NodeJSScan

NodeJSScan is a static security code scanner built specifically for Node.js applications.

With over 2,500 GitHub stars and 342 forks, it has become a trusted tool for finding security vulnerabilities in server-side JavaScript code.

The project provides both a web interface for manual analysis and a CLI tool (njsscan) designed for automated DevSecOps pipelines.

What is NodeJSScan?

NodeJSScan detects security vulnerabilities in Node.js applications through static analysis.

It scans your JavaScript and TypeScript source code for patterns that indicate security issues like SQL injection, command injection, insecure configurations, and sensitive data exposure.

The tool was created by Ajin Abraham, who also maintains Mobile Security Framework (MobSF).

The scanner uses semantic grep patterns powered by libsast to identify vulnerabilities with context awareness, reducing false positives compared to simple regex matching.

Each finding includes the exact code location and remediation guidance to help developers fix issues quickly.

Key Features

Web Interface

The NodeJSScan web UI lets you upload projects or scan Git repositories through a browser.

Results display with syntax highlighting, showing the exact vulnerable code with explanations of why it poses a risk and how to fix it.

The interface supports team collaboration with finding management and Slack notifications.

CLI Scanner (njsscan)

The njsscan command-line tool provides the same detection capabilities optimized for CI/CD integration.

It outputs JSON and SARIF formats for pipeline consumption and supports baseline files to suppress known issues.

Vulnerability Coverage

NodeJSScan detects a wide range of security issues including SQL injection, NoSQL injection, command injection, code injection, XSS vectors, insecure cryptography, hardcoded secrets, directory traversal, SSRF vulnerabilities, and insecure deserialization.

Rules are regularly updated to cover new vulnerability patterns.

Installation

Install the CLI scanner via pip or run the web interface with Docker:

# Install njsscan CLI
pip install njsscan

# Or use pipx for isolated installation
pipx install njsscan

# Run web interface with Docker
docker pull opensecurity/nodejsscan
docker run -p 9090:9090 opensecurity/nodejsscan

# Build from source
git clone https://github.com/ajinabraham/nodejsscan.git
cd nodejsscan
pip install -r requirements.txt
python manage.py runserver 0.0.0.0:9090

How to Use NodeJSScan

Scan your Node.js projects from the command line:

# Scan a directory
njsscan /path/to/nodejs/project

# Output as JSON for processing
njsscan --json -o results.json /path/to/project

# Generate SARIF for GitHub Code Scanning
njsscan --sarif -o results.sarif /path/to/project

# Scan only specific file extensions
njsscan --extensions .js,.ts /path/to/project

# Use baseline to suppress known issues
njsscan --baseline baseline.json /path/to/project

Integration

GitHub Actions

name: NodeJS Security Scan
on: [push, pull_request]

jobs:
  njsscan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run njsscan
        uses: ajinabraham/njsscan-action@master
        with:
          args: '. --sarif --output results.sarif || true'
      - uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: results.sarif

GitLab CI

nodejsscan:
  image: python:3.11
  before_script:
    - pip install njsscan
  script:
    - njsscan --json -o njsscan-report.json .
  artifacts:
    reports:
      sast: njsscan-report.json

Jenkins Pipeline

pipeline {
    agent any
    stages {
        stage('Security Scan') {
            steps {
                sh 'pip install njsscan'
                sh 'njsscan --json -o njsscan-report.json .'
            }
            post {
                always {
                    archiveArtifacts artifacts: 'njsscan-report.json'
                }
            }
        }
    }
}

When to Use NodeJSScan

NodeJSScan works well for teams building Express, Fastify, NestJS, or any Node.js backend applications.

It catches vulnerabilities that often slip through code review, particularly injection flaws and insecure configurations common in JavaScript codebases.

The tool fits into multiple stages of your development workflow.

Run the web interface locally during development for interactive analysis.

Add njsscan to pre-commit hooks for early feedback.

Integrate it into CI pipelines to gate deployments on security findings.

For larger organizations, the Docker deployment supports scanning across multiple projects with centralized results.

If you need broader JavaScript coverage including client-side code, consider pairing NodeJSScan with ESLint security plugins.

For commercial support and additional languages, tools like Semgrep or Snyk Code offer similar detection with enterprise features.