[BUG] NPM Audit has reduced the issues count over time on unchanged source code

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

Title:

Drastic Drop in npm audit Issues for Same Repository -- Clarification on Advisory Database

Hello community,

I've been investigating npm audit behavior and noticed a significant drop in reported vulnerabilities for the same source code over time.

Environment:

• Node version: v18.16.0
• npm version: 9.5.1

Observation:

• Around 4 months ago, running npm audit on some repositories showed 100+ issues.

• Running the same command today on the same source code (same lockfile) now shows only 2--3 issues.

This raises some questions on how the advisory database works internally:

1. Can advisories for specific dependencies/versions be removed or deprecated from the database at a later time?
2. Do advisories get merged/reclassified (e.g., multiple CVEs into one, or marked as "resolved")?
3. Is it expected for audit results to drop so drastically without any dependency changes done in source code?
4. Is there a public changelog or transparency report when advisories are removed/modified?

Repository Examples (Issue count differences b/w 4 month old scan and in today's reported issues):

• Web3Bugs-122 → -85 issues

• Web3Bugs-192 → -239 issues

• Web3Bugs-104 → -89 issues

• Web3Bugs-110 → -240 issues

• Web3Bugs-13 → -109 issues

• Sherlock Flatmoney Audit → -24 issues

• Sherlock Zap Protocol Audit → -210 issues

Request:
Can someone from the community (or npm/GitHub Security team) clarify how advisory lifecycle works and whether it's normal for audit results to shrink so drastically over a short period?

Thanks in advance 🙏

Expected Behavior

Expectation:
For the same package-lock.json, I would expect npm audit to show consistent results, unless advisories were intentionally deprecated or removed.

Steps To Reproduce

1. Run npm audit tool on above given repositories

Environment

• npm: 9.5.1
• Node.js: v18.16.0
• OS Name: Ubuntu 22.04.3 LTS
• System Model Name: -
• npm config: -

Run npm audit with npm 9.5.1 and Node.js v18.16.0 against the listed repositories and their existing package-lock.json files, then compare the reported counts with the earlier results. Review the audit behavior and advisory lifecycle questions; done means explaining whether unchanged lockfiles can produce different results and why.