[BUG] `npm audit` not working properly with pre-releases / JFrog article "Invisible npm malware"

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

As described in the JFrog post "Invisible npm malware – evading security checks with crafted versions", npm audit is unable to detect vulnerabilities in pre-release versions.

Their post says:

Following a disclosure from JFrog, we learned from the NPM maintainers that this functionality is the expected behavior, therefore we do not expect this behavior to change.

Could you please explain why you consider this expected behavior (even if the answer is that this is a technical limitation)? Even though you should normally avoid depending on pre-releases, in some cases it might be necessary (e.g. to get an important bug fix), and it would certainly be useful to also be notified about vulnerabilities if there are any.

Expected Behavior

npm audit should detect vulnerabilities in pre-release versions of dependencies.

Steps To Reproduce

1. Create a package.json with the following content

   {
     "name": "test",
     "version": "1.0.0",
     "dependencies": {
       "cruddl": "2.0.0-update.2"
     }
   }
   

2. Run npm install, then npm audit
   ❌ Bug: No vulnerability is detected
3. Change the dependency version to 1.7.6 or 2.0.0 and repeat step 2
   ✔️ As expected: The vulnerability is detected

Environment

• npm: 9.2.0
• Node.js: v16.14.2
• OS Name: Windows 10
• System Model Name:
• npm config:

; "builtin" config from #redacted#\AppData\Roaming\npm\node_modules\npm\npmrc

prefix = "#redacted#\\AppData\\Roaming\\npm"

; "cli" config from command line options

location = "project"

; node bin location = C:\Program Files\nodejs\node.exe
; node version = v16.14.2
; npm local prefix = #redacted#\Downloads\npm-test
; npm version = 9.2.0
; cwd = #redacted#\Downloads\npm-test
; HOME = #redacted#
; Run `npm config ls -l` to show all defaults.

Start by creating the package.json shown in the issue, running npm install, and comparing npm audit results for the pre-release and stable dependency versions. Trace the npm audit vulnerability matching behavior for pre-release versions; done means the reported vulnerability is detected consistently without breaking the existing stable-version behavior.