@pierstoval technically I think this can happen with php apps, too, if they have that security dependency that blocks vulnerable packages.

Of course, in node it just happens for funsies.