# Vulnerabilities reported when installing OpenZeppelin CLI via npm **URL:** \ **Category:** SDK\ **Created:** [August 23, 2020, 4:26pm UTC](https://forum.openzeppelin.com/t/vulnerabilities-reported-when-installing-openzeppelin-cli-via-npm/3614 "2020-08-23T16:26:32Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![David\_Schmitz](https://sea2.discourse-cdn.com/flex022/user_avatar/forum.openzeppelin.com/david_schmitz/32/12025_2.png) [@David\_Schmitz](https://forum.openzeppelin.com/u/David_Schmitz)\ **Post date:** [August 23, 2020, 4:26pm UTC](https://forum.openzeppelin.com/t/vulnerabilities-reported-when-installing-openzeppelin-cli-via-npm/3614/1 "2020-08-23T16:26:32Z")
Installing openzeppelin/contracts with npm that returns founding some vulnerabilities **💻 Environment** last version of contracts lib, npm 6.14.6 within a linux snap **📝Details** see below **🔢 Code to reproduce** + @openzeppelin/contracts@3.1.0 updated 1 package and audited 775 packages in 4.096s 10 packages are looking for funding run `npm fund` for details found 2122 vulnerabilities (5 low, 2116 high, 1 critical) run `npm audit fix` to fix them, or `npm audit` for details ---
**Author:** ![abcoathup](https://sea2.discourse-cdn.com/flex022/user_avatar/forum.openzeppelin.com/abcoathup/32/415_2.png) [@abcoathup](https://forum.openzeppelin.com/u/abcoathup)\ **Post date:** [August 24, 2020, 1:26am UTC](https://forum.openzeppelin.com/t/vulnerabilities-reported-when-installing-openzeppelin-cli-via-npm/3614/2 "2020-08-24T01:26:58Z")
Hi @David_Schmitz, I get vulnerabilities reported when installing `npm i @openzeppelin/upgrades`. I created an issue to track: [https://github.com/OpenZeppelin/openzeppelin-sdk/issues/1578](https://github.com/OpenZeppelin/openzeppelin-sdk/issues/1578) From [ethers-io/ethers.js#985](https://github.com/ethers-io/ethers.js/issues/985) (regards `elliptic`) > I believe the vulnerability does not affect Ethereum, since adding null-byte padding to the front of anything signed as RLP-data or as an EIP-191 payload, mangles the meaning of its representation. * * * I didn't get any vulnerabilities installing `@openzeppelin/contracts@3.1.0` ---
**Author:** ![David\_Schmitz](https://sea2.discourse-cdn.com/flex022/user_avatar/forum.openzeppelin.com/david_schmitz/32/12025_2.png) [@David\_Schmitz](https://forum.openzeppelin.com/u/David_Schmitz)\ **Post date:** [August 25, 2020, 7:30am UTC](https://forum.openzeppelin.com/t/vulnerabilities-reported-when-installing-openzeppelin-cli-via-npm/3614/3 "2020-08-25T07:30:55Z")
I’ve changed my node source to the official one, coming from snap. The result is the same. I don’t know why: ```auto schmitz@schmitz-HP-linux:~/dev/csan/polcoin$ node -v v12.18.3 schmitz@schmitz-HP-linux:~/dev/csan/polcoin$ npm -v 6.14.6 schmitz@schmitz-HP-linux:~/dev/csan/polcoin$ npm install @openzeppelin/contracts npm WARN polcoin@1.0.0 No description npm WARN polcoin@1.0.0 No repository field. + @openzeppelin/contracts@3.1.0 updated 1 package and audited 775 packages in 4.584s 10 packages are looking for funding run `npm fund` for details found 2122 vulnerabilities (5 low, 2116 high, 1 critical) run `npm audit fix` to fix them, or `npm audit` for details ``` ---
**Author:** ![abcoathup](https://sea2.discourse-cdn.com/flex022/user_avatar/forum.openzeppelin.com/abcoathup/32/415_2.png) [@abcoathup](https://forum.openzeppelin.com/u/abcoathup)\ **Post date:** [August 25, 2020, 7:47am UTC](https://forum.openzeppelin.com/t/vulnerabilities-reported-when-installing-openzeppelin-cli-via-npm/3614/4 "2020-08-25T07:47:26Z")
Hi @David_Schmitz, I am using Ubuntu on WSL2 In a new directory I did the following: ```auto $ node --version v12.18.3 $ npm --version 6.14.6 $ npm init -y ... $ npm i @openzeppelin/contracts npm notice created a lockfile as package-lock.json. You should commit this file. npm WARN David_Schmitz@1.0.0 No description npm WARN David_Schmitz@1.0.0 No repository field. + @openzeppelin/contracts@3.1.0 added 1 package from 1 contributor and audited 1 package in 3.63s found 0 vulnerabilities ``` Do you have anything else installed? ---
**Author:** ![David\_Schmitz](https://sea2.discourse-cdn.com/flex022/user_avatar/forum.openzeppelin.com/david_schmitz/32/12025_2.png) [@David\_Schmitz](https://forum.openzeppelin.com/u/David_Schmitz)\ **Post date:** [August 25, 2020, 1:10pm UTC](https://forum.openzeppelin.com/t/vulnerabilities-reported-when-installing-openzeppelin-cli-via-npm/3614/5 "2020-08-25T13:10:31Z")
> [@abcoathup](#): > > `npm i @openzeppelin/contracts` You're right, that doesn't come from /contract but /cli. I had installed the cli before. Without cli installed, no issue and with cli installed, here's the result: - @openzeppelin/cli@2.8.2 added 770 packages from 462 contributors and audited 770 packages in 52.583s 10 packages are looking for funding run `npm fund` for details found 32 vulnerabilities (5 low, 26 high, 1 critical) run `npm audit fix` to fix them, or `npm audit` for details npm replicates the same message when I install the contract lib just after. Nevertheless, there are fewer errors today 🙂 Work env: linux ubuntu 20.04.1 - node v12.18.3 - npm 6.14.6 ---
**Author:** ![abcoathup](https://sea2.discourse-cdn.com/flex022/user_avatar/forum.openzeppelin.com/abcoathup/32/415_2.png) [@abcoathup](https://forum.openzeppelin.com/u/abcoathup)\ **Post date:** [August 25, 2020, 11:13pm UTC](https://forum.openzeppelin.com/t/vulnerabilities-reported-when-installing-openzeppelin-cli-via-npm/3614/6 "2020-08-25T23:13:20Z")
Hi @David_Schmitz, The following issues are tracking the npm audit reports for the OpenZeppelin CLI: > > > npm audit reports High vulnerability in @openzeppelin/upgrades@2.8.0 for dependency elliptic > NPM Advisory: > https://npmjs.com/advisories/1547 > From ethers-io/ethers.js#985 > I believe the vulnerability does not affect Ethereum, since adding... > > > I've skimmed through the source, I wouldn't say you're affected but you'd probably want to remove the dependency and implement those... ---
**Author:** ![David\_Schmitz](https://sea2.discourse-cdn.com/flex022/user_avatar/forum.openzeppelin.com/david_schmitz/32/12025_2.png) [@David\_Schmitz](https://forum.openzeppelin.com/u/David_Schmitz)\ **Post date:** [August 26, 2020, 12:12am UTC](https://forum.openzeppelin.com/t/vulnerabilities-reported-when-installing-openzeppelin-cli-via-npm/3614/7 "2020-08-26T00:12:05Z")
Thanks, good to know for the future. I’ll search better…