Security News
pnpm 10.0.0 Blocks Lifecycle Scripts by Default
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
better-npm-audit
Advanced tools
Reshape npm audit into the way the community would like, by the community itself, to encourage more people to do security audits.
The goal of this project is to help to reshape npm audit into the way the community would like, by the community itself. Giving another option for everyone and encourage more people to do security audits.
NPM has upgraded to version 7 in late 2020 and has breaking changes on the npm audit
. The output of npm audit has significantly changed both in the human-readable and --json
output styles. We have added handling so it works properly in both npm versions.
Docs | Link |
---|---|
NPM v6 & v7 changes | https://github.blog/2020-10-13-presenting-v7-0-0-of-the-npm-cli/ |
NPM v7 blog post | https://blog.npmjs.org/post/626173315965468672/npm-v7-series-beta-release-and-semver-major |
Official NPM v6 audit docs | https://docs.npmjs.com/cli/v6/commands/npm-audit |
Official NPM v7 audit docs | https://docs.npmjs.com/cli/v7/commands/npm-audit |
Dealing with new npm audit | https://uko.codes/dealing-with-npm-v7-audit-changes |
$ npm install --save better-npm-audit
or
$ npm install -g better-npm-audit
better-npm-audit audit
Unhandled or new exceptions will be highlighted:
Unused exceptions will be notified:
{
"scripts": {
"prepush": "npm run test && npm run audit",
"audit": "better-npm-audit audit audit"
}
}
Now you can run locally or in your CI pipeline:
npm run audit
Flag | Short | Description |
---|---|---|
--exclude | -x | Exceptions or the vulnerabilities ID(s) to exclude |
--level | -l | The minimum audit level to validate; Same as the original --audit-level flag |
--production | -p | Skip checking the devDependencies |
Variable | Description |
---|---|
NPM_CONFIG_AUDIT_LEVEL | Used in setting the audit level. Note: this will be disregard if the audit level flag is passed onto the command. |
.nsprc
file to manage exceptionsYou may add a file .nsprc
to your project root directory to manage the exceptions. For example:
{
"1337": {
"active": true,
"notes": "Ignored since we don't use xxx method",
"expiry": 1615462134681
},
"4501": {
"active": false,
"notes": "Ignored since we don't use xxx method"
},
"980": "Ignored since we don't use xxx method",
"Note": "Any non number key will not be excepted"
}
Attribute | Description | Default |
---|---|---|
active | Boolean type to determine if we should use it for exception; true or false | true |
expiry | Date time in milliseconds, the number of milliseconds since midnight 01 January, 1970 UTC. You can use new Date(2021, 1, 1).valueOf() to get the milliseconds value. | |
notes | Notes related to the vulnerability; will be displayed in the table summary. |
When using a .nsprc
file, you will see this report display when it starts running:
You can find the changelog here.
@IanWright for his solutions in improving the vulnerability validation for us to have the minimum-audit-level and production-mode flags.
@EdwinTaylor for all the bug reports and improvement suggestions.
@MrHus for the logging of unused exceptions from the .nsprc file and -ignore flags. Courtesy of 42 BV.
If you like this project,
FAQs
Reshape into a better npm audit for the community and encourage more people to include security audit into their process.
The npm package better-npm-audit receives a total of 41,635 weekly downloads. As such, better-npm-audit popularity was classified as popular.
We found that better-npm-audit demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
Product
Socket now supports uv.lock files to ensure consistent, secure dependency resolution for Python projects and enhance supply chain security.
Research
Security News
Socket researchers have discovered multiple malicious npm packages targeting Solana private keys, abusing Gmail to exfiltrate the data and drain Solana wallets.