Repository navigation
[RRFC] npm audit <package> for a not yet installed package #223
Description
Motivation ("The Why")
In some environments (aka corporate) the NPM Registry might be behind a firewall like Nexus Firewall (which automatically blocks vulnerable packages and responds to npm with status code 403. It would be nice to have the ability to query for vulnerabilities before installing a package.
Example
npm audit <package name> --remote
This would probably not have to report back a detailed report, a summary of vulnerabilities (low, moderate or high) would probably be enough.
How
Query npm audit for a not yet installed, single package.
Current Behaviour
There is nothing I am aware of.
Desired Behaviour
Report a summary of vulnerabilities for a not yet installed package back.
foo package security summary:
0 high vulnerabilities
0 moderate vulnerabilities
1 low vulnerability
References
- n/a
Activity
isaacs commentedon Sep 16, 2020
"fix")npm view?isaacs commentedon Sep 16, 2020
Ah yes, there is: https://www.npmjs.com/package/fix
darcyclarke commentedon Sep 18, 2020
Action items
Christian24 commentedon Sep 18, 2020
Thanks, for the suggestions, @isaacs. I pretty much went with all of them for the RFC, @darcyclarke I opened a RFC, I would call it a draft, so if you have any comments let me know :)
ruyadorno commentedon Sep 23, 2020
Let's follow up with the conversation in the PR now 😊