security issue & npm start script