Old version of async has high vulnerability (discovered with npm audit). and can be fixed by updating async to latest version (3.2.3) Path: grunt-browserify > browserify-incremental > browserify-cache-api > async . See attached image for details. 