Audit dependencies for vulnerabilities
Read-only
What do risk levels mean?
- Read-only
- Inspects state without changing anything.
- Low risk
- Reversible with a routine follow-up command.
- Medium risk
- Changes state; undo path documented.
- Destructive
- Deletes or overwrites; confirmation required.
Checks the resolved dependency tree against npm security advisories without changing installed packages or package metadata.
nodenpmsecurity
Commands
Report known vulnerabilities in production and development dependencies
npm auditVerification
npm auditnpm reports vulnerability counts and remediation guidance, or reports no known vulnerabilities.
Undo
Not undoable
This recipe only queries advisory data and changes nothing.
Pitfalls
- npm audit requires a supported registry endpoint and may not cover private or non-npm advisories.
- A nonzero exit status indicates findings and should not be mistaken for failure to run the audit.