---
name: npm audit
slug: npm-audit
url: https://docs.npmjs.com/cli/commands/npm-audit
category: Dependencies
bestFor: "A local look at known vulnerabilities in the packages already installed in a JavaScript project."
freeTier: yes
price: "Included with npm"
checks: []
freeTierNote: "npm audit is a command in the npm CLI, not a separate subscription. It ships with npm, so there is no separate price. The npm docs page did not load when this was checked on 2026-10-13, so command flags and the advisory data source are listed as not stated."
verifiedOn: "2026-10-13"
sources:
  - https://docs.npmjs.com/cli/commands/npm-audit
unknowns:
  - "Current flags and which advisory database the command queries. Open the npm docs page before you script it."
---

Run it in the project directory and read the report. Fix runtime issues first. Do not run a forced upgrade that jumps major versions unless you are ready to test the app.

A clean audit does not mean the app checks auth, and a noisy audit does not mean you should delete the lockfile. Pair it with GitHub Dependabot if the code is on GitHub.