11cb0ef41Sopenharmony_ci<!DOCTYPE html><html><head> 21cb0ef41Sopenharmony_ci<meta charset="utf-8"> 31cb0ef41Sopenharmony_ci<title>npm-audit</title> 41cb0ef41Sopenharmony_ci<style> 51cb0ef41Sopenharmony_cibody { 61cb0ef41Sopenharmony_ci background-color: #ffffff; 71cb0ef41Sopenharmony_ci color: #24292e; 81cb0ef41Sopenharmony_ci 91cb0ef41Sopenharmony_ci margin: 0; 101cb0ef41Sopenharmony_ci 111cb0ef41Sopenharmony_ci line-height: 1.5; 121cb0ef41Sopenharmony_ci 131cb0ef41Sopenharmony_ci font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Helvetica, Arial, sans-serif, "Apple Color Emoji", "Segoe UI Emoji"; 141cb0ef41Sopenharmony_ci} 151cb0ef41Sopenharmony_ci#rainbar { 161cb0ef41Sopenharmony_ci height: 10px; 171cb0ef41Sopenharmony_ci background-image: linear-gradient(139deg, #fb8817, #ff4b01, #c12127, #e02aff); 181cb0ef41Sopenharmony_ci} 191cb0ef41Sopenharmony_ci 201cb0ef41Sopenharmony_cia { 211cb0ef41Sopenharmony_ci text-decoration: none; 221cb0ef41Sopenharmony_ci color: #0366d6; 231cb0ef41Sopenharmony_ci} 241cb0ef41Sopenharmony_cia:hover { 251cb0ef41Sopenharmony_ci text-decoration: underline; 261cb0ef41Sopenharmony_ci} 271cb0ef41Sopenharmony_ci 281cb0ef41Sopenharmony_cipre { 291cb0ef41Sopenharmony_ci margin: 1em 0px; 301cb0ef41Sopenharmony_ci padding: 1em; 311cb0ef41Sopenharmony_ci border: solid 1px #e1e4e8; 321cb0ef41Sopenharmony_ci border-radius: 6px; 331cb0ef41Sopenharmony_ci 341cb0ef41Sopenharmony_ci display: block; 351cb0ef41Sopenharmony_ci overflow: auto; 361cb0ef41Sopenharmony_ci 371cb0ef41Sopenharmony_ci white-space: pre; 381cb0ef41Sopenharmony_ci 391cb0ef41Sopenharmony_ci background-color: #f6f8fa; 401cb0ef41Sopenharmony_ci color: #393a34; 411cb0ef41Sopenharmony_ci} 421cb0ef41Sopenharmony_cicode { 431cb0ef41Sopenharmony_ci font-family: SFMono-Regular, Consolas, "Liberation Mono", Menlo, Courier, monospace; 441cb0ef41Sopenharmony_ci font-size: 85%; 451cb0ef41Sopenharmony_ci padding: 0.2em 0.4em; 461cb0ef41Sopenharmony_ci background-color: #f6f8fa; 471cb0ef41Sopenharmony_ci color: #393a34; 481cb0ef41Sopenharmony_ci} 491cb0ef41Sopenharmony_cipre > code { 501cb0ef41Sopenharmony_ci padding: 0; 511cb0ef41Sopenharmony_ci background-color: inherit; 521cb0ef41Sopenharmony_ci color: inherit; 531cb0ef41Sopenharmony_ci} 541cb0ef41Sopenharmony_cih1, h2, h3 { 551cb0ef41Sopenharmony_ci font-weight: 600; 561cb0ef41Sopenharmony_ci} 571cb0ef41Sopenharmony_ci 581cb0ef41Sopenharmony_ci#logobar { 591cb0ef41Sopenharmony_ci background-color: #333333; 601cb0ef41Sopenharmony_ci margin: 0 auto; 611cb0ef41Sopenharmony_ci padding: 1em 4em; 621cb0ef41Sopenharmony_ci} 631cb0ef41Sopenharmony_ci#logobar .logo { 641cb0ef41Sopenharmony_ci float: left; 651cb0ef41Sopenharmony_ci} 661cb0ef41Sopenharmony_ci#logobar .title { 671cb0ef41Sopenharmony_ci font-weight: 600; 681cb0ef41Sopenharmony_ci color: #dddddd; 691cb0ef41Sopenharmony_ci float: left; 701cb0ef41Sopenharmony_ci margin: 5px 0 0 1em; 711cb0ef41Sopenharmony_ci} 721cb0ef41Sopenharmony_ci#logobar:after { 731cb0ef41Sopenharmony_ci content: ""; 741cb0ef41Sopenharmony_ci display: block; 751cb0ef41Sopenharmony_ci clear: both; 761cb0ef41Sopenharmony_ci} 771cb0ef41Sopenharmony_ci 781cb0ef41Sopenharmony_ci#content { 791cb0ef41Sopenharmony_ci margin: 0 auto; 801cb0ef41Sopenharmony_ci padding: 0 4em; 811cb0ef41Sopenharmony_ci} 821cb0ef41Sopenharmony_ci 831cb0ef41Sopenharmony_ci#table_of_contents > h2 { 841cb0ef41Sopenharmony_ci font-size: 1.17em; 851cb0ef41Sopenharmony_ci} 861cb0ef41Sopenharmony_ci#table_of_contents ul:first-child { 871cb0ef41Sopenharmony_ci border: solid 1px #e1e4e8; 881cb0ef41Sopenharmony_ci border-radius: 6px; 891cb0ef41Sopenharmony_ci padding: 1em; 901cb0ef41Sopenharmony_ci background-color: #f6f8fa; 911cb0ef41Sopenharmony_ci color: #393a34; 921cb0ef41Sopenharmony_ci} 931cb0ef41Sopenharmony_ci#table_of_contents ul { 941cb0ef41Sopenharmony_ci list-style-type: none; 951cb0ef41Sopenharmony_ci padding-left: 1.5em; 961cb0ef41Sopenharmony_ci} 971cb0ef41Sopenharmony_ci#table_of_contents li { 981cb0ef41Sopenharmony_ci font-size: 0.9em; 991cb0ef41Sopenharmony_ci} 1001cb0ef41Sopenharmony_ci#table_of_contents li a { 1011cb0ef41Sopenharmony_ci color: #000000; 1021cb0ef41Sopenharmony_ci} 1031cb0ef41Sopenharmony_ci 1041cb0ef41Sopenharmony_ciheader.title { 1051cb0ef41Sopenharmony_ci border-bottom: solid 1px #e1e4e8; 1061cb0ef41Sopenharmony_ci} 1071cb0ef41Sopenharmony_ciheader.title > h1 { 1081cb0ef41Sopenharmony_ci margin-bottom: 0.25em; 1091cb0ef41Sopenharmony_ci} 1101cb0ef41Sopenharmony_ciheader.title > .description { 1111cb0ef41Sopenharmony_ci display: block; 1121cb0ef41Sopenharmony_ci