Search code examples
securitynpmnpm-audit

Where do NPM audit warnings come from?

From what I can glean from the docs,

The audit command submits a description of the dependencies configured in your project to your default registry and asks for a report of known vulnerabilities.

So there is an NPM registry out there, I assume the same one from which I am going to get packages with npm install, and along with the packages it contains security audit warnings. If so, how does one register these warnings?

Solution

  • The default repository for NPM installs is https://www.npmjs.com. They have a security policy, along with a specific guide to reporting that states:

    If you find a security vulnerability in an npm package (either yours or someone else’s), you can report it to the npm Security team to help keep the Javascript ecosystem safe.

    ...

    1. On the package page, click Report a vulnerability.