snyk-to-html

library3.7.1jsnpmunverified

snyk-to-html is a Node.js utility designed to convert the JSON output from various Snyk CLI commands (e.g., `snyk test --json`, `snyk code test --json`, `snyk iac test --json`, `snyk container test --json`) into a human-readable, static HTML vulnerability report. The current stable version is 3.7.1, released in April 2026. The package sees a relatively active release cadence, often featuring bug fixes, security updates, and new features like adding support for exploit maturity, reachability signals, and risk scores. A key differentiator is its ability to accept custom Handlebars templates, allowing users to tailor the report's appearance and included data fields. It is primarily used as a CLI tool but also exposes a programmatic API for integration into automated workflows.

devops testing

npm install snyk-to-html

github ↗package ↗homepage ↗

INSTALL

IMPORT

SIG · SNYK-TO-HTML

snyk-to-html

devopsjavascriptv3.7.1

Install

—

Import

—

Disk

—

Pass rate

0/ 6

Env Coverage0 / 6

glibc

18–22

musl

18–22

Install & Compatibility

Where this runs

tested against v? · npm install

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

node 18–226 runs

build_error

glibc

node 18–226 runs

build_error

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

convertToHtml

✓ import { convertToHtml } from 'snyk-to-html';

✗ const convertToHtml = require('snyk-to-html').convertToHtml;

This is the primary function for programmatic conversion. It's an ESM-first package requiring Node.js >=20.

SnykToHtmlOptions

✓ import type { SnykToHtmlOptions } from 'snyk-to-html';

Type definition for the options object passed to `convertToHtml`.

CLI usage (global)

✓ snyk-to-html -i input.json -o report.html

✗ node snyk-to-html -i input.json

The tool is primarily designed for global CLI use after `npm install -g snyk-to-html`. Direct execution via `node` requires specifying the full path to the executable or the main script.

Demonstrates programmatic conversion of Snyk JSON output into an HTML report using the `convertToHtml` function.

import { convertToHtml } from 'snyk-to-html'; import * as fs from 'fs'; const mockSnykJsonOutput = { "vulnerabilities": [ { "id": "SNYK-JS-LODASH-590135", "title": "Prototype Pollution", "severity": "high", "description": "The 'merge' function in lodash is vulnerable to prototype pollution via the 'assignValue' function.", "packageManager": "npm", "packageName": "lodash", "version": "4.17.15", "fixedIn": ["4.17.21"], "exploitMaturity": "mature" } ], "vulnerabilities": [], "dependencyCount": 1, "org": "my-org", "policy": "Snyk Security Policy", "isPrivate": true, "summary": "No vulnerabilities found.", "uniqueCount": 0, "filesystemPolicy": false, "licensesPolicy": null }; async function generateReport() { try { const htmlReport = await convertToHtml(JSON.stringify(mockSnykJsonOutput), { title: 'Snyk Security Report', // template: fs.readFileSync('./custom-template.hbs', 'utf8') // Optional: use a custom Handlebars template }); fs.writeFileSync('snyk-report.html', htmlReport); console.log('HTML report generated: snyk-report.html'); } catch (error) { console.error('Failed to generate report:', error); } } generateReport();

snyk-to-html --version

Debug

Known issues

breakingNode.js 20 or higher is required. Older Node.js versions are not supported.

fix

Upgrade your Node.js environment to version 20 or later using a tool like nvm or fnm.

affects: <3.0.0

breakingThe package transitioned to an ESM-first architecture, meaning CommonJS `require()` statements may not work directly for programmatic imports without configuration.

fix

Use ESM `import` syntax (`import { convertToHtml } from 'snyk-to-html';`) and ensure your project is configured for ESM (e.g., `"type": "module"` in `package.json`). For CommonJS, dynamic import (`import('snyk-to-html')`) might be required.

affects: >=3.0.0

gotchaCustom Handlebars templates may require updates if new data fields (e.g., `exploitMaturity`, `reachability`, `riskScore`, `epssDetails`) are introduced or existing ones change their structure.

fix

Review the `metadata` object structure in the documentation for each new major or minor version if you use custom templates. Use `{{#if metadata.fieldName}}` guards to prevent errors if fields are optional or absent.

affects: >=3.4.0

breakingA Handlebars vulnerability (CVE-2026-33937O) was patched. Ensure you are on the latest patch version to mitigate potential security risks.

fix

Update `snyk-to-html` to version 3.7.1 or newer (`npm update snyk-to-html`).

affects: <3.7.1

Errors

Common errors & fixes

snyk-to-html: command not found

The `snyk-to-html` executable is not in your system's PATH, usually because it wasn't installed globally or its global installation path isn't correctly configured.

fix

Install the package globally: `npm install -g snyk-to-html` or ensure your PATH includes `$(npm config get prefix)/bin`.

Error: Handlebars: Input is not a string

The input provided to the templating engine, either directly or via the `convertToHtml` function, was not a valid string.

fix

Ensure the Snyk JSON output is provided as a string. If using `convertToHtml`, `JSON.stringify()` the object before passing it.

TypeError: Cannot read properties of undefined (reading 'vulnerabilities')

The provided Snyk JSON input is malformed or not in the expected format, causing the report generator to fail when trying to access properties.

fix

Verify that the input JSON is valid Snyk CLI output. You can use `snyk test --json > output.json` and then validate `output.json` before passing it to `snyk-to-html`.

Upgrade

Version history

3.7.1latest on npm

Audit

Dependencies

handlebarsrequiredUsed for templating the HTML reports. Recent releases have patched vulnerabilities related to this dependency.

Agent activity

5 hits · last 30 days

node

Resources

githubhttps://github.com/snyk/snyk-to-html ↗

packagehttps://www.npmjs.com/package/snyk-to-html ↗

homepagehttps://snyk.io ↗