---
title: Schedule dependency audits
sidebarTitle: Dependency audits
description: Run npm audit in a short-lived sandbox and copy out the report
icon: "clock-rotate-left"
---

Keep the scheduler on the host and make each audit a fresh microVM. The sandbox receives only the package manifests, can reach only the npm registry, and stops after two minutes.

## Run an audit

<Steps>
<Step title="Run the audit">

<Tooltip tip="This audit works on microsandbox cloud after omitting replace-on-create from the command."><span className="msb-badge-limited">Limited on cloud <Icon icon="circle-info" size={11} /></span></Tooltip>

Run this beside `package.json` and `package-lock.json`:

<CodeGroup>
```sh macOS & Linux
msb run --name dependency-audit --replace \
  --memory 512M --max-duration 2m \
  --net-default deny --net-rule 'allow@registry.npmjs.org:tcp:443' \
  --copy-file ./package.json:/workspace/package.json \
  --copy-file ./package-lock.json:/workspace/package-lock.json \
  --workdir /workspace --user node --security restricted --rlimit fsize=8388608 \
  node:24.18.1-alpine3.23 -- sh -lc \
    'npm audit --json > /var/tmp/npm-audit.json'
```

```powershell Windows
msb run --name dependency-audit --replace `
  --memory 512M --max-duration 2m `
  --net-default deny --net-rule 'allow@registry.npmjs.org:tcp:443' `
  --copy-file ./package.json:/workspace/package.json `
  --copy-file ./package-lock.json:/workspace/package-lock.json `
  --workdir /workspace --user node --security restricted --rlimit fsize=8388608 `
  node:24.18.1-alpine3.23 -- sh -lc `
    'npm audit --json > /var/tmp/npm-audit.json'
```
</CodeGroup>

`npm audit` exits nonzero when it finds vulnerabilities. That is expected; the stopped sandbox still contains the JSON report.

</Step>

<Step title="Copy out the report">

<CodeGroup>
```sh macOS & Linux
mkdir -p .artifacts
msb cp dependency-audit:/var/tmp/npm-audit.json .artifacts/npm-audit.json
```

```powershell Windows
New-Item -ItemType Directory -Force .artifacts | Out-Null
msb cp dependency-audit:/var/tmp/npm-audit.json .artifacts/npm-audit.json
```
</CodeGroup>

Inspect the vulnerability summary:

```sh
jq '.metadata.vulnerabilities' .artifacts/npm-audit.json
```

The `fsize` limit bounds the guest report to 8 MiB. Treat the report as sensitive for private projects because it contains package names and versions.

</Step>

<Step title="Schedule and clean up">

Put the two blocks in a checked-in script, run it once manually, then call it from cron, a systemd timer, or your CI scheduler. The scheduler belongs outside the sandbox; the audit is the disposable part.

```sh
msb rm -f dependency-audit
```

Use a unique sandbox name instead of `--replace` when audit jobs may overlap.

</Step>
</Steps>