Boland模板npm安装漏洞与npm start启动失败问题求助

开发者阿泽

2026-8-20

问题：Boland电商模板npm漏洞与启动失败求助

我购买了Boland极简电商模板，执行npm install时检测到8个漏洞（1个中度、7个高危）；执行npm start时提示缺少start脚本，手动添加"start": "node ./bin/www"后，又出现找不到./bin/www模块的错误。以下是相关信息：

npm install输出

PS C:\Users\jonat\OneDrive\Documents\Projects\Boland_Front_end\boland_ecommerce_theme_bs5_v2.0> npm install

up to date, audited 935 packages in 2s

61 packages are looking for funding
  run `npm fund` for details

8 vulnerabilities (1 moderate, 7 high)

To address issues that do not require attention, run:
  npm audit fix

To address all issues possible (including breaking changes), run:
  npm audit fix --force

Some issues need review, and may require choosing
a different dependency.

Run `npm audit` for details.
PS C:\Users\jonat\OneDrive\Documents\Projects\Boland_Front_end\boland_ecommerce_theme_bs5_v2.0>

npm start初始错误输出

PS C:\Users\jonat\OneDrive\Documents\Projects\Boland_Front_end\boland_ecommerce_theme_bs5_v2.0> npm start
npm ERR! Missing script: "start"
npm ERR!
npm ERR! Did you mean one of these?
npm ERR!     npm star # Mark your favorite packages
npm ERR!     npm stars # View packages marked as favorites
npm ERR!
npm ERR! To see a list of scripts, run:
npm ERR!   npm run

npm ERR! A complete log of this run can be found in:
npm ERR!     C:\Users\jonat\AppData\Local\npm-cache\_logs\2022-09-02T21_58_05_615Z-debug-0.log

添加start脚本后的错误输出

PS C:\Users\jonat\OneDrive\Documents\Projects\Boland_Front_end\boland_ecommerce_theme_bs5_v2.0> npm start

> boland-2.0@1.0.0 start
> node ./bin/www

node:internal/modules/cjs/loader:959
  throw err;
  ^

Error: Cannot find module 'C:\Users\jonat\OneDrive\Documents\Projects\Boland_Front_end\boland_ecommerce_theme_bs5_v2.0\bin\www'
    at Function.Module._resolveFilename (node:internal/modules/cjs/loader:956:15)
    at Function.Module._load (node:internal/modules/cjs/loader:804:27)
    at Function.executeUserEntryPoint [as runMain] (node:internal/modules/run_main:81:12)
    at node:internal/main/run_main_module:17:47 {
  code: 'MODULE_NOT_FOUND',
  requireStack: []
}
PS C:\Users\jonat\OneDrive\Documents\Projects\Boland_Front_end\boland_ecommerce_theme_bs5_v2.0>

package.json内容

{
  "name": "boland-2.0",
  "version": "1.0.0",
  "description": "",
  "main": "gulpfile.js",
  "scripts": {
    "test": "echo \"Error: no test specified\" && exit 1",
    "start": "node ./bin/www"
  },
  "keywords": [],
  "author": "",
  "license": "ISC",
  "devDependencies": {
    "@babel/core": "^7.16.0",
    "@babel/preset-env": "^7.16.4",
    "babelify": "^10.0.0",
    "browser-sync": "^2.27.7",
    "browserify": "^17.0.0",
    "del": "^6.0.0",
    "glob": "^7.2.0",
    "gulp": "^4.0.2",
    "gulp-autoprefixer": "^6.1.0",
    "gulp-clean-css": "^4.3.0",
    "gulp-cli": "^2.3.0",
    "gulp-file-include": "^2.3.0",
    "gulp-rename": "^2.0.0",
    "gulp-sass": "^5.0.0",
    "gulp-sourcemaps": "^3.0.0",
    "gulp-uglify": "^3.0.2",
    "sass": "^1.45.0",
    "sass-migrator": "^1.5.3",
    "vinyl-buffer": "^1.0.1",
    "vinyl-source-stream": "^2.0.0"
  },
  "dependencies": {
    "aos": "^3.0.0-beta.6",
    "bootstrap": "^5.1.3",
    "imagesloaded": "^4.1.4",
    "jquery": "^3.6.0",
    "jquery-countdown": "^2.2.0",
    "jquery-nice-select": "^1.1.0",
    "masonry-layout": "^4.2.2",
    "popper.js": "^1.16.1",
    "simplebar": "^5.3.6",
    "smooth-scroll": "^16.1.3",
    "sticky-js": "^1.3.0",
    "swiper": "^7.3.1"
  }
}

