Answers: <p>As per October 2021:</p>
  <p><strong>GitHub Advisory Database now powers npm audit</strong> : &quot;This means that every version of the npm CLI that supports security audits is now talking directly to the GitHub Advisory Database&quot; - The GitHub Advisory Database is what powers  <strong>Dependabot</strong> and now also <em>npm audit</em></p>
  <p><a href="https://github.blog/2021-10-07-github-advisory-database-now-powers-npm-audit/" rel="nofollow noreferrer">https://github.blog/2021-10-07-github-advisory-database-now-powers-npm-audit/</a></p>
  
Answers: CC BY-SA 4.0
Answers: 2021-11-03T02:48:10.310Z
Answers: 2021-11-03T02:48:10.310Z
Answers: Alexandre Andrade
Answers: <p>Dependabot and <code>npm audit</code> both poll the <a href="https://github.com/nodejs/security-wg" rel="nofollow noreferrer">Node Security Working Group</a> database for Node-based projects. However, Dependabot has the added ability to check dependencies in <a href="https://docs.github.com/en/github/administering-a-repository/about-dependabot-version-updates#supported-repositories-and-ecosystems" rel="nofollow noreferrer">numerous other types of projects</a> as well.</p>
  <p>Also, each report Dependabot generates includes useful info and links directly to a GitHub Advisory Database listing (e.g., <a href="https://github.com/advisories/GHSA-333w-rxj3-f55r" rel="nofollow noreferrer">CVE-2017-16021</a>) that itself has multiple links to other listings such as NIST. On the other hand, <code>npm audit</code>'s reporting is limited to a single link to an npm advisory listing with far less info (e.g., <a href="https://www.npmjs.com/advisories/100" rel="nofollow noreferrer">#100</a>).</p>
  <p>Overall, Dependabot covers all the bases — and more — that <code>npm audit</code> does. No need to use both unless you need a customized audit flow in your package scripts.</p>
  <hr />
  <h2>Update</h2>
  <p>As of 7 October 2021, both methods provide info from the GitHub Advisory Database. From the links above, you can see that former npmjs.org listings now redirect to GitHub. The other points I made still stand after this change.</p>
  
Answers: CC BY-SA 4.0
Answers: 2021-02-18T05:26:25.217Z
Answers: 2022-09-26T10:18:20.657Z
Answers: 2022-09-26T10:18:20.657Z
Answers: Adam
Body: <h2>Context</h2>
  <p>There are multiple ways to scan projects for vulnerabilities.</p>
  <p><a href="https://dependabot.com/blog/javascript-security-updates/" rel="noreferrer">Dependabot</a> can be configured to check repositories for issues, and automatically submits pull requests to resolve.</p>
  <p><a href="https://docs.npmjs.com/cli/audit" rel="noreferrer">NPM Audit</a> will scan the packages used in an NPM solution for known vulnerabilities.</p>
  <p>We're trying to work out whether, if Dependabot is enabled, there's any added value to using <code>NPM Audit</code> in our pipelines.  I'm asking this solely from the perspective of what's detected; not how the tools work (i.e. whether they can cause a pipeline to block/fail).</p>
  <h2>The actual question</h2>
  <p>Do both tools base their decisions on some common known-issue database, or is it common to see each tool detect different sets of problems?</p>
  
Tags: <security><node.js><dependency-management><npm>
Title: Does `npm audit` add any value when using `dependabot`
UserDisplayName: JohnLBevan
ThreadText: # Does `npm audit` add any value when using `dependabot`
  
  (Asked by: username_0 on 2020-07-17)
  
  ## Context
  
  There are multiple ways to scan projects for vulnerabilities.
  
  [Dependabot](https://dependabot.com/blog/javascript-security-updates/) can be configured to check repositories for issues, and automatically submits pull requests to resolve.
  
  [NPM Audit](https://docs.npmjs.com/cli/audit) will scan the packages used in an NPM solution for known vulnerabilities.
  
  We're trying to work out whether, if Dependabot is enabled, there's any added value to using `NPM Audit` in our pipelines. I'm asking this solely from the perspective of what's detected; not how the tools work (i.e. whether they can cause a pipeline to block/fail).
  
  ## The actual question
  
  Do both tools base their decisions on some common known-issue database, or is it common to see each tool detect different sets of problems?
  
  **Tags:** security, node.js, dependency-management, npm
  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_2 on 2021-02-18. Score: 9 | Accepted answer
  
  Dependabot and `npm audit` both poll the [Node Security Working Group](https://github.com/nodejs/security-wg) database for Node-based projects. However, Dependabot has the added ability to check dependencies in [numerous other types of projects](https://docs.github.com/en/github/administering-a-repository/about-dependabot-version-updates#supported-repositories-and-ecosystems) as well.
  
  Also, each report Dependabot generates includes useful info and links directly to a GitHub Advisory Database listing (e.g., [CVE-2017-16021](https://github.com/advisories/GHSA-333w-rxj3-f55r)) that itself has multiple links to other listings such as NIST. On the other hand, `npm audit`'s reporting is limited to a single link to an npm advisory listing with far less info (e.g., [#100](https://www.npmjs.com/advisories/100)).
  
  Overall, Dependabot covers all the bases — and more — that `npm audit` does. No need to use both unless you need a customized audit flow in your package scripts.
  
  ---
  
  ## Update
  
  As of 7 October 2021, both methods provide info from the GitHub Advisory Database. From the links above, you can see that former npmjs.org listings now redirect to GitHub. The other points I made still stand after this change.
  
  
  ---
  
  ### Answer by username_1 on 2021-11-03. Score: 4
  
  As per October 2021:
  
  **GitHub Advisory Database now powers npm audit** : "This means that every version of the npm CLI that supports security audits is now talking directly to the GitHub Advisory Database" - The GitHub Advisory Database is what powers **Dependabot** and now also *npm audit*
  
  <https://github.blog/2021-10-07-github-advisory-database-now-powers-npm-audit/>
  
  
  ---
  
  