How to triage npm audit findings without ignoring real risk

A fresh npm audit on a mid-sized project routinely lists dozens of advisories. Most teams respond in one of two bad ways: fix none of them because the list is overwhelming, or run npm audit fix --force and break the build. A better first step is to sort the list by whether your code can reach the vulnerable package.

The four buckets this tool uses

imported — your runtime code imports or requires the vulnerable package directly. Read these first; a high or critical here deserves a fix this week.
via-imported — your code imports a package that depends on the vulnerable one. Often fixed by upgrading the parent, which is what the fix column suggests.
test-only — the package is imported only from test files or tooling configuration (test runners, bundler configs, linters). The risk is mostly to developer machines and CI, not your users.
not-referenced — nothing in the scanned source imports it or a parent that does. Usually a deep build-time dependency.

A sensible order

Run npm audit --json and the triage together so the ranked list replaces the raw list.
Fix reachable high and critical findings first. Use --fail-on high in CI so a new reachable one blocks the merge.
For via-imported findings, upgrade the parent package the report names, and re-run. If the fix is a major version, schedule it rather than forcing it.
For test-only findings, patch on your normal dependency-update cadence. Do not ignore advisories about code that runs in CI with secrets, such as a malicious or compromised build tool.
For not-referenced findings, confirm the package is really unused (a bundler plugin, a framework convention or a postinstall script can load it without an import line), then batch the upgrades.

What this ranking cannot tell you

It reads import statements as text. It cannot see a require built from a variable, code loaded by a framework by naming convention, or whether the specific vulnerable function is ever called. Not imported is a reason to lower the urgency, not a certificate of safety. It is a heuristic, not a security audit.