Gathering detailed insights and metrics for @chax-at/better-npm-audit
Gathering detailed insights and metrics for @chax-at/better-npm-audit
Gathering detailed insights and metrics for @chax-at/better-npm-audit
Gathering detailed insights and metrics for @chax-at/better-npm-audit
Reshape a better npm audit for the community and encourage more people to include security audits into their process
npm install @chax-at/better-npm-audit
Typescript
Module System
Min. Node Version
Node Version
NPM Version
70.5
Supply Chain
80.3
Quality
79.8
Maintenance
100
Vulnerability
99.3
License
TypeScript (98.7%)
JavaScript (1.3%)
Total Downloads
18,956
Last Day
20
Last Week
244
Last Month
783
Last Year
10,257
MIT License
202 Commits
3 Branches
1 Contributors
Updated on Mar 07, 2022
Minified
Minified + Gzipped
Latest Version
3.6.9
Package Id
@chax-at/better-npm-audit@3.6.9
Unpacked Size
37.21 kB
Size
9.73 kB
File Count
11
NPM Version
8.19.2
Node Version
16.17.1
Published on
Jul 18, 2023
Cumulative downloads
Total Downloads
Last Day
0%
20
Compared to previous day
Last Week
47.9%
244
Compared to previous week
Last Month
-64.9%
783
Compared to previous month
Last Year
44.7%
10,257
Compared to previous year
The goal of this project is to help to reshape npm audit into the way the community would like, by the community itself. Giving another option for everyone and encourage more people to do security audits.
NPM has upgraded to version 7 in late 2020 and has breaking changes on the npm audit
. The output of npm audit has significantly changed both in the human-readable and --json
output styles. We have added handling so it works properly in both npm versions.
Docs | Link |
---|---|
NPM v6 & v7 changes | https://github.blog/2020-10-13-presenting-v7-0-0-of-the-npm-cli/ |
NPM v7 blog post | https://blog.npmjs.org/post/626173315965468672/npm-v7-series-beta-release-and-semver-major |
Official NPM v6 audit docs | https://docs.npmjs.com/cli/v6/commands/npm-audit |
Official NPM v7 audit docs | https://docs.npmjs.com/cli/v7/commands/npm-audit |
Dealing with new npm audit | https://uko.codes/dealing-with-npm-v7-audit-changes |
$ npm install --save better-npm-audit
or
$ npm install -g better-npm-audit
1better-npm-audit audit
Unhandled or newly reported vulnerabilities will be highlighted:
Unused exceptions will be notified:
1{ 2 "scripts": { 3 "prepush": "npm run test && npm run audit", 4 "audit": "better-npm-audit audit" 5 } 6}
Now you can run locally or in your CI pipeline:
1npm run audit
Flag | Short | Description |
---|---|---|
--exclude | -x | Exceptions or the vulnerabilities ID(s) to exclude |
--module-ignore | -m | Names of modules to exclude |
--level | -l | The minimum audit level to validate; Same as the original --audit-level flag |
--production | -p | Skip checking the devDependencies |
--registry | -r | The npm registry url to use |
Variable | Description |
---|---|
NPM_CONFIG_AUDIT_LEVEL | Used in setting the audit level. Note: this will be disregard if the audit level flag is passed onto the command. |
.nsprc
file to manage exceptionsYou may add a file .nsprc
to your project root directory to manage the exceptions. For example:
1{ 2 "1337": { 3 "active": true, 4 "notes": "Ignored since we don't use xxx method", 5 "expiry": 1615462134681 6 }, 7 "4501": { 8 "active": false, 9 "notes": "Ignored since we don't use xxx method" 10 }, 11 "980": "Ignored since we don't use xxx method", 12 "https://github.com/advisories/GHSA-93q8-gq69-wqmw": "Github vulnerability URLs are supported as well", 13 "GHSA-qrpm-p2h7-hrv2": "GHSA is also possible", 14 "Note": "Any non number key will not be accepted" 15}
Attribute | Type | Description | Default | Examples |
---|---|---|---|---|
active | Boolean | If the tool should use it for exception | true | true |
expiry | String | Number | Human-readable date, or milliseconds since the UNIX Epoch | - '2020-01-31' - '2020/01/31' - '01/31/2021, 11:03:58' - '1 March 2016 15:00' - '1 March 2016 3:00 pm' - '2012-01-26T13:51:50.417-07:00' - 'Sun, 11 Jul 2021 03:03:13 GMT' - 'Thu Jan 26 2017 11:00:00 GMT+1100 (Australian Eastern Daylight Time)' - 327611110417 | |
notes | String | Notes related to the vulnerability. |
When using a .nsprc
file, a report will be displayed when it starts running:
Note: the expiry date will be styled in yellow and red color if it is detected more than one or five years ago.
You can find the changelog here.
@IanWright for his solutions in improving the vulnerability validation for us to have the minimum-audit-level and production-mode flags.
@EdwinTaylor for all the bug reports and improvement suggestions.
@MrHus for the logging of unused exceptions from the .nsprc file and -ignore flags. Courtesy of 42 BV.
If you like this project,
No vulnerabilities found.
Reason
no dangerous workflow patterns detected
Reason
SAST tool detected: CodeQL
Details
Reason
no binaries found in the repo
Reason
license file detected
Details
Reason
dependency not pinned by hash detected -- score normalized to 1
Details
Reason
Found 0/30 approved changesets -- score normalized to 0
Reason
0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Reason
detected GitHub workflow tokens with excessive permissions
Details
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
security policy file not detected
Details
Reason
project is not fuzzed
Details
Reason
branch protection not enabled on development/release branches
Details
Reason
11 existing vulnerabilities detected
Details
Score
Last Scanned on 2025-05-05
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More