npm audit

How it works

npm audit builds the dependency tree from package-lock.json and sends the package names and versions to the registry's bulk advisory endpoint. The registry answers with advisories from the GitHub Advisory Database, and npm works out which installed paths are affected.

--audit-level sets the severity that fails the command and --omit=dev skips dev dependencies. npm audit fix upgrades within semver ranges, and --force allows breaking upgrades. npm audit signatures separately checks registry signatures and provenance attestations for installed packages.

What it catches

• Known vulnerabilities in npm packages, direct and transitive
• The dependency path that pulls each one in
• Packages with invalid registry signatures or provenance

Run it

npm audit --audit-level=high --omit=dev
npm audit --json > npm-audit.json
npm audit signatures

What leaves your machine

The dependency tree (package names and versions) goes to the npm registry.

Limits

• No built-in way to ignore an advisory you have assessed.
• Reports dev dependencies unless told not to, which is most of the noise.
• npm audit fix --force can make major-version changes you didn't review.

Links

• Repository: npm/cli ↗
• npm audit docs ↗

Related tools