nsp aka: Node Security Project

Check if your Node.js projects are using packages with known and public vulnerable dependencies, using NSP DB.

Install it: npm install -g nsp

Usage:

nmotw.in> nsp

Usage: [command] --arg=value --arg2

Help:
  help              Show help menu
  [cmd] help        Show command help menu

Options:
  version           shows the current version of nsp
  shrinkwrap        alias to audit-shrinkwrap
  audit-shrinkwrap  audits your `npm shrinkwrap` against NSP db
  package           alias to audit-package
  audit-package     audits your package.json against NSP db

nmotw.in> cat package.json
{
  "name": "test",
  "version": "0.0.1",
  "author": "Node Security Project",
  "dependencies": {
    "node-print": "0.0.4",
    "request": "^2.40.0",
    "qs": "^0.5"
  }
}

nmotw.in> nsp package
Name  Installed  Patched  Vulnerable Dependency
qs      0.5.6     >= 1.x  test@0.0.1 > [email protected]

The same can be used for auditing shrinkwrap.

GIF FTW!

nsp

Thanks to the nodesecurity for making security easy!

NMOTW

Nsp

nsp aka: Node Security Project

Comments