margin-bottom: 0.5em; 1131cb0ef41Sopenharmony_ci line-height: 1; 1141cb0ef41Sopenharmony_ci} 1151cb0ef41Sopenharmony_ci 1161cb0ef41Sopenharmony_cifooter#edit { 1171cb0ef41Sopenharmony_ci border-top: solid 1px #e1e4e8; 1181cb0ef41Sopenharmony_ci margin: 3em 0 4em 0; 1191cb0ef41Sopenharmony_ci padding-top: 2em; 1201cb0ef41Sopenharmony_ci} 1211cb0ef41Sopenharmony_ci</style> 1221cb0ef41Sopenharmony_ci</head> 1231cb0ef41Sopenharmony_ci<body> 1241cb0ef41Sopenharmony_ci<div id="banner"> 1251cb0ef41Sopenharmony_ci<div id="rainbar"></div> 1261cb0ef41Sopenharmony_ci<div id="logobar"> 1271cb0ef41Sopenharmony_ci<svg class="logo" role="img" height="32" width="32" viewBox="0 0 700 700"> 1281cb0ef41Sopenharmony_ci<polygon fill="#cb0000" points="0,700 700,700 700,0 0,0"></polygon> 1291cb0ef41Sopenharmony_ci<polygon fill="#ffffff" points="150,550 350,550 350,250 450,250 450,550 550,550 550,150 150,150"></polygon> 1301cb0ef41Sopenharmony_ci</svg> 1311cb0ef41Sopenharmony_ci<div class="title"> 1321cb0ef41Sopenharmony_cinpm command-line interface 1331cb0ef41Sopenharmony_ci</div> 1341cb0ef41Sopenharmony_ci</div> 1351cb0ef41Sopenharmony_ci</div> 1361cb0ef41Sopenharmony_ci 1371cb0ef41Sopenharmony_ci<section id="content"> 1381cb0ef41Sopenharmony_ci<header class="title"> 1391cb0ef41Sopenharmony_ci<h1 id="npm-audit">npm-audit</h1> 1401cb0ef41Sopenharmony_ci<span class="description">Run a security audit</span> 1411cb0ef41Sopenharmony_ci</header> 1421cb0ef41Sopenharmony_ci 1431cb0ef41Sopenharmony_ci<section id="table_of_contents"> 1441cb0ef41Sopenharmony_ci<h2 id="table-of-contents">Table of contents</h2> 1451cb0ef41Sopenharmony_ci<div id="_table_of_contents"><ul><li><a href="#synopsis">Synopsis</a></li><li><a href="#description">Description</a></li><li><a href="#package-lock">Package lock</a></li><li><a href="#audit-signatures">Audit Signatures</a></li><li><a href="#audit-endpoints">Audit Endpoints</a></li><ul><li><a href="#bulk-advisory-endpoint">Bulk Advisory Endpoint</a></li><li><a href="#quick-audit-endpoint">Quick Audit Endpoint</a></li><li><a href="#scrubbing">Scrubbing</a></li><li><a href="#calculating-meta-vulnerabilities-and-remediations">Calculating Meta-Vulnerabilities and Remediations</a></li></ul><li><a href="#exit-code">Exit Code</a></li><li><a href="#examples">Examples</a></li><li><a href="#configuration">Configuration</a></li><ul><li><a href="#audit-level"><code>audit-level</code></a></li><li><a href="#dry-run"><code>dry-run</code></a></li><li><a href="#force"><code>force</code></a></li><li><a href="#json"><code>json</code></a></li><li><a href="#package-lock-only"><code>package-lock-only</code></a></li><li><a href="#package-lock2"><code>package-lock</code></a></li><li><a href="#omit"><code>omit</code></a></li><li><a href="#include"><code>include</code></a></li><li><a href="#foreground-scripts"><code>foreground-scripts</code></a></li><li><a href="#ignore-scripts"><code>ignore-scripts</code></a></li><li><a href="#workspace"><code>workspace</code></a></li><li><a href="#workspaces"><code>workspaces</code></a></li><li><a href="#include-workspace-root"><code>include-workspace-root</code></a></li><li><a href="#install-links"><code>install-links</code></a></li></ul><li><a href="#see-also">See Also</a></li></ul></div> 1461cb0ef41Sopenharmony_ci</section> 1471cb0ef41Sopenharmony_ci 1481cb0ef41Sopenharmony_ci<div id="_content"><h3 id="synopsis">Synopsis</h3> 1491cb0ef41Sopenharmony_ci<pre><code class="language-bash">npm audit [fix|signatures] 1501cb0ef41Sopenharmony_ci</code></pre> 1511cb0ef41Sopenharmony_ci<h3 id="description">Description</h3> 1521cb0ef41Sopenharmony_ci<p>The audit command submits a description of the dependencies configured in 1531cb0ef41Sopenharmony_ciyour project to your default registry and asks for a report of known 1541cb0ef41Sopenharmony_civulnerabilities. If any vulnerabilities are found, then the impact and 1551cb0ef41Sopenharmony_ciappropriate remediation will be calculated. If the <code>fix</code> argument is 1561cb0ef41Sopenharmony_ciprovided, then remediations will be applied to the package tree.</p> 1571cb0ef41Sopenharmony_ci<p>The command will exit with a 0 exit code if no vulnerabilities were found.</p> 1581cb0ef41Sopenharmony_ci<p>Note that some vulnerabilities cannot be fixed automatically and will 1591cb0ef41Sopenharmony_cirequire manual intervention or review. Also note that since <code>npm audit fix</code> runs a full-fledged <code>npm install</code> under the hood, all configs that 1601cb0ef41Sopenharmony_ciapply to the installer will also apply to <code>npm install</code> -- so things like 1611cb0ef41Sopenharmony_ci<code>npm audit fix --package-lock-only</code> will work as expected.