npm-pip-maven-audit

Overview

Most package managers ship native audit subcommands that query an ecosystem-specific advisory feed (npm advisories, PyPA, RubySec, Cargo advisory DB, etc.) - the fastest first-line defense: already installed, no extra tooling, runs in seconds. For full coverage, run one native audit + a unified scanner (snyk-test / osv-scanner). The speed/coverage tradeoff table is in references/ecosystem-config-and-triage.md.

When to use

• Fast first-line CI gate (run before slower comprehensive scans).
• Single-ecosystem repo where one native audit is sufficient.
• Local dev loop: npm audit after npm install is faster than setting up Snyk locally.
• Layered with snyk-test + osv-scanner for full coverage.

Step 1 - npm / Yarn / pnpm

# npm (built-in since npm 6)
npm audit
npm audit --audit-level=high              # filter to HIGH+CRITICAL
npm audit --json > audit.json
npm audit fix                              # auto-upgrade where compatible
npm audit fix --force                      # may break: bumps majors

# Yarn 2+ (Berry)
yarn npm audit
yarn npm audit --severity=high
yarn npm audit --recursive                 # scan all workspaces

# pnpm
pnpm audit
pnpm audit --audit-level high
pnpm audit --json

Source: docs.npmjs.com/cli/v10/commands/npm-audit + yarnpkg.com/cli/npm/audit + pnpm.io/cli/audit.

Step 2 - pip-audit (Python)

pip install pip-audit

# Scan installed packages in current env
pip-audit

# Scan a requirements file
pip-audit -r requirements.txt

# Scan with PyPA + OSV.dev
pip-audit -s pypi -s osv

# JSON / SARIF output
pip-audit --format json --output pip-audit.json
pip-audit --format sarif --output pip-audit.sarif

# Fix vulnerabilities (auto-upgrade)
pip-audit --fix

# Skip specific CVEs
pip-audit --ignore-vuln GHSA-xxxx-yyyy-zzzz

Source: pypi.org/project/pip-audit + github.com/pypa/pip-audit. pip-audit is the official PyPA tool (preferred over the older safety package).

Step 3 - Maven (OWASP Dependency-Check)

Maven has no native mvn audit; use the OWASP Dependency-Check plugin, which fails the build above a CVSS threshold and emits HTML/JSON/SARIF:

mvn dependency-check:check

The pom.xml plugin block (with failBuildOnCVSS + suppression file) and the Gradle equivalent are in references/ecosystem-config-and-triage.md.

Source: jeremylong.github.io/DependencyCheck/dependency-check-maven/.

Step 4 - cargo audit (Rust)

cargo install cargo-audit

cargo audit
cargo audit --json
cargo audit --deny warnings              # treat warnings as errors
cargo audit --ignore RUSTSEC-2023-0001   # specific advisory

Source: rustsec.org + github.com/rustsec/rustsec.

Step 5 - bundler-audit (Ruby)

gem install bundler-audit

bundle-audit check                        # one-time scan
bundle-audit update                       # refresh advisory DB
bundle-audit check --update               # combined refresh + scan
bundle-audit check --ignore CVE-2024-1234 # specific CVE

Source: github.com/rubysec/bundler-audit.

Step 6 - False-positive triage (MANDATORY)

Each native audit has its own suppression mechanism:

Every suppression carries a mandatory justification (reason + approver + re-review date). The Maven XML template, the AUDIT_IGNORES.md pattern for ad-hoc CLI ignores, and the quarterly review cadence are in references/ecosystem-config-and-triage.md.

Step 7 - CI integration patterns

# Fast first-line gate
jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      # npm
      - if: hashFiles('package-lock.json') != ''
        run: npm audit --audit-level=high
      # Python
      - if: hashFiles('requirements.txt') != ''
        run: pip-audit -r requirements.txt
      # Maven
      - if: hashFiles('pom.xml') != ''
        run: mvn dependency-check:check
      # Rust
      - if: hashFiles('Cargo.lock') != ''
        run: cargo audit
      # Ruby
      - if: hashFiles('Gemfile.lock') != ''
        run: bundle-audit check --update

The if: hashFiles(...) pattern auto-skips ecosystems not present in the repo.

Anti-patterns

Limitations

• Per-ecosystem DB coverage varies; one ecosystem's feed may carry a CVE another lacks.
• No reachability analysis: every CVE on a declared dep counts even if the vulnerable function isn't called.
• Maven Dependency-Check requires an NVD data sync (slow first run, ~1 GB cache).
• npm audit fix --force bumps majors; always manual-review before applying.
• Yarn classic (1.x) and pnpm have slightly different audit output shapes vs npm.

References

• Native audit docs: npm (docs.npmjs.com/cli/v10/commands/npm-audit), Yarn (yarnpkg.com/cli/npm/audit), pnpm (pnpm.io/cli/audit), pip-audit (pypa.github.io/pip-audit), OWASP Dependency-Check (jeremylong.github.io/DependencyCheck), cargo-audit (rustsec.org), bundler-audit (github.com/rubysec/bundler-audit)
• Per-ecosystem config, triage templates, and output aggregation: references/ecosystem-config-and-triage.md
• snyk-test, osv-scanner, dependabot-config, renovate-config - sister tools