Use `npx aud` instead of `npm audit`, whether you have a lockfile or not! - View it on GitHub