</p> 1621cb0ef41Sopenharmony_ci<p>By default, the audit command will exit with a non-zero code if any 1631cb0ef41Sopenharmony_civulnerability is found. It may be useful in CI environments to include the 1641cb0ef41Sopenharmony_ci<code>--audit-level</code> parameter to specify the minimum vulnerability level that 1651cb0ef41Sopenharmony_ciwill cause the command to fail. This option does not filter the report 1661cb0ef41Sopenharmony_cioutput, it simply changes the command's failure threshold.</p> 1671cb0ef41Sopenharmony_ci<h3 id="package-lock">Package lock</h3> 1681cb0ef41Sopenharmony_ci<p>By default npm requires a package-lock or shrinkwrap in order to run the 1691cb0ef41Sopenharmony_ciaudit. You can bypass the package lock with <code>--no-package-lock</code> but be 1701cb0ef41Sopenharmony_ciaware the results may be different with every run, since npm will 1711cb0ef41Sopenharmony_cire-build the dependency tree each time.</p> 1721cb0ef41Sopenharmony_ci<h3 id="audit-signatures">Audit Signatures</h3> 1731cb0ef41Sopenharmony_ci<p>To ensure the integrity of packages you download from the public npm registry, or any registry that supports signatures, you can verify the registry signatures of downloaded packages using the npm CLI.</p> 1741cb0ef41Sopenharmony_ci<p>Registry signatures can be verified using the following <code>audit</code> command:</p> 1751cb0ef41Sopenharmony_ci<pre><code class="language-bash">$ npm audit signatures 1761cb0ef41Sopenharmony_ci</code></pre> 1771cb0ef41Sopenharmony_ci<p>The npm CLI supports registry signatures and signing keys provided by any registry if the following conventions are followed:</p> 1781cb0ef41Sopenharmony_ci<ol> 1791cb0ef41Sopenharmony_ci<li>Signatures are provided in the package's <code>packument</code> in each published version within the <code>dist</code> object:</li> 1801cb0ef41Sopenharmony_ci</ol> 1811cb0ef41Sopenharmony_ci<pre><code class="language-json">"dist":{ 1821cb0ef41Sopenharmony_ci "..omitted..": "..omitted..", 1831cb0ef41Sopenharmony_ci "signatures": [{ 1841cb0ef41Sopenharmony_ci "keyid": "SHA256:{{SHA256_PUBLIC_KEY}}", 1851cb0ef41Sopenharmony_ci "sig": "a312b9c3cb4a1b693e8ebac5ee1ca9cc01f2661c14391917dcb111517f72370809..." 1861cb0ef41Sopenharmony_ci }] 1871cb0ef41Sopenharmony_ci} 1881cb0ef41Sopenharmony_ci</code></pre> 1891cb0ef41Sopenharmony_ci<p>See this <a href="https://registry.npmjs.org/light-cycle/1.4.3">example</a> of a signed package from the public npm registry.</p> 1901cb0ef41Sopenharmony_ci<p>The <code>sig</code> is generated using the following template: <code>${package.name}@${package.version}:${package.dist.integrity}</code> and the <code>keyid</code> has to match one of the public signing keys below.</p> 1911cb0ef41Sopenharmony_ci<ol start="2"> 1921cb0ef41Sopenharmony_ci<li>Public signing keys are provided at <code>registry-host.tld/-/npm/v1/keys</code> in the following format:</li> 1931cb0ef41Sopenharmony_ci</ol> 1941cb0ef41Sopenharmony_ci<pre><code>{ 1951cb0ef41Sopenharmony_ci "keys": [{ 1961cb0ef41Sopenharmony_ci "expires": null, 1971cb0ef41Sopenharmony_ci "keyid": "SHA256:{{SHA256_PUBLIC_KEY}}", 1981cb0ef41Sopenharmony_ci "keytype": "ecdsa-sha2-nistp256", 1991cb0ef41Sopenharmony_ci "scheme": "ecdsa-sha2-nistp256", 2001cb0ef41Sopenharmony_ci "key": "{{B64_PUBLIC_KEY}}" 2011cb0ef41Sopenharmony_ci }] 2021cb0ef41Sopenharmony_ci} 2031cb0ef41Sopenharmony_ci</code></pre> 2041cb0ef41Sopenharmony_ci<p>Keys response:</p> 2051cb0ef41Sopenharmony_ci<ul> 2061cb0ef41Sopenharmony_ci<li><code>expires</code>: null or a simplified extended <a href="https://en.wikipedia.org/wiki/ISO_8601%22">ISO 8601 format</a>: <code>YYYY-MM-DDTHH:mm:ss.sssZ</code></li> 2071cb0ef41Sopenharmony_ci<li><code>keydid</code>: sha256 fingerprint of the public key</li> 2081cb0ef41Sopenharmony_ci<li><code>keytype</code>: only <code>ecdsa-sha2-nistp256</code> is currently supported by the npm CLI</li> 2091cb0ef41Sopenharmony_ci<li><code>scheme</code>: only <code>ecdsa-sha2-nistp256</code> is currently supported by the npm CLI</li> 2101cb0ef41Sopenharmony_ci<li><code>key</code>: base64 encoded public key</li> 2111cb0ef41Sopenharmony_ci</ul> 2121cb0ef41Sopenharmony_ci<p>See this <a href="https://registry.npmjs.org/-/npm/v1/keys%22">example key's response from the public npm registry</a>.</p> 2131cb0ef41Sopenharmony_ci<h3 id="audit-endpoints">Audit Endpoints</h3> 2141cb0ef41Sopenharmony_ci<p>There are two audit endpoints that npm may use to fetch vulnerability 2151cb0ef41Sopenharmony_ciinformation: the <code>Bulk Advisory</code> endpoint and the <code>Quick Audit</code> endpoint.