Run an audit
1
Run the audit
Run this beside
package.json and package-lock.json:npm audit exits nonzero when it finds vulnerabilities. That is expected; the stopped sandbox still contains the JSON report.2
Copy out the report
fsize limit bounds the guest report to 8 MiB. Treat the report as sensitive for private projects because it contains package names and versions.3
Schedule and clean up
Put the two blocks in a checked-in script, run it once manually, then call it from cron, a systemd timer, or your CI scheduler. The scheduler belongs outside the sandbox; the audit is the disposable part.Use a unique sandbox name instead of
--replace when audit jobs may overlap.