SOC 2 compliance

[jean]

For the sake of SOC 2 compliance, we need to review vendor risk. For this, compliance reports such as SOC 2 is very useful. However, npm does not have its own SOC 2 report, and it is not mentioned in the security docs from GitHub (SOC 3, CSA STAR).

• Does npm undergo third-party audits? As part of GitHub's audit process?
• If so, where should I look for the audit results pertaining to npm?