Requirements

Features

Getting Started

$ npm i @nodesecure/scanner
# or
$ yarn add @nodesecure/scanner

Usage example

import * as scanner from "@nodesecure/scanner";
import fs from "node:fs/promises";
// CONSTANTS
const kPackagesToAnalyze = ["mocha", "cacache", "is-wsl"];
const payloads = await Promise.all(
 kPackagesToAnalyze.map((name) => scanner.from(name))
);
const promises = [];
for (let i = 0; i < kPackagesToAnalyze.length; i++) {
 const data = JSON.stringify(payloads[i], null, 2);
 promises.push(fs.writeFile(`${kPackagesToAnalyze[i]}.json`, data));
}
await Promise.allSettled(promises);

API

function workingDir(
 location: string,
 options?: Scanner.WorkingDirOptions,
 logger?: Scanner.Logger
): Promise<Scanner.Payload>;
function from(
 packageName: string,
 options?: Scanner.FromOptions,
 logger?: Scanner.Logger
): Promise<Scanner.Payload>;
function verify(
 packageName?: string
): Promise<tarball.ScannedPackageResult>;

type WorkingDirOptions = Options & {
 /**
 * NPM runtime configuration (such as local .npmrc file)
 * It is optionally used to fetch registry authentication tokens
 */
 npmRcConfig?: Config;
};
type FromOptions = Omit<Options, "includeDevDeps">;
interface Options {
 /**
 * Specifies the maximum depth to traverse for each root dependency.
 * A value of 2 would mean only traversing deps and their immediate deps.
 *
 * @default Infinity
 */
 maxDepth?: number;
 /**
 * Includes development dependencies in the walk.
 * Note that enabling this option can significantly increase I/O and processing time.
 *
 * @default false
 */
 includeDevDeps?: boolean;
 readonly registry?: string | URL;
 /**
 * Enables the use of Arborist for rapidly walking over the dependency tree.
 * When enabled, it triggers different methods based on the presence of `node_modules`:
 * - `loadActual()` if `node_modules` is available.
 * - `loadVirtual()` otherwise.
 *
 * When disabled, it will iterate on all dependencies by using pacote
 */
 packageLock?: {
 /**
 * Fetches all manifests for additional metadata.
 *
 * @default false
 */
 fetchManifest?: boolean;
 /**
 * Specifies the location of the manifest file for Arborist.
 * This is typically the path to the `package.json` file.
 */
 location: string;
 };
 highlight?: {
 contacts: Contact[];
 };
 /**
 * Vulnerability strategy name (npm, snyk, node)
 *
 * @default NONE
 */
 readonly vulnerabilityStrategy?: Vuln.Strategy.Kind;
 /**
 * Analyze root package.
 *
 * @default false for from() API
 * @default true for cwd() API
 */
 readonly scanRootNode?: boolean;
}

Workspaces

Contributors ✨

License