npm audit

The npm audit command submits a list of the dependencies from your project and returns a report of security violations. The report includes instructions on how you could remediate the issues.

Nexus Repository may be configured to use Sonatype Repository Firewall as a data source for npm audit to return results that align with your open-source governance policies.

• Requires a license for Sonatype Repository Firewall. Configure the Repository Firewall to audit your npm proxy repositories.
• Configure your npm project within Nexus Repository to use the npm audit command from the Repository Firewall.

See Configuring npm

• npm audit is supported with proxy and group repositories.
• Use npm audit fix to automatically remediate vulnerable dependencies.

Setup

Depending on which Sonatype solutions you are using with Nexus Repository, you have the option to evaluate npm packages using the policies configured for a specific application.

• Sonatype Lifecycle configuration for npm 6

Add the following line to your local .npmrc file including the application ID. (requires npm 6)

headers[]="app_id:<application_id>"

Note
The app_id header is supported only with npm 6. For npm 7 and later, npm audit evaluates packages against root organization policies. For application-scoped evaluation, use a supported Sonatype Lifecycle integration, such as IQ CLI or a CI/CD integration.

• Sonatype Repository Firewall configuration

Not including the application ID returns the results using the root organization policies. These reports do not include which violation would fail a build and are not scoped to the application's license policies.

Troubleshooting

• Reset the audit cache

Audit information is locally cached for 12 hours. Invalidating the cache at the repository level clears the audit cache.

• Increase the npm timeout

npm v6.14.4 limits requests to 30 seconds while most evaluations take just under a few minutes to finish. Add the timeout flag to increase the amount of time to fetch the results.

npm audit --timeout=300000

• Force update the lock file

If you don't get the application ID using the script try purging the cache with the following commands:

npm cache clean --force
npm clean install

• Error message example

You will receive the following message if the configuration is incomplete or incorrect:

Search results

No results found.