# Node-red-node-openweathermap 0.2.1 \> Insufficient Entropy / severity vulnerability

**URL:** <https://discourse.nodered.org/t/node-red-node-openweathermap-0-2-1-insufficient-entropy-severity-vulnerability/22333>\
**Category:** General\
**Created:** [27 February 2020 16:20 UTC](https://discourse.nodered.org/t/node-red-node-openweathermap-0-2-1-insufficient-entropy-severity-vulnerability/22333 "2020-02-27T16:20:20Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![RueCo](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/rueco/32/765_2.png) [@RueCo](https://discourse.nodered.org/u/RueCo)\
**Post date:** [27 February 2020 16:20 UTC](https://discourse.nodered.org/t/node-red-node-openweathermap-0-2-1-insufficient-entropy-severity-vulnerability/22333/1 "2020-02-27T16:20:20Z")

</div>

After installing NR and the flow node-red-node-openweathermap 0.2.1  
Node-RED Version: v1.0.3  
Node.js Version: v12.16.1  
Linux 4.19.79-v7+ arm LE  
we got an npm audit error message which we are not able to fix.  
What do we need to do?  
npm audit fix does not work.

**Installation process and error message**  
npm install node-red-node-openweathermap

npm WARN deprecated cryptiles@3.1.4: This version has been deprecated in accordance with the hapi support policy (hapi.im/support). Please upgrade to the latest version to get the best features, bug fixes, and security patches. If you are unable to upgrade at this time, paid support is available for older versions (hapi.im/commercial).  
npm WARN node-red-project@0.0.1 No repository field.  
npm WARN node-red-project@0.0.1 No license field.

- node-red-node-openweathermap@0.2.1  
updated 1 package, moved 1 package and audited 1404 packages in 27.849s

1 package is looking for funding  
run `npm fund` for details

found 1 high severity vulnerability  
run `npm audit fix` to fix them, or `npm audit` for details  
sudo npm audit

```
                   === npm audit security report ===                        
                                                                            
                            Manual Review
        Some vulnerabilities require your attention to resolve
     Visit https://go.npm.me/audit-guide for additional guidance

```

High │ Insufficient Entropy  
Package │ cryptiles  
Patched in │ \>=4.1.2  
Dependency of │ node-red-node-openweathermap  
Path │ node-red-node-openweathermap \> request \> hawk \> cryptiles  
More info │ [https://npmjs.com/advisories/1464](https://npmjs.com/advisories/1464)  
found 1 high severity vulnerability in 1404 scanned packages  
1 vulnerability requires manual review. See the full report for details.

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [27 February 2020 17:40 UTC](https://discourse.nodered.org/t/node-red-node-openweathermap-0-2-1-insufficient-entropy-severity-vulnerability/22333/2 "2020-02-27T17:40:54Z")

</div>

I think you need to raise an issue - that node is provided by node-red-web-nodes so you can raise the issue there.

The problem is the `request` node which was deprecated by the author a year ago. The openweathermap node hasn't been updated for 2 years (didn't need to be really).

Looks like the request module will need to be replaced - possibly with the popular `axios` request library.

---

<div class="post-metadata">

**Author:** ![dceejay](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/dceejay/32/38_2.png) [@dceejay](https://discourse.nodered.org/u/dceejay)\
**Post date:** [27 February 2020 19:57 UTC](https://discourse.nodered.org/t/node-red-node-openweathermap-0-2-1-insufficient-entropy-severity-vulnerability/22333/3 "2020-02-27T19:57:58Z")

</div>

Well despite being deprecated their last release is still somewhat newer than the one included in the node so I have bumped that in case it helps for now. Published as v0.2.2

---

<div class="post-metadata">

**Author:** ![RueCo](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/rueco/32/765_2.png) [@RueCo](https://discourse.nodered.org/u/RueCo)\
**Post date:** [27 February 2020 21:08 UTC](https://discourse.nodered.org/t/node-red-node-openweathermap-0-2-1-insufficient-entropy-severity-vulnerability/22333/4 "2020-02-27T21:08:25Z")

</div>

Thank you all very much for your fast reply and support!

Now the npm audit report is ok after reinstalling the flow v0.2.2:

npm audit  
=== npm audit security report ===  
found 0 vulnerabilities

We appreciate very much your help, really a great service!  
Thanks guys

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [27 April 2020 21:08 UTC](https://discourse.nodered.org/t/node-red-node-openweathermap-0-2-1-insufficient-entropy-severity-vulnerability/22333/5 "2020-04-27T21:08:26Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.