Skip to main content
Keep the scheduler on the host and make each audit a fresh microVM. The sandbox receives only the package manifests, can reach only the npm registry, and stops after two minutes.

Run an audit

1

Run the audit

Run this beside package.json and package-lock.json:
npm audit exits nonzero when it finds vulnerabilities. That is expected; the stopped sandbox still contains the JSON report.
2

Copy out the report

Inspect the vulnerability summary:
The fsize limit bounds the guest report to 8 MiB. Treat the report as sensitive for private projects because it contains package names and versions.
3

Schedule and clean up

Put the two blocks in a checked-in script, run it once manually, then call it from cron, a systemd timer, or your CI scheduler. The scheduler belongs outside the sandbox; the audit is the disposable part.
Use a unique sandbox name instead of --replace when audit jobs may overlap.