How do I get npm audit as JSON?

Run npm audit --json > audit.json in the folder with package-lock.json, then drop audit.json here. Add --omit=dev to audit production dependencies only. pnpm audit --json and yarn audit --json (classic, one JSON object per line) work too, as does yarn npm audit --json on Yarn 2+.

Why does a package show up with no advisory of its own?

npm lists every package in the vulnerable chain. mkdirp has no advisory, but it depends on a vulnerable minimist, so npm marks it critical “via minimist”. The report shows each advisory once, against the package it was filed for, and lists the packages it reaches through the tree.

What does “Breaking: react-scripts@2.1.3” mean?

npm's fixAvailable says the only resolution is a semver-major change — here, the famous case where npm audit fix --force would downgrade react-scripts to 2.1.3. That's why --force deserves a review: for build-time tools like react-scripts the advisory often doesn't reach production at all.

What if a package has no fix?

“No fix yet” means no patched version exists (fixAvailable is false, or the advisory's patched_versions is <0.0.0). The options are replacing the package, pinning a safe transitive version with npm overrides or pnpm.overrides, or recording that you accept the risk — which is a decision worth writing down where reviewers can see it.

Can I paste the result into a pull request?

Yes. “Copy Markdown” gives a GitHub-flavored table — severity with CVSS, package, linked advisory, vulnerable range and fix — that pastes into a PR comment or appends to $GITHUB_STEP_SUMMARY in a GitHub Actions job.

Is my audit uploaded?

No. The JSON is parsed and the report is built in your browser. It only leaves your machine if you click “Get a shareable link” and publish it to Comma — and then you choose who can open it.

Free tool

npm audit, as one page people can act on.

Drop the JSON from npm audit --json, pnpm audit --json or yarn audit --json. Get each advisory once, with its CVSS score, the packages it reaches and what it takes to fix — then copy a Markdown table for the pull request or send the report to whoever signs off on the risk.

