NodeSecure
We are building free open source tools to secure the Node.js & JavaScript ecosystem. Our biggest area of expertise is in package and code analysis (SCA).
We are mainly developers who like to build tools that bring you value for free ❤️. Our tools often provide a range of benefits and information such as:
- Non opinionated metrics (On quality and maintainability).
- Very useful information about the projects you use:
- The different security threats within your codes (detected using our open source SAST JS-X-Ray).
Our tools have proven to be of great use to rigorous developers and package maintainers. But there is still a long way to go to make our tools more accessible to beginners 💪.
We welcome new contributors. Please feel free to join us on Discord and help on the different projects.
It doesn't necessarily matter if you are a beginner in security or not. Many projects require skills that are not directly related to security. So don't feel illegitimate to come and contribute and learn.
Learn how you can contribute by reading our guide:
- We frequently write articles about our different tools on https://dev.to/nodesecure.
- OpenSSF - Concise Guide for Evaluating Open Source Software 2023-01-03
- OpenSSF - Concise Guide for Developing More Secure Software 2023-01-03
- Build a software bill of materials (SBOM) for open source supply chain security
- A curated list of awesome Node.js Security resources.
- Collection of npm package manager Security Best Practices
Before contributing, please check and read our Code of conduct. There is some guides available to help developers and contributors:
The maintainers of NodeSecure are also the creators behind projects like TopCli, Dashlog, and many more (see OpenAlly).
Pinned Loading
Repositories
- report Public
NodeSecure HTML & PDF report generator for any public and/or private git repositories.
- scanner Public
⚡️ A package API to run a static analysis of your module's dependencies. This is the CLI engine!
- js-x-ray Public
JavaScript & Node.js open-source SAST scanner. A static analyser for detecting most common malicious patterns 🔬.
- cli Public
JavaScript security CLI that allow you to deeply analyze the dependency tree of a given package or local Node.js project.
- vulnera Public
Programmatically fetch security vulnerabilities with one or many strategies (GitHub Advisory, Sonatype, OSV, Snyk).
- npm-security-fetcher Public
a Node.js CLI created to simplify the analysis of npm registry packages.
- actionable Public
The missing security layer for your GitHub Actions workflows. Scan for excessive permissions, unpinned dependencies, dangerous variable usage and more.
Top languages
Loading…
Most used topics
Loading…