How do I turn npm audit into a shareable report?

Render the JSON to HTML — `npm audit --json | npx npm-audit-html --output audit.html` — and POST the file to https://commareports.com/api/v1/reports with a Bearer comma_sk_ token. You get a URL with the advisories laid out as a document instead of a wall of terminal output.

Can I build the HTML myself instead of using a renderer?

Yes, and for a recurring digest it is often better. `npm audit --json` gives you a structured object; render the four or five fields your team argues about into a small table and publish that. A short table is easier to comment on than a full advisory dump.

How do I stop re-triaging the same advisory every week?

Publish to one report id and PATCH it on each run. The comment explaining why an advisory is accepted stays pinned at that URL, so the next run shows the finding with the decision already attached.

Does this work for pnpm and yarn?

Yes. `pnpm audit --json` and `yarn npm audit --json` emit comparable JSON; render and publish it the same way. Keep one report per workspace so each has its own history.

Whoever you allow — reports are private by default, with per-report access: private, team-visible, domain-gated, or named reviewers.

Share an npm audit report

npm audit is one of the few security tools every JavaScript team already runs, and one of the least acted upon. The output is terminal text, it scrolls past in CI, and its recommendation is frequently npm audit fix --force, which nobody is going to run on a Friday. So the audit becomes noise that the build prints and the team filters out.

The fix is not a different scanner. It is putting the results somewhere a human decision can attach to them.

Publish it

npm audit --json > audit.json || true
npx npm-audit-html --input audit.json --output audit.html

curl -fsS -X PATCH \
  "https://commareports.com/api/v1/reports/$COMMA_REPORT_ID" \
  -H "Authorization: Bearer $COMMA_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d "$(jq -n --rawfile html audit.html \
        --arg title "npm audit — web — $(date +%F)" \
        '{title: $title, html: $html}')"

|| true because a non-zero exit means findings, which is the case you care about. PATCH keeps one URL per workspace with a revision per run.

Or render your own digest

The full advisory list is not what a team discusses. What it discusses is: what is new since last week, what is high severity and reachable, what is blocked on a major bump. Three rows of HTML built from audit.json beats 900 lines of rendered advisories, and it gives reviewers something short enough to actually read — and to comment on. See commenting on HTML.

What the URL changes

Accepted advisories stay accepted, with the reason attached.
Each run is a revision, so "did that upgrade help" is a diff, not a memory test.
A weekly digest posts itself. A routine can run the audit on a cron and publish the refreshed report to the same URL.

Limits

HTML body: 5 MB. Deep dependency trees can render large — publish a digest and attach the raw JSON as an asset.
Scripts run, sandboxed: allow-scripts, no allow-same-origin.
60 requests/minute per token. Use a scoped token with reports:write only.

Try it

Comma is free — unlimited reports, unlimited commenters, unlimited revision history.

Publish an audit →