npm-audit-check

Enforces npm audit policies

Designed to be used within a build process to interrogate the output from npm audit --json and return an error exit code if any of the vulnerability levels are higher than those specified.

Use

npm-audit-check [options]

Option	Optional?	Use
-V, --version	Yes	output the version number
-i, --info	Yes	Set the maximum number of info vulnerabilities allowed
-l, --low	Yes	Set the maximum number of low vulnerabilities allowed
-m, --moderate	Yes	Set the maximum number of moderate vulnerabilities allowed
-h, --high	Yes	Set the maximum number of high vulnerabilities allowed
-c, --critical	Yes	Set the maximum number of critical vulnerabilities allowed
-t, --test	Yes	Report on level of vulnerabilities but return a success exit code
--help	Yes	Output usage information

You can also create a .auditrc file with your security policy or add it to your package.json file;

.auditrc

{
  "policy": {
    "critical": 10,
    "high": 5
  }
}

package.json

...
  "audit": {
    "policy": {
      "critical": 10,
      "high": 5
    }
  }

Note: The security policy is resolved in the following priority; command line arguments > package.json > .auditrc

Note: Not specifying any maximum vulnerabilities, will mean that npm-audit-check will not perform any checks.

Examples

npm-audit-check --critical 0

This will return an exit code set to 1 (error) if npm audit reports any critical vulnerabilities

npm-audit-check --critical 0 --high 5 --moderate 20

This will return an exit code set to 1 (error) if npm audit reports any critical vulnerabilities or more than 5 high vulnerabilities or more than 20 moderate vulnerabilities.

npm-audit-check --critical 0 --high 5 --moderate 20 -t

As above but the -t option means that the vulnerabilities will be reported but the check will return an exit code set to 0 (success)

Sample Output

Failure

npm-audit-check --low 0 --moderate 0 --high 0 --critical 0
There are 672 low vulnerabilities which is more than your allowed policy of 0
There are 36 moderate vulnerabilities which is more than your allowed policy of 0
There are 20 high vulnerabilities which is more than your allowed policy of 0
There are 5 critical vulnerabilities which is more than your allowed policy of 0
---------------------------------
Run npm audit to get more details
---------------------------------

Success

npm-audit-check --critical 10
---------------------------------------------------
No vulnerabilities found above the levels specified
---------------------------------------------------