How do I fix a vulnerable npm package in my package-lock.json that isn't listed in the package.json?

Question

Github is telling me that a dependency in my package-lock.json file is vulnerable and outdated. The problem is that if I do npm install or npm update

Answer 1

Use:

npm i hoek

npm will install the latest version of hoek and your package.lock.json become updated.

Answer 2

To check vulnerable npm packages, just use following commands:

npm audit

To fix vulnerable npm packages, just use following commands which will fix package-lock.json too:

npm audit fix

Answer 3

It sounds like Hoek is a dependency of one of your dependencies (so, a package you have in your package.json is requiring it from it's own package.json).

You've already tried deleting/reinstalling and updating your project dependencies without success, so it seems that the package dependency in question has an explicit or max version specified.

Without seeing the package.json for each of your dependencies, it would be difficult to advise further on how to force an update.

Edit: To help you identify which packages are using which dependencies, you can use NPM's ls command: https://docs.npmjs.com/cli/ls

For example, to see which packages are using Hoek: npm ls hoek

Edit 2: As Ulysse BN correctly points out, if you have NPM version 6 or later, you can use npm audit fix to ask NPM to attempt to fix the vulnerabilities for you.

Edit 3: Those reading this should also check out JBallin's answer below. It expands on information I have given here, and is (in my opinion) a more structured answer that addresses OP's question better. However - if you want a quick fix - this answer should suffice.