Why catching npm vulnerabilities in CI is already too late

Software engineer Sonu Kapoor, writing for DevOps.com, argues that discovering npm dependency vulnerabilities during CI pipeline runs is a structural flaw, not a security practice. By the time a scanner flags an issue in CI, the developer has already installed the package, written dependent code, and moved on, making the fix a separate project rather than a quick decision. To illustrate the scale of the problem, Kapoor cites a scan of the NestJS repository's package-lock.json, which revealed 1,626 resolved packages carrying 25 vulnerabilities, 13 of which were buried in transitive dependencies. The recommended fix involves shifting discovery earlier through pre-commit hooks, mandatory PR-level lockfile scans, and branch-protection policies, rather than relying solely on a local CLI tool. Critics of the approach note that developer-side tools can be inconsistently applied, and that enforced PR checks and branch-protection rules offer more reliable controls than optional local scanning.