Security Audit

npm audit, cargo audit, pip-audit — query a vulnerability database for your installed packages.

The flow:

1. Read your lockfile.
2. For each (package, version) pair, query a CVE database.
3. Report any matches with severity (low / moderate / high / critical) and remediation suggestions.

The database (npm's, GitHub Advisory Database, OSV.dev, snyk.io) has entries like:

{
  "package": "lodash",
  "vulnerable_versions": "<4.17.21",
  "severity": "high",
  "title": "Prototype Pollution",
  "patched_versions": ">=4.17.21",
  "cve": "CVE-2020-8203"
}

When lodash 4.17.20 is in your lockfile, this entry matches. The audit tool reports it and suggests upgrading.

npm audit fix (or equivalents): bump versions in your lockfile to the patched range, re-resolve. Sometimes the fix conflicts with another constraint — manual intervention required.

For this lesson: simulate the audit lookup and report.