What does npm audit do and how should you act on its results?
npm audit checks your dependency tree against a database of known vulnerabilities and reports severity and fixes. Use npm audit fix for safe upgrades, and review breaking or unreachable issues by hand.
Explain it simply
Your app depends on dozens of packages, and those depend on hundreds more. npm audit sends the list of exact versions in your lock file to the npm registry, which compares it with known security advisories. It is like an FSSAI check on every ingredient used in your kitchen, including the ones your suppliers bought.
Example
npm audit # list problems with severity
npm audit --omit=dev # only what ships to production
npm audit fix # apply upgrades that stay within semver ranges
npm audit fix --force # allow breaking major upgrades (review carefully)How to read the report:
- Severity levels are low, moderate, high and critical.
- "fix available" means a newer version removes the issue.
- A vulnerability in a dev-only tool, like a test runner, rarely affects production.
- Some issues sit in deep, transitive packages; the fix may need the direct dependency to update first.
Do not run --force blindly, since it may upgrade a package by a major version and break your build. Run your tests after any audit fix.
What to say in the interview
"npm audit compares my locked dependency versions against known advisories. I run it in CI, use audit fix for safe patches, check whether the vulnerable code path is actually used, and re-run tests before merging."
Common mistakes
- Treating a clean audit as proof the app is secure; it only knows published advisories.
- Using
--forceand shipping a broken upgrade.