4 ms·

I wouldn’t recommend NPM audit. You’ll spend more time dealing with false positives, than fixing anything of significance. When everything is urgent, nothing i

• pimterry 5y ago
  There's some ongoing work to improve this, by reducing noise & false positives: https://github.com/npm/rfcs/pull/422 https://github.com/npm/rfcs/pull/422
  • vinnymac 5y ago
    This work is very exciting. Thanks for sending me the link, greatly appreciate it!
• dane-pgp 5y ago
  Filtering out a few false positives is easier than auditing every dependency from scratch by yourself, and probably less effort than explaining to your users why your site didn't include a fix for a known vulnerability. I take your point about "npm audit" being an annoying tool to use, though, and would recommend the package better-npm-audit in its place, which allows developers to ignore specific vulnerabilities by adding entries to a config file that can be committed to the repo. https://www.npmjs.com/package/better-npm-audit https://www.npmjs.com/package/better-npm-audit