How to Audit npm Supply Chain
npm supply chain in 2026 — one of the top-3 attack surfaces. The 2024 xz backdoor + 2023 event-stream + 2024 shai-hulud showed: any of 1000+ transitive deps can be hijacked. Defence: (1) npm audit + Dependabot (basic, free), (2) Socket.dev ($15/mo, runtime behavior analysis), (3) Snyk ($0+), (4) pnpm + strict lockfile, (5) npm package-lock integrity hashing, (6) --ignore-scripts to reject postinstall.
Below: step-by-step, working examples, common pitfalls, FAQ.
Step-by-Step Setup
npm auditin CI — fails build on > high severity- Enable Dependabot in GitHub (Settings → Security)
- Install Socket GitHub App for PR-level anomaly detection
- pnpm or bun instead of npm — deterministic install, shared store
npm config set ignore-scripts trueglobally + review per-package- Pin exact versions (no ^):
"react": "18.2.0"vs"^18.2.0" - Monitor published versions: socket.dev CLI alert on suspicious upgrades
Working Examples
| Scenario | Config |
|---|---|
| npm audit in CI | # .github/workflows/audit.yml
- run: npm ci
- run: npm audit --audit-level=high
# Fails build on found high+ CVE |
| pnpm strict mode | # .npmrc
strict-peer-dependencies=true
save-exact=true
auto-install-peers=false
# package.json
"packageManager": "pnpm@8.15.0" |
| Socket.dev CI | # Via npm scripts
"scripts": {
"preinstall": "socket preinstall"
}
# Blocks install if supply-chain risk detected |
| Ignore postinstall scripts | # Global
$ npm config set ignore-scripts true
# Per install
$ npm install --ignore-scripts
# For specific trusted packages — whitelist
$ npm rebuild sharp |
| Lockfile integrity (yarn) | # .yarnrc.yml
enableGlobalCache: true
checksumBehavior: update
# Lockfile hashes rejected if corrupted |
Common Pitfalls
- npm audit — only known CVEs, not a new attack. Socket.dev for behavior-based detection
- Transitive deps errors — parent package has not released a fix. npm overrides in package.json — force resolution
- Minified code / obfuscated postinstall — hide malicious actions. Ignore-scripts default is safer
- Dev-only deps still installed in CI if NODE_ENV≠production. npm ci --production or prune
- shrinkwrap / lock is committed — but if an attacker pushes a lockfile → CI installs malicious exact-version
Why teams trust us
How it works
Enter site URL
Security headers analyzed
Get grade A–F
What Does the Security Analysis Check?
The tool checks HTTP security headers, SSL/TLS configuration, server info leaks, and protection against common attacks (XSS, clickjacking, MIME sniffing). A grade fromA to F shows overall security level.
Header Analysis
Checking Content-Security-Policy, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and more.
SSL Check
TLS version, certificate expiry, chain of trust, HSTS support.
Leak Detection
Finding exposed server versions, debug modes, open configs, and directories.
Report with Recommendations
Detailed report explaining each issue with specific steps to fix it.
Who uses this
Security teams
HTTP header audit
DevOps
config verification
Developers
CSP & HSTS setup
Auditors
compliance checks
Common Mistakes
Strict-Transport-Security.Server: Apache/2.4.52 helps attackers find exploits. Hide the version.DENY or SAMEORIGIN.nosniff, browsers may misinterpret file types (MIME sniffing).Best Practices
Content-Security-Policy-Report-Only, monitor violations, then enforce.Server, X-Powered-By, X-AspNet-Version from responses.Get more with a free account
Security check history and HTTP security header monitoring.
Sign up freeLearn more
Frequently Asked Questions
Dependabot or Renovate?
Dependabot: GitHub-native, simpler. Renovate: more flexible, works on GitLab/Bitbucket, configurable schedules. Solo projects — Dependabot. Teams with complex policies — Renovate.
Is Socket.dev free?
Free tier: 5 repos. $15/dev/mo paid. Analyses package behavior (network calls, file ops, eval usage) — detects novel supply-chain attacks.
xz 2024 incident?
xz-utils CVE-2024-3094 — backdoor via social engineering after a 2-year maintainer takeover. Would have compromised OpenSSH on major Linux distros. Caught by luck.
npm vs pnpm vs bun?
pnpm: content-addressable, fast, deterministic. bun: Rust backend, 10x faster. For audit — pnpm/bun show the actual installed graph more precisely than npm.