Safeguard
Tag

npm-audit

Safeguard articles tagged "npm-audit" — guides, analysis, and best practices for software supply chain and application security.

8 articles

Application Security

Wiring dependency and SAST scanning into your JavaScript CLI workflow

npm audit has shipped for free since npm 6 in 2018, yet most JavaScript teams still find out about vulnerable dependencies in a Slack alert, not a failed commit.

Jul 8, 20267 min read
Open Source Security

npm audit vs Snyk: comparing vulnerability scanners

npm audit is free and built-in; Snyk adds reachability analysis and auto-fix PRs. Here's how they really compare on data, false positives, and supply chain attacks.

Apr 20, 20267 min read
Open Source Security

package-lock.json integrity checks and the npm audit work...

A step-by-step guide to verifying package-lock.json integrity, running npm audit correctly, and scanning Node.js dependencies for tampering and vulnerabilities.

Jan 24, 20268 min read
Supply Chain

How to Fix a Vulnerable Transitive Dependency in npm

The CVE is four levels deep in a package you never installed. Four escalating fixes — parent upgrade, npm update, overrides, and forking — with the exact commands.

Oct 21, 20256 min read
AppSec

JavaScript Security Scanner: How It Works and What to Use

A JavaScript security scanner analyzes your code and dependencies for vulnerabilities. Here's what the different scanner types catch and how to wire them into CI.

Jul 21, 20256 min read
Open Source

How to Check for npm Vulnerabilities (and Actually Fix Them)

npm check vulnerabilities the right way: what npm audit tells you, where it misleads, and how to turn a wall of advisories into a short list of things worth fixing.

Jun 19, 20255 min read
Open Source

mocha npm: Security Review and Safe Usage

The mocha npm test framework runs only code you write, so its direct risk is low, but its dependency tree generates npm audit noise worth understanding.

May 14, 20256 min read
Supply Chain

npm Vulnerabilities: Detection, Triage, and Fix Workflow

Known CVEs and hostile packages are two different problems that share one dependency tree. A workflow for detecting npm vulnerabilities, triaging by reachability, and fixing without breaking your lockfile.

Mar 18, 20256 min read

Self-healing security runs on Safeguard.

Your first fix PR is minutes away.

No sales call required, even your agent can complete the purchase over MCP.

npm-audit — Safeguard Blog