diff --git a/security/security-appsec-engineer.md b/security/security-appsec-engineer.md
index 0c62f4df..f7b2d4de 100644
--- a/security/security-appsec-engineer.md
+++ b/security/security-appsec-engineer.md
@@ -262,13 +262,14 @@ class DependencyScanner:
             via = vuln.get("via", [])
             advisories = [item for item in via if isinstance(item, dict)]
             fix = vuln.get("fixAvailable")
-            severity = vuln.get("severity")
-            if severity not in {item.value for item in Severity} | {"info"}:
+            # npm levels are info, low, moderate, high and critical.
+            severity = {"info": "low", "moderate": "medium"}.get(vuln.get("severity"), vuln.get("severity"))
+            if severity not in {item.value for item in Severity}:
                 raise RuntimeError(f"npm audit returned unknown severity for {package}")
             findings.append(VulnFinding(
                 package=package,
                 version=vuln.get("range", "unknown"),
-                severity=Severity.LOW if severity == "info" else Severity(severity),
+                severity=Severity(severity),
                 cve=advisories[0].get("url", "N/A") if advisories else "N/A",
                 fixed_version=(fix.get("version", "N/A") if isinstance(fix, dict)
                                else "available" if fix is True else "N/A"),