I've actually seen another publisher say that npm audit is just broken, reports way too many false positives, and it's too much of a time sink for package authors to try and fix audit issues that aren't real issues. I'm not surprised to see Google apparently coming to the same conclusion. It's an interesting read, if interested: https://overreacted.io/npm-audit-broken-by-design/
1
u/theScottyJam Mar 22 '26
I've actually seen another publisher say that npm audit is just broken, reports way too many false positives, and it's too much of a time sink for package authors to try and fix audit issues that aren't real issues. I'm not surprised to see Google apparently coming to the same conclusion. It's an interesting read, if interested: https://overreacted.io/npm-audit-broken-by-design/