# npm ERR! code ELIFECYCLE
npm ERR! errno 1
npm ERR! audit: `npm audit`
npm ERR! Exit status 1
npm ERR! Found 1 high severity vulnerability

- **ID:** `policy/npm-audit-fails-on-high-severity-vulnerability`
- **Domain:** policy
- **Category:** build_error
- **Error Code:** `ELIFECYCLE`
- **Verification:** ai_generated
- **Fix Rate:** 80%

## Root Cause

The project's npm audit policy (configured in .npmrc or package.json) treats high-severity vulnerabilities as build failures, blocking CI/CD pipelines.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| npm 8.x | active | — | — |
| npm 9.x | active | — | — |
| npm 10.x | active | — | — |

## Workarounds

1. **Update the vulnerable package to a patched version using 'npm audit fix --force' (if breaking changes are acceptable) or manually upgrade the dependency in package.json.
Example:
  npm audit fix --force
  # Or manually:
  npm install semver@7.5.2 --save-exact** (75% success)
   ```
   Update the vulnerable package to a patched version using 'npm audit fix --force' (if breaking changes are acceptable) or manually upgrade the dependency in package.json.
Example:
  npm audit fix --force
  # Or manually:
  npm install semver@7.5.2 --save-exact
   ```
2. **Override the audit policy in .npmrc to allow high-severity vulnerabilities temporarily by setting 'audit-level=high' to 'audit-level=critical'. This is a workaround for development, not production.
Example:
  echo "audit-level=critical" >> .npmrc
  npm audit** (60% success)
   ```
   Override the audit policy in .npmrc to allow high-severity vulnerabilities temporarily by setting 'audit-level=high' to 'audit-level=critical'. This is a workaround for development, not production.
Example:
  echo "audit-level=critical" >> .npmrc
  npm audit
   ```
3. **Use a vulnerability management tool like Snyk or Dependabot to automatically fix vulnerabilities and update PRs, bypassing npm audit's strict exit code.
Example:
  # Install Snyk CLI
  npm install -g snyk
  snyk test --severity-threshold=high** (85% success)
   ```
   Use a vulnerability management tool like Snyk or Dependabot to automatically fix vulnerabilities and update PRs, bypassing npm audit's strict exit code.
Example:
  # Install Snyk CLI
  npm install -g snyk
  snyk test --severity-threshold=high
   ```

## Dead Ends

- **Running 'npm audit fix' blindly** — Running 'npm audit fix' without understanding the dependency tree can introduce breaking changes or remove necessary packages, leading to runtime errors. (35% fail)
- **Deleting node_modules and reinstalling** — Deleting node_modules and package-lock.json then reinstalling does not resolve the vulnerability if the vulnerable package version is pinned in package.json. (50% fail)
- **Using '--json' flag to suppress exit code** — Using 'npm audit --json' to bypass the exit code might hide the vulnerability but doesn't address the policy; the CI will still fail if the policy is enforced at a higher level. (70% fail)