npm audit

You will receive the following message if configuration is incomplete or incorrect:

IQ Server is required to use this feature with Nexus Repository Manager. You have the option to evaluate npm packages in the context of the repository or you can specify an application ID for each project.

You need to configure your npm project within Nexus Repository Manager to use the npm auditcommand. Details on the configuration of npm can be found in the Configuring npm section.

There are three different methods to evaluate your npm projects, described below. Each method is ordered in preference but may depend on your use case.

Creating a project local .npmrc file and adding the following lines:

headers[]="app_id:<application_id>"

<application_id> should be replaced with the application name in your IQ server you would like the audit to be conducted.

This approach unlocks the full functionality of npm audit by scanning against application-defined policies.

Running npm audit will produce a report listing the application policies that your build will violate, for example:

This method also unlocks the full functionality of npm audit you will need to provide the APP_ID parameter in the package-lock.json file. The value of this parameter should be one of the application ids from the IQ Server. You can inject the APP_ID into your package-lock.json or npm-shrinkwrap.json by adding a script to your package.json file.For example, using a script called add_id.sh:

app_id.sh

app_id.sh

node -p "fs = require('fs');fp = './' + (fs.existsSync('package-lock.json') ? 'package-lock.json' : 'npm-shrinkwrap.json');fs.writeFileSync(fp, JSON.stringify({...require(fp), APP_ID: '$npm_package_APP_ID'}, null, 2));"

package.json

package.json

{
  "name": "my-super-project",
  "version": "0.0.1",
  "description": "Test Project",
  "main": "index.js",
  "dependencies": {
    "debug": "^2.2.0",
    "qs": "^2.3.3"
  },
  "optionalDependencies": {
    "lodash": "2.4.2"
  },
 "APP_ID": "<APP_ID>",
 "scripts": {
    "postshrinkwrap": "bash app_id.sh"
  }
}

The result of npm install should be package-lock.json / npm-shrinkwrap.json, for example:

package-lock.json / npm-shrinkwrap.json

{
"name":"my-super-project",
"version":"0.0.1",
"lockfileVersion":1,
"requires":true,
"dependencies":{
"debug":{
"version":"2.6.9",
"resolved":"https://registry.npmjs.org/debug/-/debug-2.6.9.tgz",
"integrity":"sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==",
"requires":{
"ms":"2.0.0"
}
},
"lodash":{
"version":"2.4.2",
"resolved":"https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz",
"integrity":"sha1-+t2DS5aDBz2hebPq5tnA0VBT9z4=",
"optional":true
},
"ms":{
"version":"2.0.0",
"resolved":"https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
"integrity":"sha1-VgiurfwAvmwpAd9fmGF4jeDVl8g="
},
"qs":{
"version":"2.4.2",
"resolved":"https://registry.npmjs.org/qs/-/qs-2.4.2.tgz",
"integrity":"sha1-9854jld33wtQENp/fE5zujJHD1o="
}
},
"APP_ID":"<APP_ID>"
}

Running npm audit will produce a report listing the policies that your build will violate:

If you do npm audit without specifying an APP_ID in your package-lock.json or npm-shrinkwrap.json, NXRM will download and cache the packages before evaluating them. This may cause a short delay the first time a project is evaluated.

Using this method the report will be not as detailed as using APP_ID, but it will contain all policy violations under the root organization as shown here:

If you have configured an APP_ID then you can use npm audit fix to automatically remediate any vulnerable dependencies.