NPM AUDIT TRIAGE · RUNS IN YOUR BROWSER

Which npm audit findings does your code actually use?

npm audit prints 40 vulnerabilities and no way to tell the one your server imports from the one buried in a test runner. Paste the npm audit --json output and your source files: findings are ranked by whether the vulnerable package is imported by your code, reached through a package you import, test/tooling only, or not referenced. Paid platforms (Snyk, Socket) sell reachability analysis; this is the free, offline first pass.

Nothing is uploaded. What you paste is read in this browser and never leaves your device, and this tool makes no network calls of its own. It is a static text scan and a heuristic ranking, not a security audit.

1. Paste npm audit --json

2. Paste your source (optional but it is the point)

Concatenate files, or put a line // file: src/app.js before each so test files are recognised. In the CLI the directory is scanned for you.

Paste the audit output above and click Triage.

Want it as a CI gate?

Same logic, zero dependencies. It reads the audit file and walks your source directory, nothing else:

npm audit --json | node audit-triage.mjs - src             # triage, print ranked list
npm audit --json | node audit-triage.mjs - src --fail-on high   # exit 1 if a reachable high/critical exists
node audit-triage.mjs audit.json src lib --json              # machine-readable

Get audit-triage.mjs and triage.mjs from the repo. Node 18+, nothing to install, no network calls.

Common questions

Why does npm audit report so many vulnerabilities that do not matter?

npm audit matches your dependency tree against an advisory database and cannot see whether your code calls the vulnerable function, or even imports the package. Many findings sit in build tooling, test runners or transitive packages your application never loads at runtime. This tool adds one extra signal, whether the package is imported, so the findings you read first are the ones a real code path could reach.

How does the triage decide a package is reachable?

It scans source text for import, require, dynamic import and re-export statements and compares the package names to the audit. A vulnerable package that is imported from runtime code is ranked first. One only reached through an imported parent package is ranked next. One imported only from test or tooling files, or not referenced at all, is ranked lowest. It is a static text scan, so it cannot see dynamic requires built from variables.

Does this mean the low-ranked vulnerabilities are safe to ignore?

No. Not imported is not the same as not exploitable: a vulnerable package can still be loaded by a bundler, a postinstall script or a framework convention, and a build-time vulnerability can matter to your supply chain. The ranking tells you where to look first, not what to skip forever. Keep patching on a schedule.

Does this tool upload my audit output or source code?

No. Everything you paste is processed in this page and never leaves your device, and the page makes no network calls. The CLI reads the audit file and the source directory you name and nothing else.

Is this security advice?

No. It is a heuristic ranking of publicly reported advisories using a text scan of your code. It is not a security audit, penetration test or guarantee, and it can miss reachable vulnerabilities.

More: how to triage npm audit findings without ignoring real risk