Sorry, I should have been clearer in my question: I understand that npm requires the package.json and package-lock.json files to be present for npm audit to work. Internally our project uses Yarn, and thus generates a corresponding yarn.lock file, and yarn has the ability to run an audit command as ...