JS Security Audit

Run a 5-area security audit on a JS/TS project (npm, yarn, or pnpm). Produces a pass/fail report per area with file:line references.

When to Use

• New repo hardening — verify .npmrc, lockfiles, 2FA, exact pinning
• Reviewing a PR that adds or upgrades dependencies
• Setting up CI security gates (npm ci --ignore-scripts, lockfile-lint, audit gate)
• After news of a supply-chain attack (Axios March 2026, Shai-Hulud, etc.)
• Periodic security review before production deploy

Process

See audit-checklist.md for the full MUST/SHOULD/SHOULDN'T list. See eslint-security.md for the SAST ESLint template and rules table. See incident-playbook.md for the 5-step compromised-dependency response. See package-manager.md for npm/yarn/pnpm command equivalents and tooling.