njsscan

library0.4.3pypypi✓ verified 79d ago

njsscan is a Static Application Security Testing (SAST) tool designed to identify insecure code patterns within Node.js applications. It leverages the `semgrep` engine for its scanning capabilities. The library is actively maintained, currently at version 0.4.3, with frequent minor updates focusing on rule improvements, performance, and bug fixes.

testing auth-security

pip install njsscan

github ↗package ↗

INSTALL

IMPORT

SIG · NJSSCAN

njsscan

testingpythonv0.4.3

Install

14.5s avg

Import

—

Disk

557MB

Pass rate

10/ 10

Env Coverage10 / 10

glibc

3.9–3.13

musl

3.9–3.13

Install & Compatibility

Where this runs

tested against v0.4.3 · pip install

no network on importno background threads

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

py 3.10–3.920 runs

installs and imports cleanly · install 0.0s · import 0.000s · 559MB

glibc

py 3.10–3.920 runs

installs and imports cleanly · install 14.5s · import 0.000s · 623MB

557MB installed

● package 557MB

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

main

✓ import njsscan

✗ from njsscan import main

njsscan is primarily used as a command-line tool. This example demonstrates how to scan a Node.js project located at `./my_nodejs_project` and output the results to a JSON file.

njsscan -p ./my_nodejs_project -o results.json -f json cat results.json

njsscan --version

Debug

Known issues

gotchanjsscan relies on the `semgrep` tool being installed separately and available in your system's PATH. Without `semgrep`, njsscan will not be able to perform scans and will likely report 'semgrep: command not found' errors.

fix

Ensure `semgrep` is installed (e.g., `pip install semgrep` or via official `semgrep` installation methods) and its executable is accessible in your system's PATH.

affects: All versions

breakingSupport for Python 3.6 was dropped in version 0.3.2. Users on Python 3.6 will encounter compatibility errors.

fix

Upgrade to Python 3.7 or newer. The library is tested against recent Python versions.

affects: >=0.3.2

gotchaOlder versions of njsscan (prior to 0.3.6) may exhibit significantly slower performance, especially on large Node.js projects, due to less optimized underlying library versions.

fix

Upgrade to the latest version of njsscan (0.3.6 or newer) to benefit from performance improvements and updated underlying dependencies like `libsast` and `semgrep`.

affects: <0.3.6

gotchaEarly versions of njsscan might have had compatibility issues or suboptimal performance on M1 Mac (ARM) architectures. Full support and testing for M1 Mac ARM was explicitly added in version 0.3.2.

fix

Upgrade to njsscan version 0.3.2 or newer to ensure full compatibility and optimized performance on M1 Mac ARM systems.

affects: <0.3.2

Upgrade

Version history

0.4.3latest on PyPI · released Nov 14, 2024

Audit

Dependencies

semgreprequirednjsscan is a wrapper around the `semgrep` static analysis engine. `semgrep` must be installed separately and available in the system's PATH for njsscan to function.

Agent activity

12 hits · last 30 days

node

OpenAI (training)

Resources

githubhttps://github.com/ajinabraham/njsscan ↗

packagehttps://pypi.org/project/njsscan/ ↗