Dependency Vulnerability Scanning - Complete Guide

# NPM Audit Commands

# 1. Basic audit
npm audit

# 2. Audit with fix
npm audit fix

# 3. Audit with force fix
npm audit fix --force

# 4. Audit production only
npm audit --production

# 5. Audit with JSON output
npm audit --json

# 6. Audit specific package
npm audit package-name

# 7. Audit with registry
npm audit --registry https://registry.npmjs.org/

# 8. Audit with audit-level
npm audit --audit-level moderate

# 9. Audit with dry-run
npm audit fix --dry-run

# 10. Audit with verbose output
npm audit --verbose

# 11. Audit with fix strategy
npm audit fix --audit-level high

# 12. Audit with package-lock
npm audit --package-lock-only

# 13. Audit with fund
npm audit --fund

# 14. Audit with audit-level critical
npm audit --audit-level critical

# 15. Audit with fix and fund
npm audit fix --fund

# Yarn Audit Commands

# 1. Basic audit
yarn audit

# 2. Audit with fix
yarn audit --fix

# 3. Audit with level
yarn audit --level moderate

# 4. Audit with groups
yarn audit --groups dependencies

# 5. Audit with registry
yarn audit --registry https://registry.yarnpkg.com/

# 6. Audit with verbose
yarn audit --verbose

# 7. Audit with JSON output
yarn audit --json

# 8. Audit with summary
yarn audit --summary

# 9. Audit with recursive
yarn audit --recursive

# 10. Audit with pattern
yarn audit --pattern "react*"

# 11. Audit with exclude
yarn audit --exclude "devDependencies"

# 12. Audit with ignore
yarn audit --ignore "lodash"

# 13. Audit with fix and level
yarn audit --fix --level high

# 14. Audit with groups and level
yarn audit --groups dependencies --level moderate

# 15. Audit with recursive and fix
yarn audit --recursive --fix

# Advanced Security Tools

# 1. Snyk Security Scanner
# Install Snyk
npm install -g snyk

# Authenticate
snyk auth

# Test for vulnerabilities
snyk test

# Monitor project
snyk monitor

# Fix vulnerabilities
snyk fix

# 2. OWASP Dependency Check
# Install dependency-check
npm install -g dependency-check

# Run dependency check
dependency-check package.json

# 3. Retire.js
# Install retire
npm install -g retire

# Run retire scan
retire

# 4. Audit-ci
# Install audit-ci
npm install -g audit-ci

# Run audit-ci
audit-ci --config audit-ci.json

# 5. npm-audit-resolver
# Install resolver
npm install -g npm-audit-resolver

# Resolve audit issues
npm-audit-resolver

# 6. Security audit with custom config
# .auditrc
{
  "audit-level": "moderate",
  "fix": true,
  "force": false
}

# 7. GitHub Security Advisories
# Enable Dependabot
# .github/dependabot.yml
version: 2
updates:
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "weekly"

# 8. GitLab Security Scanning
# .gitlab-ci.yml
security_scan:
  stage: test
  script:
    - npm audit
    - yarn audit

# 9. Jenkins Security Plugin
# Jenkinsfile
pipeline {
  agent any
  stages {
    stage('Security Scan') {
      steps {
        sh 'npm audit'
        sh 'yarn audit'
      }
    }
  }
}

# 10. Custom security script
# security-scan.js
const { execSync } = require('child_process');

try {
  execSync('npm audit --audit-level moderate', { stdio: 'inherit' });
  console.log('Security scan passed');
} catch (error) {
  console.error('Security vulnerabilities found');
  process.exit(1);
}

# CI/CD Security Integration

# 1. GitHub Actions Security
# .github/workflows/security.yml
name: Security Scan
on: [push, pull_request]
jobs:
  security:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v3
    - uses: actions/setup-node@v3
      with:
        node-version: '18'
    - run: npm ci
    - run: npm audit --audit-level moderate
    - run: npm audit fix

# 2. GitLab CI Security
# .gitlab-ci.yml
security_scan:
  stage: test
  script:
    - npm ci
    - npm audit --audit-level moderate
    - npm audit fix
  only:
    - main
    - develop

# 3. Jenkins Security Pipeline
# Jenkinsfile
pipeline {
  agent any
  stages {
    stage('Security Scan') {
      steps {
        sh 'npm ci'
        sh 'npm audit --audit-level moderate'
        sh 'npm audit fix'
      }
    }
  }
}

# 4. Azure DevOps Security
# azure-pipelines.yml
trigger:
- main
pool:
  vmImage: 'ubuntu-latest'
steps:
- task: NodeTool@0
  inputs:
    versionSpec: '18.x'
- script: |
    npm ci
    npm audit --audit-level moderate
    npm audit fix
  displayName: 'Security Scan'

# 5. CircleCI Security
# .circleci/config.yml
version: 2
jobs:
  security:
    docker:
      - image: node:18
    steps:
      - checkout
      - run: npm ci
      - run: npm audit --audit-level moderate
      - run: npm audit fix