{"ref":"artifact:qualiture-audit-summary","page":"/artifacts/qualiture-audit-summary","json":"/artifacts/qualiture-audit-summary.json","generated":"2026-10-26","drafted_with_ai":true,"entity":{"id":"qualiture-audit-summary","name":"audit-summary","artifact_type":"cli","ecosystem":"general","serves_ecosystems":["cap","ui5"],"domain":"security-and-compliance","secondary_domains":["developer-experience"],"origin_ring":"independent","use_as":"dependency","description":{"one_line":"A command line that summarises `npm audit` results by root dependency, with severity counts, current against latest versions and thresholds that exit with code 1.","short":"Groups npm audit findings by root dependency, with failing thresholds","what_it_solves":"Runs `npm audit` and `npm ls` in a project, maps each finding to the top-level dependency that brings it in, removes duplicate counts and prints one table with critical, high, moderate and low counts per root dependency. `--verbose` lists the vulnerabilities per package, `--json` writes machine-readable output, `--workspace <name>` audits a single workspace of a monorepo, and `--init` creates an `.audit-summary.json` file with baseline thresholds. A threshold is a limit per severity, set per package or as a `default`; when one is exceeded the tool lists the offending packages and exits with code 1, so a [CI/CD](capability:ci-cd) step fails. It reads the npm dependency tree, so it sees known vulnerabilities in a project's declared npm dependencies before deployment, and it does not see anything installed elsewhere.","when_not_to_use":"It audits through npm: a project that resolves its dependencies with another package manager, or has no `package.json`, has nothing for it to run. What it reports is what `npm audit` knows, so a vulnerability outside the npm advisory data is not in its table."},"links":{"repo":"https://github.com/qualiture/audit-summary","npm":"https://www.npmjs.com/package/audit-summary"},"identity":{"author":"Robin van het Hof","license":"MIT"},"maintainers":["actor:qualiture"],"source_available":true,"compat":{"runtimes":["node"]},"provides":[{"capability":"capability:vulnerability-scanning","what_it_does":"Groups the vulnerabilities `npm audit` reports under the root dependency that brings them in, deduplicated, with a severity breakdown per root and current against latest versions.","sources":[{"url":"https://github.com/qualiture/audit-summary","title":"qualiture/audit-summary README","checked":"2026-10-26","quote":"A powerful CLI tool that provides a clear, organized summary of NPM package vulnerabilities grouped by root dependencies."},{"url":"https://github.com/qualiture/audit-summary","title":"qualiture/audit-summary README, Why audit-summary?","checked":"2026-10-26","quote":"While `npm audit` provides detailed vulnerability information, it can be overwhelming and difficult to prioritize."}]},{"capability":"capability:ci-cd","what_it_does":"Compares the vulnerability counts per severity with thresholds the project keeps in `.audit-summary.json` and exits with code 1 when one is exceeded, which fails the build of a pipeline that runs it.","sources":[{"url":"https://github.com/qualiture/audit-summary","title":"qualiture/audit-summary README, Why audit-summary?","checked":"2026-10-26","quote":"Set limits and fail CI/CD builds when thresholds are exceeded"},{"url":"https://github.com/qualiture/audit-summary","title":"qualiture/audit-summary README, Thresholds","checked":"2026-10-26","quote":"Exits with code 1 (fails CI/CD builds)"}]}],"provenance":{"discovered_via":[{"source":"source:npm"}],"first_seen":"2026-10-26"},"drafted_with_ai":true},"effective_normative_relations":[],"readings":{"liveness":[{"label":"Maintenance","tier":"fair","evidence":"8 months since release"},{"label":"Continuity","tier":"fair","evidence":"2 contributors, 1 publisher"},{"label":"Repository","tier":"fair","evidence":"pushed 2026-03, not archived"}],"compatibility":[{"label":"Declared for","tier":"unknown","evidence":"no GENERAL release lines in the atlas"},{"label":"Survived majors","tier":"unknown","evidence":"no GENERAL release lines in the atlas"},{"label":"Maintainer's CI","tier":"good","evidence":"Publish NPM Package green, 2026-03-08"}],"practice":[{"label":"Tests","tier":"poor","evidence":"none found in the tree"},{"label":"Docs","tier":"good","evidence":"README 11 KB"},{"label":"Changelog","tier":"good","evidence":"CHANGELOG in the repo"}],"reach":[{"value":9,"unit":"installs/week"},{"value":1,"unit":"watching"}]},"signals":{"crawled_at":"2026-10-26","latest_version":"1.2.0","majors":{"1":{"version":"1.0.0","date":"2025-10-05"}},"license":"MIT","first_release":"2025-10-05","last_release":"2026-03-08","releases":5,"cadence_days":51,"maintainers":1,"repository":"git+https://github.com/qualiture/audit-summary.git","repository_directory":null,"peer_cds":null,"dependencies":3,"node_engine":null,"test_script":false,"types":false,"downloads_weekly":9,"downloads_monthly":62,"stars":1,"forks":1,"open_issues":0,"archived":false,"pushed_at":"2026-03-08","license_spdx":null,"org_owned":false,"default_branch":"main","created_at":"2025-10-04T09:29:59Z","open_prs":0,"tree_truncated":false,"test_files":0,"workflows":1,"other_ci":false,"readme_bytes":11204,"docs_files":0,"changelog":true,"license_file":false,"dts_files":0,"first_commit":"2025-10-04","last_commit":"2026-03-08","commits":17,"contributors":2,"ci_status":"success","ci_run_at":"2026-03-08","ci_workflow":"Publish NPM Package","ci_event":"push","readme_path":"README.md","readme_sha":"0e13fcbf3a4ba7f0e991590d90cad28381f8bc86","months_since_release":8,"dormant":false,"repo_read":"2026-10-26"},"edges":{"maintainers":[{"ref":"actor:qualiture","name":"Robin van het Hof","json":"/actors/qualiture.json"}],"contributors":[],"explained_by":[],"alternative_to_this":[],"needed_by":[],"available_via":[],"parts":[],"add_ons":[],"answered_through_parts":[]}}