@cryptotaxi247 / documentation
Code Commits Issues Pulls Sessions CI/CD
main
@reggi/path-to-regexp dependabot/npm_and_yarn/main/copy-to-clipboard-4.0.2 dependabot/npm_and_yarn/main/eslint-10.4.0 dependabot/npm_and_yarn/main/npmcli/eslint-config-7.0.0 dependabot/npm_and_yarn/main/proc-log-7.0.0 dependabot/npm_and_yarn/npm_and_yarn-826852524d dependabot/npm_and_yarn/npm_and_yarn-ab9a7f4bc2 deprecate-totp-2fa dhei/classic-tokens gat-bypass-2fa-docs jpg619/fix-accessibility-content-flow jpg619/version-bump-tar-2 kartykp/gat-bypass-2fa-docs kartykp/upgrade-path-to-regex main maitxn/version-bump-tar patch-1 reggi/cache-based-on-version reggi/dev-engines reggi/fix-transform-prettier reggi/overrides update-search-sensitivity
mdx 124 lines 8.28 KB
Raw
1 ---
2 title: Auditing package dependencies for security vulnerabilities
3 redirect_from:
4 - /getting-started/running-a-security-audit/
5 ---
6
7 ## About security audits
8
9 A security audit is an assessment of package dependencies for security vulnerabilities. Security audits help you protect your package's users by enabling you to find and fix known vulnerabilities in dependencies that could cause data loss, service outages, unauthorized access to sensitive information, or other issues.
10
11 ## Running a security audit with `npm audit`
12
13 <Note>
14
15 **Note:** The `npm audit` command is available in npm@6. To upgrade, run `npm install npm@latest -g`.
16
17 </Note>
18
19 The [`npm audit` command](https://docs.npmjs.com/cli/audit) submits a description of the dependencies configured in your package to your default registry and asks for a report of known vulnerabilities. `npm audit` checks direct dependencies, devDependencies, bundledDependencies, and optionalDependencies, but does not check peerDependencies.
20
21 `npm audit` automatically runs when you install a package with `npm install`. You can also run `npm audit` manually on your [locally installed packages](downloading-and-installing-packages-locally) to conduct a security audit of the package and produce a report of dependency vulnerabilities and, if available, suggested patches.
22
23 1. On the command line, navigate to your package directory by typing `cd path/to/your-package-name` and pressing **Enter**.
24 2. Ensure your package contains `package.json` and `package-lock.json` files.
25 3. Type `npm audit` and press **Enter**.
26 4. Review the audit report and run recommended commands or investigate further if needed.
27
28 ### Resolving `EAUDITNOPJSON` and `EAUDITNOLOCK` errors
29
30 `npm audit` requires packages to have `package.json` and `package-lock.json` files.
31
32 - If you get an `EAUDITNOPJSON` error, create a `package.json` file by following the steps in "[Creating a package.json file](creating-a-package-json-file)".
33 - If you get an `EAUDITNOLOCK` error, make sure your package has a `package.json` file, then create the package lock file by running `npm i --package-lock-only`.
34
35 ## Reviewing and acting on the security audit report
36
37 Running `npm audit` will produce a report of security vulnerabilities with the affected package name, vulnerability severity and description, path, and other information, and, if available, commands to apply patches to resolve vulnerabilities. For more information on the fields in the audit report, see "[About audit reports](about-audit-reports)"
38
39 ### Security vulnerabilities found with suggested updates
40
41 If security vulnerabilities are found and updates are available, you can either:
42
43 - Run the `npm audit fix` subcommand to automatically install compatible updates to vulnerable dependencies.
44 - Run the recommended commands individually to install updates to vulnerable dependencies. (Some updates may be semver-breaking changes; for more information, see "[SEMVER warnings](#semver-warnings)".)
45
46 <Screenshot src="/packages-and-modules/securing-your-code/audit-report-suggested-fixes.png" alt="Screenshot of command-line audit results with suggested fixes" />
47
48 #### SEMVER warnings
49
50 If the recommended action is a potential breaking change (semantic version major change), it will be followed by a `SEMVER WARNING` that says "SEMVER WARNING: Recommended action is a potentially breaking change". If the package with the vulnerability has changed its API, you may need to make additional changes to your package's code.
