https://ajinabraham.github.io/NodeJsScan
nodejsscan is a static security code scanner for Node.js applications.
https://ajinabraham.github.io/NodeJsScan
code-analysis code-review devsecops javascript lint node node-security nodejs nodejsscan sast security security-scanner static-analysis
Last synced: about 2 months ago
JSON representation
nodejsscan is a static security code scanner for Node.js applications.
- Host: GitHub
- URL: https://ajinabraham.github.io/NodeJsScan
- Owner: ajinabraham
- License: gpl-3.0
- Created: 2015-02-27T12:52:46.000Z (about 10 years ago)
- Default Branch: master
- Last Pushed: 2024-10-16T11:43:49.000Z (6 months ago)
- Last Synced: 2024-10-29T15:34:10.672Z (6 months ago)
- Topics: code-analysis, code-review, devsecops, javascript, lint, node, node-security, nodejs, nodejsscan, sast, security, security-scanner, static-analysis
- Language: CSS
- Homepage: https://opensecurity.in
- Size: 5.28 MB
- Stars: 2,395
- Watchers: 58
- Forks: 327
- Open Issues: 11
-
Metadata Files:
- Readme: README.md
- Funding: .github/FUNDING.yml
- License: LICENSE
Awesome Lists containing this project
- awesome-nodejs-security - NodeJSScan - A static security code scanner for Node.js applications. Including neat UI that can point where the issue is and how to fix it. (Static Code Analysis)
README
# nodejsscan 
Static security code scanner (SAST) for Node.js applications powered by [libsast](https://github.com/ajinabraham/libsast) and [semgrep](https://github.com/returntocorp/semgrep).
Made with  in India [](https://twitter.com/intent/tweet/?text=nodejsscan,%20a%20static%20security%20code%20scanner%20for%20node.js%20applications%20by%20%40ajinabraham%20%40OpenSecurity_IN&url=https://github.com/ajinabraham/nodejsscan)
[](https://github.com/ajinabraham/nodejsscan)
[](https://www.gnu.org/licenses/gpl-3.0.html)
[](https://www.python.org/downloads/)
[](https://github.com/ajinabraham/nodejsscan/actions?query=workflow%3ATests)
### Support nodejsscan
* **Donate via Paypal:** [](https://paypal.me/ajinabraham)
* **Sponsor the Project:** [](https://github.com/sponsors/ajinabraham)
### e-Learning Courses & Certifications
[](https://opsecx.com/index.php/product/node-js-security-pentesting-and-exploitation/?uid=github) [OpSecX Node.js Security: Pentesting and Exploitation - NJS](https://opsecx.com/index.php/product/node-js-security-pentesting-and-exploitation/?uid=github)
## Run nodejsscan
```bash
docker pull opensecurity/nodejsscan:latest
docker run -it -p 9090:9090 opensecurity/nodejsscan:latest
```
## Setup nodejsscan locally
Install Postgres and configure `SQLALCHEMY_DATABASE_URI` in `nodejsscan/settings.py` or as environment variable.
From version 4 onwards, windows support is dropped.
```bash
git clone https://github.com/ajinabraham/nodejsscan.git
cd nodejsscan
python3 -m venv venv
source venv/bin/activate
pip install -r requirements.txt
python3 manage.py recreate-db # Run once to create database schema
```
To run nodejsscan
`./run.sh`
This will run nodejsscan web user interface at `http://127.0.0.1:9090`
## Command Line Interface(CLI) and Python API
* CLI: https://github.com/ajinabraham/njsscan#command-line-options
* API: https://github.com/ajinabraham/njsscan#python-api
## Presentations
[](https://youtu.be/kTjICeZCvS0)
## Integrations
### Slack Alerts
Create your slack app [Slack App](https://api.slack.com/messaging/webhooks) and set `SLACK_WEBHOOK_URL` in `nodejsscan/settings.py` or as environment variable.
### Email Alerts
Configure SMTP settings in `nodejsscan/settings.py` or as environment variable.
### CI/CD or DevSecOps
* **Github Action**: https://github.com/ajinabraham/njsscan#github-action
* **Gitlab CI/CD**: https://github.com/ajinabraham/njsscan#gitlab-cicd
* **Travis CI**: https://github.com/ajinabraham/njsscan#travis-ci
## Build Docker image
```bash
docker build -t nodejsscan .
docker run -it -p 9090:9090 nodejsscan
```
* CLI Docker Image: https://github.com/ajinabraham/njsscan#build-locally
## nodejsscan screenshots
