NAME

       npm-audit - Run a security audit

   Synopsis
         npm audit [--json|--parseable|--audit-level=(low|moderate|high|critical)]
         npm audit fix [--force|--package-lock-only|--dry-run]

         common options: [--production] [--only=(dev|prod)]

   Examples
       Scan  your  project  for  vulnerabilities  and automatically install any compatible updates to vulnerable
       dependencies:

         $ npm audit fix

       Run audit fix without modifying node_modules, but still updating the pkglock:

         $ npm audit fix --package-lock-only

       Skip updating devDependencies:

         $ npm audit fix --only=prod

       Have audit fix install semver-major updates to toplevel dependencies, not just semver-compatible ones:

         $ npm audit fix --force

       Do a dry run to get an idea of what audit fix will do,  and  also  output  install  information  in  JSON
       format:

         $ npm audit fix --dry-run --json

       Scan your project for vulnerabilities and just show the details, without fixing anything:

         $ npm audit

       Get the detailed audit report in JSON format:

         $ npm audit --json

       Get  the  detailed  audit  report  in plain text result, separated by tab characters, allowing for future
       reuse in scripting or command line post processing, like for  example,  selecting  some  of  the  columns
       printed:

         $ npm audit --parseable

       To parse columns, you can use for example awk, and just print some of them:

         $ npm audit --parseable | awk -F $'\t' '{print $1,$4}'

       Fail an audit only if the results include a vulnerability with a level of moderate or higher:

         $ npm audit --audit-level=moderate

   Description
       The  audit  command  submits a description of the dependencies configured in your project to your default
       registry and asks for a report of known vulnerabilities. The report returned includes instructions on how
       to act on this information. The command will exit with a 0 exit code if no vulnerabilities were found.

       You can also have npm automatically fix the vulnerabilities by running npm  audit  fix.  Note  that  some
       vulnerabilities  cannot  be fixed automatically and will require manual intervention or review. Also note
       that since npm audit fix runs a full-fledged npm install under the hood, all configs that  apply  to  the
       installer will also apply to npm install -- so things like npm audit fix --package-lock-only will work as
       expected.

       By  default,  the  audit  command will exit with a non-zero code if any vulnerability is found. It may be
       useful in CI environments to include the --audit-level parameter to  specify  the  minimum  vulnerability
       level  that  will  cause  the  command  to fail. This option does not filter the report output, it simply
       changes the command's failure threshold.

   Content Submitted
       • npm_version

       • node_version

       • platform

       • node_env

       • A scrubbed version of your package-lock.json or npm-shrinkwrap.json

   Scrubbing
       In order to ensure that potentially sensitive information is not included in the audit data bundle,  some
       dependencies  may  have  their  names  (and  sometimes  versions)  replaced  with  opaque  non-reversible
       identifiers.  It is done for the following dependency types:

       • Any module referencing a scope that is configured for a non-default registry  has  its  name  scrubbed.
         (That is, a scope you did a npm login --scope=@ourscope for.)

       • All git dependencies have their names and specifiers scrubbed.

       • All remote tarball dependencies have their names and specifiers scrubbed.

       • All local directory and tarball dependencies have their names and specifiers scrubbed.

       The  non-reversible  identifiers  are  a  sha256 of a session-specific UUID and the value being replaced,
       ensuring a consistent value within the payload that is different between runs.

   Exit Code
       The npm audit command will exit with a 0 exit code if no vulnerabilities were found.

       If vulnerabilities were found the exit code will depend on the audit-level configuration setting.

   See Also
       • npm help install

       • npm help package-locks

       • npm help config

                                                   April 2020                                       NPM-AUDIT(1)