[npm] Recommended action is for tertiary dependencies which cant be touched.

[anantshri]

Ran it over an npm codebase. and the recommendations are specifically pointing to packages that are 3 or 5 level deep in dependencies.

1. we should be marking them as such that its not a direct dependency.
2. we should be de prioritizing them or rolling them up on the top level dependency that this has following faults.

[abhisek]

@anantshri Thanks for opening this issue. We have a #8 as a planned item to better handle these requirements.

[abhisek]

@anantshri We will be grouping remediation advice by top level (direct) dependencies so that you can easily identify which top level dependency to upgrade to fix maximum number of issues, including identifying how to update a vulnerable transitive dependency.