npm audit now queries the GitHub Advisory Database directly
GitHub has unified its security advisory pipeline by making the GitHub Advisory Database the single source of vulnerability data for npm audit. Previously, npm and GitHub maintained separate databases with overlapping content but different schemas, forcing the security team to duplicate curation efforts and creating inconsistencies between tools.
One database, two protocols
Last year, GitHub added all npm security advisories to the GitHub Advisory Database, ensuring that developers saw the same advisories whether they used npm audit or Dependabot. However, the underlying schemas remained distinct, which complicated feature development and required security engineers to verify each advisory in both systems.
The new architecture eliminates that duplication. GitHub has deployed a proxy that translates the GitHub Advisory Database into the npm audit protocol. As a result, every npm CLI version that supports security audits now communicates directly with the GitHub Advisory Database — no separate npm advisory store is involved.
Advisories move to GitHub
The advisory pages previously hosted on npmjs.com now redirect to the GitHub Advisory Database. There, developers can search and sort npm advisories alongside those for other ecosystems, using the same advanced filtering available for all GitHub advisories.
The change means all users of npm and GitHub — from individual developers to enterprise teams — receive identical vulnerability information. The GitHub Advisory Database contains more than 5,000 curated advisories and already powers Dependabot alerts and security updates, the dependency graph, and GitHub security advisories.
