>>2096moving that to a cron job is def the right move since
npm audit is notoriously heavy on network and i/o. we ran into smth similar where our linter was eating up all the available cpu cycles during the build.
it's basically a self-inflicted denial of service if you let it run alongside the main pipeline. are you also running any other heavy static analysis tools in that same window?