npmpackage.info

@chax-at/better-npm-audit

Reshape a better npm audit for the community and encourage more people to include security audits into their process

3.6.9

MIT

TypeScript

37.21 kB

14,079 3.2

Installations

npm install @chax-at/better-npm-audit

Developer Guide

BETA

Typescript

No

Module System

CommonJS

Min. Node Version

>= 8.12

Node Version

16.17.1

NPM Version

8.19.2 Score

68.2

Supply Chain

80.3

Quality

80.6

Maintenance

100

Vulnerability

99.3

License

Pull Requests

Open

0

Total

0

Closed

0

Issues

Open

0

Total

0

Closed

0

Releases

Unable to fetch releases

Contributors

Unable to fetch Contributors

View all 1 contributors

Languages

TypeScript

JavaScript

TypeScript (98.7%)

JavaScript (1.3%)

Developer

chax-at

Download Statistics

Total Downloads

14,079

Last Day

Last Week

165

Last Month

471

Last Year

9,511

GitHub Statistics

202 Commits

3 Branches

1 Contributors

Maintainers

Package Meta Information

Latest Version

3.6.9

Package Id

@chax-at/better-npm-audit@3.6.9

Unpacked Size

37.21 kB

Size

9.73 kB

File Count

NPM Version

8.19.2

Node Version

16.17.1

Publised On

18 Jul 2023

Total Downloads

Cumulative downloads

Total Downloads

14,079

Last day

33.3%

Compared to previous day

Last week

44.7%

165

Compared to previous week

Last month

-19.3%

471

Compared to previous month

Last year

156.6%

9,511

Compared to previous year

Daily Downloads

Weekly Downloads

Monthly Downloads

Yearly Downloads

Versions

Better NPM Audit

The goal of this project is to help to reshape npm audit into the way the community would like, by the community itself. Giving another option for everyone and encourage more people to do security audits.

npm vulnerability GitHub issues npm bundle size Languages

Supports both NPM version 6 and 7

NPM has upgraded to version 7 in late 2020 and has breaking changes on the npm audit. The output of npm audit has significantly changed both in the human-readable and --json output styles. We have added handling so it works properly in both npm versions.

Docs	Link
NPM v6 & v7 changes	https://github.blog/2020-10-13-presenting-v7-0-0-of-the-npm-cli/
NPM v7 blog post	https://blog.npmjs.org/post/626173315965468672/npm-v7-series-beta-release-and-semver-major
Official NPM v6 audit docs	https://docs.npmjs.com/cli/v6/commands/npm-audit
Official NPM v7 audit docs	https://docs.npmjs.com/cli/v7/commands/npm-audit
Dealing with new npm audit	https://uko.codes/dealing-with-npm-v7-audit-changes

Installation

$ npm install --save better-npm-audit

$ npm install -g better-npm-audit

Usage

Run global

1better-npm-audit audit

Run with exceptions

Demo of table displaying the security report

Unhandled or newly reported vulnerabilities will be highlighted:

Unused exceptions will be notified:

Add into package scripts

1{
2  "scripts": {
3    "prepush": "npm run test && npm run audit",
4    "audit": "better-npm-audit audit"
5  }
6}

Now you can run locally or in your CI pipeline:

1npm run audit

Options

Flag	Short	Description
`--exclude`	`-x`	Exceptions or the vulnerabilities ID(s) to exclude
`--module-ignore`	`-m`	Names of modules to exclude
`--level`	`-l`	The minimum audit level to validate; Same as the original `--audit-level` flag
`--production`	`-p`	Skip checking the `devDependencies`
`--registry`	`-r`	The npm registry url to use

Environment Variables

Variable	Description
`NPM_CONFIG_AUDIT_LEVEL`	Used in setting the audit level. Note: this will be disregard if the audit level flag is passed onto the command.

Using `.nsprc` file to manage exceptions

You may add a file .nsprc to your project root directory to manage the exceptions. For example:

1{
2  "1337": {
3    "active": true,
4    "notes": "Ignored since we don't use xxx method",
5    "expiry": 1615462134681
6  },
7  "4501": {
8    "active": false,
9    "notes": "Ignored since we don't use xxx method"
10  },
11  "980": "Ignored since we don't use xxx method",
12  "https://github.com/advisories/GHSA-93q8-gq69-wqmw": "Github vulnerability URLs are supported as well",
13  "GHSA-qrpm-p2h7-hrv2": "GHSA is also possible",
14  "Note": "Any non number key will not be accepted"
15}

Fields

Attribute	Type	Description	Default	Examples
`active`	Boolean	If the tool should use it for exception	`true`	`true`
`expiry`	String \| Number	Human-readable date, or milliseconds since the UNIX Epoch		- `'2020-01-31'` - `'2020/01/31'` - `'01/31/2021, 11:03:58'` - `'1 March 2016 15:00'` - `'1 March 2016 3:00 pm'` - `'2012-01-26T13:51:50.417-07:00'` - `'Sun, 11 Jul 2021 03:03:13 GMT'` - `'Thu Jan 26 2017 11:00:00 GMT+1100 (Australian Eastern Daylight Time)'` - `327611110417`
`notes`	String	Notes related to the vulnerability.

When using a .nsprc file, a report will be displayed when it starts running:

Demo of table displaying a list of exceptions

Note: the expiry date will be styled in yellow and red color if it is detected more than one or five years ago.

Changelog

You can find the changelog here.

Special mentions

@IanWright for his solutions in improving the vulnerability validation for us to have the minimum-audit-level and production-mode flags.
@EdwinTaylor for all the bug reports and improvement suggestions.
@MrHus for the logging of unused exceptions from the .nsprc file and -ignore flags. Courtesy of 42 BV.

If you like this project,

No vulnerabilities found.

10

Binary-Artifacts

Determines if the project has generated executable (binary) artifacts in the source repository.

10

SAST

Determines if the project uses static code analysis.

10

Dangerous-Workflow

Determines if the project's GitHub Action workflows avoid dangerous patterns.

10

License

Determines if the project has defined a license.

1

Pinned-Dependencies

Determines if the project has declared and pinned the dependencies of its build process.

0

Maintained

Determines if the project is "actively maintained".

0

Token-Permissions

Determines if the project's workflows follow the principle of least privilege.

0

Code-Review

Determines if the project requires human code review before pull requests (aka merge requests) are merged.

0

CII-Best-Practices

Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.

0

Security-Policy

Determines if the project has published a security policy.

0

Fuzzing

Determines if the project uses fuzzing.

0

Branch-Protection

Determines if the default and release branches are protected with GitHub's branch protection settings.

0

Vulnerabilities

Determines if the project has open, known unfixed vulnerabilities.

Score

3.2

/10

Last Scanned on 2024-12-16

The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.

Learn More

@chax-at/better-npm-audit

Installations

Developer Guide

No

CommonJS

>= 8.12

16.17.1

8.19.2

Score

Pull Requests

0

0

0

Issues

0

0

0

Releases

Unable to fetch releases

Contributors

Unable to fetch Contributors

Languages

Developer

chax-at

Download Statistics

GitHub Statistics

Maintainers

Package Meta Information

Total Downloads

14,079

Daily Downloads

Weekly Downloads

Monthly Downloads

Yearly Downloads

Dependencies

Dev Dependencies

Better NPM Audit

Supports both NPM version 6 and 7

Installation

Usage

Run global

Run with exceptions

Add into package scripts

Options

Environment Variables

Using .nsprc file to manage exceptions

Fields

Changelog

Special mentions

10

10

10

10

1

0

0

0

0

0

0

0

0

3.2

/10

Using `.nsprc` file to manage exceptions