npm audit
A local look at known vulnerabilities in the packages already installed in a JavaScript project.
Last updated
- Free tier
- Yes
- Checked
- 2026-10-13
What the public pages say
Run it in the project directory and read the report. Fix runtime issues first. Do not run a forced upgrade that jumps major versions unless you are ready to test the app.
A clean audit does not mean the app checks auth, and a noisy audit does not mean you should delete the lockfile. Pair it with GitHub Dependabot if the code is on GitHub.
Free tier
npm audit is a command in the npm CLI, not a separate subscription. It ships with npm, so there is no separate price. The npm docs page did not load when this was checked on 2026-10-13, so command flags and the advisory data source are listed as not stated.
Not stated on the vendor's site
- Current flags and which advisory database the command queries. Open the npm docs page before you script it.
Sources
Markdown version · Canonical page: https://shipsecurely.dev/tools/npm-audit