@cryptotaxi247 / documentation-1
Code Commits Issues Pulls Sessions CI/CD
patch-1
@reggi/path-to-regexp dependabot/npm_and_yarn/main/copy-to-clipboard-4.0.2 dependabot/npm_and_yarn/main/eslint-10.4.0 dependabot/npm_and_yarn/main/npmcli/eslint-config-7.0.0 dependabot/npm_and_yarn/main/proc-log-7.0.0 dependabot/npm_and_yarn/npm_and_yarn-826852524d dependabot/npm_and_yarn/npm_and_yarn-ab9a7f4bc2 deprecate-totp-2fa dhei/classic-tokens gat-bypass-2fa-docs jpg619/fix-accessibility-content-flow jpg619/version-bump-tar-2 kartykp/gat-bypass-2fa-docs kartykp/upgrade-path-to-regex main maitxn/version-bump-tar patch-1 reggi/cache-based-on-version reggi/dev-engines reggi/fix-transform-prettier reggi/overrides update-search-sensitivity
mdx 130 lines 4.53 KB
Raw
1 ---
2 title: npm-audit
3 section: 1
4 description: Run a security audit
5 github_repo: npm/cli
6 github_branch: release/v6
7 github_path: docs/content/commands/npm-audit.md
8 redirect_from:
9 - /cli-documentation/v6/audit
10 - /cli-documentation/v6/cli-commands/audit
11 - /cli-documentation/v6/cli-commands/npm-audit
12 - /cli-documentation/v6/commands/audit
13 - /cli-documentation/v6/commands/npm-audit
14 - /cli-documentation/v6/npm-audit
15 - /cli/v6/audit
16 - /cli/v6/cli-commands/audit
17 - /cli/v6/cli-commands/npm-audit
18 - /cli/v6/commands/audit
19 - /cli/v6/npm-audit
20 ---
21
22 ### Synopsis
23
24 ```bash
25 npm audit [--json|--parseable|--audit-level=(low|moderate|high|critical)]
26 npm audit fix [--force|--package-lock-only|--dry-run]
27
28 common options: [--production] [--only=(dev|prod)]
29 ```
30
31 ### Examples
32
33 Scan your project for vulnerabilities and automatically install any compatible updates to vulnerable dependencies:
34
35 ```bash
36 $ npm audit fix
37 ```
38
39 Run `audit fix` without modifying `node_modules`, but still updating the pkglock:
40
41 ```bash
42 $ npm audit fix --package-lock-only
43 ```
44
45 Skip updating `devDependencies`:
46
47 ```bash
48 $ npm audit fix --only=prod
49 ```
50
51 Have `audit fix` install semver-major updates to toplevel dependencies, not just semver-compatible ones:
52
53 ```bash
54 $ npm audit fix --force
55 ```
56
57 Do a dry run to get an idea of what `audit fix` will do, and _also_ output install information in JSON format:
58
59 ```bash
60 $ npm audit fix --dry-run --json
61 ```
62
63 Scan your project for vulnerabilities and just show the details, without fixing anything:
64
65 ```bash
66 $ npm audit
67 ```
68
69 Get the detailed audit report in JSON format:
70
71 ```bash
72 $ npm audit --json
73 ```
74
75 Get the detailed audit report in plain text result, separated by tab characters, allowing for future reuse in scripting or command line post processing, like for example, selecting some of the columns printed:
76
77 ```bash
78 $ npm audit --parseable
79 ```
80
81 To parse columns, you can use for example `awk`, and just print some of them:
82
83 ```bash
84 $ npm audit --parseable | awk -F $'\t' '{print $1,$4}'
85 ```
86
87 Fail an audit only if the results include a vulnerability with a level of moderate or higher:
88
89 ```bash
90 $ npm audit --audit-level=moderate
91 ```
92
93 ### Description
94
95 The audit command submits a description of the dependencies configured in your project to your default registry and asks for a report of known vulnerabilities. The report returned includes instructions on how to act on this information. The command will exit with a 0 exit code if no vulnerabilities were found.
96
97 You can also have npm automatically fix the vulnerabilities by running `npm audit fix`. Note that some vulnerabilities cannot be fixed automatically and will require manual intervention or review. Also note that since `npm audit fix` runs a full-fledged `npm install` under the hood, all configs that apply to the installer will also apply to `npm install` -- so things like `npm audit fix --package-lock-only` will work as expected.
98
99 By default, the audit command will exit with a non-zero code if any vulnerability is found. It may be useful in CI environments to include the `--audit-level` parameter to specify the minimum vulnerability level that will cause the command to fail. This option does not filter the report output, it simply changes the command's failure threshold.
100
101 ### Content Submitted
102
103 - npm_version
104 - node_version
105 - platform
106 - node_env
107 - A scrubbed version of your package-lock.json or npm-shrinkwrap.json
108
109 #### Scrubbing
110
111 In order to ensure that potentially sensitive information is not included in the audit data bundle, some dependencies may have their names (and sometimes versions) replaced with opaque non-reversible identifiers. It is done for the following dependency types:
112
113 - Any module referencing a scope that is configured for a non-default registry has its name scrubbed. (That is, a scope you did a `npm login --scope=@ourscope` for.)
114 - All git dependencies have their names and specifiers scrubbed.
115 - All remote tarball dependencies have their names and specifiers scrubbed.
116 - All local directory and tarball dependencies have their names and specifiers scrubbed.
117
118 The non-reversible identifiers are a sha256 of a session-specific UUID and the value being replaced, ensuring a consistent value within the payload that is different between runs.
119
120 ### Exit Code
121
122 The `npm audit` command will exit with a 0 exit code if no vulnerabilities were found.
123
124 If vulnerabilities were found the exit code will depend on the `audit-level` configuration setting.
125
126 ### See Also
127
128 - [npm install](/cli/v6/commands/npm-install)
129 - [package-locks](/cli/v6/configuring-npm/package-locks)
130 - [config](/cli/v6/using-npm/config)