How to fix npm ERR! code EAUDITINSTALL npm ERR! Audit shows vulnerabilities in npm

npmINTERMEDIATEHIGHUpdated Dec 5, 2025· 199 views

The npm install command fails when security vulnerabilities are detected in dependencies and the audit-level threshold is breached. npm audit automatically scans packages during installation and can block the process if high-severity issues are found.

Quick fix

Fixes npm ERR! code EAUDITINSTALL npm ERR! Audit shows vulnerabilities

npm audit
  1. Examine what vulnerabilities are blocking installation
  2. Try automatic vulnerability fixes with npm audit fix
  3. Use --force flag for breaking updates
  4. Adjust audit-level settings for unfixable vulnerabilities
npm — error
npm audit
npm ERR! code EAUDITINSTALL
npm ERR! Audit shows vulnerabilities

What this error means

npm audit runs automatically during package installation and submits your dependency tree to the npm registry for vulnerability scanning. When vulnerabilities meeting or exceeding the configured audit-level threshold are found, npm exits with a non-zero code, blocking installation. EAUDITINSTALL specifically indicates that audit vulnerabilities were detected and the installation cannot proceed without addressing them or changing audit settings. This is a security gate designed to prevent vulnerable code from entering your project. Unlike older npm versions that only warned about vulnerabilities, npm 7+ enforces audit-level by default during installation.

Typical symptoms

  • npm install command exits with error after downloading packages
  • Full error message shows 'npm ERR! code EAUDITINSTALL' with vulnerability summary
  • npm reports specific vulnerability details (CVE ID, package name, severity level)
  • Installation halts before node_modules is created or populated
  • CI/CD pipelines fail during the install step before tests or builds can run
  • Some vulnerabilities cannot be automatically fixed with npm audit fix

Common causes

  1. A dependency or transitive dependency contains a known security vulnerability above the configured audit-level threshold
  2. npm audit-level setting is configured to fail on vulnerabilities (default in npm 7+)
  3. Dependency tree includes outdated package versions with published security advisories
  4. Recent CVEs were published for packages you depend on after initial package-lock.json generation
  5. Some vulnerabilities cannot be auto-fixed because fixing requires a breaking change
  6. Legacy dependencies maintained by abandoned projects with unpatched vulnerabilities

How to fix "npm ERR! code EAUDITINSTALL npm ERR! Audit shows vulnerabilities"

1Examine what vulnerabilities are blocking installation

Run npm audit without installing to see the full vulnerability report:

bash
npm audit

This shows:
- Package names and affected versions
- Vulnerability severity (critical, high, moderate, low)
- CVE IDs and detailed advisory links
- Which of your packages depend on the vulnerable code

2Try automatic vulnerability fixes with npm audit fix

The safest first step is to let npm automatically remediate vulnerabilities:

bash
npm audit fix

This command:
- Identifies which package versions contain fixes
- Updates your package.json and package-lock.json if updates are compatible
- Respects semantic versioning by default (won't bump major versions)

If this succeeds, run npm audit again to confirm zero vulnerabilities.

3Use --force flag for breaking updates

If npm audit fix leaves vulnerabilities because semantic versioning blocks updates:

bash
npm audit fix --force

Warning: --force can upgrade major versions and introduce breaking changes. Use only if:
- You've reviewed the breaking changes
- You have tests to catch incompatibilities
- You're willing to debug dependency issues

4Adjust audit-level settings for unfixable vulnerabilities

If vulnerabilities cannot be fixed without breaking your app, you can lower the audit threshold:

bash
npm install --audit-level=moderate

Audit levels (most to least strict):
- critical - fails on critical only
- high - fails on high or critical
- moderate - fails on moderate, high, or critical
- low - fails on low and above (most permissive)

To make this permanent, set it in your .npmrc:

bash
audit-level=moderate

Note: This allows installation but doesn't remove the security risk.

5Skip dev dependencies if vulnerabilities are dev-only

If all vulnerabilities are in devDependencies, install production dependencies only:

bash
npm install --omit=dev

This:
- Skips devDependencies entirely
- Avoids dev-only vulnerabilities
- Is safe for production deployments
- Cannot be used during local development if devDependencies are needed

6Remove unused vulnerable packages

Check whether the vulnerable package is actually used:

bash
npm uninstall package-name

Use npm ls package-name to trace which dependency brought it in:

bash
npm ls vulnerable-package

Removing the package entirely eliminates the vulnerability.

Advanced notes

npm audit limitations: Not all reported vulnerabilities are equally dangerous—many relate to build tools or development-only packages that don't affect production. False positives occur frequently, especially with transitive vulnerabilities.

audit-ci for CI/CD: For more sophisticated audit policies in CI/CD, use the audit-ci package:

bash
npm install --save-dev audit-ci
audit-ci --moderate --production

This allows ignoring specific CVEs by advisory ID, applying different rules for production vs. dev dependencies, and custom exit codes.

Production vs Development: The key distinction is between vulnerabilities in code that runs in production vs. development-only tools. For critical production software, always fix critical and high vulnerabilities.

Frequently asked questions

What does "npm ERR! code EAUDITINSTALL npm ERR! Audit shows vulnerabilities" mean?
npm audit runs automatically during package installation and submits your dependency tree to the npm registry for vulnerability scanning. When vulnerabilities meeting or exceeding the configured audit-level threshold are found, npm exits with a non-zero code, blocking installation. EAUDITINSTALL specifically indicates that audit vulnerabilities were detected and the installation cannot proceed without addressing them or changing audit settings.
How do I fix "npm ERR! code EAUDITINSTALL npm ERR! Audit shows vulnerabilities"?
The npm install command fails when security vulnerabilities are detected in dependencies and the audit-level threshold is breached. npm audit automatically scans packages during installation and can block the process if high-severity issues are found.
What causes "npm ERR! code EAUDITINSTALL npm ERR! Audit shows vulnerabilities"?
A dependency or transitive dependency contains a known security vulnerability above the configured audit-level threshold npm audit-level setting is configured to fail on vulnerabilities (default in npm 7+) Dependency tree includes outdated package versions with published security advisories
Is the "npm ERR! code EAUDITINSTALL npm ERR! Audit shows vulnerabilities" error serious?
Yes. This is a high-severity error that usually blocks work until it is fixed, but the steps above resolve it.

Official resources & further reading