The vulnerability report shows that there is a dependency with security issues. https://david-dm.org/fullcube/loopback-component-migrate The recommended path is to update the package https://nodesecurity.io/advisories/534