a Node.js CLI to deeply analyze the dependency tree of a given NPM package or Node.js local app

• Run a static scan on every JavaScript files and sort out warnings (unsafe-regex, unsafe-import etc) and the complete list of required expr and statements (files, node.js module, etc.).
• Return complete composition for each packages (extensions, files, tarball size, etc).
• Packages metadata from the npm registry API (number of releases, last publish date, maintainers etc).
• Search for licenses files in the tarball and return the SPDX expression conformance of each detected licenses.
• Link vulnerabilities from the multiple sources like GitHub Advisory, Sonatype or Snyk using Vulnera.
• Add flags (emojis) to each packages versions to identify well known patterns and potential security threats easily.
• First-class support of open source security initiatives like OpenSSF Scorecard.
• Generate security report (PDF).

• Node.js v24 or higher

$ npm install @nodesecure/cli -g

or, from source (this package lives in the NodeSecure/cli monorepo):

$ git clone https://github.com/NodeSecure/cli.git
$ cd cli

$ npm install
# bundle/compile front-end assets for every workspace
$ npm run build

$ cd workspaces/cli
$ npm link

Then the nsecure binary will be available in your terminal. Give a try with the popular express package. This will automatically open the webpage in your default system browser.

$ nsecure auto express

# Run a scan on the current working dir
# Note: must have a package.json or node_modules directory
$ nsecure cwd

# Run a scan on a remote 'npm' package
$ nsecure from mocha

Then a nsecure-result.json will be writted at the current CLI location. To open it on a web page just run

$ nsecure open

The CLI includes built-in documentation accessible with the --help option:

$ nsecure --help
$ nsecure <command> --help

For complete details on each command, refer to the following documents:

• cwd
• from
• auto
• open
• verify
• summary
• scorecard
• report
• lang
• config create
• config
• cache
• extract integrity
• stats
• re-highlight

Each link provides access to the full documentation for the command, including additional details, options, and usage examples.

NodeSecure allow you to fetch stats on private npm packages by setting up a NODE_SECURE_TOKEN env variable (which must contains an npm token).

NodeSecure is capable to work behind a custom private npm registry too by searching the default registry URL in your local npm configuration.

$ npm config get registry
$ npm config set registry "http://your-registry/"

Our back-end scanner package is available here.

Flags and emojis legends are documented here.

Press Cmd+K (macOS) or Ctrl+K (Windows/Linux) from the network view to open the search command. It lets you filter the dependency graph using one or more criteria simultaneously.

Type a package name directly to search, or prefix with a filter name followed by : to use a specific filter:

• package — default when no prefix is given, matches by name.
• version — semver range (e.g. >=1.2.0, ^2.0.0).
• flag — select from the list of flags present in the current tree.
• license — SPDX identifier (e.g. MIT, Apache-2.0).
• author — author name or email.
• ext — file extension present in the package (e.g. .js, .ts).
• builtin — Node.js core module used by the package (e.g. fs, path).
• size — size range (see size-satisfies, e.g. >50kb, 10kb..200kb).
• highlighted — all highlighted packages by default.

Nodes are highlighted in red when the project/package is flagged with 🔬 hasMinifiedCode or ⚠️ hasWarnings. You can deactivate specific warnings in the options if desired.

The back-end scanner will analyze the complete size of the npm tarball without any filters or specific optimizations. In contrast, Bundlephobia will bundle the package and remove most of the unnecessary files from the tarball, such as documentation and other non-essential items.

See Scorecard Public Data:

MIT