Run a security audit
npm audit
npm audit fix
The audit command submits a description of the dependencies configured in your project to your default registry and asks for a report of known vulnerabilities. The report returned includes instructions on how to act on this information.
You can also have npm automatically fix the vulnerabilities by running npm
audit fix
. Note that some vulnerabilities cannot be fixed automatically and
will require manual intervention or review.
In order to ensure that potentially sensitive information is not included in the audit data bundle, some dependencies may have their names (and sometimes versions) replaced with opaque non-reversible identifiers. It is done for the following dependency types:
npm login --scope=@ourscope
for.)The non-reversible identifiers are a sha256 of a session-specific UUID and the value being replaced, ensuring a consistent value within the payload that is different between runs.