--- title: npm audit: Broken by Design | daily.dev description: Npm audit is a stain on the entire Node.js ecosystem. Its rollout as a default was rushed, inconsiderate, and inadequate for the front-end tooling. The best... canonical: https://daily.dev/posts/npm-audit-broken-by-design-u6x-u8xrn twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: npm audit: Broken by Design | daily.dev og:description: Npm audit is a stain on the entire Node.js ecosystem. Its rollout as a default was rushed, inconsiderate, and inadequate for the front-end tooling. The best... og:url: https://daily.dev/posts/npm-audit-broken-by-design-u6x-u8xrn og:image: https://api.daily.dev/og/posts/u6X_U8xRN.png og:image:alt: npm audit: Broken by Design og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # npm audit: Broken by Design **[Overreacted](https://daily.dev/sources/overreacted)** · 12 min read · 11 upvotes · 2 comments ## Summary Npm audit is a stain on the entire Node.js ecosystem. Its rollout as a default was rushed, inconsiderate, and inadequate for the front-end tooling. The best time to fix it was before rolling it out as adefault. The next best time is now. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Community discussion Top comments from developers on daily.dev. **@dailydevtips** · 1 upvotes > Pretty spot of if you ask me: > `I also have a proposal: I need a way to mark for my users that a certain vulnerability can’t possibly affect them. If you don’t trust my judgement, why are you running my code on your computer? I’d be happy to discuss other options too.` > > I also fought this fight many times, and then going down the rabbit hole you realize there's no high urgency to fix something that potentially would never impact anyone actually. 🤦‍♂️ **@alexlee** · 0 upvotes > "Neque porro quisquam est qui dolorem ipsum quia dolor sit amet, consectetur, adipisci velit..." --- Tags: [#security](https://daily.dev/tags/security), [#react](https://daily.dev/tags/react), [#webdev](https://daily.dev/tags/webdev), [#cyber](https://daily.dev/tags/cyber) [View this post on daily.dev](https://daily.dev/posts/npm-audit-broken-by-design-u6x-u8xrn) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"npm audit: Broken by Design","url":"https://daily.dev/posts/npm-audit-broken-by-design-u6x-u8xrn","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/npm-audit-broken-by-design-u6x-u8xrn"},"datePublished":"2021-07-07T14:16:17.843Z","dateModified":"2021-10-07T14:17:10.317Z","description":"Npm audit is a stain on the entire Node.js ecosystem. Its rollout as a default was rushed, inconsiderate, and inadequate for the front-end tooling. The best...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/7a38ea30680c8f53bbe96729b4c14374","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/7a38ea30680c8f53bbe96729b4c14374","isAccessibleForFree":true,"articleSection":"Overreacted","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Overreacted","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/e2063b0ecb234cf28fcd0460f7526b75","url":"https://daily.dev/sources/overreacted"},"commentCount":2,"discussionUrl":"https://daily.dev/posts/npm-audit-broken-by-design-u6x-u8xrn","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":11},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":2}],"keywords":"security,react,webdev,cyber","timeRequired":"PT12M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Overreacted","item":"https://daily.dev/sources/overreacted"},{"@type":"ListItem","position":3,"name":"npm audit: Broken by Design"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/npm-audit-broken-by-design-u6x-u8xrn","comment":[{"@type":"Comment","text":"Pretty spot of if you ask me:\nI also have a proposal: I need a way to mark for my users that a certain vulnerability can’t possibly affect them. If you don’t trust my judgement, why are you running my code on your computer? I’d be happy to discuss other options too.\nI also fought this fight many times, and then going down the rabbit hole you realize there’s no high urgency to fix something that potentially would never impact anyone actually. 🤦‍♂️","datePublished":"2024-01-05T08:49:14.474Z","url":"https://daily.dev/posts/u6X_U8xRN#c-YRpDx5NhC","author":{"@type":"Person","name":"Chris Bongers","url":"https://daily.dev/dailydevtips","image":"https://media.daily.dev/image/upload/s--9gxFz1e7--/f_auto/v1705902590/avatars/avatar_JUNiIGCV-?_a=BAMAMiZW0"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1}},{"@type":"Comment","text":"“Neque porro quisquam est qui dolorem ipsum quia dolor sit amet, consectetur, adipisci velit…”","datePublished":"2022-07-07T11:32:44.193Z","url":"https://daily.dev/posts/u6X_U8xRN#c-SJQKswxh2","author":{"@type":"Person","name":"Laz Boi","url":"https://daily.dev/alexlee","image":"https://lh3.googleusercontent.com/a-/AOh14GiQiqTlz3vyK7JnQ-ph3wPKoFo4p_I2yuw69rwhag=s100"}}]} ```