Currently there is an explicit dependency on node-pre-gyp@0.6.39, this vulnerability can be solved by upgrading this dependency to 0.9.1.
For npm I think it is safe to move that dependency as a devDependency, this way NSP won’t complain about security vulnerabilities there.
NSP (https://www.npmjs.com/package/nsp) is flagging this module as vulnerable due to the dependency on hoek (https://github.com/hapijs/hoek) via node-pre-gyp@0.6.38 and npm@5.8.0:
Currently there is an explicit dependency on node-pre-gyp@0.6.39, this vulnerability can be solved by upgrading this dependency to 0.9.1. For npm I think it is safe to move that dependency as a devDependency, this way NSP won’t complain about security vulnerabilities there.