Security advisories addressed

OWASP A06 (Vulnerable and Outdated Components) is the most mechanically preventable entry on the OWASP Top 10 — npm audit flags high and critical vulnerabilities automatically, yet most projects never run it in CI. SSDF SP 800-218 PW.4.4 requires active vulnerability scanning of dependencies as a baseline software security practice. A high-severity advisory in a direct dependency (e.g., prototype pollution in lodash, RCE in an older serialize-javascript) can be fixed with a single npm audit fix — but only if you know it's there.

Add npm audit to your CI pipeline. It exits non-zero on findings at or above the specified level, blocking the build:

# .github/workflows/ci.yml
- name: Audit dependencies
  run: npm audit --audit-level=high

To fix current findings:

npm audit fix          # auto-fix compatible versions
npm audit fix --force  # upgrade to breaking versions (review changes carefully)
npm audit              # see remaining issues requiring manual intervention

Add to package.json for local runs:

{ "scripts": { "audit:ci": "npm audit --audit-level=high" } }

• ID: security-advisories

• Severity: high

• What to look for: Check whether npm audit (or equivalent) is part of the development workflow. Look for an audit script in package.json scripts. Check CI/CD workflow files in .github/workflows/ for npm audit --audit-level=high or similar commands. If the CI does not run an audit, there is no automated mechanism to catch new vulnerabilities introduced when dependencies are updated. For a manual check: mentally scan package.json for well-known historically vulnerable packages (e.g., older express versions, serialize-javascript below 6.0.2, lodash below 4.17.21, path-parse below 1.0.7) and note their versions. Security advisories at the high and critical level are the pass/fail threshold.

• Pass criteria: Enumerate all relevant code locations. npm audit runs in CI (or equivalent), OR the project has no high/critical vulnerabilities in its current dependency tree. Audit command present in package.json scripts or CI workflow with at least 1 verified location.

• Fail criteria: No security audit step in CI and no evidence of manual audit; or known high/critical advisories are present in the current dependencies.

• Skip (N/A) when: Not a Node.js project.

• Detail on fail: "No npm audit step found in CI or package.json scripts; high/critical vulnerabilities may go undetected"

• Remediation: Add security auditing to your CI pipeline. For GitHub Actions:

  # .github/workflows/ci.yml
  - name: Audit dependencies
    run: npm audit --audit-level=high
  

  To fix current vulnerabilities:

  npm audit fix          # auto-fix compatible versions
  npm audit fix --force  # upgrade to breaking versions (review changes)
  npm audit              # see remaining issues requiring manual intervention
  

  Add to package.json for local runs:

  { "scripts": { "audit:ci": "npm audit --audit-level=high" } }