</p> 2161cb0ef41Sopenharmony_ci<h4 id="bulk-advisory-endpoint">Bulk Advisory Endpoint</h4> 2171cb0ef41Sopenharmony_ci<p>As of version 7, npm uses the much faster <code>Bulk Advisory</code> endpoint to 2181cb0ef41Sopenharmony_cioptimize the speed of calculating audit results.</p> 2191cb0ef41Sopenharmony_ci<p>npm will generate a JSON payload with the name and list of versions of each 2201cb0ef41Sopenharmony_cipackage in the tree, and POST it to the default configured registry at 2211cb0ef41Sopenharmony_cithe path <code>/-/npm/v1/security/advisories/bulk</code>.</p> 2221cb0ef41Sopenharmony_ci<p>Any packages in the tree that do not have a <code>version</code> field in their 2231cb0ef41Sopenharmony_cipackage.json file will be ignored. If any <code>--omit</code> options are specified 2241cb0ef41Sopenharmony_ci(either via the <a href="../using-npm/config#omit.html"><code>--omit</code> config</a>, or one of the 2251cb0ef41Sopenharmony_cishorthands such as <code>--production</code>, <code>--only=dev</code>, and so on), then packages will 2261cb0ef41Sopenharmony_cibe omitted from the submitted payload as appropriate.</p> 2271cb0ef41Sopenharmony_ci<p>If the registry responds with an error, or with an invalid response, then 2281cb0ef41Sopenharmony_cinpm will attempt to load advisory data from the <code>Quick Audit</code> endpoint.</p> 2291cb0ef41Sopenharmony_ci<p>The expected result will contain a set of advisory objects for each 2301cb0ef41Sopenharmony_cidependency that matches the advisory range. Each advisory object contains 2311cb0ef41Sopenharmony_cia <code>name</code>, <code>url</code>, <code>id</code>, <code>severity</code>, <code>vulnerable_versions</code>, and <code>title</code>.</p> 2321cb0ef41Sopenharmony_ci<p>npm then uses these advisory objects to calculate vulnerabilities and 2331cb0ef41Sopenharmony_cimeta-vulnerabilities of the dependencies within the tree.</p> 2341cb0ef41Sopenharmony_ci<h4 id="quick-audit-endpoint">Quick Audit Endpoint</h4> 2351cb0ef41Sopenharmony_ci<p>If the <code>Bulk Advisory</code> endpoint returns an error, or invalid data, npm will 2361cb0ef41Sopenharmony_ciattempt to load advisory data from the <code>Quick Audit</code> endpoint, which is 2371cb0ef41Sopenharmony_ciconsiderably slower in most cases.</p> 2381cb0ef41Sopenharmony_ci<p>The full package tree as found in <code>package-lock.json</code> is submitted, along 2391cb0ef41Sopenharmony_ciwith the following pieces of additional metadata:</p> 2401cb0ef41Sopenharmony_ci<ul> 2411cb0ef41Sopenharmony_ci<li><code>npm_version</code></li> 2421cb0ef41Sopenharmony_ci<li><code>node_version</code></li> 2431cb0ef41Sopenharmony_ci<li><code>platform</code></li> 2441cb0ef41Sopenharmony_ci<li><code>arch</code></li> 2451cb0ef41Sopenharmony_ci<li><code>node_env</code></li> 2461cb0ef41Sopenharmony_ci</ul> 2471cb0ef41Sopenharmony_ci<p>All packages in the tree are submitted to the Quick Audit endpoint. 2481cb0ef41Sopenharmony_ciOmitted dependency types are skipped when generating the report.</p> 2491cb0ef41Sopenharmony_ci<h4 id="scrubbing">Scrubbing</h4> 2501cb0ef41Sopenharmony_ci<p>Out of an abundance of caution, npm versions 5 and 6 would "scrub" any 2511cb0ef41Sopenharmony_cipackages from the submitted report if their name contained a <code>/</code> character, 2521cb0ef41Sopenharmony_ciso as to avoid leaking the names of potentially private packages or git 2531cb0ef41Sopenharmony_ciURLs.</p> 2541cb0ef41Sopenharmony_ci<p>However, in practice, this resulted in audits often failing to properly 2551cb0ef41Sopenharmony_cidetect meta-vulnerabilities, because the tree would appear to be invalid 2561cb0ef41Sopenharmony_cidue to missing dependencies, and prevented the detection of vulnerabilities 2571cb0ef41Sopenharmony_ciin package trees that used git dependencies or private modules.</p> 2581cb0ef41Sopenharmony_ci<p>This scrubbing has been removed from npm as of version 7.</p> 2591cb0ef41Sopenharmony_ci<h4 id="calculating-meta-vulnerabilities-and-remediations">Calculating Meta-Vulnerabilities and Remediations</h4> 2601cb0ef41Sopenharmony_ci<p>npm uses the 2611cb0ef41Sopenharmony_ci<a href="http://npm.im/@npmcli/metavuln-calculator"><code>@npmcli/metavuln-calculator</code></a> 2621cb0ef41Sopenharmony_cimodule to turn a set of security advisories into a set of "vulnerability" 2631cb0ef41Sopenharmony_ciobjects. A "meta-vulnerability" is a dependency that is vulnerable by 2641cb0ef41Sopenharmony_civirtue of dependence on vulnerable versions of a vulnerable package.