npm Audit Parser

Run `npm audit --json` in your project directory. This outputs a machine-readable JSON object with all vulnerabilities. Pipe it to a file with `npm audit --json > audit.json` or paste the output directly into this tool.

npm audit uses four severity levels: critical (CVSS 9.0-10.0, immediate action required), high (7.0-8.9, fix soon), moderate (4.0-6.9, fix when able), low (0.1-3.9, fix at convenience). Critical and high severities are generally the most urgent to address.

A direct dependency is a package you explicitly listed in package.json. A transitive (indirect) dependency is a package that one of your dependencies depends on. Many vulnerabilities are in transitive dependencies, which require upgrading the parent package or using npm audit fix --force.

It automatically updates packages to the minimum version that fixes the vulnerability, as long as the update is semver-compatible (not a major version bump). For fixes requiring major version bumps, you need `npm audit fix --force` — but this may introduce breaking changes.

GHSA stands for GitHub Security Advisory. Each vulnerability gets a GHSA-xxxx-xxxx-xxxx identifier that you can look up at github.com/advisories for full details, affected versions, and patches. npm audit output includes these identifiers for easy cross-referencing.