By default, yarn npm audit checks the direct dependencies of the active workspace, and you must add the recursive option to include transitive ones. pnpm audit checks installed packages and lets you narrow to production or development sets. Both exit non-zero when they report findings, so read the scope before you trust a clean result.
Definitions
Workspace. One package inside a monorepo that shares a lockfile.
Recursive audit. An audit that also covers transitive dependencies.
Advisory. A published record describing a vulnerability and its affected versions.
What the documentation says
Yarn's audit command pulls advisory data from the npm registry by default. The docs note that reports may not apply to your program, since not every vulnerability affects every code path. Its scope options are:
- Default: direct dependencies of the active workspace.
- All: audit across every workspace.
- Recursive: include transitive dependencies.
- Environment: for example, production skips devDependencies.
- Severity: hide findings below a chosen level.
pnpm audit checks installed packages and reports advisories. It can restrict to production or development dependencies, set a minimum audit level, print JSON, and ignore specific advisories by GHSA identifier. It also has a fix option that adds overrides to the workspace file, or updates the lockfile in newer versions. In JSON output, the patched versions field is null when no fix has been published.
Comparison
| Question | yarn npm audit | pnpm audit |
|---|---|---|
| Covers transitive packages by default? | No, add the recursive option | Reports on installed packages, check the report for depth |
| Production only filter | Environment option | Production option |
| Severity filter | Severity option | Audit level option |
| Ignore an advisory | Ignore option or config | Ignore option or workspace setting |
| JSON output | Yes, as a stream of lines | Yes |
Steps
- Run the audit with the broadest scope first, such as all workspaces and recursive in Yarn.
- Save the output as JSON for tracking.
- Run a second pass with the production filter, to see what can reach users.
- Fix direct items first, then trace transitive ones to a parent.
- Record each ignored advisory with a reason.
yarn npm audit --all --recursive
pnpm audit --prod
pnpm audit --json
Mistakes to avoid
- Reading a clean Yarn audit that covered direct packages as a clean tree.
- Hiding low severity findings without noting that you did.
- Letting an ignore entry outlive the reason for it.
Try it yourself
Click through it at your own pace, or open it full screen.
Open a finding and check whether it sits on a direct or a transitive package.
Quick check
Why did my Yarn audit show nothing when my tree has issues?
It probably checked direct dependencies alone. Add the recursive option to include transitive packages.
Does a finding mean my code is exploitable?
No. The Yarn docs say reports may not apply to your program, because not every vulnerability affects every code path.
Safeguard dependency scanning reads lockfiles from npm, Yarn and pnpm projects and shows direct and transitive findings together. Try a free scan.
Sources
Last reviewed: 19 October 2026.
