Schedule dependency audits - Microsandbox

Keep the scheduler on the host and make each audit a fresh microVM. The sandbox receives only the package manifests, can reach only the npm registry, and stops after two minutes.

Run an audit

<Tooltip tip="This audit works on microsandbox cloud after omitting replace-on-create from the command."><span className="msb-badge-limited">Limited on cloud <Icon icon="circle-info" size={11} /></span></Tooltip>

Run this beside package.json and package-lock.json:

<CodeGroup> ```sh macOS & Linux msb run --name dependency-audit --replace \ --memory 512M --max-duration 2m \ --net-default deny --net-rule '[email protected]:tcp:443' \ --copy-file ./package.json:/workspace/package.json \ --copy-file ./package-lock.json:/workspace/package-lock.json \ --workdir /workspace --user node --security restricted --rlimit fsize=8388608 \ node:24.18.1-alpine3.23 -- sh -lc \ 'npm audit --json > /var/tmp/npm-audit.json' ```

powershell

msb run --name dependency-audit --replace `
  --memory 512M --max-duration 2m `
  --net-default deny --net-rule '[email protected]:tcp:443' `
  --copy-file ./package.json:/workspace/package.json `
  --copy-file ./package-lock.json:/workspace/package-lock.json `
  --workdir /workspace --user node --security restricted --rlimit fsize=8388608 `
  node:24.18.1-alpine3.23 -- sh -lc `
    'npm audit --json > /var/tmp/npm-audit.json'

</CodeGroup>

npm audit exits nonzero when it finds vulnerabilities. That is expected; the stopped sandbox still contains the JSON report.

</Step> <Step title="Copy out the report"> <CodeGroup> ```sh macOS & Linux mkdir -p .artifacts msb cp dependency-audit:/var/tmp/npm-audit.json .artifacts/npm-audit.json ```

powershell

New-Item -ItemType Directory -Force .artifacts | Out-Null
msb cp dependency-audit:/var/tmp/npm-audit.json .artifacts/npm-audit.json

</CodeGroup>

Inspect the vulnerability summary:

jq '.metadata.vulnerabilities' .artifacts/npm-audit.json

The fsize limit bounds the guest report to 8 MiB. Treat the report as sensitive for private projects because it contains package names and versions.

</Step> <Step title="Schedule and clean up">

Put the two blocks in a checked-in script, run it once manually, then call it from cron, a systemd timer, or your CI scheduler. The scheduler belongs outside the sandbox; the audit is the disposable part.

msb rm -f dependency-audit

Use a unique sandbox name instead of --replace when audit jobs may overlap.

</Step> </Steps>