npm audit Integration Guide

Integrate npm audit with Vulnetix. The built-in npm command audits your package.json and lockfile against the npm advisory database and converts JSON output to SARIF for upload.

Install & scan

$ # npm audit is built into npm - no separate install needed
npm --version   # verify npm is installed
$ # Step 1 - produce JSON report
npm audit --json > npm-audit.json

# Step 2 - convert to SARIF for Vulnetix
npx npm-audit-sarif -i npm-audit.json -o npm-audit.sarif

Run npm audit in CI

Scan on every push and upload the report as a workflow artifact:

- name: Run npm audit
  run: |
    npm ci
    npm audit --json > npm-audit.json || true

- name: Convert to SARIF
  run: npx npm-audit-sarif -i npm-audit.json -o npm-audit.sarif

- name: Upload report
  uses: actions/upload-artifact@v6
  with:
    name: npm-audit
    path: npm-audit.sarif
    if-no-files-found: warn

Then one publish job hands every artifact in the run to Vulnetix, recorded under npm audit's own name and version. Written once per workflow, however many scanners you run:

publish:
  name: Publish to Vulnetix
  runs-on: ubuntu-latest
  needs: [scan]        # every scanner job, or its report is never published
  if: always()         # or one failing scanner suppresses all the others
  permissions:
    contents: read
    actions: read      # required to list the run's artifacts
  env:
    VULNETIX_ORG_ID: ${{ secrets.VULNETIX_ORG_ID }}
    VULNETIX_API_KEY: ${{ secrets.VULNETIX_API_KEY }}
  steps:
    - uses: actions/checkout@v5
    - name: Install Vulnetix CLI
      run: |
        curl -fsSL https://cli.vulnetix.com/install.sh | sh -s -- --install-dir "$HOME/.local/bin"
        echo "$HOME/.local/bin" >> "$GITHUB_PATH"
    - name: Publish scanner reports
      env:
        GITHUB_TOKEN: ${{ github.token }}
      run: vulnetix gha upload --org-id "$VULNETIX_ORG_ID" --json

After the run, vulnetix gha status reports what was actually recorded.

How Vulnetix compares: better together

Vulnetix does not replace npm audit. Keep running it. Vulnetix sits on top of npm audit (and every other scanner you already own) turning disconnected tool outputs into one prioritised, fixable queue.

✓ full · ~ partial · ✗ not covered

What npm audit does well

• Built into every npm install: zero setup, universally available in any Node project's toolchain and CI
• Reads package-lock.json to build a full direct+transitive tree and computes 'meta-vulnerabilities' where a dep is vulnerable only through its own dependencies
• npm audit fix applies in-range remediations automatically, with --force for SemVer-major bumps
• Configurable severity gating via --audit-level (info/low/moderate/high/critical) makes it a simple CI fail-gate

Where Vulnetix adds to it: npm audit covers one ecosystem (npm) with no exploit context or dedup. Vulnetix consumes its output and unifies it with SCA across 40+ ecosystems plus SAST, IaC, container, secrets, cloud and malware, adding EPSS/KEV/ESS prioritisation, reachability, versioned VEX and SSVC. It layers governance over npm audit's local fix, never replacing the built-in command.

No migration, no rip-and-replace. npm audit keeps doing what it does best; Vulnetix adds the orchestration, exploit-intelligence prioritisation and remediation layer built for the way AppSec works today.

Centralise npm audit results in Vulnetix

Upload npm audit JSON, SARIF output to the Vulnetix platform to deduplicate findings, prioritise them with EPSS, CISA KEV and Coalition ESS exploit intelligence, and track remediation across every scanner in a single queue.

npm audit documentation ↗  ·  Source repository ↗

Wire npm audit into your CI/CD pipeline →