Unverified50% confidenceFactExact time
npm audit primarily relies on the npm official vulnerability database for vulnerability scanning.
1
Sources
50%
Confidence
Long-term
Relevance
10/12/2026
First Seen
Sources
Related Entities
Related Claims
Unverifiednpm's package-lock.json locks the exact hash of every dependency, and npm audit interfaces with the NVD to automatically cross-reference known CVEs.67% similarUnverifiedIn CI environments, multi-layer verification to reduce dependency poisoning risks can be built by combining tools such as npm audit, package-lock.json hash locking, and Sigstore.66% similarUnverifiedEcosystems such as npm and PyPI have experienced supply chain attacks in which core packages were injected with malicious code or maintainer accounts were hijacked.66% similarUnverifiedDevelopers can reduce the risk of dependency substitution through npm audit and lock files (package-lock.json / pnpm-lock.yaml).66% similarUnverifiedSecurity audits focus on identifying common vulnerability patterns such as SQL injection, improper permission validation, and plaintext storage of sensitive data.66% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1004449API
curl https://kongchang.com/api/v1/knowledge/claims/1004449MCP
get_claim(id=1004449)