Versions of googleapis prior to 39.1.0 are vulnerable to Improper Authorization. Setting credentials to one client may apply to all clients which may cause requests to be sent with the incorrect credentials.

Recommendation

Upgrade to version 39.1.0.

References

• https://www.npmjs.com/advisories/791
• googleapis/google-api-nodejs-client#1594