Understanding NPM Install Messages: Added Packages, Audits, and Funding Requests Explained

Hello everyone! Have you ever wondered why, after installing dependencies, you see messages like added 374 packages, audited 375 packages, or 143 packages are looking for funding?

These numbers can vary based on the dependencies your project requires. For instance:

Added Packages: This represents the total number of packages installed, including your direct dependencies and their sub-dependencies.
Audited Packages: This refers to the number of packages checked for known vulnerabilities.
Looking for Funding: Indicates the number of packages whose maintainers are seeking financial support.

These insights not only give an overview of your dependency tree but also highlight opportunities to support the open-source ecosystem. Keep in mind, the exact numbers depend entirely on your project's specific dependencies and their versions.

Let's understand it with a very smooth way,

What is Audit

An audit is a process used in software development to analyze and verify the integrity, security, and compliance of the installed dependencies in a project. When working with a package manager like npm (for JavaScript/TypeScript projects), the audit specifically checks for security vulnerabilities and compliance issues in your project’s dependencies.

What is an NPM Audit?

npm audit is a command provided by the Node Package Manager (npm) that scans your project's dependency tree and reports:

Known Vulnerabilities: Check if any packages you're using (or their sub-dependencies) have security vulnerabilities reported in the public vulnerability database.
Severity Levels: Depending on its impact, each vulnerability is categorized as low, moderate, high, or critical.
Dependency Tree Analysis: Reports vulnerabilities at any level in the dependency chain (your dependencies or their dependencies).

1. Why is Auditing Important?

Security Assurance: Helps identify and resolve vulnerabilities that attackers could exploit, protecting your application and users.
Compliance: Ensures your project complies with best practices for dependency management.
Transparency: Provides a detailed overview of potential risks in third-party packages, encouraging developers to maintain secure environments.
Proactive Fixes: Allows you to address vulnerabilities before they are exploited.

How Does NPM Audit Work?

Database Check:
- npm audit uses a database maintained by the Node Security Working Group and other contributors.
- The database contains reported vulnerabilities for open-source packages.
Dependency Analysis:
- It analyzes your project’s package-lock.json or yarn.lock file to get a list of all installed dependencies (both direct and transitive).
- Each package is cross-checked against the vulnerability database.
Generate a Report:
- After scanning, a detailed report is generated. It includes:
  - Name of the vulnerable package.
  - Version of the package installed in your project.
  - Severity level of the vulnerability (low, moderate, high, critical).
  - A description of the vulnerability and potential impacts.
  - A recommended solution (e.g., updating the package or replacing it).

Example of an NPM Audit Report

Here’s what a typical npm audit output might look like:

=== npm audit security report ===

# Run  npm install package@latest  to resolve 1 vulnerability
# Run  npm audit for details

found 1 low severity vulnerability
  Package        lodash
  Dependency of  my-app
  Path           my-app > some-package > lodash
  More info      https://npmjs.com/advisories/1523

Key Details:

Package: lodash is the affected package.
Path: The path in your dependency tree where the vulnerable package exists.
Severity: In this case, the vulnerability is of "low" severity.
Resolution: Suggests running a command to install the updated version of the package.

Run Audit:
```
 npm audit
```
Scans the dependencies and displays the results.
Fix Vulnerabilities:
```
 npm audit fix
```
Attempts to automatically fix vulnerabilities by upgrading packages to secure versions.
Fix with Force:

 npm audit fix --force

Installs major version updates that may include breaking changes to address vulnerabilities.

Audit Specific Package: You can run npm audit for a specific package to isolate vulnerabilities in a particular dependency.

Severity Levels in NPM Audit

Low: Vulnerabilities that might not directly affect your application but could be used in combination with others to create issues.
Moderate: Vulnerabilities that could affect your application under specific conditions.
High: Serious vulnerabilities that could lead to a breach, such as data leakage or unauthorized access.
Critical: Severe vulnerabilities that need immediate attention.

Benefits of Auditing

Protects Against Exploits:
- Identifies known exploits like Remote Code Execution (RCE), Cross-Site Scripting (XSS), or SQL Injection.
Encourages Best Practices:
- Keeps dependencies up-to-date, ensuring you're using the most secure versions.
Supports Compliance:
- Essential for organizations that must follow industry regulations like GDPR or HIPAA.
Improves Application Stability:
- Fixing vulnerabilities often includes stability and performance improvements in updated versions of packages.

Limitations of NPM Audit

Known Vulnerabilities Only:
- It only reports vulnerabilities already recorded in public databases.
- New or undisclosed vulnerabilities won’t be detected.
Dependency Chain Complexity:
- Fixing vulnerabilities in deeply nested dependencies can be challenging.
- You might need to wait for package maintainers to update their dependencies.
False Positives:
- Sometimes vulnerabilities are reported but don’t directly impact your project’s usage of the package.

When Should You Run an Audit?

After installing new dependencies.
Before deploying your application to production.
Periodically, to ensure no new vulnerabilities have emerged in your dependencies.

2. Packages Looking for Funding

What does it mean? Some open-source packages include metadata indicating that the project is seeking financial support (e.g., donations or sponsorships). When you see 143 packages are looking for funding, it means these packages have links to funding sources that you can support.
Why is this shown? Many open-source maintainers rely on contributions to sustain their projects. npm displays this information to encourage users to support the ecosystem.
How to see details? Run the command:
```
  npm fund
```
- This will list the packages and their associated funding URLs.

Conclusion

Auditing is an essential part of modern software development that ensures the security and reliability of the third-party code you depend on. Withnpm audit, you can identify vulnerabilities in your dependencies, understand their impact, and address them proactively, thereby maintaining the integrity of your application. These messages help you stay informed about your project's dependencies and their status.

Thank You! Hope this article will help you!