>So many people are reporting these in tons of different projects: <a href="https:&#x2F;&#x2F;github.com&#x2F;search?q=regex+denial+of+service&amp;type=issues" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;search?q=regex+denial+of+service&amp;type=iss...</a><p>Anyhow it is just annoying and they broke NPM Audit based on these reports.<p>It is good to fix all possible bugs, but many of these are not anywhere close to the level of bad that the reports are making them to be.<p>But maybe this is needed to just get rid of these issues in genera?  So a wave of regex vulnerability reports and then we build this type of checking into prettier or similar and we do not have these in the future?<p>EDIT: It appears there as a project that found 100s of CVE reported Regex vulnerabilities in npm projects -- this is maybe one of the sources of mass reports.  See the bottom of this resume: <a href="https:&#x2F;&#x2F;yetingli.github.io" rel="nofollow">https:&#x2F;&#x2F;yetingli.github.io</a>