“As of today, npm audit is a stain on the entire npm ecosystem.”
Run npm install on a fresh React app and you get a wall of “high severity” warnings. Almost none of them can be exploited in a build tool that never touches user input. Beginners panic, CI blocks deploys, and people learn to ignore the alerts. A security tool that cries wolf every day is worse than none at all.