Lion Cipher Lab
Audit and fix vulnerable npm dependencies with npm audit
- AppSec / DevSecOps
- Intermediate
- ~45 min
- Free · no account required
Why it matters
You write a few hundred lines; you ship a few hundred thousand. A plain Node project with three dependencies in this lab installs a tree whose real risk lives in a package you never typed the name of. That is exactly where attackers look, and it is why "Vulnerable and Outdated Components" is its own entry in the OWASP Top 10. The good news is that the npm toolchain already knows which of your installed versions have published advisories: `npm audit` reads your lockfile, checks every package against the registry's advisory database, and tells you the severity, the advisory, and the dependency…
What you'll learn
- explaining why most of a Node app's code is transitive dependencies, and why that is where known CVEs hide
- running `npm audit` and `npm audit --json`, and reading the real fields: severity, the vulnerable package, the dependency PATH (nodes), the advisory URL (via), isDirect, and fixAvailable.isSemVerMajor
- telling a direct vulnerability from a transitive one, and knowing which `npm audit fix` can bump within your SemVer range and which it refuses to touch without --force
- remediating a transitive vulnerability with `overrides` in package.json, including the EOVERRIDE trap where a top-level override conflicts with a direct dependency and must be scoped under its parent
- measuring remediation honestly: vulnerability count by severity before vs after, and which fixes required a breaking, protection-off --force
- the pro flow: pin with a committed lockfile, audit in CI with a severity gate, use overrides for transitive issues, and upgrade deliberately rather than running --force in anger
Steps in this lab
- Why the risk is in the code you did not write
- Confirm Node and npm, and make an empty folder
- Create a deliberately vulnerable project and an OLD lockfile
- Run npm audit and read every field (BEFORE)
- Fix the safe ones with npm audit fix (3 -> 2)
- Fix the transitive one with overrides (2 -> 0)
- The honest negative: what --force and audit itself will not tell you
- The judgment: fix, override, accept, and gate it in CI
- Clean up