</p> 2651cb0ef41Sopenharmony_ci<p>For example, if the package <code>foo</code> is vulnerable in the range <code>>=1.0.2 <2.0.0</code>, and the package <code>bar</code> depends on <code>foo@^1.1.0</code>, then that version 2661cb0ef41Sopenharmony_ciof <code>bar</code> can only be installed by installing a vulnerable version of <code>foo</code>. 2671cb0ef41Sopenharmony_ciIn this case, <code>bar</code> is a "metavulnerability".</p> 2681cb0ef41Sopenharmony_ci<p>Once metavulnerabilities for a given package are calculated, they are 2691cb0ef41Sopenharmony_cicached in the <code>~/.npm</code> folder and only re-evaluated if the advisory range 2701cb0ef41Sopenharmony_cichanges, or a new version of the package is published (in which case, the 2711cb0ef41Sopenharmony_cinew version is checked for metavulnerable status as well).</p> 2721cb0ef41Sopenharmony_ci<p>If the chain of metavulnerabilities extends all the way to the root 2731cb0ef41Sopenharmony_ciproject, and it cannot be updated without changing its dependency ranges, 2741cb0ef41Sopenharmony_cithen <code>npm audit fix</code> will require the <code>--force</code> option to apply the 2751cb0ef41Sopenharmony_ciremediation. If remediations do not require changes to the dependency 2761cb0ef41Sopenharmony_ciranges, then all vulnerable packages will be updated to a version that does 2771cb0ef41Sopenharmony_cinot have an advisory or metavulnerability posted against it.</p> 2781cb0ef41Sopenharmony_ci<h3 id="exit-code">Exit Code</h3> 2791cb0ef41Sopenharmony_ci<p>The <code>npm audit</code> command will exit with a 0 exit code if no vulnerabilities 2801cb0ef41Sopenharmony_ciwere found. The <code>npm audit fix</code> command will exit with 0 exit code if no 2811cb0ef41Sopenharmony_civulnerabilities are found <em>or</em> if the remediation is able to successfully 2821cb0ef41Sopenharmony_cifix all vulnerabilities.</p> 2831cb0ef41Sopenharmony_ci<p>If vulnerabilities were found the exit code will depend on the 2841cb0ef41Sopenharmony_ci<a href="../using-npm/config#audit-level.html"><code>audit-level</code> config</a>.</p> 2851cb0ef41Sopenharmony_ci<h3 id="examples">Examples</h3> 2861cb0ef41Sopenharmony_ci<p>Scan your project for vulnerabilities and automatically install any compatible 2871cb0ef41Sopenharmony_ciupdates to vulnerable dependencies:</p> 2881cb0ef41Sopenharmony_ci<pre><code class="language-bash">$ npm audit fix 2891cb0ef41Sopenharmony_ci</code></pre> 2901cb0ef41Sopenharmony_ci<p>Run <code>audit fix</code> without modifying <code>node_modules</code>, but still updating the 2911cb0ef41Sopenharmony_cipkglock:</p> 2921cb0ef41Sopenharmony_ci<pre><code class="language-bash">$ npm audit fix --package-lock-only 2931cb0ef41Sopenharmony_ci</code></pre> 2941cb0ef41Sopenharmony_ci<p>Skip updating <code>devDependencies</code>:</p> 2951cb0ef41Sopenharmony_ci<pre><code class="language-bash">$ npm audit fix --only=prod 2961cb0ef41Sopenharmony_ci</code></pre> 2971cb0ef41Sopenharmony_ci<p>Have <code>audit fix</code> install SemVer-major updates to toplevel dependencies, not 2981cb0ef41Sopenharmony_cijust SemVer-compatible ones:</p> 2991cb0ef41Sopenharmony_ci<pre><code class="language-bash">$ npm audit fix --force 3001cb0ef41Sopenharmony_ci</code></pre> 3011cb0ef41Sopenharmony_ci<p>Do a dry run to get an idea of what <code>audit fix</code> will do, and <em>also</em> output 3021cb0ef41Sopenharmony_ciinstall information in JSON format:</p> 3031cb0ef41Sopenharmony_ci<pre><code class="language-bash">$ npm audit fix --dry-run --json 3041cb0ef41Sopenharmony_ci</code></pre> 3051cb0ef41Sopenharmony_ci<p>Scan your project for vulnerabilities and just show the details, without 3061cb0ef41Sopenharmony_cifixing anything:</p> 3071cb0ef41Sopenharmony_ci<pre><code class="language-bash">$ npm audit 3081cb0ef41Sopenharmony_ci</code></pre> 3091cb0ef41Sopenharmony_ci<p>Get the detailed audit report in JSON format:</p> 3101cb0ef41Sopenharmony_ci<pre><code class="language-bash">$ npm audit --json 3111cb0ef41Sopenharmony_ci</code></pre> 3121cb0ef41Sopenharmony_ci<p>Fail an audit only if the results include a vulnerability with a level of moderate or higher:</p> 3131cb0ef41Sopenharmony_ci<pre><code class="language-bash">$ npm audit --audit-level=moderate 3141cb0ef41Sopenharmony_ci</code></pre> 3151cb0ef41Sopenharmony_ci<h3 id="configuration">Configuration</h3> 3161cb0ef41Sopenharmony_ci<h4 id="audit-level"><code>audit-level</code></h4> 3171cb0ef41Sopenharmony_ci<ul> 3181cb0ef41Sopenharmony_ci<li>Default: null</li> 3191cb0ef41Sopenharmony_ci<li>Type: null, "info", "low", "moderate", "high", "critical", or "none"</li> 3201cb0ef41Sopenharmony_ci</ul> 3211cb0ef41Sopenharmony_ci<p>The minimum level of vulnerability for <code>npm audit</code> to exit with a non-zero 3221cb0ef41Sopenharmony_ciexit code.