# NPM Security Audit — 2026-06-07

React partner dashboards (`apps/seller`, `apps/buyer`) for CodeCanyon checklist §10.

## Commands

```bash
cd apps/seller && npm audit
cd apps/buyer && npm audit
```

## Results (after remediation)

| App | Before | After `npm audit fix` | Residual |
|-----|--------|----------------------|----------|
| `apps/seller` | 15 (1 critical, 6 high, 8 moderate) | **0** | None |
| `apps/buyer` | 2 high (`react-router`) | **0** | None |

### Notable packages updated

| Package | Issue class | Apps |
|---------|-------------|------|
| `react-router` / `react-router-dom` | High — redirect/XSS/RCE advisories | seller, buyer |
| `axios` | High — SSRF / prototype pollution chain | seller |
| `protobufjs` | Critical — code execution | seller (transitive) |
| `vite` | High — dev-server path traversal | seller (devDependency) |
| `postcss`, `picomatch`, `brace-expansion`, `qs`, `ws` | Moderate | seller (transitive) |

## Verification

```bash
cd apps/seller && npm run lint
cd apps/buyer && npm run lint
```

Lockfiles updated: `apps/seller/package-lock.json`, `apps/buyer/package-lock.json`.

## Release process

Re-run `npm audit` in both dashboard apps before each marketplace update. Fail the release if Critical/High advisories affect production dependencies (`dependencies`, not only `devDependencies`).

## Related

- `PACKAGE_AUDIT_2026-06-07.md` — Composer side
- `DEMO_IMAGE_AUDIT_2026-06-07.md` — bundled demo assets