{"categories":[{"label":"Quality Assurance","url":"https://skillfed.io/packages/category/software-development-quality-assurance/3"}],"enrichment":{"capability":"njsscan is a static application security testing (SAST) tool that finds insecure code patterns in Node.js applications using pattern matching and semantic code analysis.","skillfed_tags":["security-scanning","nodejs","sast"],"use_cases":["Scan Node.js source code in CI/CD pipelines to catch security issues before deployment.","Integrate into local development workflows to find insecure patterns during code review.","Generate compliance-ready security reports in SonarQube, DefectDojo, or GitLab SAST formats.","Suppress known false positives or acceptable patterns using inline comments and configuration files.","Audit existing Node.js codebases for common vulnerabilities like SQL injection and XSS."],"what_it_does":"njsscan combines two scanning approaches to find security issues in Node.js code: simple pattern matching via libsast and syntax-aware semantic analysis via semgrep. It detects common vulnerabilities like SQL injection, cross-site scripting (XSS), open redirects, and other OWASP-class issues. The tool runs from the command line or as a Python library, accepts configuration files to customize rules and ignore paths, and outputs results in multiple formats including JSON, SARIF, SonarQube, DefectDojo, GitLab SAST, and HTML.\n\nThe package is designed for developers and security teams integrating code scanning into development workflows. It supports suppressing individual findings via inline comments, filtering by severity level, and overriding rule severity. Runtime dependencies include colorama for terminal output, tabulate for formatted tables, and the two core scanning engines (libsast and semgrep), plus utilities for schema validation and SARIF report generation.","worth_installing":"Yes, if you develop Node.js applications on Mac or Linux and want to integrate security scanning into your workflow. The tool is actively maintained, has no known vulnerabilities, and offers both CLI and Python API access. The LGPLv3+ license is a consideration for proprietary software; review your distribution model before use. Windows is not supported."},"id":"njsscan","links":{"html":"https://skillfed.io/packages/njsscan","md":"https://skillfed.io/packages/njsscan.md","pypi":"https://pypi.org/project/njsscan/"},"maintenance":{"status":"active"},"meta":{"latest_release":"2026-08-11","license_spdx":null,"license_treatment":"copyleft","name":"njsscan","python_support":"supports_current","summary":"njsscan is a SAST tool that can find insecure code patterns in your Node.js applications."},"popularity":{"monthly_downloads":163023,"position":10580,"tier":"top_15000"},"security":{"n_vulnerabilities":0},"version":"1.0.0"}