Why npm and pnpm audit can show different results for the same codebase

Running npm audit and pnpm audit on the same repository can produce conflicting vulnerability reports, despite both tools querying the same underlying GitHub Advisory Database. The discrepancy arises because each tool resolves and deduplicates the dependency tree differently, and advisory data can shift between successive calls. Neither tool performs local code analysis; both send a description of the dependency tree to a remote registry endpoint and return whatever advisories come back. This means audit results can be silently incomplete in air-gapped environments, behind private registries, or for non-JavaScript dependencies in the same project. Security experts suggest using lockfile-based local scanners, aggregated databases like OSV, and generating a CycloneDX SBOM to produce more reliable and auditable dependency risk assessments.