（注：原始package.json中的#I added the below line...是非法JSON注释，已移除）

gulpfile.js内容

'use strict';
var { src, dest, series, parallel, watch } = require('gulp');
var browserify = require('browserify');
var babelify = require('babelify');
var source = require('vinyl-source-stream');
var buffer = require('vinyl-buffer');
var sass = require('gulp-sass')(require('sass'));
var rename = require('gulp-rename');
var sourcemaps = require('gulp-sourcemaps');
var browsersync = require('browser-sync').create();
var uglify = require('gulp-uglify');
var cleanCSS = require('gulp-clean-css');
var del = require('del');
var glob = require('glob');
var autoprefixer = require('gulp-autoprefixer');
var fileinclude = require('gulp-file-include');
// Define paths
var paths = {
    here: './',
    base: {
        base: {
            dest: './'
        },
        node: {
            dest: './node_modules'
        }
    },
    src: {
        base: {
            dir: './',
            files: './**/*',
            dest: './public'
        },
        html: {
            dir: './html/*.html',
            files: './html/**/*.html',
            dest: './public',
            cleanHtml: './public/*.html',
        },
        js: {
            dir: './js',
            files: './js/custom/**/*.js',
            theme: './js/theme.js',
            dest: './public/assets/js',
            clean: './public/assets/js/*.js',
        },
        scss: {
            dir: './scss',
            files: './scss/**/*',
            main: './scss/*.scss',
            dest: './public/assets/css'
        },
        vendor: {
            files: [
                "./node_modules/jquery/dist/jquery.min.js",
                "./node_modules/jquery-countdown/dist/jquery.countdown.min.js",
                "./node_modules/swiper/swiper-bundle.min.js",
                "./node_modules/imagesloaded/imagesloaded.pkgd.min.js",
                "./node_modules/simplebar/dist/simplebar.min.js",
                "./node_modules/masonry-layout/dist/masonry.pkgd.min.js",
                "./node_modules/jquery-nice-select/js/jquery.nice-select.min.js"
            ],
            css: [
                "./node_modules/swiper/swiper-bundle.min.css",
                "./node_modules/simplebar/dist/simplebar.min.css",
                "./node_modules/jquery-nice-select/css/nice-select.css"
            ],
            dest: './public/assets/vendor/node_modules/js',
            destCss: './public/assets/vendor/node_modules/css',
            clean: './public/assets/vendor/node_modules'
        }
    }
};
//Clean public folder html,css,js
function cleanUp() {
    return del([paths.src.js.clean,paths.src.vendor.clean, paths.src.scss.dest, paths.src.html.cleanHtml]);
};


//Copy vendor to assets/vendor folder
function copyVendor() {
    return src(paths.src.vendor.files)
        .pipe(dest(paths.src.vendor.dest))
        .pipe(browsersync.stream());
}
function copyVendorCss() {
    return src(paths.src.vendor.css)
        .pipe(dest(paths.src.vendor.destCss))
        .pipe(browsersync.stream());
}

//BrowserSync
function browserSync(done) {
    browsersync.init({
        server: {
            baseDir: [paths.src.base.dest]
        },
    });
    done();
};

function browsersyncReload(done) {
    browsersync.reload();
    done();
};


function bundleJs() {
    var files = glob.sync('./js/theme.js');
    return (
        browserify({
            entries: files,
            debug: true,
            cache: {},
            packageCache: {}
        }).transform(babelify, {
            global: true,
            presets: ["@babel/preset-env"]
        })
            .bundle()
            .pipe(source('theme.bundle.js'))
            .pipe(buffer())
            .pipe(sourcemaps.init())
            .pipe(uglify())
            .pipe(sourcemaps.write(paths.here))
            .pipe(dest(paths.src.js.dest))
    );
};
//styles
function buildCss() {
    return src(paths.src.scss.main)
        .pipe(sourcemaps.init())
        .pipe(sass.sync().on('error', sass.logError))
        .pipe(autoprefixer())
        .pipe(sourcemaps.write(paths.here))
        .pipe(dest(paths.src.scss.dest))
        .pipe(browsersync.stream());
};

