How to Audit and Secure npm Dependencies Against Supply Chain Attacks

Start by ensuring you're running the latest Node.js LTS and npm CLI versions. The 2026 npm v10.8+ includes critical security enhancements for detecting metavulnerabilities and behavioral threats that older versions miss.

# Check current versions
node --version
npm --version

# Update npm to latest (v10.8+)
npm install -g npm@latest

# Verify npm version includes 2026 security features
npm --version

If you're not on Node.js v22.x LTS, download it from nodejs.org. The v22.x series includes updated vulnerability databases that catch more supply chain threats.

The built-in npm audit command is your first line of defense. It scans your dependencies against the npm vulnerability database and reports CVEs by severity level.

# Navigate to your project directory
cd your-project

# Install dependencies and generate package-lock.json
npm install

# Run comprehensive security audit
npm audit

# View dependency tree to understand attack surface
npm ls

# Check for high and critical vulnerabilities only
npm audit --audit-level=high

The audit output shows vulnerabilities categorized as low, moderate, high, or critical. Pay special attention to high and critical issues, especially in packages like lodash, cross-spawn, or puppeteer chains that were targeted in recent campaigns.

Once you've identified vulnerabilities, use npm's automated fixing capabilities. The 2026 version includes smarter dependency resolution that minimizes breaking changes.

# Fix vulnerabilities that don't require breaking changes
npm audit fix

# For more aggressive fixes (may break compatibility)
npm audit fix --force

# Verify fixes were applied
npm audit

# Check that your application still works
npm test
npm start

The --force flag should be used cautiously as it can introduce breaking changes by updating to major versions. Always test thoroughly after using it.

If some vulnerabilities can't be automatically fixed, you'll need to manually update the affected packages or find alternative dependencies.

Snyk provides more comprehensive vulnerability detection than npm audit alone, including license compliance and deeper dependency analysis. The 2026 version includes behavioral scanning capabilities.

# Install Snyk CLI globally
npm install -g snyk

# Authenticate with Snyk (opens browser for free account)
snyk auth

# Test your project for vulnerabilities
snyk test

# Monitor your project for new vulnerabilities
snyk monitor

# Test with specific severity threshold
snyk test --severity-threshold=high

Snyk's database is updated more frequently than npm's and includes proprietary vulnerability research. It also checks for license compliance issues that could pose legal risks.

The snyk monitor command creates a baseline snapshot of your dependencies and will alert you when new vulnerabilities are discovered in packages you're using.

To catch GlassWorm-style attacks that bypass traditional CVE scanning, implement behavioral analysis tools that detect malicious code patterns before they're added to vulnerability databases.

# Option 1: Install Aikido CLI for behavioral scanning
npm install -g @aikidosec/cli

# Enable Safe Chain protection (blocks malware at install)
aikido install

# Scan existing dependencies for malicious behavior
aikido scan

# Option 2: Install Socket CLI as npm wrapper
npm install -g @socketsecurity/cli

# Create alias to wrap npm commands
echo 'alias npm="socket npm"' >> ~/.bashrc
source ~/.bashrc

# Scan project with Socket
socket scan

These tools use machine learning and static analysis to detect suspicious patterns like network requests, file system access, or obfuscated code that traditional scanners miss.

Aikido's Safe Chain feature includes a 24-hour cooldown period for new packages, giving time for the security community to identify potential threats.

Automate your security checks to catch vulnerabilities before they reach production. This GitHub Actions workflow combines multiple scanning tools for comprehensive coverage.

