Dependency audit

Most of the code shipping in a typical application was written by strangers. An audit answers three questions about that code: is it dangerous, is it legal, and is it maintained.

Scanners answer the first well. The second and third need judgement, and they are where the expensive surprises live — a licence discovered at acquisition, a critical library abandoned three years ago.

1. See the whole tree, not the manifest

Your manifest lists what you asked for. The lockfile lists what you got, and it is usually five to twenty times larger.

npm ls --all | wc -l          # or: pip list, go list -m all, cargo tree