Detecting dependency vulnerabilities

Thanks to the wealth of modules on npm, we're able mostly focus on application logic, relying on the ecosystem for canned solutions. This does, however, lead to large dependency trees and security vulnerabilities can be discovered at any time, even for the most conscientious, mature, and popular modules and frameworks.

In this recipe, we will demonstrate how to detect vulnerabilities in a project's dependency tree.

Getting ready

We'll create a folder called app, initialize it as a package, and install express:

$ mkdir app
$ cd app
$ npm init -y 
$ npm install express

We don't need to add any of our own code since we're only checking dependencies.

How to do it...

We're going to use auditjs to automatically check our dependency tree against vulnerability databases.

Let's install auditjs into our project app folder:

$ npm install --save-dev auditjs

Now let's add a field to the scripts object in the package.json file:

  "scripts": {
     "test": "echo \"Error: no test...