NeoKeeper
NeoKeeper
it may like this 
https://nvd.nist.gov/vuln/detail/CVE-2017-18349 
Why are dependencies not included like in other product implementations? like package-lock.json or Pipfile.lock
+1 @Azleal @Freelander @YSoer @ElegantNorlin