npm audit Is Not Enough: Auditing Dependencies
What npm audit catches, what it misses - install scripts, typosquats, maintainer turnover - and a ten-minute review that covers the gap.
Short answer
npm audit covers known CVE matches in the tree. It misses typosquatting, malicious install scripts, compromised maintainers, and business-logic risk. Add lockfile review and install-script discipline.
What audit catches
Known advisory matches against your resolved tree - useful, incomplete.
Green audit does not mean "safe supply chain." It means "no known CVE matches in the DB today."
Readers skimming npm audit not enough often stop at definitions. The part that prevents incidents is the verification step after the change - and the habit of re-checking after the next deploy that touches the same layer.
Ten-minute extras
Diff lockfiles on PRs, watch new maintainers on critical packages, avoid surprise postinstall scripts, keep an SBOM for incidents.
Those habits catch classes of attack audit never sees.
Common failure mode for npm audit not enough: staging looks fine, production still serves the old config because a CDN, load balancer, or second vhost was never updated. Always verify the hostname customers hit.
CI policy
Fail builds on high/critical where reachable. Do not fail forever on unreachable noise without a human override path.
Noise that trains people to ignore red builds is worse than a strict policy with an escape hatch.
If this section on npm audit not enough becomes a recurring ticket, automate the check. Manual one-offs rot; a post-deploy assertion or weekly grade keeps the control honest.
What to do this week
- Run npm audit (or equivalent) and triage high/critical.
- Require lockfile diffs on dependency PRs.
- Flag packages with unexpected install scripts.
- Export an SBOM for the current release.
Audit is necessary. It is not sufficient.
Update log (1)
2026-06-25Editorial form rewrite for length and uniqueness.
Sources + verification
Practical guidance based on mainstream browser behavior, common reverse-proxy configuration, and widely published RFCs and vendor docs. Verify on your own stack with curl, browser devtools, and a re-scan after each change.
