Potentially Dangerous PATH Variables C:\ProgramData\npm\npm : builtin\users

[vinaykasireddy]

Description

Potentially Dangerous PATH Variables "C:\ProgramData\npm\npm : builtin\users" is reported.

Steps to Reproduce

We have followed all the instructions as mentioned in the below link. As part of this we have also run "npm run configure" command and running this has created "C:\ProgramData\npm" in the environment variables "Path". However this seems to have reported as a vulnerability when the run the scan in EC2 servers. My organisation is asking if we can remove this setting or to put provide a remediation. Please advise.

https://github.com/jessety/pm2-installer

Environment

Windows Server 2016
Node JS 16.13.1 (Windows)
[email protected]
[email protected]

[xinthose]

Why would that be a vulnerability? The path has to be permanent and accessible by the system account.