Skip to content
@NodeSecure

NodeSecure

A group of people 👯 moving toward a safer Node.js and JavaScript ecosystem 🐢🚀
README.md

👋 Welcome visitor

We are building free open source tools to secure the Node.js & JavaScript ecosystem. Our biggest area of expertise is in package and code analysis.

We are mainly developers who like to build tools that bring you value for free ❤️. Our tools often provide a range of benefits and information such as:

  • Non opinionated metrics (On quality and maintainability).
  • Very useful information about the projects you use:
    • OpenSSF Scorecard.
    • SPDX license conformance.
    • Vulnerabilities (with support of multiple strategies: NPM, Sonatype, Snyk).
  • The different security threats within your codes (detected using our open source SAST JS-X-Ray).

Our tools have proven to be of great use to rigorous developers and package maintainers. But there is still a long way to go to make our tools more accessible to beginners 💪.

❤️ Contributors

We welcome new contributors. Please feel free to join us on Discord and help on the different projects.

ES-Community

It doesn't necessarily matter if you are a beginner in security or not. Many projects require skills that are not directly related to security. So don't feel illegitimate to come and contribute and learn.

🐤 How to contribute

Learn how you can contribute by reading our guide:

Resources to learn more about the project or good security practices

Pinned

  1. Governance Governance Public

    NodeSecure Governance (Code of conduct & Contribution guidelines)

    13 4

  2. cli cli Public

    JavaScript security CLI that allow you to deeply analyze the dependency tree of a given package or local Node.js project.

    JavaScript 360 38

  3. ci ci Public

    NodeSecure tool enabling secured continuous integration

    TypeScript 19 7

  4. js-x-ray js-x-ray Public

    JavaScript & Node.js open-source SAST scanner. A static analyser for detecting most common malicious patterns 🔬.

    JavaScript 196 24

  5. scanner scanner Public

    ⚡️ A package API to run a static analysis of your module's dependencies. This is the CLI engine!

    JavaScript 27 14

  6. vulnera vulnera Public

    Programmatically fetch security vulnerabilities with one or many strategies (NPM Audit, Sonatype, Snyk, Node.js DB).

    TypeScript 30 14

Repositories

Showing 10 of 33 repositories
View all repositories