This repository was archived by the owner on Aug 11, 2022. It is now read-only.
File tree Expand file tree Collapse file tree 3 files changed +56
-0
lines changed
Filter options
Expand file tree Collapse file tree 3 files changed +56
-0
lines changed
Original file line number Diff line number Diff line change 1+ npm-audit(1) -- Run a security audit
2+ ====================================
3+
4+ ## SYNOPSIS
5+
6+ npm audit
7+
8+ ## DESCRIPTION
9+
10+ The audit command submits a description of the dependencies configured in
11+ your project to your default registry and asks for a report of known
12+ vulnerabilities. The report returned includes instructions on how to act on
13+ this information.
14+
15+ ## CONTENT SUBMITTED
16+
17+ * npm_version
18+ * node_version
19+ * platform
20+ * node_env
21+ * A scrubbed version of your package-lock.json or npm-shrinkwrap.json
22+
23+ ### SCRUBBING
24+
25+ In order to ensure that potentially sensitive information is not included in
26+ the audit data bundle, some dependencies may have their names (and sometimes
27+ versions) replaced with opaque non-reversible identifiers. It is done for
28+ the following dependency types:
29+
30+ * Any module referencing a scope that is configured for a non-default
31+ registry has its name scrubbed. (That is, a scope you did a ` npm login --scope=@ourscope ` for.)
32+ * All git dependencies have their names and specifiers scrubbed.
33+ * All remote tarball dependencies have their names and specifiers scrubbed.
34+ * All local directory and tarball dependencies have their names and specifiers scrubbed.
35+
36+ The non-reversible identifiers are a sha256 of a session-specific UUID and the
37+ value being replaced, ensuring a consistent value within the payload that is
38+ different between runs.
39+
40+ ## SEE ALSO
41+
42+ * npm-install(1)
43+ * config(7)
Original file line number Diff line number Diff line change @@ -359,6 +359,9 @@ node source code so that npm can compile native modules.
359359The ` --only={prod[uction]|dev[elopment]} ` argument will cause either only
360360` devDependencies ` or only non-` devDependencies ` to be installed regardless of the ` NODE_ENV ` .
361361
362+ The ` --no-audit ` argument can be used to disable sending of audit reports to
363+ the configured registries. See ` npm-audit(1) ` for details on what is sent.
364+
362365See ` npm-config(7) ` . Many of the configuration params have some
363366effect on installation, since that's most of what npm does.
364367
@@ -434,6 +437,7 @@ affects a real use-case, it will be investigated.
434437
435438* npm-folders(5)
436439* npm-update(1)
440+ * npm-audit(1)
437441* npm-link(1)
438442* npm-rebuild(1)
439443* npm-scripts(7)
Original file line number Diff line number Diff line change @@ -155,6 +155,15 @@ even for `GET` requests.
155155When "dev" or "development" and running local ` npm shrinkwrap ` ,
156156` npm outdated ` , or ` npm update ` , is an alias for ` --dev ` .
157157
158+ ### audit
159+
160+ * Default: true
161+ * Type: Boolean
162+
163+ When "true" submit audit reports alongside ` npm install ` runs to the default
164+ registry and all registries configured for scopes. See the documentation
165+ for npm-audit(1) for details on what is submitted.
166+
158167### auth-type
159168
160169* Default: ` 'legacy' `
You can’t perform that action at this time.
0 commit comments