# npm audit: Broken by Design

DevFeed: [npm audit: Broken by Design](<https://devfeed.tech/articles/npm-audit-broken-by-design-36182.md>)

Original publisher: [Read original article](<https://overreacted.io/npm-audit-broken-by-design/>)

Published: 2021-07-07T00:00:00Z

Content type: opinion

Language: en

Sources: [Dan Abramov](<https://devfeed.tech/sources/dan-abramov.md>)

Topics: [npm](<https://devfeed.tech/topics/npm.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [Security](<https://devfeed.tech/topics/security.md>), [Tooling](<https://devfeed.tech/topics/tooling.md>), [Node.js](<https://devfeed.tech/topics/node-js.md>)

Tags: [npm](<https://devfeed.tech/tags/npm.md>), [security](<https://devfeed.tech/tags/security.md>), [tooling](<https://devfeed.tech/tags/tooling.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>)

## AI overview

This opinion article argues that npm audit is poorly designed for front-end tooling and became a default before it was adequately prepared. It explains how npm audit reports dependency vulnerabilities, how fixes can propagate through permissible version ranges, and when forced upgrades may be necessary.

## Source excerpt

Found 99 vulnerabilities (84 moderately irrelevant, 15 highly irrelevant)