52

As stated in the official npm documentation you can manually run npm audit on locally installed packages, which must have both package.json and package-lock.json files.

Globally installed packages doesn't have package-lock.json, if you run an audit it will trow an error: npm ERR! code EAUDITNOLOCK

How can I run npm audit on all globally installed packages?

1

4 Answers 4

47

It's good to keep them up-to-date.

That's not really auditing, but with few as possible global packages, this should be fine enough.

there is npm-check-updates or alternatively npm-check

npm install -g npm-check-updates

check outdated global packages:

ncu -g        

OR

as recommended by @pldg via npx

npx npm-check-updates -g

OR

as recommended by @wheredidthatnamecomefrom

npx npm-global-audit

this is a script running with yarn. it does a temporary copy of your current global packages. see more on their github.

this the npm way as recommended by @Henke

npx npm-global-audit --auditor npm 
5
  • 6
    Thanks it works. If you don't want to install npm-check-updates you can use npx: npx npm-check-updates -g
    – pldg
    Nov 15, 2020 at 16:58
  • 1
    npm-global-audit will do a true audit. Dec 3, 2021 at 2:54
  • 1
    npx npm-global-audit --auditor npm if you don't use yarn.
    – Henke
    Apr 2, 2023 at 9:50
  • Why it is required to install more deps. into the project instead of considering a solution for the current problem?
    – Franco Gil
    May 1, 2023 at 15:52
  • 1
    @FrancoGil you are right. this is not the most correct answer, but has a green checkmark at it. pls check the answer of philn5d which seems to be a valid solution without extra needed packages. in the end it's about what comes in more handy for some devs, i would say. other then that you could open up a new question, as i did now not answered yours here. May 2, 2023 at 6:25
12

I found an answer to your question:

  1. go to your global npm folder (e.g. cd $(npm root -g)/..).
  2. npm init just keep pressing enter to the questions, or npm init -y so it is populated with default values. That'll give you a package.json that npm audit needs and automatically add what's in your node_modules to it.
  3. npm i --package-lock-only will install if needed and add package-lock.json (required by npm audit).
  4. run npm audit.

To find your global npm folder just run npm root -g it'll print it out at the end. The package.json file needs to be in its parent folder.

7
  • Thanks for your answer, anyway I don't think it's a good solution. I can instead list all my global installed packages, install them in a local repository and then npm audit. My question is: how can I run an audit directly on global installed packages? Maybe is not possibile...
    – pldg
    Dec 5, 2018 at 15:57
  • 5
    This gets you to a state where you can run audit directly on your globally installed packages. But, I suppose the packages.json wouldn't get updated when you install new packages globally. You could always delete the package.json + package-lock.json and repeat whenever you want to audit again. Easy enough to make into a script.
    – philn5d
    Dec 12, 2018 at 19:57
  • The only thing that worries me is to messing around with npm folder. Maybe it's better to create a local repository and make a script to mirror the global packages to that repository in which audit run automatically
    – pldg
    Dec 12, 2018 at 22:46
  • That's an interesting idea too! You'd have to perform the updates individually, even if they could be done by npm audit.
    – philn5d
    Dec 13, 2018 at 17:30
  • 1
    @philn5d You say "easy enough to make into a script" but being web devs, some of us only made websites, never "scripts". Do you know any good recourses or guides to get started on our very first script ?
    – mesqueeb
    Dec 19, 2020 at 22:30
6
# Without installing the package locally, using npx
npx npm-check-updates -g

# otherwise, install and update on occasion 
npm install -g npm-check-updates

# Then check outdated global packages:
ncu -g        
1
0

Well, there is another interesting way to audit global packages without using some third party packages. After all, we don't want to violate security principles by using them on such a sensitive data ;).

You might need to run terminal (bash or similar on Unix-like system or cmd on Windows) with administrative priviledges to get proper results.

  1. Use this command to figure out the path and the list of globally installed packages:
npm i

You should get something like this:

C:\Program Files\nodejs -> .\
├── [email protected]
├── [email protected]
├── [email protected]
└── [email protected]
  1. Go to that path using your terminal. Keep in mind that this path might by a link (or symlink) to another folder.

  2. Create a package.json file in that folder with the contents reflecting global packages list and exact versions you've got in step 1 like this:

{
  "name": "-",
  "version": "0.0.1",
  "dependencies": {
    "gulp-cli": "2.3.0",
    "nodemon": "2.0.15",
    "npm": "8.4.1",
    "ts-node": "10.5.0"
  }
}

Pay attention that npm itself is included as well.

  1. Create a package-lock.json file there using this cli command:
npm i --package-lock-only
  1. Run audit with
npm audit

It worked for me on my Windows 8.1 system at least, running node v.16.13.2, npm v.8.4.1.

Interesting that I've got a moderate severity vulnerability for npm itself in my report.

I would appreciate it if you'll share your experience with the way I suggested to solve the problem.

1
  • 1
    doesn't work the same for me npm version 8.9.0 on Linux.Tries to read the current directories package.json meaning its not a global search. May 5, 2022 at 20:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.