How do I keep npm dependencies secure?

Triage instead of panicking. Many npm audit findings don't apply to how you use the package.

1. Focus on production dependencies: npm audit --omit=dev. A ReDoS in a build-tool dependency is rarely exploitable in your running app. 2. Update direct dependencies first (npm outdated, then update). Many transitive issues disappear. 3. For stuck transitive dependencies, use overrides in package.json to force a patched version, and test. 4. Automate: Dependabot or Renovate to get small, regular update PRs instead of a scary pile every six months. 5. Supply-chain hygiene (often a bigger risk than known CVEs): - commit the lockfile and use npm ci in CI; - be suspicious of new packages with few downloads and typosquats (expresss, reqeusts); - consider disabling install scripts by default (ignore-scripts) and allowing them per package; - enable 2FA on your npm account if you publish. 6. Fewer dependencies = smaller attack surface. Don't add a package for a 5-line function.