{"id":13825486,"url":"https://github.com/ljharb/aud","last_synced_at":"2025-07-08T22:31:16.448Z","repository":{"id":56459921,"uuid":"171999142","full_name":"ljharb/aud","owner":"ljharb","description":"Use `npx aud` instead of `npm audit`, whether you have a lockfile or not!","archived":true,"fork":false,"pushed_at":"2024-07-31T21:13:21.000Z","size":186,"stargazers_count":26,"open_issues_count":0,"forks_count":2,"subscribers_count":5,"default_branch":"main","last_synced_at":"2024-08-04T09:03:48.998Z","etag":null,"topics":["audit","lockfile","npm"],"latest_commit_sha":null,"homepage":"","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/ljharb.png","metadata":{"funding":{"github":["ljharb"],"patreon":null,"open_collective":null,"ko_fi":"ljharb","tidelift":null,"community_bridge":null,"liberapay":null,"issuehunt":null,"otechie":null,"polar":null,"buy_me_a_coffee":null,"custom":null},"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":".github/FUNDING.yml","license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2019-02-22T05:19:31.000Z","updated_at":"2024-08-04T09:03:54.557Z","dependencies_parsed_at":"2023-12-03T06:24:19.369Z","dependency_job_id":"11958fdc-6d58-4549-a2cf-2e3ad492f538","html_url":"https://github.com/ljharb/aud","commit_stats":{"total_commits":101,"total_committers":1,"mean_commits":101.0,"dds":0.0,"last_synced_commit":"af8b7f98b28cf0b2eeb1213b03de5ee44e027390"},"previous_names":[],"tags_count":15,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ljharb%2Faud","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ljharb%2Faud/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ljharb%2Faud/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ljharb%2Faud/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/ljharb","download_url":"https://codeload.github.com/ljharb/aud/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":225470631,"owners_count":17479366,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["audit","lockfile","npm"],"created_at":"2024-08-04T09:01:21.921Z","updated_at":"2024-11-20T04:30:27.923Z","avatar_url":"https://github.com/ljharb.png","language":"JavaScript","funding_links":["https://github.com/sponsors/ljharb","https://ko-fi.com/ljharb"],"categories":["JavaScript"],"sub_categories":[],"readme":"# ***END OF LIFE***\n\nThanks to the wonderful folks at npm, in npm v10.2+, after [6 years](https://twitter.com/adam_baldwin/status/994314354530045952), `npm audit` [no longer requires a lockfile](https://github.com/npm/cli/pull/6732)!\n\nTherefore, you should no longer use `aud`. Instead, use `npx npm@'\u003e=10.2' audit --production`.\n\n--------\n\n# aud \u003csup\u003e[![Version Badge][npm-version-svg]][npm-url]\u003c/sup\u003e\n\n[![License][license-image]][license-url]\n[![Downloads][downloads-image]][downloads-url]\n\n[![npm badge][npm-badge-png]][npm-url]\n\nUse `npx aud` instead of `npm audit`, whether you have a lockfile or not!\n\nIt's a great idea to run `npm audit` in CI; it ensures that you don't unknowingly have vulnerabilities in your dep graph.\n\nUnfortunately, it doesn't work without a lockfile :crying_cat_face: and [only apps should have lockfiles](https://github.com/sindresorhus/ama/issues/479#issuecomment-310661514). It also requires `npm` `v6` or above.\n\nNow, instead of `npm audit`, you can run `npx aud`! If your repo has a lockfile, it will just run `npm audit`; if it does not, it will use [`npm-lockfile`](https://www.npmjs.com/package/npm-lockfile) to copy your `package.json` and your currently configured audit level (`npm config get audit-level`) to a temp dir that has the proper version of npm installed, it will use `npm install --package-lock-only` to create a temporary lockfile, and it will run `npm audit` there. On exit, all the temp dirs will get cleaned up.\n\n`aud fix` without a lockfile present will throw `npm audit`'s normal \"no lockfile\" error, since there's no way to preserve fixes to transitive dependencies.\n\n[npm-url]: https://npmjs.org/package/aud\n[npm-version-svg]: https://versionbadg.es/ljharb/aud.svg\n[deps-svg]: https://david-dm.org/ljharb/aud.svg?theme=shields.io\n[deps-url]: https://david-dm.org/ljharb/aud\n[dev-deps-svg]: https://david-dm.org/ljharb/aud/dev-status.svg?theme=shields.io\n[dev-deps-url]: https://david-dm.org/ljharb/aud#info=devDependencies\n[npm-badge-png]: https://nodei.co/npm/aud.png?downloads=true\u0026stars=true\n[license-image]: https://img.shields.io/npm/l/aud.svg\n[license-url]: LICENSE\n[downloads-image]: https://img.shields.io/npm/dm/aud.svg\n[downloads-url]: https://npm-stat.com/charts.html?package=aud\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fljharb%2Faud","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fljharb%2Faud","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fljharb%2Faud/lists"}