As described here...
https://nodesecurity.io/check/request-http-cache
...locking to major versions lodash:3.x.x and wreck:5.x.x in https://github.com/gitterHQ/request-http-cache/blob/master/package.json means request-http-cache is locked into modules which have known security issues.
Distributing a new version of request-http-cache with a version bump to the latest lodash and wreck should address this.