audit.json

{
  "auditReportVersion": 2,
  "vulnerabilities": {
    "css-select": {
      "name": "css-select",
      "severity": "high",
      "isDirect": false,
      "via": [
        "nth-check"
      ],
      "effects": [
        "svgo"
      ],
      "range": "<=3.1.0",
      "nodes": [
        "node_modules/svgo/node_modules/css-select"
      ],
      "fixAvailable": {
        "name": "react-scripts",
        "version": "2.1.3",
        "isSemVerMajor": true
      }
    },
    "follow-redirects": {
      "name": "follow-redirects",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        {
          "source": 1096856,
          "name": "follow-redirects",
          "dependency": "follow-redirects",
          "title": "follow-redirects' Proxy-Authorization header kept across hosts",
          "url": "https://github.com/advisories/GHSA-cxjh-pqwp-8mfp",
          "severity": "moderate",
          "cwe": [
            "CWE-200"
          ],
          "cvss": {
            "score": 6.5
          },
          "range": "<=1.15.5"
        }
      ],
      "effects": [],
      "range": "<=1.15.5",
      "nodes": [
        "node_modules/follow-redirects"
      ],
      "fixAvailable": true
    },
    "lodash": {
      "name": "lodash",
      "severity": "high",
      "isDirect": true,
      "via": [
        {
          "source": 1096305,
          "name": "lodash",
          "dependency": "lodash",
          "title": "Command Injection in lodash",
          "url": "https://github.com/advisories/GHSA-35jh-r3h4-6jhm",
          "severity": "high",
          "cwe": [
            "CWE-77",
            "CWE-94"
          ],
          "cvss": {
            "score": 7.2
          },
          "range": "<4.17.21"
        },
        {
          "source": 1096302,
          "name": "lodash",
          "dependency": "lodash",
          "title": "Prototype Pollution in lodash",
          "url": "https://github.com/advisories/GHSA-p6mc-m468-83gw",
          "severity": "high",
          "cwe": [
            "CWE-770",
            "CWE-1321"
          ],
          "cvss": {
            "score": 7.4
          },
          "range": ">=3.7.0 <4.17.19"
        }
      ],
      "effects": [],
      "range": "<=4.17.20",
      "nodes": [
        "node_modules/lodash"
      ],
      "fixAvailable": true
    },
    "minimist": {
      "name": "minimist",
      "severity": "critical",
      "isDirect": false,
      "via": [
        {
          "source": 1097678,
          "name": "minimist",
          "dependency": "minimist",
          "title": "Prototype Pollution in minimist",
          "url": "https://github.com/advisories/GHSA-xvch-5gv4-984h",
          "severity": "critical",
          "cwe": [
            "CWE-1321"
          ],
          "cvss": {
            "score": 9.8
          },
          "range": ">=1.0.0 <1.2.6"
        }
      ],
      "effects": [
        "mkdirp"
      ],
      "range": "1.0.0 - 1.2.5",
      "nodes": [
        "node_modules/minimist"
      ],
      "fixAvailable": true
    },
    "mkdirp": {
      "name": "mkdirp",
      "severity": "critical",
      "isDirect": false,
      "via": [
        "minimist"
      ],
      "effects": [],
      "range": "0.4.1 - 0.5.1",
      "nodes": [
        "node_modules/mkdirp"
      ],
      "fixAvailable": true
    },
    "nth-check": {
      "name": "nth-check",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1095141,
          "name": "nth-check",
          "dependency": "nth-check",
          "title": "Inefficient Regular Expression Complexity in nth-check",
          "url": "https://github.com/advisories/GHSA-rp65-9cf3-cjxr",
          "severity": "high",
          "cwe": [
            "CWE-1333"
          ],
          "cvss": {
            "score": 7.5
          },
          "range": "<2.0.1"
        }
      ],
      "effects": [
        "css-select"
      ],
      "range": "<2.0.1",
      "nodes": [
        "node_modules/svgo/node_modules/nth-check"
      ],
      "fixAvailable": {
        "name": "react-scripts",
        "version": "2.1.3",
        "isSemVerMajor": true
      }
    },
    "react-scripts": {
      "name": "react-scripts",
      "severity": "high",
      "isDirect": true,
      "via": [
        "svgo"
      ],
      "effects": [],
      "range": ">=2.1.4",
      "nodes": [
        "node_modules/react-scripts"
      ],
      "fixAvailable": {
        "name": "react-scripts",
        "version": "2.1.3",
        "isSemVerMajor": true
      }
    },
    "semver": {
      "name": "semver",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        {
          "source": 1101088,
          "name": "semver",
          "dependency": "semver",
          "title": "semver vulnerable to Regular Expression Denial of Service",
          "url": "https://github.com/advisories/GHSA-c2qf-rxjj-qqgw",
          "severity": "moderate",
          "cwe": [
            "CWE-1333"
          ],
          "cvss": {
            "score": 5.3
          },
          "range": ">=7.0.0 <7.5.2"
        }
      ],
      "effects": [],
      "range": "7.0.0 - 7.5.1",
      "nodes": [
        "node_modules/semver"
      ],
      "fixAvailable": true
    },
    "svgo": {
      "name": "svgo",
      "severity": "high",
      "isDirect": false,
      "via": [
        "css-select"
      ],
      "effects": [
        "react-scripts"
      ],
      "range": "1.0.0 - 1.3.2",
      "nodes": [
        "node_modules/svgo"
      ],
      "fixAvailable": {
        "name": "react-scripts",
        "version": "2.1.3",
        "isSemVerMajor": true
      }
    }
  },
  "metadata": {
    "vulnerabilities": {
      "info": 0,
      "low": 0,
      "moderate": 2,
      "high": 5,
      "critical": 2,
      "total": 9
    },
    "dependencies": {
      "prod": 1312,
      "dev": 214,
      "optional": 41,
      "peer": 0,
      "peerOptional": 0,
      "total": 1525
    }
  }
}

5.8 KBnpm 7+ audit

Dependency audit.html

9 vulnerable packages (2 critical, 5 high, 2 moderate) · 6 advisories · 1525 dependencies scanned

Publishes this report on Comma: one URL for the audit that opens without repo access, restricted to named people or your company’s email domain if you like, comments pinned to the exact advisory (“accepted — build-time only”), and next week’s audit kept as a revision you can diff. Free, no card.

