{"id":19061376,"url":"https://github.com/rouanw/npm-audit-helper","last_synced_at":"2025-04-24T07:12:15.399Z","repository":{"id":33021454,"uuid":"149214145","full_name":"rouanw/npm-audit-helper","owner":"rouanw","description":"Helps you understand and work through npm audit results","archived":false,"fork":false,"pushed_at":"2022-12-20T13:45:12.000Z","size":141,"stargazers_count":19,"open_issues_count":0,"forks_count":2,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-04-24T07:12:05.708Z","etag":null,"topics":["npm","npm-audit","security","security-vulnerability"],"latest_commit_sha":null,"homepage":"","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/rouanw.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE.md","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2018-09-18T02:01:12.000Z","updated_at":"2023-09-01T16:58:59.000Z","dependencies_parsed_at":"2023-01-14T23:05:08.935Z","dependency_job_id":null,"html_url":"https://github.com/rouanw/npm-audit-helper","commit_stats":null,"previous_names":[],"tags_count":9,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rouanw%2Fnpm-audit-helper","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rouanw%2Fnpm-audit-helper/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rouanw%2Fnpm-audit-helper/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rouanw%2Fnpm-audit-helper/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/rouanw","download_url":"https://codeload.github.com/rouanw/npm-audit-helper/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":250580735,"owners_count":21453536,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["npm","npm-audit","security","security-vulnerability"],"created_at":"2024-11-09T00:20:57.082Z","updated_at":"2025-04-24T07:12:15.381Z","avatar_url":"https://github.com/rouanw.png","language":"JavaScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# npm-audit-helper\n\n\u003e Are your `npm audit` results overwhelming you? This library helps you resolve them step by step.\n\n[![npm version](https://badge.fury.io/js/npm-audit-helper.svg)](https://badge.fury.io/js/npm-audit-helper)\n[![npm](https://img.shields.io/npm/dt/npm-audit-helper)](https://www.npmjs.com/package/npm-audit-helper)\n[![Build Status](https://travis-ci.org/rouanw/npm-audit-helper.svg?branch=master)](https://travis-ci.org/rouanw/npm-audit-helper)\n\n## Overview\n\nIt can be really overwhelming to stare at an npm audit report with 50+ vulnerabilities. Where do you start? `npm-audit-helper` helps answer that question, by providing smaller sets of output and a few hints. Example output:\n\n```sh\nfound 155 vulnerabilities (60 low, 76 moderate, 18 high, 1 critical) in 22715 scanned packages\n  3 vulnerabilities require manual review. See the full report for details.\n\n=== A little bit of help ===\n\nWhere to start:\n\n- run `npm audit fix` to automatically fix 13 issues. These should all be non-breaking upgrades, so don't stress.\n\n- Resolve the 3 high severity issues above and run this command again to move to the next severity.\n\n- The most problematic dependency seems to be example-lib with 18 issues that need your attention.\n```\n\n## Getting started\n\nAll you need to do is run `npm audit --json` and pipe the output to `npm-audit-helper`. There are a few different installation options:\n\n### npx (no installation)\n\n```sh\nnpm audit --json | npx npm-audit-helper\n```\n\n### Global installation\n\n```sh\nnpm install -g npm-audit-helper\nnpm audit --json | npm-audit-helper\n```\n\n### Per-project installation\n\n(1) __Install:__\n\n```sh\nnpm install --save-dev npm-audit-helper\n```\n\n(2) __Create task in `package.json`:__\n\n```jsonc\n{\n  \"scripts\": {\n    // ...\n    \"vuln\": \"npm audit --json | npm-audit-helper\"\n  }\n}\n```\n\n(3) __Run:__\n\n```sh\nnpm run vuln\n```\n\nThis last approach is great for setting up a `prepush` hook with a tool like [`husky`](https://github.com/typicode/husky). `npm-audit-helper` will return a non-zero exit code if vulnerabilities are found.\n\n## Options\n\n| Flag          | Description                                                                                                                 | Default |\n|---------------|-----------------------------------------------------------------------------------------------------------------------------|---------|\n| `--exit-zero` | Return a zero exit code even when there are vulnerabilities. Useful while you're working your way down to 0 vulnerabilities | `false` |\n| `--prod-only` | Only available for npm \u003c 7. Filter out vulnerability information for `devDependencies`                                      | `false` |\n\nTo filter our dev dependencies on npm 7+, pass the `--only=prod` option directly to npm:\n\n```sh\nnpm audit --json --only=prod | npx npm-audit-helper\n```\n\n## Dependencies\n\n- `npm-audit-helper` requires `npm` \u003e= `6.1.0` because it relies on the `--json` option. `npm install -g npm` to upgrade.\n- `npm-audit-helper` won't work if it's piped invalid JSON, so you should check the output of `npm audit --json` if you have any trouble. A likely cause of invalid JSON is additional `npm` logging, so check the `loglevel` option in your `.npmrc` or `~/.npmrc` file.\n- This has been tested on *nix, not Windows. Let me know if you use Windows and you'd like to use this library by opening an issue.\n\n## `npm audit` hints\n\n- You can get `npm audit` to ignore issues of a certain severity (but only for its exit code) by setting the [`audit-level` option](https://docs.npmjs.com/misc/config#audit-level).\n- You can tell `npm audit fix` to only fix production dependencies with `npm audit fix --only=prod`.\n- If you want to add exclusions to your project (i.e. these are vulnerabilities I've reviewed and want to ignore), take a look at [npm-audit-resolver](https://www.npmjs.com/package/npm-audit-resolver). There is [an RFC open](https://github.com/npm/rfcs/pull/18) to get `npm audit resolve` built into `npm`.\n\n## License\n\nMIT\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Frouanw%2Fnpm-audit-helper","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Frouanw%2Fnpm-audit-helper","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Frouanw%2Fnpm-audit-helper/lists"}