# Dependency Audit

> Audits npm/yarn/pnpm dependencies for known vulnerabilities, outdated packages, license risks, and suspicious packages. Use when the user asks for dependency audit, npm audit, CVE check, or supply chain review of packages.

- Skill: `leo4135/dependency-audit` (Agent Skill)
- Install (CLI): `npx skillmds@latest add leo4135/dependency-audit`
- Raw SKILL.md: https://api.skillmd.com/api/skills/leo4135/dependency-audit/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: leo4135 (https://skillmd.com/u/leo4135)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/leo4135/dependency-audit

---


# Dependency Audit Rules

## Audit Workflow

```
Dependency Audit:
- [ ] Run package manager audit
- [ ] Check lockfile integrity
- [ ] Review direct dependencies
- [ ] Flag transitive high/critical CVEs
- [ ] Check for abandoned/unmaintained packages
- [ ] Verify license compatibility
- [ ] Scan for suspicious install scripts
```

## Automated Scans

```bash
# npm
npm audit --json 2>/dev/null | head -c 50000
npm outdated 2>/dev/null

# yarn
yarn npm audit --json 2>/dev/null || yarn audit --json 2>/dev/null

# pnpm
pnpm audit --json 2>/dev/null

# Alternative scanners (if available)
npx --yes audit-ci --moderate 2>/dev/null
npx --yes better-npm-audit audit 2>/dev/null
npx --yes lockfile-lint --path package-lock.json --type npm 2>/dev/null
```

## Lockfile Rules

| Rule | Check |
|------|-------|
| Lockfile committed | `package-lock.json` / `yarn.lock` / `pnpm-lock.yaml` in git |
| CI uses frozen install | `npm ci` / `yarn install --frozen-lockfile` / `pnpm install --frozen-lockfile` |
| No lockfile drift | Lockfile matches `package.json` |
| Integrity hashes present | `integrity` fields in lockfile |

```bash
# Verify frozen install works
npm ci --dry-run 2>&1 || true
```

## Direct Dependency Review

For each direct dependency, check:

1. **Maintenance** — last publish date, open issues, bus factor
2. **Popularity** — weekly downloads (typosquatting risk if low)
3. **Permissions** — does it need network/filesystem at install?
4. **Alternatives** — is a lighter/safer alternative available?

```bash
# List direct deps with versions
node -e "const p=require('./package.json'); Object.entries({...p.dependencies}).forEach(([k,v])=>console.log(k,v))"

# Packages with install scripts (higher risk)
rg -n '"scripts"' node_modules/*/package.json -A5 2>/dev/null | rg "postinstall|preinstall|install" | head -30
```

## CVE Triage Rules

| Severity | Action |
|----------|--------|
| **Critical** | Fix immediately — upgrade, patch, or remove |
| **High** | Fix within 7 days — assess exploitability in your context |
| **Medium** | Fix within 30 days — document if not exploitable |
| **Low** | Track — fix in next maintenance window |

### Exploitability Assessment

Before dismissing a CVE, verify:
- Is the vulnerable code path reachable in your app?
- Is the vulnerable function exported/used?
- Does your version range actually include the vulnerable code?
- Is there a network-accessible attack vector?

## Risky Package Patterns

| Pattern | Risk | Action |
|---------|------|--------|
| `*` or `latest` version | Unpredictable updates | Pin exact or caret with lockfile |
| GitHub URL dependencies | Unverified code | Pin commit SHA, audit source |
| Packages with no repository | Supply chain | Investigate or replace |
| Recently created, few downloads | Typosquatting | Verify package authenticity |
| `postinstall` scripts | Arbitrary code execution | Review script, use `--ignore-scripts` in CI until verified |

## License Audit

```bash
npx --yes license-checker --summary 2>/dev/null
npx --yes license-checker --onlyAllow "MIT;Apache-2.0;BSD-2-Clause;BSD-3-Clause;ISC" 2>/dev/null
```

Flag for legal review:
- GPL/AGPL in distributed applications
- Unknown/missing licenses
- Custom restrictive licenses

## Overrides & Resolutions

Document any `overrides` / `resolutions` in package.json:

```bash
rg -n "overrides|resolutions" package.json -A10
```

Each override must include:
- CVE being mitigated
- Why direct upgrade isn't possible
- Planned removal date

## Report Template

```markdown
## Dependency Audit Summary

**Package manager:** npm | yarn | pnpm
**Total dependencies:** N direct, M transitive
**Audit date:** YYYY-MM-DD

### Vulnerabilities
| Package | Severity | CVE | Installed | Fixed In | Reachable | Action |
|---------|----------|-----|-----------|----------|-----------|--------|
| lodash | High | CVE-2021-23337 | 4.17.20 | 4.17.21 | Yes | Upgrade |

### Outdated (security-relevant)
| Package | Current | Latest | Notes |
|---------|---------|--------|-------|

### Install Script Risks
| Package | Script | Risk |
|---------|--------|------|

### License Issues
| Package | License | Concern |

### Recommendations
1. Run `npm audit fix` for [list]
2. Replace [package] with [alternative]
3. Add `npm ci` to CI pipeline
```

## Remediation Commands

```bash
# Safe auto-fix
npm audit fix

# Breaking changes (review each)
npm audit fix --force

# Update single package
npm update lodash

# Check what would change
npm outdated
```