Security News
tea.xyz Spam Plagues npm and RubyGems Package Registries
Tea.xyz, a crypto project aimed at rewarding open source contributions, is once again facing backlash due to an influx of spam packages flooding public package registries.
@nodesecure/cli
Advanced tools
Readme
a Node.js CLI to deeply analyze the dependency tree of a given NPM package or Node.js local app
$ npm install @nodesecure/cli -g
or
$ git clone https://github.com/NodeSecure/cli.git
$ cd cli
# install NPM dependencies
$ npm install
# run esbuild to bundle/compile front-end assets
$ npm run build
$ npm link
Then the nsecure binary will be available in your terminal. Give a try with the popular express package. This will automatically open the webpage in your default system browser.
$ nsecure auto express
[!TIP] Setup an npm token to avoid hiting the maximum request limit of the npm registry API.
To show the complete list of commands
$ nsecure --help
# Run an analysis on the current working dir (must have a package.json file).
$ nsecure cwd
# Run an analysis for a given 'npm' package (must be in the npm registry).
$ nsecure from mocha
Then a nsecure-result.json
will be writted at the current CLI location. To open it on a web page just run
$ nsecure open
# If you want to define a specific port use the --port option.
$ nsecure open --port 8080
name | shortcut | default value | description |
---|---|---|---|
--port | -p | Define the running port, can also be define through the environment variable PORT |
The auto
command can be used to chain cwd/from
and open
commands automatically.
$ nsecure auto jest
# if no package is given to the auto command then it will run the cwd command instead of from.
$ nsecure auto
👀 By default with the auto command the .json file is deleted when the http server is closed. It's possible to disable this behavior by using the CLI option
--keep
,-k
.
Some options are available on both cwd
, from
and auto
commands. The output option is not available for the auto
command.
name | shortcut | default value | description |
---|---|---|---|
--depth | -d | 4 | the maximum depth we must walk (when we fetch the whole tree). |
--output | -o | nsecure-result | the name that the outputted .json file will have |
$ nsecure from express -d 10 -o express-security-report
NodeSecure allow you to fetch stats on private npm packages by setting up a NODE_SECURE_TOKEN
env variable (which must contains an npm token).
[!TIP] If you
npm link
the package by yourself you can create a.env
file at the root of the project too.
NodeSecure is capable to work behind a custom private npm registry too by searching the default registry URL in your local npm configuration.
$ npm config get registry
$ npm config set "http://your-registry/"
Our back-end scanner package is available here.
Flags and emojis legends are documented here.
Since version 0.6.0 of Node-secure the UI include a brand new searchbar that allow to search anything on the tree (graph) by multiple criteria (filters). The current available filters are:
Exemple of query:
version: >=1.2 | 2, ext: .js, builtin: fs
Nodes are red when the project/package has been flagged with 🔬 hasMinifiedCode
or ⚠️ hasWarnings
.
Node-secure will analyze the complete size of the npm tarball with no filters or particular optimization. Bundlephobia on the other side will bundle and remove most of the useless files from the tarball (Like the documentation, etc.).
We run a weekly Scorecard scan of the 1 million most critical open source projects judged by their direct dependencies and publish the results in a BigQuery public dataset.
If you are a developer wishing to contribute to the project, you must first read the CONTRIBUTING guide.
If you have already cloned and installed the project with npm locally, you still need to build and bundle front-end assets using the npm build
script:
$ npm run build
[!IMPORTANT] Restart this command when modifying files in the public root folder
Once you have finished your development, check that the tests (and linter) are still good by running the following script:
$ npm test
[!CAUTION] If you add a feature, try adding tests for it along.
Click on one of the links to access the documentation of the workspace:
name | package and link |
---|---|
documentation-ui | @nodesecure/documentation-ui |
vis-network | @nodesecure/vis-network |
size-satisfies | @nodesecure/size-satisfies |
These packages are available in the Node Package Repository and can be easily installed with npm or yarn.
$ npm i @nodesecure/documentation-ui
# or
$ yarn add @nodesecure/documentation-ui
Thanks goes to these wonderful people (emoji key):
This project follows the all-contributors specification. Contributions of any kind welcome!
MIT
FAQs
Node.js security CLI
The npm package @nodesecure/cli receives a total of 8 weekly downloads. As such, @nodesecure/cli popularity was classified as not popular.
We found that @nodesecure/cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 5 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Tea.xyz, a crypto project aimed at rewarding open source contributions, is once again facing backlash due to an influx of spam packages flooding public package registries.
Security News
As cyber threats become more autonomous, AI-powered defenses are crucial for businesses to stay ahead of attackers who can exploit software vulnerabilities at scale.
Security News
UnitedHealth Group disclosed that the ransomware attack on Change Healthcare compromised protected health information for millions in the U.S., with estimated costs to the company expected to reach $1 billion.