{"id":19528852,"url":"https://github.com/netspi/npm-deps-parser","last_synced_at":"2025-09-17T16:06:27.593Z","repository":{"id":149489445,"uuid":"197884440","full_name":"NetSPI/npm-deps-parser","owner":"NetSPI","description":"Parses, summarizes, and prints \"npm audit\" json output to markdown for nVision reports","archived":false,"fork":false,"pushed_at":"2020-08-19T23:04:30.000Z","size":14,"stargazers_count":4,"open_issues_count":0,"forks_count":6,"subscribers_count":3,"default_branch":"master","last_synced_at":"2025-04-04T12:04:03.665Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/NetSPI.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2019-07-20T05:28:08.000Z","updated_at":"2023-03-02T19:08:48.000Z","dependencies_parsed_at":null,"dependency_job_id":"c9e75bc1-f16b-4838-8a0f-f0fb24e0dfec","html_url":"https://github.com/NetSPI/npm-deps-parser","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/NetSPI%2Fnpm-deps-parser","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/NetSPI%2Fnpm-deps-parser/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/NetSPI%2Fnpm-deps-parser/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/NetSPI%2Fnpm-deps-parser/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/NetSPI","download_url":"https://codeload.github.com/NetSPI/npm-deps-parser/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":250980901,"owners_count":21517747,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-11T01:20:18.474Z","updated_at":"2025-09-17T16:06:22.556Z","avatar_url":"https://github.com/NetSPI.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# npm-deps-parser\n\nParses, summarizes, and prints \"npm audit\" json output to markdown. Because neither making sense out of `npm audit` nor manually writing markdown tables is fun.\n\n## Caveats\n\nWill need to parse the CSV rating or get it from an api.\n\n## Usage\n\nThe fastest way to use the parser is to pass the `npm audit --json` output as stdin. To do so run the following from the folder where the `package.json` file is located:\n\n```shell\nnpm audit --json | python3 ~/path/to/npm-vuln-parser/parser.py -i\n```\n\nIf you get errors, you can try the below method:\n\n1. From the source code repo, run `npm audit --json \u003e path/to/output_file.json` \n2. Navigate to this repo, and run `python3 parser.py -f \"path/to/output_file.json\"`.\n3. If you are only interested in vulns with published CVEs, add `--cves-only` to the above command.\n4. Copy and paste the markdown table in your MD editor.\n5. For now, you'd have to manually look for the CVE scores of vulnerabilities with CVEs assigned. I have not found a reliable API to grab that from yet.\n\nFeel free to change and/or improve as needed.\n\n## Example \n\n```shell\n$ python3 parser.py -f \"../../../Assesments/client/vuln_code.json\"\n```\n\nresults in:\n\n| CVE | Module | Dependency of | Title | CVSS 3.0 Score | Info |\n| --- | --- | --- | --- | --- | --- |\n| N/A | handlebars | react-scripts | Prototype Pollution | N/A | https://npmjs.com/advisories/755 |\n| CVE-2019-10746 | mixin-deep | lint-staged, react-scripts | Prototype Pollution | ? | https://npmjs.com/advisories/1013 |\n| CVE-2019-10744 | lodash | @redux-offline/redux-offline, aws-appsync, lint-staged, react-scripts | Prototype Pollution | ? | https://npmjs.com/advisories/1065 |\n\n```shell\n$ python3 parser.py -f \"../../../Assesments/client/vuln_code.json\" --cves-only\n```\n\nresults in:\n\n| CVE | Module | Dependency of | Title | CVSS 3.0 Score | Info |\n| --- | --- | --- | --- | --- | --- |\n| CVE-2019-10747 | set-value | lint-staged, react-scripts | Prototype Pollution | ? | https://npmjs.com/advisories/1012 |\n| CVE-2019-10746 | mixin-deep | lint-staged, react-scripts | Prototype Pollution | ? | https://npmjs.com/advisories/1013 |\n\n\nYou can also display the max depth for the reported vulnerabilities using the `-d` flag.\n\nUtilizing the `-af` flag will format the table for Atlassian products such as JIRA or Confluence.\n\n```\n|| CVE || Module || Dependency of || Title || CVSS 3.0 Score || Info ||\n| CVE-2019-10747 | set-value | lint-staged, react-scripts | Prototype Pollution | ? | https://npmjs.com/advisories/1012 |\n| CVE-2019-10746 | mixin-deep | lint-staged, react-scripts | Prototype Pollution | ? | https://npmjs.com/advisories/1013 |\n```\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnetspi%2Fnpm-deps-parser","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fnetspi%2Fnpm-deps-parser","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnetspi%2Fnpm-deps-parser/lists"}