</p> 3231cb0ef41Sopenharmony_ci<h4 id="dry-run"><code>dry-run</code></h4> 3241cb0ef41Sopenharmony_ci<ul> 3251cb0ef41Sopenharmony_ci<li>Default: false</li> 3261cb0ef41Sopenharmony_ci<li>Type: Boolean</li> 3271cb0ef41Sopenharmony_ci</ul> 3281cb0ef41Sopenharmony_ci<p>Indicates that you don't want npm to make any changes and that it should 3291cb0ef41Sopenharmony_cionly report what it would have done. This can be passed into any of the 3301cb0ef41Sopenharmony_cicommands that modify your local installation, eg, <code>install</code>, <code>update</code>, 3311cb0ef41Sopenharmony_ci<code>dedupe</code>, <code>uninstall</code>, as well as <code>pack</code> and <code>publish</code>.</p> 3321cb0ef41Sopenharmony_ci<p>Note: This is NOT honored by other network related commands, eg <code>dist-tags</code>, 3331cb0ef41Sopenharmony_ci<code>owner</code>, etc.</p> 3341cb0ef41Sopenharmony_ci<h4 id="force"><code>force</code></h4> 3351cb0ef41Sopenharmony_ci<ul> 3361cb0ef41Sopenharmony_ci<li>Default: false</li> 3371cb0ef41Sopenharmony_ci<li>Type: Boolean</li> 3381cb0ef41Sopenharmony_ci</ul> 3391cb0ef41Sopenharmony_ci<p>Removes various protections against unfortunate side effects, common 3401cb0ef41Sopenharmony_cimistakes, unnecessary performance degradation, and malicious input.</p> 3411cb0ef41Sopenharmony_ci<ul> 3421cb0ef41Sopenharmony_ci<li>Allow clobbering non-npm files in global installs.</li> 3431cb0ef41Sopenharmony_ci<li>Allow the <code>npm version</code> command to work on an unclean git repository.</li> 3441cb0ef41Sopenharmony_ci<li>Allow deleting the cache folder with <code>npm cache clean</code>.</li> 3451cb0ef41Sopenharmony_ci<li>Allow installing packages that have an <code>engines</code> declaration requiring a 3461cb0ef41Sopenharmony_cidifferent version of npm.</li> 3471cb0ef41Sopenharmony_ci<li>Allow installing packages that have an <code>engines</code> declaration requiring a 3481cb0ef41Sopenharmony_cidifferent version of <code>node</code>, even if <code>--engine-strict</code> is enabled.</li> 3491cb0ef41Sopenharmony_ci<li>Allow <code>npm audit fix</code> to install modules outside your stated dependency 3501cb0ef41Sopenharmony_cirange (including SemVer-major changes).</li> 3511cb0ef41Sopenharmony_ci<li>Allow unpublishing all versions of a published package.</li> 3521cb0ef41Sopenharmony_ci<li>Allow conflicting peerDependencies to be installed in the root project.</li> 3531cb0ef41Sopenharmony_ci<li>Implicitly set <code>--yes</code> during <code>npm init</code>.</li> 3541cb0ef41Sopenharmony_ci<li>Allow clobbering existing values in <code>npm pkg</code></li> 3551cb0ef41Sopenharmony_ci<li>Allow unpublishing of entire packages (not just a single version).</li> 3561cb0ef41Sopenharmony_ci</ul> 3571cb0ef41Sopenharmony_ci<p>If you don't have a clear idea of what you want to do, it is strongly 3581cb0ef41Sopenharmony_cirecommended that you do not use this option!</p> 3591cb0ef41Sopenharmony_ci<h4 id="json"><code>json</code></h4> 3601cb0ef41Sopenharmony_ci<ul> 3611cb0ef41Sopenharmony_ci<li>Default: false</li> 3621cb0ef41Sopenharmony_ci<li>Type: Boolean</li> 3631cb0ef41Sopenharmony_ci</ul> 3641cb0ef41Sopenharmony_ci<p>Whether or not to output JSON data, rather than the normal output.</p> 3651cb0ef41Sopenharmony_ci<ul> 3661cb0ef41Sopenharmony_ci<li>In <code>npm pkg set</code> it enables parsing set values with JSON.parse() before 3671cb0ef41Sopenharmony_cisaving them to your <code>package.json</code>.</li> 3681cb0ef41Sopenharmony_ci</ul> 3691cb0ef41Sopenharmony_ci<p>Not supported by all npm commands.</p> 3701cb0ef41Sopenharmony_ci<h4 id="package-lock-only"><code>package-lock-only</code></h4> 3711cb0ef41Sopenharmony_ci<ul> 3721cb0ef41Sopenharmony_ci<li>Default: false</li> 3731cb0ef41Sopenharmony_ci<li>Type: Boolean</li> 3741cb0ef41Sopenharmony_ci</ul> 3751cb0ef41Sopenharmony_ci<p>If set to true, the current operation will only use the <code>package-lock.json</code>, 3761cb0ef41Sopenharmony_ciignoring <code>node_modules</code>.</p> 3771cb0ef41Sopenharmony_ci<p>For <code>update</code> this means only the <code>package-lock.json</code> will be updated, 3781cb0ef41Sopenharmony_ciinstead of checking <code>node_modules</code> and downloading dependencies.</p> 3791cb0ef41Sopenharmony_ci<p>For <code>list</code> this means the output will be based on the tree described by the 3801cb0ef41Sopenharmony_ci<code>package-lock.json</code>, rather than the contents of <code>node_modules</code>.