security-dependencies

Dependency Vulnerability Scanner

Scan project dependencies across multiple ecosystems to identify vulnerabilities, generate an SBOM, and provide risk-weighted prioritization.

Arguments

$ARGUMENTS

Instructions

Step 1: Determine scan path and detect ecosystems

SCAN_PATH="${1:-.}"
echo "========================================="
echo "DEPENDENCY VULNERABILITY SCAN"
echo "========================================="
echo "Scanning: $SCAN_PATH"
echo ""

echo "--- Ecosystem Detection ---"
HAS_NPM=false
HAS_PIP=false
HAS_MAVEN=false
HAS_PUB=false

[ -f "$SCAN_PATH/package.json" ] && HAS_NPM=true && echo "  npm ecosystem detected (package.json)"
[ -f "$SCAN_PATH/pyproject.toml" ] || [ -f "$SCAN_PATH/requirements.txt" ] && HAS_PIP=true && echo "  pip ecosystem detected"
[ -f "$SCAN_PATH/pom.xml" ] && HAS_MAVEN=true && echo "  Maven ecosystem detected (pom.xml)"
[ -f "$SCAN_PATH/pubspec.yaml" ] && HAS_PUB=true && echo "  pub.dev ecosystem detected (pubspec.yaml)"

if [ "$HAS_NPM" = false ] && [ "$HAS_PIP" = false ] && [ "$HAS_MAVEN" = false ] && [ "$HAS_PUB" = false ]; then
  echo "  No supported ecosystems detected. Supported: npm, pip, Maven, pub.dev"
  echo "  Ensure $SCAN_PATH contains package.json, pyproject.toml, requirements.txt, pom.xml, or pubspec.yaml."
  exit 1
fi
echo ""

Step 2: Run ecosystem-specific scanners

npm (NestJS / Angular)

if [ "$HAS_NPM" = true ]; then
  echo "--- npm Audit ---"
  cd "$SCAN_PATH"

  if ! command -v npm &>/dev/null; then
    echo "  [SKIP] npm not found. Install Node.js: https://nodejs.org/"
  else
    if command -v jq &>/dev/null; then
      npm audit --json 2>/dev/null | jq '.vulnerabilities | to_entries[] | {name: .key, severity: .value.severity, cvss: .value.cvss.score, fixAvailable: .value.fixAvailable}' 2>/dev/null || echo "  No vulnerabilities found or npm audit not available."
    else
      npm audit 2>/dev/null | grep -E "CRITICAL|HIGH|MODERATE|LOW" || echo "  No vulnerabilities found or npm audit not available."
      echo "  [NOTE] Install jq for structured JSON output: https://jqlang.github.io/jq/"
    fi
  fi
  echo ""
fi