function minifyCss() {
    return src(paths.src.scss.main)
        .pipe(sourcemaps.init())
        .pipe(sass.sync().on('error', sass.logError))
        .pipe(autoprefixer())
        .pipe(cleanCSS())
        .pipe(rename({
            suffix: '.min'
        }))
        .pipe(sourcemaps.write(paths.here))
        .pipe(dest(paths.src.scss.dest))
        .pipe(browsersync.stream());
};

//Copy html
function html() {
    return src(paths.src.html.dir)
        .pipe(fileinclude({
            prefix: '@@',
            basepath: '@file',
            indent: true
        }))
        .pipe(dest(paths.src.html.dest))
        .pipe(browsersync.reload({
            stream: true
        }));
};


function watchFiles() {
    watch(paths.src.scss.files, series(buildCss, minifyCss));
    watch(paths.src.js.files, series(bundleJs, browsersyncReload));
    watch(paths.src.html.files, series(html, browsersyncReload));
};

exports.watchFiles = watch;
exports.buildCss = buildCss;
exports.bundleJs = bundleJs;
exports.minifyCss = minifyCss;
exports.html = html;
exports.copyVendor = copyVendor;
exports.copyVendorCss = copyVendorCss;
exports.cleanUp = cleanUp;
exports.default = series(cleanUp, html, buildCss, minifyCss, copyVendor, copyVendorCss, bundleJs, parallel(browserSync, watchFiles));

解决方案

一、修复npm安装漏洞

查看漏洞详情
先运行命令获取每个漏洞的具体信息，明确受影响的依赖和修复建议：
```
npm audit
```
自动修复无破坏性漏洞
执行默认的自动修复命令，该命令只会修复不改变依赖版本的漏洞，不会影响项目兼容性：
```
npm audit fix
```
强制修复（谨慎操作）
如果部分漏洞无法通过上述命令修复，可尝试强制修复（可能会升级依赖版本，有兼容性风险，建议先备份package-lock.json）：
```
npm audit fix --force
```
手动处理顽固漏洞
对于无法自动修复的漏洞，根据npm audit的报告：
- 定位到存在漏洞的依赖，查询其官方仓库确认安全版本
- 更新package.json中对应依赖的版本号
- 重新执行npm install安装更新后的依赖

二、修复npm start启动失败问题

这个模板是Gulp驱动的前端构建项目，并非Node.js后端服务，你添加的node ./bin/www脚本完全不符合项目结构，按以下步骤修正：

1. 修改package.json的启动脚本

将错误的start脚本替换为调用Gulp默认任务的命令，同时可添加一个仅构建不启动服务器的build脚本：

"scripts": {
  "test": "echo \"Error: no test specified\" && exit 1",
  "start": "gulp",
  "build": "gulp cleanUp && gulp html && gulp buildCss && gulp minifyCss && gulp copyVendor && gulp copyVendorCss && gulp bundleJs"
}

2. 确保全局安装gulp-cli

如果你的环境中没有全局安装Gulp命令行工具，执行以下命令安装：

npm install -g gulp-cli

3. 启动项目

现在运行以下命令即可正常启动项目，Gulp会自动完成构建并启动BrowserSync预览服务器，文件修改后会自动刷新浏览器：

npm start

内容的提问来源于stack exchange，提问作者rockets4all

Boland模板npm安装漏洞与npm start启动失败问题求助

npm install输出 #

npm start初始错误输出 #

添加start脚本后的错误输出 #

package.json内容 #

gulpfile.js内容 #

一、修复npm安装漏洞 #

二、修复npm start启动失败问题 #

1. 修改package.json的启动脚本 #

2. 确保全局安装gulp-cli #

3. 启动项目 #