The vuln-era has begun! Programmatically fetch security vulnerabilities with one or many strategies. Originally designed to run and analyze Scanner dependencies it now also runs independently from an npm Manifest.

Requirements

• Node.js v24 or higher

Getting Started

This package is available in the Node Package Repository and can be easily installed with npm or yarn.

$ npm i @nodesecure/vulnera
# or
$ yarn add @nodesecure/vulnera

Usage example

import*asvulnerafrom"@nodesecure/vulnera";constgithub=vulnera.setStrategy(vulnera.strategies.GITHUB_ADVISORY);constvulnerabilities=awaitgithub.getVulnerabilities(process.cwd(),{useFormat: "Standard"});console.log(vulnerabilities);

Available strategy

The default strategy is NONE which mean no strategy at all (we execute nothing).

• GitHub Advisory
• Sonatype OSS Index
• OSV

Those strategies are described as "string" type with the following TypeScript definition:

typeKind="github-advisory"|"sonatype"|"osv"|"none";

To add a strategy or better understand how the code works, please consult the following guide.

API

functionsetStrategy<TextendsKind>(name: T): AllStrategy[T];functiongetStrategy(): AnyStrategy;conststrategies: Object.freeze({GITHUB_ADVISORY: "github-advisory",SONATYPE: "sonatype",OSV: "osv",NONE: "none"});/** Equal to strategies.NONE by default **/constdefaultStrategyName: "none";

Strategy extend from the following set of interfaces;

exportinterfaceBaseStrategy<TextendsKind>{/** Name of the strategy **/strategy: T;/** Method to hydrate dependency vulnerabilities fetched by the Scanner **/hydratePayloadDependencies: (dependencies: Dependencies,options?: HydratePayloadDepsOptions)=>Promise<void>;}exportinterfaceExtendedStrategy<TextendsKind,VulnFormat>extendsBaseStrategy<T>{/** Method to get vulnerabilities using the current strategy **/getVulnerabilities: (path: string,options?: BaseStrategyOptions)=>Promise<(VulnFormat|StandardVulnerability)[]>;}exporttypeBaseStrategyFormat=|"Standard"|"OSV";exportinterfaceBaseStrategyOptions{useFormat?: BaseStrategyFormat;}exportinterfaceHydratePayloadDepsOptionsextendsBaseStrategyOptions{/** * Absolute path to the location to analyze * (with a package.json and/or package-lock.json for NPM Audit for example) **/path?: string;}

Where dependencies is the dependencies Map() object of the NodeSecure Scanner.

Note

the option hydrateDatabase is only useful for some of the strategy (like Node.js Security WG).

Formats

• Standard
• OSV

Databases

• OSV
• NVD
• Sonatype

Contributors ✨

Thanks goes to these wonderful people (emoji key):

Gentilhomme 💻📖👀🛡️🐛	Tony Gorez 💻👀🐛	Antoine 💻🐛📖	OlehSych 💻	Mathieu 💻	PierreD 💻📖	Kouadio Fabrice Nguessan 💻🚧
benjamin antonioli 💻⚠️	HoyeongJeon 💻

License

MIT