| name | auditing-npm-dependencies |
| description | Audit a Node.js project's installed npm dependency tree for known
CVEs by wrapping the npm audit JSON output and emitting findings in
the canonical penetration-tester schema. Detects direct AND transitive
vulnerabilities, normalizes npm's severity scale (info/low/moderate/
high/critical) to the shared Severity enum, and parses both v1 and
v2 audit output formats so the skill works against npm 6 and npm
7+ lockfiles.
Use when: pre-merge gate on a Node project, post-incident sweep
after a transitive package compromise (e.g. event-stream, ua-parser,
node-ipc, color.js), SOC2 vendor-management evidence collection,
or auditing an inherited or acquired Node codebase.
Threshold: any HIGH or CRITICAL CVE in the resolved dependency
tree. MODERATE / LOW reported informationally.
Trigger with: "audit npm deps", "npm vulnerability scan", "check
node packages for CVEs", "npm audit".
|
| allowed-tools | ["Read","Bash(npm:*)","Bash(python3:*)","Glob"] |
| disallowed-tools | ["Bash(rm:*)","Bash(curl:*)","Bash(wget:*)","Write(.env)","Edit(.env)","Bash(npm publish:*)","Bash(npm install:*)"] |
| version | 3.30.0 |
| author | Jeremy Longshore <jeremy@intentsolutions.io> |
| license | MIT |
| compatibility | Designed for Claude Code |
| tags | ["security","dependency-audit","npm","cve","pentest"] |
Auditing npm Dependencies
Overview
Modern Node.js applications pull in hundreds of transitive packages
through a single npm install. The ratio of direct-to-transitive
dependencies on a typical app is around 1:50 — install 30 packages,
end up with 1,500. Every one of those packages can ship a CVE, get
maintainer-takeover-attacked, or contain a typosquatted near-name
package that someone slipped into your lockfile.
The published-CVE feed for npm is among the busiest in the ecosystem
because the registry is shared, public, and trivially installable.
npm audit queries the same advisory database GitHub's Dependabot
uses, returning per-package vulnerability records with CVE ID,
severity, affected version range, and fix-available version. Running
it is free and fast; the friction is interpreting the output and
deciding which findings actually block your release.
This skill standardizes that interpretation. It wraps npm audit --json, parses both the v1 (npm 6) and v2 (npm 7+) output shapes,
maps npm's severity vocabulary to the shared Severity enum, and
emits Findings in the canonical penetration-tester JSON shape so
downstream tooling (CI gates, security dashboards, SOC2 evidence
collection) gets uniform records regardless of which package
manager surfaced them.
When the skill produces findings
| Finding | Severity | Threshold | Affected control |
|---|
| Critical CVE in direct dep | CRITICAL | npm severity: critical AND package in dependencies of root package.json | CWE-1104 |
| Critical CVE in transitive dep | CRITICAL | npm severity: critical AND package NOT in root dependencies | CWE-1104 |
| High CVE in direct dep | HIGH | npm severity: high AND direct | CWE-1104 |
| High CVE in transitive dep | HIGH | npm severity: high AND transitive | CWE-1104 |
| Moderate CVE | MEDIUM | npm severity: moderate | CWE-1104 |
| Low CVE | LOW | npm severity: low |
