Static security code scanner (SAST) for Node.js applications.
- Install Postgres and configure
SQLALCHEMY_DATABASE_URIincore/settings.py - Run
pip install -r requirements.txt - Run
python createdb.py - Run
python app.py
This will run NodeJsScan on http://0.0.0.0:9090
If you need to debug, set DEBUG = True in core/settings.py
The command line interface (CLI) allows you to integrate NodeJsScan with DevSecOps CI/CD pipelines. The results are in JSON format. When you use CLI the results are never stored with NodeJsScan backend.
virtualenv venv
source venv/bin/activate
(venv)pip install nodejsscan
(venv)nodejsscan
usage: nodejsscan [-h] [-d DIRECTORY [DIRECTORY ...]] [-o OUTPUT]
optional arguments:
-h, --help show this help message and exit
-d DIRECTORY [DIRECTORY ...], --directory DIRECTORY [DIRECTORY ...]
Node.js source code directory to scan
-o OUTPUT, --output OUTPUT
Output file to save JSON report
docker build -t nodejsscan .
docker run -it -p 9090:9090 nodejsscan
docker pull opensecurity/nodejsscan
docker run -it -p 9090:9090 opensecurity/nodejsscan:latest
