Every Node.js project accumulates vulnerable dependencies. The npm registry holds over 2.5 million packages, and researchers found 454,000 malicious or vulnerable packages uploaded in 2025 alone.
Annual Input-Output statistics are updated in late September each year. Note: With the release of the 2026 Annual Update of the NEAs, BEA corrected historical quarterly industry account statistics for ...