Getting an alert from npm for 9 vulnerabilities

[ToonLunk]

When I installed socketio (using npm i socketio) I got this warning:

9 vulnerabilities (1 low, 1 moderate, 7 high)

Is that normal, did I install it wrong, or is this a new thing being worked on?

[darrachequesne]

Hi! I can't reproduce:

$ npm -v
8.1.2

$ npm i socket.io

added 23 packages, and audited 24 packages in 2s

found 0 vulnerabilities

Do you have some specific environment?

[ToonLunk]

My bad y'all. I ran

npm i socketio

Instead of

npm i socket.io

And got those vulnerability warnings. Which raises a question, why is there a package with such a similar name with so many vulnerabilities?

[darrachequesne]

Hum, thanks for reporting this, looks like a suspicious package 👀

I have sent a request to the NPM support.