leo4135 Dependency Audit Rules
Audit Workflow
Dependency Audit:
- [ ] Run package manager audit
- [ ] Check lockfile integrity
- [ ] Review direct dependencies
- [ ] Flag transitive high/critical CVEs
- [ ] Check for abandoned/unmaintained packages
- [ ] Verify license compatibility
- [ ] Scan for suspicious install scripts
Automated Scans
# npm
npm audit --json 2>/dev/null | head -c 50000
npm outdated 2>/dev/null
# yarn
yarn npm audit --json 2>/dev/null || yarn audit --json 2>/dev/null
# pnpm
pnpm audit --json 2>/dev/null
# Alternative scanners (if available)
npx --yes audit-ci --moderate 2>/dev/null
npx --yes better-npm-audit audit 2>/dev/null
npx --yes lockfile-lint --path package-lock.json --type npm 2>/dev/null
Lockfile Rules
| Rule | Check |
|---|---|
| Lockfile committed | package-lock.json / yarn.lock / pnpm-lock.yaml in git |
| CI uses frozen install | npm ci / yarn install --frozen-lockfile / pnpm install --frozen-lockfile |
| No lockfile drift | Lockfile matches package.json |
| Integrity hashes present | integrity fields in lockfile |
# Verify frozen install works
npm ci --dry-run 2>&1 || true
Direct Dependency Review
For each direct dependency, check:
- Maintenance — last publish date, open issues, bus factor
- Popularity — weekly downloads (typosquatting risk if low)
- Permissions — does it need network/filesystem at install?
- Alternatives — is a lighter/safer alternative available?
# List direct deps with versions
node -e "const p=require('./package.json'); Object.entries({...p.dependencies}).forEach(([k,v])=>console.log(k,v))"
# Packages with install scripts (higher risk)
rg -n '"scripts"' node_modules/*/package.json -A5 2>/dev/null | rg "postinstall|preinstall|install" | head -30
CVE Triage Rules
| Severity | Action |
|---|---|
| Critical | Fix immediately — upgrade, patch, or remove |
| High | Fix within 7 days — assess exploitability in your context |
| Medium | Fix within 30 days — document if not exploitable |
| Low | Track — fix in next maintenance window |
Exploitability Assessment
Before dismissing a CVE, verify:
- Is the vulnerable code path reachable in your app?
- Is the vulnerable function exported/used?
- Does your version range actually include the vulnerable code?
- Is there a network-accessible attack vector?
Risky Package Patterns
| Pattern | Risk | Action |
|---|---|---|
* or latest version |
Unpredictable updates | Pin exact or caret with lockfile |
| GitHub URL dependencies | Unverified code | Pin commit SHA, audit source |
| Packages with no repository | Supply chain | Investigate or replace |
| Recently created, few downloads | Typosquatting | Verify package authenticity |
postinstall scripts |
Arbitrary code execution | Review script, use --ignore-scripts in CI until verified |
License Audit
npx --yes license-checker --summary 2>/dev/null
npx --yes license-checker --onlyAllow "MIT;Apache-2.0;BSD-2-Clause;BSD-3-Clause;ISC" 2>/dev/null
Flag for legal review:
- GPL/AGPL in distributed applications
- Unknown/missing licenses
- Custom restrictive licenses
Overrides & Resolutions
Document any overrides / resolutions in package.json:
rg -n "overrides|resolutions" package.json -A10
Each override must include:
- CVE being mitigated
- Why direct upgrade isn't possible
- Planned removal date
Report Template
## Dependency Audit Summary
**Package manager:** npm | yarn | pnpm
**Total dependencies:** N direct, M transitive
**Audit date:** YYYY-MM-DD
### Vulnerabilities
| Package | Severity | CVE | Installed | Fixed In | Reachable | Action |
|---------|----------|-----|-----------|----------|-----------|--------|
| lodash | High | CVE-2021-23337 | 4.17.20 | 4.17.21 | Yes | Upgrade |
### Outdated (security-relevant)
| Package | Current | Latest | Notes |
|---------|---------|--------|-------|
### Install Script Risks
| Package | Script | Risk |
|---------|--------|------|
### License Issues
| Package | License | Concern |
### Recommendations
1. Run `npm audit fix` for [list]
2. Replace [package] with [alternative]
3. Add `npm ci` to CI pipeline
Remediation Commands
# Safe auto-fix
npm audit fix
# Breaking changes (review each)
npm audit fix --force
# Update single package
npm update lodash
# Check what would change
npm outdated