Node Dependency Vulnerabilities

Use this skill when the user asks to run an audit, fix npm audit findings, clean up vulnerable dependencies, remediate transitive package issues, or decide whether an override or resolution is necessary.

Default approach

• Detect the package manager before running any install, audit, or update command.
• Stay on the project's existing package manager and lockfile format.
• Prefer clean dependency upgrades over forced pins.
• If a major version bump may be the right fix, tell the user before applying it.
• Treat overrides and resolutions as temporary last-resort mitigations.

Workflow

1. Detect the package manager and workspace root

Use this order of evidence: