npm audit

npm audit --production

Analyze the project's npm dependencies with npm audit, detecting known package vulnerabilities and applying fixes.

Run it in the pipeline of Node projects when you want the native dependency analysis from the package manager: npm audit queries the npm advisory database with the dependency tree and reports findings — packages with vulnerabilities, severity, and the fix (npm audit fix). It's the SCA for the npm ecosystem: the pipeline check with the manager the team already uses. In Node DevSecOps, npm audit is the pipeline filter: a high-severity finding (--audit-level) blocks the merge and the fix is applied (audit fix).

Don't use it as a complete analysis: npm audit covers vulnerabilities from the npm database (advisories) — code (SAST) and runtime (DAST) issues are out of scope. The npm database updates: new CVEs require re-scanning. And beware: npm audit fix updates dependencies automatically — in projects with pinned dependencies, the fix breaks (breaking changes): review and apply with judgment. For commercial coverage (with reachability), Snyk (019); npm audit is the native check.