From b310834d42b311bd85a4840738b397e56c40c95f Mon Sep 17 00:00:00 2001 From: Rudy Celekli Date: Sun, 18 Oct 2026 09:24:01 -0400 Subject: [PATCH] fix(appsec): accept npm's moderate audit severity --- security/security-appsec-engineer.md | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/security/security-appsec-engineer.md b/security/security-appsec-engineer.md index 0c62f4df..f7b2d4de 100644 --- a/security/security-appsec-engineer.md +++ b/security/security-appsec-engineer.md @@ -262,13 +262,14 @@ class DependencyScanner: via = vuln.get("via", []) advisories = [item for item in via if isinstance(item, dict)] fix = vuln.get("fixAvailable") - severity = vuln.get("severity") - if severity not in {item.value for item in Severity} | {"info"}: + # npm levels are info, low, moderate, high and critical. + severity = {"info": "low", "moderate": "medium"}.get(vuln.get("severity"), vuln.get("severity")) + if severity not in {item.value for item in Severity}: raise RuntimeError(f"npm audit returned unknown severity for {package}") findings.append(VulnFinding( package=package, version=vuln.get("range", "unknown"), - severity=Severity.LOW if severity == "info" else Severity(severity), + severity=Severity(severity), cve=advisories[0].get("url", "N/A") if advisories else "N/A", fixed_version=(fix.get("version", "N/A") if isinstance(fix, dict) else "available" if fix is True else "N/A"),