Why and How to Run NPM Security Scans
NPM package vulnerabilities
NPM itself doesn’t automatically check for vulnerabilities like these or prevent developers and users from uploading and downloading insecure packages. As a result, if left undetected, vulnerabilities in NPM packages can spread quickly within communities that use Node.js software. Developers may end up importing vulnerable NPM packages into the software they write, which places them at risk of distributing insecure software to their users. For their part, end-users who don’t check NPM packages for risks may inadvertently install malicious packages on their computers.
Risks like these have created major security vulnerabilities for NPM packages, such as a severe remote code execution flaw in an NPM package that is downloaded 12 million times per month.
Using security scans to manage NPM security
The primary method of defense against risks like these is NPM security scanning. NPM security scanners recursively parse through all layers of an NPM package, including dependencies (meaning other packages that an NPM package requires in order to run an application).
By identifying the contents of each layer of an NPM package and its dependencies, then checking whether the contents contain known security vulnerabilities, NPM security scanning helps protect both developers and end-users from malware, insecure application code and other threats that may exist within NPM packages.
Tools for NPM security scanning
There are two main ways to perform NPM security scanning.
The first is to use NPM’s native auditing tool, called npm-audit. Npm-audit is an open source command-line utility that generates a report of known vulnerabilities within a given NPM package. In certain cases, npm-audit can attempt to fix a vulnerability by replacing a vulnerable package with an updated, patched alternative. The command-line tool “npm” can also list CVE advisories associated with a package.
You can download and run npm-audit directly on your computer, or you can access it through platforms like JFrog Artifactory, which features native support for npm-audit.
The second method for performing NPM security scanning is to use a commercial scanning tool, such as JFrog Xray. Unlike npm-audit, which is designed only for providing one-off security reports on individual packages that users scan manually from the command line (although it could be integrated into a script to run rep), Xray can continuously scan packages within Artifactory repositories. This ensures that whenever a new package is uploaded, or an existing package is changed, it will be automatically checked for security vulnerabilities.
In addition, Xray supports integration with CI/CD pipelines to perform continuous scanning (via IDE plugins) as developers write Node.js code. It also provides impact analysis, which helps developers and users understand how widespread a detected vulnerability is within their NPM packages.