</p> 3811cb0ef41Sopenharmony_ci<h4 id="package-lock2"><code>package-lock</code></h4> 3821cb0ef41Sopenharmony_ci<ul> 3831cb0ef41Sopenharmony_ci<li>Default: true</li> 3841cb0ef41Sopenharmony_ci<li>Type: Boolean</li> 3851cb0ef41Sopenharmony_ci</ul> 3861cb0ef41Sopenharmony_ci<p>If set to false, then ignore <code>package-lock.json</code> files when installing. This 3871cb0ef41Sopenharmony_ciwill also prevent <em>writing</em> <code>package-lock.json</code> if <code>save</code> is true.</p> 3881cb0ef41Sopenharmony_ci<h4 id="omit"><code>omit</code></h4> 3891cb0ef41Sopenharmony_ci<ul> 3901cb0ef41Sopenharmony_ci<li>Default: 'dev' if the <code>NODE_ENV</code> environment variable is set to 3911cb0ef41Sopenharmony_ci'production', otherwise empty.</li> 3921cb0ef41Sopenharmony_ci<li>Type: "dev", "optional", or "peer" (can be set multiple times)</li> 3931cb0ef41Sopenharmony_ci</ul> 3941cb0ef41Sopenharmony_ci<p>Dependency types to omit from the installation tree on disk.</p> 3951cb0ef41Sopenharmony_ci<p>Note that these dependencies <em>are</em> still resolved and added to the 3961cb0ef41Sopenharmony_ci<code>package-lock.json</code> or <code>npm-shrinkwrap.json</code> file. They are just not 3971cb0ef41Sopenharmony_ciphysically installed on disk.</p> 3981cb0ef41Sopenharmony_ci<p>If a package type appears in both the <code>--include</code> and <code>--omit</code> lists, then 3991cb0ef41Sopenharmony_ciit will be included.</p> 4001cb0ef41Sopenharmony_ci<p>If the resulting omit list includes <code>'dev'</code>, then the <code>NODE_ENV</code> environment 4011cb0ef41Sopenharmony_civariable will be set to <code>'production'</code> for all lifecycle scripts.</p> 4021cb0ef41Sopenharmony_ci<h4 id="include"><code>include</code></h4> 4031cb0ef41Sopenharmony_ci<ul> 4041cb0ef41Sopenharmony_ci<li>Default:</li> 4051cb0ef41Sopenharmony_ci<li>Type: "prod", "dev", "optional", or "peer" (can be set multiple times)</li> 4061cb0ef41Sopenharmony_ci</ul> 4071cb0ef41Sopenharmony_ci<p>Option that allows for defining which types of dependencies to install.</p> 4081cb0ef41Sopenharmony_ci<p>This is the inverse of <code>--omit=<type></code>.</p> 4091cb0ef41Sopenharmony_ci<p>Dependency types specified in <code>--include</code> will not be omitted, regardless of 4101cb0ef41Sopenharmony_cithe order in which omit/include are specified on the command-line.</p> 4111cb0ef41Sopenharmony_ci<h4 id="foreground-scripts"><code>foreground-scripts</code></h4> 4121cb0ef41Sopenharmony_ci<ul> 4131cb0ef41Sopenharmony_ci<li>Default: <code>false</code> unless when using <code>npm pack</code> or <code>npm publish</code> where it 4141cb0ef41Sopenharmony_cidefaults to <code>true</code></li> 4151cb0ef41Sopenharmony_ci<li>Type: Boolean</li> 4161cb0ef41Sopenharmony_ci</ul> 4171cb0ef41Sopenharmony_ci<p>Run all build scripts (ie, <code>preinstall</code>, <code>install</code>, and <code>postinstall</code>) 4181cb0ef41Sopenharmony_ciscripts for installed packages in the foreground process, sharing standard 4191cb0ef41Sopenharmony_ciinput, output, and error with the main npm process.</p> 4201cb0ef41Sopenharmony_ci<p>Note that this will generally make installs run slower, and be much noisier, 4211cb0ef41Sopenharmony_cibut can be useful for debugging.</p> 4221cb0ef41Sopenharmony_ci<h4 id="ignore-scripts"><code>ignore-scripts</code></h4> 4231cb0ef41Sopenharmony_ci<ul> 4241cb0ef41Sopenharmony_ci<li>Default: false</li> 4251cb0ef41Sopenharmony_ci<li>Type: Boolean</li> 4261cb0ef41Sopenharmony_ci</ul> 4271cb0ef41Sopenharmony_ci<p>If true, npm does not run scripts specified in package.json files.</p> 4281cb0ef41Sopenharmony_ci<p>Note that commands explicitly intended to run a particular script, such as 4291cb0ef41Sopenharmony_ci<code>npm start</code>, <code>npm stop</code>, <code>npm restart</code>, <code>npm test</code>, and <code>npm run-script</code> 4301cb0ef41Sopenharmony_ciwill still run their intended script if <code>ignore-scripts</code> is set, but they 4311cb0ef41Sopenharmony_ciwill <em>not</em> run any pre- or post-scripts.</p> 4321cb0ef41Sopenharmony_ci<h4 id="workspace"><code>workspace</code></h4> 4331cb0ef41Sopenharmony_ci<ul> 4341cb0ef41Sopenharmony_ci<li>Default:</li> 4351cb0ef41Sopenharmony_ci<li>Type: String (can be set multiple times)</li> 4361cb0ef41Sopenharmony_ci</ul> 4371cb0ef41Sopenharmony_ci<p>Enable running a command in the context of the configured workspaces of the 4381cb0ef41Sopenharmony_cicurrent project while filtering by running only the workspaces defined by 4391cb0ef41Sopenharmony_cithis configuration option.