This vulnerability report highlights several challenges that we face in the Node.js Security Working Group as security analysts who need to respond to security incidents.