report/security/report security check nodemodules
Note: You are currently viewing documentation for Moodle 3.3. Up-to-date documentation for the latest stable version of Moodle is probably available here: report/security/report security check nodemodules.
Node.js modules directory security check
The node_modules directory should not be present on public sites.
The directory node_modules inside the Moodle dirroot contains Node.js modules and their dependencies, typically installed by the NPM utility. These modules may be required for Moodle development. They are not needed to run a Moodle site and they can contain potentially dangerous code exposing your site to remote attacks.
It is strongly recommended to remove the directory if the site is available via a public URL, or at least prohibit web access to it.