Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Node.js security advisories

nodesecurity.io

Post reply on HN
Print view View original

11–14 of 14 posts

Re: Node.js security advisories

#11

Post by malandrew »

atishay811 wrote: post #4

Can't this be made simpler. Something like a cli call npm vulnerable This could take the package.json and list which of my packages need to be upgraded or downgraded to be secure as per the known issues database.

it could also be run automatically when cd-ing into a directory by overriding the default cd

    cd() {
      builtin cd $*
      if [ -f "package.json" ] ; then
        npm check-vulnerabilities
      fi
    }
I reckon you could also use this with david[0] to check if packages are up to date.

[0] https://github.com/alanshaw/david

Re: Node.js security advisories

#13

Post by atishay811 »

malandrew wrote: post #11
atishay811 wrote: post #4

Can't this be made simpler. Something like a cli call npm vulnerable This could take the package.json and list which of my packages need to be upgraded or downgraded to be secure as per the known issues database.

it could also be run automatically when cd-ing into a directory by overriding the default cd cd() { builtin cd $* if [ -f "package.json" ] ; then npm check-vulnerabilities fi } I reckon you could also use this with david[0] to check if packages are up to date. [0] https://github.com/alanshaw/david

I did not mean outdated. npm outdated can do that. See https://npmjs.org/doc/cli/npm-outdated.html I was looking insecure version of the same through a public repo.

Re: Node.js security advisories

#14

Post by gravis »

kibibyte wrote: post #6
viraptor wrote: post #3

Earlier quoted context omitted.

I think the security checker from Sensio labs is the best approach to this. You can upload your composer file, which is really the list of packages you use and they'll check it against the known reports for various Symfony modules. It's got both the API and its own module with a CLI tool, so you can easily integrate it into monitoring. https://security.sensiolabs.org/ I really wish other projects had something like t…

There actually does exist one for Ruby. Check out gemcanary https://gemcanary.com/

and https://gemnasium.com (which supports npm as well)
Post reply on HN