14 hours ago
- npm audit is broken by design due to a high rate of false positives in front-end tooling contexts.
- Many reported vulnerabilities (e.g., regular expression DoS) are irrelevant for static site builds, where user input cannot trigger them.
- The default `npm audit` after every install overwhelms beginners and wastes maintainer effort on non-issues.
- Proposed solutions include moving dependencies to devDependencies (flawed), bundling dependencies, or allowing maintainers to counter-claim reports.
- The author plans to close false-positive GitHub issues and calls for npm to prioritize fixing the system.