Weird Ubuntu "esm" packages

[sbraz]

Hi, I noticed that one of my Ubuntu Xenial hosts is reported as vulnerable to CVE-2016-10540, CVE-2015-8860 and CVE-2017-1000381. Looking at the Ubuntu reports indicates that an esm version is required but it's not the currently installed version (and it doesn't seem to be available in the standard repositories):

• node-minimatch 1.0.0-1ubuntu0.1~esm2 vs 1.0.0-1
• node-tar 1.0.3-2ubuntu0.1~esm1 vs 1.0.3-2
• nodejs 4.2.6~dfsg-1ubuntu4.2+esm1 vs 4.2.6~dfsg-1ubuntu4.2

I don't understand why Ubuntu 14 would have ESM packages since it's still supported. Does this mean that the packages in the normal repositories are still vulnerable or is this a Pakiti bug?

[sbraz]

Apparently nodejs and friends are part of universe which isn't fully supported. I guess this isn't a bug then…