> ## Documentation Index
> Fetch the complete documentation index at: https://docs.microsandbox.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Schedule dependency audits

> Run npm audit in a short-lived sandbox and copy out the report

Keep the scheduler on the host and make each audit a fresh microVM. The sandbox receives only the package manifests, can reach only the npm registry, and stops after two minutes.

## Run an audit

<Steps>
  <Step title="Run the audit">
    <Tooltip tip="This audit works on microsandbox cloud after omitting replace-on-create from the command."><span className="msb-badge-limited">Limited on cloud <Icon icon="circle-info" size={11} /></span></Tooltip>

    Run this beside `package.json` and `package-lock.json`:

    <CodeGroup>
      ```sh macOS & Linux theme={null}
      msb run --name dependency-audit --replace \
        --memory 512M --max-duration 2m \
        --net-default deny --net-rule 'allow@registry.npmjs.org:tcp:443' \
        --copy-file ./package.json:/workspace/package.json \
        --copy-file ./package-lock.json:/workspace/package-lock.json \
        --workdir /workspace --user node --security restricted --rlimit fsize=8388608 \
        node:24.18.1-alpine3.23 -- sh -lc \
          'npm audit --json > /var/tmp/npm-audit.json'
      ```

      ```powershell Windows theme={null}
      msb run --name dependency-audit --replace `
        --memory 512M --max-duration 2m `
        --net-default deny --net-rule 'allow@registry.npmjs.org:tcp:443' `
        --copy-file ./package.json:/workspace/package.json `
        --copy-file ./package-lock.json:/workspace/package-lock.json `
        --workdir /workspace --user node --security restricted --rlimit fsize=8388608 `
        node:24.18.1-alpine3.23 -- sh -lc `
          'npm audit --json > /var/tmp/npm-audit.json'
      ```
    </CodeGroup>

    `npm audit` exits nonzero when it finds vulnerabilities. That is expected; the stopped sandbox still contains the JSON report.
  </Step>

  <Step title="Copy out the report">
    <CodeGroup>
      ```sh macOS & Linux theme={null}
      mkdir -p .artifacts
      msb cp dependency-audit:/var/tmp/npm-audit.json .artifacts/npm-audit.json
      ```

      ```powershell Windows theme={null}
      New-Item -ItemType Directory -Force .artifacts | Out-Null
      msb cp dependency-audit:/var/tmp/npm-audit.json .artifacts/npm-audit.json
      ```
    </CodeGroup>

    Inspect the vulnerability summary:

    ```sh theme={null}
    jq '.metadata.vulnerabilities' .artifacts/npm-audit.json
    ```

    The `fsize` limit bounds the guest report to 8 MiB. Treat the report as sensitive for private projects because it contains package names and versions.
  </Step>

  <Step title="Schedule and clean up">
    Put the two blocks in a checked-in script, run it once manually, then call it from cron, a systemd timer, or your CI scheduler. The scheduler belongs outside the sandbox; the audit is the disposable part.

    ```sh theme={null}
    msb rm -f dependency-audit
    ```

    Use a unique sandbox name instead of `--replace` when audit jobs may overlap.
  </Step>
</Steps>