Well, there is another interesting way to audit global packages without using some third party packages. After all, we don't want to violate security principles by using them on such a sensitive data ;).
You might need to run terminal (bash or similar on Unix-like system or cmd on Windows) with administrative priviledges to get proper results.
- Use this command to figure out the path and the list of globally installed packages:
npm i
You should get something like this:
C:\Program Files\nodejs -> .\
├── [email protected]
├── [email protected]
├── [email protected]
└── [email protected]
Go to that path using your terminal. Keep in mind that this path might by a link (or symlink) to another folder.
Create a package.json file in that folder with the contents reflecting global packages list and exact versions you've got in step 1 like this:
{
"name": "-",
"version": "0.0.1",
"dependencies": {
"gulp-cli": "2.3.0",
"nodemon": "2.0.15",
"npm": "8.4.1",
"ts-node": "10.5.0"
}
}
Pay attention that npm itself is included as well.
- Create a
package-lock.json file there using this cli command:
npm i --package-lock-only
- Run audit with
npm audit
It worked for me on my Windows 8.1 system at least, running node v.16.13.2, npm v.8.4.1.
Interesting that I've got a moderate severity vulnerability for npm itself in my report.
I would appreciate it if you'll share your experience with the way I suggested to solve the problem.