"Why I stopped trusting npm audit (and built my own)"

Generate a CycloneDX SBOM and deterministic, audit-ready risk report from your package-lock.json. You run npm audit. It says “47 vulnerabilities.” Cool. Which ones actually matter? The one in your production bundle? The dev-only Jest dependency? The transitive package you didn’t even know existed? You don’t know. So you either: Ignore everything → ship anyway Or block everything → break your team Either way, you lose signal. The real problem isn’t vulnerabilities — it’s decision-making Most tool