What Does npm audit Actually Check and How Do I Read the Output?

npm audit scans your project’s installed Node.js dependencies (including transitive/indirect ones) against a database of known vulnerabilities and reports matches with a severity rating.

Reading the output

• Each finding lists the affected package, severity (low/moderate/high/critical), and often a suggested fixed version
• npm audit fix attempts to automatically upgrade to non-vulnerable versions where a compatible fix exists
• npm audit fix --force will apply fixes that include breaking (major version) changes — use cautiously, and test thoroughly afterward

Practical use

Run it routinely (ideally in CI on every build, not just manually), and don’t treat every finding as equally urgent — prioritize by severity and whether the vulnerable code path is actually reachable in your usage.

FAQ

Does npm audit catch vulnerabilities in my own code?

No — it only checks third-party dependencies, not custom application code; that requires separate static analysis or manual review.