How the audit is read

npm 7 and later key vulnerabilities by package. Each via entry is either an advisory (title, GHSA URL, CVSS, CWE, range) or the name of another vulnerable package this one is affected through.
Advisories are listed once, most severe and highest CVSS first, against the package they were filed for — with the packages they reach followed through the via chain.
Fixes come from fixAvailable: true means npm audit fix resolves it within your ranges, an object with isSemVerMajor means only a breaking upgrade (what --force would install) does, false means no patch exists.
npm 6, pnpm and yarn classic use the older advisories shape: module_name, vulnerable_versions, patched_versions and dependency paths like express>body-parser>qs. A patched_versions of <0.0.0 means no fix.
Counts are of vulnerable packages, matching the totals line npm audit prints.

Getting the JSON

Package manager	Command
npm 7+	npm audit --json > audit.json
npm, production only	npm audit --omit=dev --json > audit.json
npm workspaces	npm audit --workspaces --json > audit.json
pnpm	pnpm audit --json > audit.json
yarn 1 (classic)	yarn audit --json > audit.json
yarn 2+ (berry)	yarn npm audit --all --recursive --json > audit.json
CI, without failing the step	npm audit --json > audit.json \|\| true

npm audit exits non-zero whenever it finds something, which stops most CI steps before the file is used — hence the || true.

When the audit needs a decision, not a terminal

Most audit findings end in a judgement call — upgrade now, override a transitive version, or accept the risk because the package only runs at build time. That call usually belongs to someone who won’t run npm audit: the tech lead, the client, the security reviewer collecting evidence for SOC 2. Published to Comma, the report is one link they can open on a phone and comment on advisory by advisory, and an agent can publish it from the pipeline after every lockfile change. More in how to share an npm audit report and what an SBOM is.

Questions

How do I get npm audit as JSON?: Run npm audit --json > audit.json in the folder with package-lock.json, then drop audit.json here. Add --omit=dev to audit production dependencies only. pnpm audit --json and yarn audit --json (classic, one JSON object per line) work too, as does yarn npm audit --json on Yarn 2+.
Why does a package show up with no advisory of its own?: npm lists every package in the vulnerable chain. mkdirp has no advisory, but it depends on a vulnerable minimist, so npm marks it critical “via minimist”. The report shows each advisory once, against the package it was filed for, and lists the packages it reaches through the tree.
What does “Breaking: react-scripts@2.1.3” mean?: npm's fixAvailable says the only resolution is a semver-major change — here, the famous case where npm audit fix --force would downgrade react-scripts to 2.1.3. That's why --force deserves a review: for build-time tools like react-scripts the advisory often doesn't reach production at all.
What if a package has no fix?: “No fix yet” means no patched version exists (fixAvailable is false, or the advisory's patched_versions is <0.0.0). The options are replacing the package, pinning a safe transitive version with npm overrides or pnpm.overrides, or recording that you accept the risk — which is a decision worth writing down where reviewers can see it.
Can I paste the result into a pull request?: Yes. “Copy Markdown” gives a GitHub-flavored table — severity with CVSS, package, linked advisory, vulnerable range and fix — that pastes into a PR comment or appends to $GITHUB_STEP_SUMMARY in a GitHub Actions job.
Is my audit uploaded?: No. The JSON is parsed and the report is built in your browser. It only leaves your machine if you click “Get a shareable link” and publish it to Comma — and then you choose who can open it.