Yes, NPM's vulnerability warnings are effectively meaningless. You can read more about it here: https://overreacted.io/npm-audit-broken-by-design/