# Create .github/workflows/security-audit.yml
name: Security Audit

on:
  push:
    branches: [ main, develop ]
  pull_request:
    branches: [ main ]
  schedule:
    - cron: '0 2 * * 1'  # Weekly Monday 2 AM

jobs:
  security-audit:
    runs-on: ubuntu-latest
    
    steps:
    - name: Checkout code
      uses: actions/checkout@v4
      
    - name: Setup Node.js
      uses: actions/setup-node@v4
      with:
        node-version: '22'
        cache: 'npm'
        
    - name: Install dependencies
      run: npm ci  # Uses package-lock.json for reproducible builds
      
    - name: Run npm audit
      run: npm audit --audit-level=high
      
    - name: Run Snyk security scan
      run: |
        npm install -g snyk
        snyk auth ${{ secrets.SNYK_TOKEN }}
        snyk test --severity-threshold=high
      env:
        SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        
    - name: Upload audit results
      uses: actions/upload-artifact@v4
      if: failure()
      with:
        name: security-audit-results
        path: audit-results.json

This workflow runs on every push, pull request, and weekly to catch newly discovered vulnerabilities. The npm ci command ensures reproducible builds using your committed package-lock.json.

Implement strict dependency management policies to prevent unauthorized package installations and ensure reproducible builds across environments.

# Always commit package-lock.json to version control
git add package-lock.json
git commit -m "Lock dependency versions for security"

# Configure npm for security-first installations
npm config set audit-level moderate
npm config set fund false
npm config set ignore-scripts true

# Pin critical dependencies to exact versions in package.json
# Edit package.json to remove ^ and ~ from version numbers

{
  "dependencies": {
    "lodash": "4.17.21",
    "express": "4.18.2",
    "helmet": "7.1.0"
  },
  "engines": {
    "node": ">=22.9.0",
    "npm": ">=10.8.0"
  }
}

The ignore-scripts setting prevents malicious packages from running arbitrary code during installation. Pin exact versions for security-critical packages to prevent automatic updates that might introduce vulnerabilities.

Enable GitHub's Dependabot by creating .github/dependabot.yml:

version: 2
updates:
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "weekly"
    open-pull-requests-limit: 5

Secure your npm account to prevent attackers from publishing malicious updates to packages you maintain or have access to.

# Check current npm profile settings
npm profile get

# Enable 2FA for authentication and publishing
npm profile enable-2fa auth-and-writes

# Verify 2FA is enabled
npm profile get

# Create and use access tokens for CI/CD instead of passwords
npm token create --read-only
npm token create --cidr=0.0.0.0/0

Two-factor authentication prevents unauthorized access even if your password is compromised. The "auth-and-writes" mode requires 2FA for both login and package publishing.

For CI/CD systems, use access tokens instead of your main credentials. Create read-only tokens for dependency installation and limited-scope tokens for publishing.

If you maintain packages, consider enabling npm's two-factor authentication requirement for all collaborators:

# Require 2FA for all package collaborators
npm access set mfa=publish your-package-name
npm access set mfa=automation your-package-name

Prepare for potential supply chain attacks by establishing clear procedures for detection, containment, and recovery. Recent campaigns like GlassWorm show that rapid response is crucial.

# Create security monitoring script
cat > security-monitor.sh << 'EOF'
#!/bin/bash

# Daily security check script
echo "Running daily security audit..."
date

# Check for new vulnerabilities
npm audit --json > audit-$(date +%Y%m%d).json

# Compare with baseline
if [ -f "audit-baseline.json" ]; then
    diff audit-baseline.json audit-$(date +%Y%m%d).json > audit-diff.txt
    if [ -s audit-diff.txt ]; then
        echo "NEW VULNERABILITIES DETECTED!"
        cat audit-diff.txt
        # Send alert (configure your notification system)
        # curl -X POST your-webhook-url -d @audit-diff.txt
    fi
fi

# Update baseline
cp audit-$(date +%Y%m%d).json audit-baseline.json

echo "Security audit complete"
EOF

chmod +x security-monitor.sh

Document your incident response procedures in a SECURITY.md file:

# Security Incident Response Plan

## Detection
- Monitor security-audit.yml workflow failures
- Watch for unusual network traffic or file system access
- Check npm audit reports daily

## Immediate Response
1. Isolate affected systems
2. Document the incident
3. Identify compromised packages
4. Remove malicious dependencies
5. Rotate all credentials

## Recovery
1. Update to clean package versions
2. Rebuild from clean sources
3. Verify system integrity
4. Update security measures

## Communication
- Internal team notification
- Customer communication if data affected
- Security community disclosure if appropriate