Dependency Audit

Scan project dependencies for vulnerabilities, outdated packages, and unused modules.

When to Trigger

• User asks to audit dependencies or check for vulnerabilities
• User requests a security scan on packages
• User asks "are my dependencies safe?" or "any known CVEs?"
• Before publishing or deploying a new release

Audit Workflow

Step 1: Vulnerability Scan

bash
npm audit --json

Parse the JSON output and extract:

• Advisory ID, severity, title
• Vulnerable package name and version range
• Patched version (if available)
• CVSS score and vector
• CWE identifier

Step 2: Cross-Reference with Sonatype (if MCP available)

Use the Sonatype MCP tool getRecommendedComponentVersions for each vulnerable package to get:

• Recommended safe version
• Known malicious versions to avoid
• License risk assessment

Step 3: Categorize Findings

Group by severity: critical > high > moderate > low.

Output Format

Present as a markdown table sorted by severity:

| # | Severity | Package        | Current | Fixed    | CVSS | Vulnerability              | Fix Command                          |
|---|----------|----------------|---------|----------|------|----------------------------|--------------------------------------|
| 1 | critical | lodash         | 4.17.15 | 4.17.21  | 9.8  | Prototype Pollution (CVE-…)| `npm install lodash@4.17.21`         |
| 2 | high     | axios          | 0.21.0  | 0.21.2   | 7.5  | SSRF via redirect (CVE-…) | `npm install axios@0.21.2`           |
| 3 | moderate | minimatch      | 3.0.4   | 3.0.5    | 5.3  | ReDoS (CVE-…)             | `npm install minimatch@3.0.5`        |
| 4 | low      | debug          | 2.6.8   | 2.6.9    | 3.1  | Regular Expression DoS    | `npm install debug@2.6.9`            |

Include a summary line:

Found X vulnerabilities: Y critical, Z high, W moderate, V low

Auto-Fix Mode

Safe fixes (non-breaking — execute without confirmation):

bash
npm audit fix

Report what was fixed and what remains.

Breaking fixes (requires user confirmation):

bash
# Only run after explicit user approval
npm audit fix --force

Warn the user: "This may upgrade packages to new major versions with breaking changes. Review the changes before proceeding."

Additional Checks

Outdated Packages

bash
npm outdated --json

Present as a table:

| Package    | Current | Wanted | Latest | Type       |
|------------|---------|--------|--------|------------|
| react      | 18.2.0  | 18.3.1 | 19.1.0 | dependency |
| typescript | 5.3.3   | 5.4.5  | 5.8.2  | devDep     |

Unused Dependencies

If depcheck is installed:

bash
npx depcheck --json

List unused dependencies and missing dependencies (imported but not in package.json).

If not installed, check manually by grepping for import/require statements against package.json entries.

Safety Rules

1. Never run npm audit fix --force without user confirmation — it can introduce breaking changes
2. Always show findings before fixing — let the user review and decide
3. Preserve lockfile integrity — if using package-lock.json or bun.lockb, ensure fixes maintain lock consistency
4. Flag transitive vulnerabilities — note when a vulnerability is in a sub-dependency vs direct dependency
5. Check for monorepo — if workspaces exist in package.json, run audit at root and note which workspace is affected