npm audit checks your dependency tree against advisories served by the npm registry. SCA scanners such as OSV-Scanner and Dependabot check against other databases, OSV.dev and the GitHub Advisory Database. The tools differ mainly in data source, ecosystems and what happens after a finding.
Safeguard publishes this guide and sells a competing product, so we describe other tools only from their own documentation. Facts below are as of 19 October 2026.
Key takeaways
- npm audit submits package names and versions to the registry and gets back a report.
- npm audit only covers npm projects. OSV-Scanner lists many ecosystems.
- Dependabot alerts only come from advisories reviewed by GitHub.
- The audit-level option sets the exit code threshold but does not filter the report.
What does npm audit check?
It sends a description of your dependencies to the default registry and requests a report of known vulnerabilities. Since npm 7, it posts each package's name and versions to a bulk advisory endpoint. It then calculates impact and remediation. npm audit fix applies remediations by running a full install, and the docs say some vulnerabilities cannot be fixed automatically. It needs a package-lock.json or npm-shrinkwrap.json unless you opt out, and without a lockfile results may differ between runs.
How do OSV-Scanner and Dependabot differ?
OSV-Scanner is a frontend to the OSV.dev database that reads lockfiles from many ecosystems, such as npm, pnpm, yarn, Go, Maven, Cargo, Composer and Python. Dependabot alerts come from the GitHub Advisory Database, and only advisories reviewed by GitHub trigger them. Dependabot security updates then open fix pull requests.
Comparison table
| Criteria | npm audit | OSV-Scanner | Dependabot |
|---|---|---|---|
| Ecosystem | npm | Many | Many, via GitHub dependency graph |
| Data source | npm registry advisories | OSV.dev | GitHub Advisory Database |
| Runs where | Your terminal or CI | Terminal, CI, Go library | GitHub |
| Fix action | npm audit fix | Reports findings | Pull requests |
| Needs lockfile | Yes by default | Reads lockfiles and manifests | Manifest or lock file for security updates |
How to choose
- If you only ship npm packages, npm audit is the built-in baseline.
- If you have other ecosystems, check OSV-Scanner's supported file list.
- If your code is on GitHub, review Dependabot alerts settings.
- Run two on one repository and compare which advisories each reports.
- Set the audit-level option to the severity that should fail CI.
Try a no login check at gold.safeguard.sh/scan.
Frequently asked questions
Does npm audit send my code anywhere?
The docs say it sends package names and versions to the registry. The fallback endpoint sends the lockfile tree plus npm and node versions and platform details.
Does audit-level hide low severity findings?
No. The docs say it sets the minimum severity for a non-zero exit and does not filter the report.
Can npm audit fix break my project?
The docs say the force option allows changes outside the stated dependency range, including semver-major updates, so review them.
Sources
- npm audit docs: https://docs.npmjs.com/cli/v10/commands/npm-audit
- OSV-Scanner: https://google.github.io/osv-scanner/
- Dependabot alerts: https://docs.github.com/en/code-security/dependabot/dependabot-alerts/about-dependabot-alerts
Last reviewed: 19 October 2026.
