[kaishiro]

As a security engineer, do you feel like the addition of npm audit is a net positive for the security of the npm ecosystem?

[efitz]

Net positive for awareness. Not sure I like the “force update with dependency that might break me”. NPM audit needs the ability to filter by severity and the ability for users to tune vuln severities per project.