I don't use npm all that often, but I don't think I've ever run "npm install" in a project and not gotten any warnings about outdated dependencies and security vulnerabilities in them.
it gives a bit of a 'broken window' effect, 'cos while it still irks me now, I'll probably start turning a blind eye to all these warnings only to miss something really critical later on.