0

From what I can glean from the docs,

The audit command submits a description of the dependencies configured in your project to your default registry and asks for a report of known vulnerabilities.

So there is an NPM registry out there, I assume the same one from which I am going to get packages with npm install, and along with the packages it contains security audit warnings. If so, how does one register these warnings?

jonrsharpe
  • 115,751
  • 26
  • 228
  • 437
Bondolin
  • 2,793
  • 7
  • 34
  • 62
  • 1
    Did you read https://docs.npmjs.com/reporting-a-vulnerability-in-an-npm-package? There's also a security policy: https://www.npmjs.com/policies/security. If you're using a different repository for your installs, look for their equivalent. – jonrsharpe Mar 09 '20 at 13:19
  • @jonrsharpe, that's what I was looking for, thanks. If you go ahead and make it an answer I'll accept it. – Bondolin Mar 09 '20 at 13:27

1 Answers1

1

The default repository for NPM installs is https://www.npmjs.com. They have a security policy, along with a specific guide to reporting that states:

If you find a security vulnerability in an npm package (either yours or someone else’s), you can report it to the npm Security team to help keep the Javascript ecosystem safe.

...

  1. On the package page, click Report a vulnerability.
jonrsharpe
  • 115,751
  • 26
  • 228
  • 437