PCI DSS 4.0.1 requirements 6.4.3 and 11.6.1 have been mandatory since 2025-03-31, and the PCI SSC revised FAQ 1331 on 2026-08-04 so a QSA agreement alone no longer marks them not applicable. This read

Audits NPM, Yarn, and PNPM projects in CI environments

Lists every script on your checkout page that has no integrity hash, no authorisation and no written justification - the three things PCI DSS 6.4.3 has required since 31 March 2025.

Descope audit management widget

Verdaccio Middleware plugin to bypass npmjs audit

Given a response from the npm security api, render it into a variety of security reports

Reshape into a better npm audit for the community and encourage more people to include security audit into their process.

Fast 0-deps bash parser written in TypeScript

Core modules for audit-resolve.json file and logic of its processing

Aids humans and automation in managing npm audit results

OCI NodeJS client for Audit Service

Generate an HTML report for CODEOWNERS ownership gaps and run in CI or from the CLI to fail when files are not covered.

Micro util to run npm audit for lerna packages (with autofix)

Provides audit logging functionalities for Node.js applications

The missing `yarn audit fix`

A tool for working with CODEOWNERS files

A wrapper around yarn audit that fixes many issues

Handy tool for working with file ownership using Githubs CODEOWNERS file

generate TeamCity code inspections from the output of `npm audit`

Simple, pluggable, zero-dependency, GraphQL over HTTP spec compliant server, client and audit suite.