Dependency Security Audit Guide

Modern applications depend on hundreds of third-party packages. One vulnerable transitive dependency can expose your entire application. This guide covers the tools and workflows to find, track, and fix dependency vulnerabilities at every stage of development.

Tool Comparison Overview

npm audit: Basics to Advanced

# Basic audit — shows all vulnerabilities
npm audit

# JSON output for scripting
npm audit --json

# Audit only production dependencies (exclude devDeps)
npm audit --omit=dev

# Auto-fix compatible vulnerabilities
npm audit fix

# Force fix (may upgrade major versions — review changes!)
npm audit fix --force

# Fail CI if high or critical vulns found
npm audit --audit-level=high  # exits 1 if high+ found

# Fix transitive dependency with npm overrides (package.json)
# "overrides": { "vulnerable-package": "^2.1.0" }

Reading npm audit Output

found 3 vulnerabilities (1 moderate, 1 high, 1 critical)

# critical
lodash  <=4.17.20
Severity: critical
Prototype Pollution — https://npmjs.com/advisories/1523
fix available via `npm audit fix`
node_modules/lodash
  your-package > lodash

# To fix transitive dep when no direct update exists:
# In package.json:
# "overrides": { "lodash": "^4.17.21" }

Snyk CLI

# Install and authenticate
npm install -g snyk
snyk auth  # opens browser for auth

# Test current project
snyk test

# Test with threshold (fail on high+)
snyk test --severity-threshold=high

# Monitor project (sends snapshot to Snyk dashboard)
snyk monitor

# Fix vulnerabilities (opens PR or patches)
snyk fix

# Test a specific package
snyk test [email protected]

# Ignore a vuln temporarily (creates .snyk file)
snyk ignore --id=SNYK-JS-LODASH-1234567 --expiry=2026-06-01 --reason="no fix available"

# Python
snyk test --file=requirements.txt

# Docker image scanning
snyk container test node:18-alpine

OWASP Dependency-Check

# Install (requires Java)
# Download from: https://github.com/jeremylong/DependencyCheck/releases

# Run against Node.js project
./dependency-check.sh \
  --project "MyApp" \
  --scan ./node_modules \
  --format HTML \
  --out ./reports/

# Run against Java project
./dependency-check.sh \
  --project "MyJavaApp" \
  --scan ./build/libs/ \
  --format "HTML,JSON,SARIF" \
  --out ./reports/

# Fail build if CVSS score >= 8
./dependency-check.sh \
  --project "MyApp" \
  --scan . \
  --failOnCVSS 8 \
  --out ./reports/

GitHub Dependabot Configuration

# .github/dependabot.yml
version: 2
updates:
  # npm dependencies
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "weekly"
      day: "monday"
    open-pull-requests-limit: 10
    groups:
      # Group minor/patch updates into one PR
      production-minor:
        dependency-type: "production"
        update-types: ["minor", "patch"]
    ignore:
      # Ignore major version bumps (review manually)
      - dependency-name: "react"
        update-types: ["version-update:semver-major"]

  # GitHub Actions versions
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"

  # Python pip
  - package-ecosystem: "pip"
    directory: "/backend"
    schedule:
      interval: "weekly"

CI/CD Integration: GitHub Actions

# .github/workflows/security.yml
name: Security Audit

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main]
  schedule:
    - cron: '0 6 * * 1'  # Weekly Monday 6am

jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: '20'

      - run: npm ci

      # npm audit — fail on high+ severity
      - name: npm audit
        run: npm audit --audit-level=high --omit=dev

      # Snyk (requires SNYK_TOKEN secret)
      - name: Snyk security scan
        uses: snyk/actions/node@master
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          args: --severity-threshold=high

      # Dependency Review (checks PRs for new vulns)
      - name: Dependency review
        uses: actions/dependency-review-action@v4
        with:
          fail-on-severity: high

CVE Severity Levels Reference