<p>As per October 2021:</p>
<p><strong>GitHub Advisory Database now powers npm audit</strong> : &quot;This means that every version of the npm CLI that supports security audits is now talking directly to the GitHub Advisory Database&quot; - The GitHub Advisory Database is what powers  <strong>Dependabot</strong> and now also <em>npm audit</em></p>
<p><a href="https://github.blog/2021-10-07-github-advisory-database-now-powers-npm-audit/" rel="nofollow noreferrer">https://github.blog/2021-10-07-github-advisory-database-now-powers-npm-audit/</a></p>

CC BY-SA 4.0
2021-11-03T02:48:10.310Z
2021-11-03T02:48:10.310Z
Alexandre Andrade
<p>Dependabot and <code>npm audit</code> both poll the <a href="https://github.com/nodejs/security-wg" rel="nofollow noreferrer">Node Security Working Group</a> database for Node-based projects. However, Dependabot has the added ability to check dependencies in <a href="https://docs.github.com/en/github/administering-a-repository/about-dependabot-version-updates#supported-repositories-and-ecosystems" rel="nofollow noreferrer">numerous other types of projects</a> as well.</p>
<p>Also, each report Dependabot generates includes useful info and links directly to a GitHub Advisory Database listing (e.g., <a href="https://github.com/advisories/GHSA-333w-rxj3-f55r" rel="nofollow noreferrer">CVE-2017-16021</a>) that itself has multiple links to other listings such as NIST. On the other hand, <code>npm audit</code>'s reporting is limited to a single link to an npm advisory listing with far less info (e.g., <a href="https://www.npmjs.com/advisories/100" rel="nofollow noreferrer">#100</a>).</p>
<p>Overall, Dependabot covers all the bases — and more — that <code>npm audit</code> does. No need to use both unless you need a customized audit flow in your package scripts.</p>
<hr />
<h2>Update</h2>
<p>As of 7 October 2021, both methods provide info from the GitHub Advisory Database. From the links above, you can see that former npmjs.org listings now redirect to GitHub. The other points I made still stand after this change.</p>

CC BY-SA 4.0
2021-02-18T05:26:25.217Z
2022-09-26T10:18:20.657Z
2022-09-26T10:18:20.657Z
Adam
<h2>Context</h2>
<p>There are multiple ways to scan projects for vulnerabilities.</p>
<p><a href="https://dependabot.com/blog/javascript-security-updates/" rel="noreferrer">Dependabot</a> can be configured to check repositories for issues, and automatically submits pull requests to resolve.</p>
<p><a href="https://docs.npmjs.com/cli/audit" rel="noreferrer">NPM Audit</a> will scan the packages used in an NPM solution for known vulnerabilities.</p>
<p>We're trying to work out whether, if Dependabot is enabled, there's any added value to using <code>NPM Audit</code> in our pipelines.  I'm asking this solely from the perspective of what's detected; not how the tools work (i.e. whether they can cause a pipeline to block/fail).</p>
<h2>The actual question</h2>
<p>Do both tools base their decisions on some common known-issue database, or is it common to see each tool detect different sets of problems?</p>

<security><node.js><dependency-management><npm>
Does `npm audit` add any value when using `dependabot`
JohnLBevan
# Does `npm audit` add any value when using `dependabot`

(Asked by: username_0 on 2020-07-17)

## Context

There are multiple ways to scan projects for vulnerabilities.

[Dependabot](https://dependabot.com/blog/javascript-security-updates/) can be configured to check repositories for issues, and automatically submits pull requests to resolve.

[NPM Audit](https://docs.npmjs.com/cli/audit) will scan the packages used in an NPM solution for known vulnerabilities.

We're trying to work out whether, if Dependabot is enabled, there's any added value to using `NPM Audit` in our pipelines. I'm asking this solely from the perspective of what's detected; not how the tools work (i.e. whether they can cause a pipeline to block/fail).

## The actual question

Do both tools base their decisions on some common known-issue database, or is it common to see each tool detect different sets of problems?

**Tags:** security, node.js, dependency-management, npm


---

## 2 answers

### Answer by username_2 on 2021-02-18. Score: 9 | Accepted answer

Dependabot and `npm audit` both poll the [Node Security Working Group](https://github.com/nodejs/security-wg) database for Node-based projects. However, Dependabot has the added ability to check dependencies in [numerous other types of projects](https://docs.github.com/en/github/administering-a-repository/about-dependabot-version-updates#supported-repositories-and-ecosystems) as well.

Also, each report Dependabot generates includes useful info and links directly to a GitHub Advisory Database listing (e.g., [CVE-2017-16021](https://github.com/advisories/GHSA-333w-rxj3-f55r)) that itself has multiple links to other listings such as NIST. On the other hand, `npm audit`'s reporting is limited to a single link to an npm advisory listing with far less info (e.g., [#100](https://www.npmjs.com/advisories/100)).

Overall, Dependabot covers all the bases — and more — that `npm audit` does. No need to use both unless you need a customized audit flow in your package scripts.

---

## Update

As of 7 October 2021, both methods provide info from the GitHub Advisory Database. From the links above, you can see that former npmjs.org listings now redirect to GitHub. The other points I made still stand after this change.


---

### Answer by username_1 on 2021-11-03. Score: 4

As per October 2021:

**GitHub Advisory Database now powers npm audit** : "This means that every version of the npm CLI that supports security audits is now talking directly to the GitHub Advisory Database" - The GitHub Advisory Database is what powers **Dependabot** and now also *npm audit*

<https://github.blog/2021-10-07-github-advisory-database-now-powers-npm-audit/>


---

