Skip to main content

Static security code scanner (SAST) for Node.js applications

Project description

# NodeJsScan

Static security code scanner (SAST) for Node.js applications.

### Configure & Run NodeJsScan

Install Postgres and configure `SQLALCHEMY_DATABASE_URI` in `core/`

pip3 install -r requirements.txt
python3 // once to create database entries required

This will run NodeJsScan on ``

If you need to debug, set `DEBUG = True` in `core/`

### NodeJsScan CLI

The command line interface (CLI) allows you to integrate NodeJsScan with DevSecOps CI/CD pipelines. The results are in JSON format. When you use CLI the results are never stored with NodeJsScan backend.

virtualenv venv -p python3
source venv/bin/activate
(venv)pip install nodejsscan
(venv)$ nodejsscan
usage: nodejsscan [-h] [-f FILE [FILE ...]] [-d DIRECTORY [DIRECTORY ...]]
[-o OUTPUT] [-v]

optional arguments:
-h, --help show this help message and exit
-f FILE [FILE ...], --file FILE [FILE ...]
Node.js file(s) to scan
Node.js source code directory/directories to scan
-o OUTPUT, --output OUTPUT
Output file to save JSON report
-v, --version Show nodejsscan version

### Learn Node.js Security: Pentesting and Exploitation
[OpSecX Video Course](

### Docker

docker build -t nodejsscan .
docker run -it -p 9090:9090 nodejsscan

### DockerHub

docker pull opensecurity/nodejsscan
docker run -it -p 9090:9090 opensecurity/nodejsscan:latest

#### NodeJsScan Web UI

#### Static Analysis
![NodeJsScan Static Scan Results](
![NodeJsScan Static Scan Vulnerability Details](
![NodeJsScan CLI](

Project details

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distributions

No source distribution files available for this release.See tutorial on generating distribution archives.

Built Distribution

nodejsscan-3.3-py3-none-any.whl (13.7 kB view hashes)

Uploaded Python 3

Supported by

AWS AWS Cloud computing and Security Sponsor Datadog Datadog Monitoring Fastly Fastly CDN Google Google Download Analytics Microsoft Microsoft PSF Sponsor Pingdom Pingdom Monitoring Sentry Sentry Error logging StatusPage StatusPage Status page