51
52 ### Security vulnerabilities found requiring manual review
53
54 If security vulnerabilities are found, but no patches are available, the audit report will provide information about the vulnerability so you can investigate further.
55
56 <Screenshot src="/packages-and-modules/securing-your-code/audit-manual-review.png" alt="Screenshot of command-line audit results requiring a manual review" />
57
58 To address the vulnerability, you can
59
60 - [Check for mitigating factors](#check-for-mitigating-factors)
61 - [Update dependent packages if a fix exists](#update-dependent-packages-if-a-fix-exists)
62 - [Fix the vulnerability](#fix-the-vulnerability)
63 - [Open an issue in the package or dependent package issue tracker](#open-an-issue-in-the-package-or-dependent-package-issue-tracker)
64
65 #### Check for mitigating factors
66
67 Review the security advisory in the "More info" field for mitigating factors that may allow you to continue using the package with the vulnerability in limited cases. For example, the vulnerability may only exist when the code is used on specific operating systems, or when a specific function is called.
68
69 #### Update dependent packages if a fix exists
70
71 If a fix exists but packages that depend on the package with the vulnerability have not been updated to include the fixed version, you may want to open a pull or merge request on the dependent package repository to use the fixed version.
72
73 1. To find the package that must be updated, check the "Path" field for the location of the package with the vulnerability, then check for the package that depends on it. For example, if the path to the vulnerability is `@package-name > dependent-package > package-with-vulnerability`, you will need to update `dependent-package`.
74 2. On the [npm public registry](https://npmjs.com), find the dependent package and navigate to its repository. For more information on finding packages, see "[Searching for and choosing packages to download](searching-for-and-choosing-packages-to-download)".
75 3. In the dependent package repository, open a pull or merge request to update the version of the vulnerable package to a version with a fix.
76 4. Once the pull or merge request is merged and the package has been updated in the [npm public registry](https://npmjs.com), update your copy of the package with `npm update`.
77
78 #### Fix the vulnerability
79
80 If a fix does not exist, you may want to suggest changes that address the vulnerability to the package maintainer in a pull or merge request on the package repository.
81
82 1. Check the "Path" field for the location of the vulnerability.
83 2. On the [npm public registry](https://npmjs.com), find the package with the vulnerability. For more information on finding packages, see "[Searching for and choosing packages to download](searching-for-and-choosing-packages-to-download)".
84 3. In the package repository, open a pull or merge request to make the fix on the package repository.
85 4. Once the fix is merged and the package has been updated in the npm public registry, update your copy of the package that depends on the package with the fix.
86
87 #### Open an issue in the package or dependent package issue tracker
88
89 If you do not want to fix the vulnerability or update the dependent package yourself, open an issue in the package or dependent package issue tracker.
90
91 1. On the [npm public registry](https://npmjs.com), find the package with the vulnerability or the dependent package that needs an update. For more information on finding packages, see "[Searching for and choosing packages to download](searching-for-and-choosing-packages-to-download)".
92 2. In the package or dependent package issue tracker, open an issue and include information from the audit report, including the vulnerability report from the "More info" field.
93
94 ### No security vulnerabilities found
95
96 If no security vulnerabilities are found, this means that packages with known vulnerabilities were not found in your package dependency tree. Since the advisory database can be updated at any time, we recommend regularly running `npm audit` manually, or adding `npm audit` to your continuous integration process.
97
98 <Screenshot src="/packages-and-modules/securing-your-code/audit-no-vulnerabilities.png" alt="Screenshot showing audit report with no vulnerabilities" />
99
100 ## Turning off `npm audit` on package installation
101
102 ### Installing a single package
103
104 To turn off `npm audit` when installing a single package, use the `--no-audit` flag:
105
106 ```
107 npm install example-package-name --no-audit
108 ```
109
110 For more information, see the [`npm-install` command][cli-install].
111
112 ### Installing all packages
113
114 To turn off `npm audit` when installing all packages, set the `audit` setting to `false` in your user and global npmrc config files:
115
116 ```
117 npm set audit false
118 ```
119
120 For more information, see the [`npm-config` management command][cli-config] and the [`npm-config` audit setting][cli-config-audit].
121
122 [cli-install]: /cli/install
123 [cli-config]: /cli/config
124 [cli-config-audit]: /cli/config#audit