It depends on the tool, and the defaults differ. Yarn's audit covers direct dependencies unless you add the recursive option. NuGet audits direct packages by default before .NET 10 and all packages from net10.0. Composer audits dev packages unless told not to. Read the default for your tool before trusting a clean run.
Definitions
Direct dependency. A package you declared.
Transitive dependency. A package pulled in by another package.
Dev dependency. A package used for building or testing.
Defaults by tool
| Tool | Transitive by default | Dev by default |
|---|---|---|
| yarn npm audit | No, add the recursive option | Included, use the environment option to filter |
| NuGet audit on restore | Direct before net10.0, all from net10.0 | Not applicable |
| dotnet package list, vulnerable | Needs the transitive option | Not applicable |
| composer audit | Audits installed packages, or the lock file with the locked option | Included, use the no dev option to skip |
| npm audit | Report covers your configured dependencies | Omitted when NODE_ENV is production |
| pnpm audit | Installed packages | Filter with production or dev options |
| pip-audit | Whatever is installed or resolved from your input | Whatever the input contains |
For NuGet, when a project targets several frameworks and any one of them selects all, the audit uses all for every target.
Why this matters
A scan limited to direct packages misses most of a typical tree. A scan that skips dev packages can miss risk to your build pipeline. A scan that includes everything can bury runtime issues. The right choice is to run a broad scan for visibility and a narrow one for release gating.
Steps
- Look up the default in your tool's documentation.
- Run a deliberately broad scan once, and count findings by direct, transitive and dev.
- Compare that with your normal command's output. If counts differ, your default is narrower than you thought.
- Set options in CI explicitly instead of relying on defaults.
- Review the settings after a major tool or SDK upgrade, since defaults can change.
An example of default drift
NuGet changed the audit mode default for projects targeting .NET 10, moving from direct to all. A team that upgraded would see new findings without changing a line of their own code. Pin the setting in your repository so the behaviour is stable.
Try it yourself
Click through it at your own pace, or open it full screen.
Expand each level of the inventory and count direct and transitive packages.
Quick check
Which is safer, auditing everything or production alone?
Do both. Gate releases on production findings, and review the full list on a schedule.
Can defaults change under me?
Yes. NuGet changed its mode default for .NET 10 projects. Set options explicitly.
Safeguard SBOM and dependency scanning inventories direct and transitive packages together. Run a free scan to see the split.
Sources
- Yarn docs, yarn npm audit
- Microsoft Learn, Auditing package dependencies
- Microsoft Learn, dotnet package list
- Composer documentation, audit
- npm docs, npm audit
- pnpm docs, pnpm audit
- pip-audit on GitHub
Last reviewed: 19 October 2026.
