Use `npx aud` instead of `npm audit`, whether you have a lockfile or not!