Security Audits & Supply Chain Attacks
The npm registry is a prime target for supply chain attacks. `npm audit` helps identify known vulnerabilities, while defensive flags like `--ignore-scripts` protect against malicious code execution during installation.
What is it?
A software supply chain attack occurs when a hacker compromises a dependency your app relies on. If they push a malicious update to a popular package, anyone who installs it gets infected.
npm audit scans your package-lock.json against a database of known vulnerabilities (CVEs) and warns you about compromised packages in your tree.
Why use it?
Because Node.js dependencies are deeply nested, you might explicitly install 10 packages, but implicitly download 1,000 transitive dependencies.
Without regular auditing, you could unknowingly ship applications containing backdoors, crypto-miners, or data-stealing malware.
How it works
Run npm audit to see a report of vulnerabilities. If a fix is available in a newer, compatible version, npm audit fix will automatically update your lockfile to patch it.
For vulnerabilities requiring a breaking major version bump, you must run npm audit fix --force (which is risky) or manually upgrade the package.
Interactive Demo
Explore the concept in action using the interactive visualization below.
Run a security audit to scan package-lock.json for known vulnerabilities.
Remember this
npm auditchecks your dependency tree against a database of known CVEs.npm audit fixautomatically bumps versions to patch non-breaking vulnerabilities.- Typosquatting and Dependency Confusion are common ways malware enters your tree.
- Malware often executes via
postinstallscripts; block them with--ignore-scripts.
Done with this concept?
Mark it complete to track your progress. No login needed.