@soos-io/soos-sca

SOOS Core SCA

SOOS is an independent software security company, located in Winooski, VT USA, building security software for your team. SOOS, Software security, simplified.

Use SOOS to scan your software for vulnerabilities and open source license issues with SOOS Core SCA. Generate and ingest SBOMs. Export reports to industry standards. Govern your open source dependencies. Run the SOOS DAST vulnerability scanner against your web apps or APIs. Scan your Docker containers for vulnerabilities. Check your source code for issues with SAST Analysis.

Demo SOOS or Register for a Free Trial.

If you maintain an Open Source project, sign up for the Free as in Beer SOOS Community Edition.

soos-sca

NPM package to run SOOS Core SCA

SOOS Badge Status

Supported Languages and Package Managers

Our full list of supported manifest formats can be found here.

Need an Account?

Visit soos.io to create your trial account.

Requirements

• npm

Installation

Globally

run npm i -g @soos-io/soos-sca@latest

Then Run soos-sca from any terminal and add the parameters you want.

Locally

run npm install --prefix ./soos @soos-io/soos-sca

Then run from the same terminal node ./soos/node_modules/@soos-io/soos-sca/bin/index.js

Running the CLI

See CLI Knowledge Base Documentation

Linux Shell CLI Example

See Linux GitHub Gist

Windows CMD CLI Example

See Windows Batch File Gist

Client Parameters

Argument	Default	Description
--apiKey		SOOS API Key - get yours from SOOS Integration. Uses SOOS_API_KEY env value if present.
--branchName		The name of the branch from the SCM System.
--branchURI		The URI to the branch from the SCM System.
--buildURI		URI to CI build info.
--buildVersion		Version of application build artifacts.
--clientId		SOOS Client ID - get yours from SOOS Integration. Uses SOOS_API_CLIENT env value if present.
--commitHash		The commit hash value from the SCM System.
--directoriesToExclude	**/node_modules/**, "**/bin/**", "**/obj/**", "**/lib/**	Listing of directories or patterns to exclude from the search for manifest files. eg: bin/start/, /start/
--exportFormat		Write the scan result to this file format. Options: CsafVex, CycloneDx, Sarif, Spdx, SoosIssues, SoosLicenses, SoosPackages, SoosVulnerabilities
--exportFileType		Write the scan result to this file type (when used with exportFormat). Options: Csv, Html, Json, Text, Xml
--filesToExclude		Listing of files or patterns to exclude from the search for manifest files. eg: /req.txt/, **/requirements.txt
--logLevel		Minimum level to show logs: DEBUG, INFO, WARN, FAIL, ERROR.
--onFailure	continue_on_failure	Action to perform when the scan fails. Options: fail_the_build, continue_on_failure.
--operatingEnvironment		Set Operating environment for information purposes only.
--outputDirectory		Export file destination.
--packageManagers		A list of package managers, delimited by comma, to include when searching for manifest files.
--projectName		Project Name - this is what will be displayed in the SOOS app.
--scriptVersion		None provided.
--sourceCodePath	process.cwd()	Root path to begin recursive search for manifests.
--workingDirectory	process.cwd()	Absolute path where SOOS may write and read persistent files for the given build. eg Correct: /tmp/workspace/

Feedback and Support

See SOOS Knowledge Base