</p> 4401cb0ef41Sopenharmony_ci<p>Valid values for the <code>workspace</code> config are either:</p> 4411cb0ef41Sopenharmony_ci<ul> 4421cb0ef41Sopenharmony_ci<li>Workspace names</li> 4431cb0ef41Sopenharmony_ci<li>Path to a workspace directory</li> 4441cb0ef41Sopenharmony_ci<li>Path to a parent workspace directory (will result in selecting all 4451cb0ef41Sopenharmony_ciworkspaces within that folder)</li> 4461cb0ef41Sopenharmony_ci</ul> 4471cb0ef41Sopenharmony_ci<p>When set for the <code>npm init</code> command, this may be set to the folder of a 4481cb0ef41Sopenharmony_ciworkspace which does not yet exist, to create the folder and set it up as a 4491cb0ef41Sopenharmony_cibrand new workspace within the project.</p> 4501cb0ef41Sopenharmony_ci<p>This value is not exported to the environment for child processes.</p> 4511cb0ef41Sopenharmony_ci<h4 id="workspaces"><code>workspaces</code></h4> 4521cb0ef41Sopenharmony_ci<ul> 4531cb0ef41Sopenharmony_ci<li>Default: null</li> 4541cb0ef41Sopenharmony_ci<li>Type: null or Boolean</li> 4551cb0ef41Sopenharmony_ci</ul> 4561cb0ef41Sopenharmony_ci<p>Set to true to run the command in the context of <strong>all</strong> configured 4571cb0ef41Sopenharmony_ciworkspaces.</p> 4581cb0ef41Sopenharmony_ci<p>Explicitly setting this to false will cause commands like <code>install</code> to 4591cb0ef41Sopenharmony_ciignore workspaces altogether. When not set explicitly:</p> 4601cb0ef41Sopenharmony_ci<ul> 4611cb0ef41Sopenharmony_ci<li>Commands that operate on the <code>node_modules</code> tree (install, update, etc.) 4621cb0ef41Sopenharmony_ciwill link workspaces into the <code>node_modules</code> folder. - Commands that do 4631cb0ef41Sopenharmony_ciother things (test, exec, publish, etc.) will operate on the root project, 4641cb0ef41Sopenharmony_ci<em>unless</em> one or more workspaces are specified in the <code>workspace</code> config.</li> 4651cb0ef41Sopenharmony_ci</ul> 4661cb0ef41Sopenharmony_ci<p>This value is not exported to the environment for child processes.</p> 4671cb0ef41Sopenharmony_ci<h4 id="include-workspace-root"><code>include-workspace-root</code></h4> 4681cb0ef41Sopenharmony_ci<ul> 4691cb0ef41Sopenharmony_ci<li>Default: false</li> 4701cb0ef41Sopenharmony_ci<li>Type: Boolean</li> 4711cb0ef41Sopenharmony_ci</ul> 4721cb0ef41Sopenharmony_ci<p>Include the workspace root when workspaces are enabled for a command.</p> 4731cb0ef41Sopenharmony_ci<p>When false, specifying individual workspaces via the <code>workspace</code> config, or 4741cb0ef41Sopenharmony_ciall workspaces via the <code>workspaces</code> flag, will cause npm to operate only on 4751cb0ef41Sopenharmony_cithe specified workspaces, and not on the root project.</p> 4761cb0ef41Sopenharmony_ci<p>This value is not exported to the environment for child processes.</p> 4771cb0ef41Sopenharmony_ci<h4 id="install-links"><code>install-links</code></h4> 4781cb0ef41Sopenharmony_ci<ul> 4791cb0ef41Sopenharmony_ci<li>Default: false</li> 4801cb0ef41Sopenharmony_ci<li>Type: Boolean</li> 4811cb0ef41Sopenharmony_ci</ul> 4821cb0ef41Sopenharmony_ci<p>When set file: protocol dependencies will be packed and installed as regular 4831cb0ef41Sopenharmony_cidependencies instead of creating a symlink. This option has no effect on 4841cb0ef41Sopenharmony_ciworkspaces.</p> 4851cb0ef41Sopenharmony_ci<h3 id="see-also">See Also</h3> 4861cb0ef41Sopenharmony_ci<ul> 4871cb0ef41Sopenharmony_ci<li><a href="../commands/npm-install.html">npm install</a></li> 4881cb0ef41Sopenharmony_ci<li><a href="../using-npm/config.html">config</a></li> 4891cb0ef41Sopenharmony_ci</ul></div> 4901cb0ef41Sopenharmony_ci 4911cb0ef41Sopenharmony_ci<footer id="edit"> 4921cb0ef41Sopenharmony_ci<a href="https://github.com/npm/cli/edit/latest/docs/content/commands/npm-audit.md"> 4931cb0ef41Sopenharmony_ci<svg role="img" viewBox="0 0 16 16" width="16" height="16" fill="currentcolor" style="vertical-align: text-bottom; margin-right: 0.3em;"> 4941cb0ef41Sopenharmony_ci<path fill-rule="evenodd" d="M11.013 1.427a1.75 1.75 0 012.474 0l1.086 1.086a1.75 1.75 0 010 2.474l-8.61 8.61c-.21.21-.47.364-.756.445l-3.251.93a.75.75 0 01-.927-.928l.929-3.25a1.75 1.75 0 01.445-.758l8.61-8.61zm1.414 1.06a.25.25 0 00-.354 0L10.811 3.75l1.439 1.44 1.263-1.263a.25.25 0 000-.354l-1.086-1.086zM11.189 6.25L9.75 4.81l-6.286 6.287a.25.25 0 00-.064.108l-.558 1.953 1.953-.558a.249.249 0 00.108-.064l6.286-6.286z"></path> 4951cb0ef41Sopenharmony_ci</svg> 4961cb0ef41Sopenharmony_ciEdit this page on GitHub 4971cb0ef41Sopenharmony_ci</a> 4981cb0ef41Sopenharmony_ci</footer> 4991cb0ef41Sopenharmony_ci</section> 5001cb0ef41Sopenharmony_ci 5011cb0ef41Sopenharmony_ci 5021cb0ef41Sopenharmony_ci 5031cb0ef41Sopenharmony_ci</body></html>