Detecting known dependency vulnerabilities

Throughout this book, we've leveraged modules on the npm registry to form a foundation for the applications we build. We've learned how the vast module ecosystem enables us to focus on application logic and not have to reinvent common low-level technical solutions for every application.

This ecosystem is key to Node.js's success. But it does lead to large, nested dependency trees within our applications. Not only must we be concerned with the security of the application code that we write ourselves, but we must also consider the security of the code included in the modules in our dependency tree. Even the most mature and popular modules and frameworks may contain security vulnerabilities.

In this recipe, we will demonstrate how to detect known vulnerabilities in a project's dependency tree.

Getting ready

For this recipe, we will just need a directory where we can install some Node.js modules:

$ mkdir audit...