title: npm audit versus yarn audit
body: <p>I have a React Native project (0.61.4) that uses <code>yarn</code> as its package manager.</p>
  
  <p>When I run <code>yarn audit</code> a huge number of vulnerabilities are reported:</p>
  
  <pre><code>18202 vulnerabilities found - Packages audited: 958823
  Severity: 18202 High
  ✨  Done in 14.34s.
  </code></pre>
  
  <p>Most are in some very deep dependency paths. For instance: </p>
  
  <pre><code>┌───────────────┬──────────────────────────────────────────────────────────────┐
  │ high          │ Prototype Pollution                                          │
  ├───────────────┼──────────────────────────────────────────────────────────────┤
  │ Package       │ lodash                                                       │
  ├───────────────┼──────────────────────────────────────────────────────────────┤
  │ Patched in    │ &gt;=4.17.12                                                    │
  ├───────────────┼──────────────────────────────────────────────────────────────┤
  │ Dependency of │ react-native                                                 │
  ├───────────────┼──────────────────────────────────────────────────────────────┤
  │ Path          │ react-native &gt; @react-native-community/cli &gt;                 │
  │               │ metro-react-native-babel-transformer &gt; @babel/core &gt; lodash  │
  ├───────────────┼──────────────────────────────────────────────────────────────┤
  │ More info     │ https://www.npmjs.com/advisories/1065                        │
  └───────────────┴──────────────────────────────────────────────────────────────┘
  </code></pre>
  
  <p>When I run <code>npm audit</code>, it first reports:</p>
  
  <pre><code>Neither npm-shrinkwrap.json nor package-lock.json found: Cannot audit a project without a lockfile
  </code></pre>
  
  <p>So I run: </p>
  
  <pre><code>npm i --package-lock-only
  </code></pre>
  
  <p>A <code>package-lock.json</code> file is generated. On inspection this file seems correct.</p>
  
  <p>When I now run <code>npm audit</code>, the results are:</p>
  
  <pre><code>=== npm audit security report ===                        
  
  found 0 vulnerabilities
  </code></pre>
  
  <p>I don't understand the discrepancy between these two package managers. Why does <code>npm</code> report 0 errors, and <code>yarn</code> 18.202?</p>