---
id: njsscan
version: "1.0.0"
license: unclear
license_treatment: copyleft
maintenance: active
---

# njsscan — njsscan is a SAST tool that can find insecure code patterns in your Node.js applications.

License: copyleft · Maintenance: active · Downloads: 163.0K/mo

## What it is and what it does

njsscan combines two scanning approaches to find security issues in Node.js code: simple pattern matching via libsast and syntax-aware semantic analysis via semgrep. It detects common vulnerabilities like SQL injection, cross-site scripting (XSS), open redirects, and other OWASP-class issues. The tool runs from the command line or as a Python library, accepts configuration files to customize rules and ignore paths, and outputs results in multiple formats including JSON, SARIF, SonarQube, DefectDojo, GitLab SAST, and HTML.

The package is designed for developers and security teams integrating code scanning into development workflows. It supports suppressing individual findings via inline comments, filtering by severity level, and overriding rule severity. Runtime dependencies include colorama for terminal output, tabulate for formatted tables, and the two core scanning engines (libsast and semgrep), plus utilities for schema validation and SARIF report generation.

Use it for:

- Scan Node.js source code in CI/CD pipelines to catch security issues before deployment.
- Integrate into local development workflows to find insecure patterns during code review.
- Generate compliance-ready security reports in SonarQube, DefectDojo, or GitLab SAST formats.
- Suppress known false positives or acceptable patterns using inline comments and configuration files.
- Audit existing Node.js codebases for common vulnerabilities like SQL injection and XSS.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

njsscan is a static application security testing (SAST) tool that finds insecure code patterns in Node.js applications using pattern matching and semantic code analysis.

Yes, if you develop Node.js applications on Mac or Linux and want to integrate security scanning into your workflow. The tool is actively maintained, has no known vulnerabilities, and offers both CLI and Python API access. The LGPLv3+ license is a consideration for proprietary software; review your distribution model before use. Windows is not supported.

## Install

pip install njsscan
uv add njsscan
poetry add njsscan

## Installing njsscan

Before you install: Low install friction with a pure Python wheel. Actively maintained as of 2026-08-11 with recent releases. Requires Python 3.10 or later and runs on Mac and Linux only.

License in practice: Licensed under LGPLv3+, a copyleft license. Derivative works and modifications must be released under the same license; using this in proprietary software requires careful review of your distribution model.

Quickstart:

pip install njsscan

from njsscan.njsscan import NJSScan
scanner = NJSScan(['/path/to/node/code'], json=True)
scanner.scan()

Requires Python 3.10+ and runs only on Mac and Linux (not Windows).

Verify before relying:

- Whether semgrep and libsast dependencies are pre-installed or downloaded on first run, and any network/system requirements they impose.
- Performance characteristics and typical scan time for large Node.js codebases.
- Whether the tool can be integrated into CI/CD pipelines beyond the GitHub Actions example shown.

## Package facts

- License: not declared (copyleft)
- Python support: supports_current
- Install friction: low
- Maintenance: active
- Downloads: 163.0K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

node.js security scanning, sast tool javascript, static code analysis nodejs, vulnerability detection javascript, code pattern matching security, semgrep nodejs, insecure code patterns, security-scanning, nodejs, sast

[View on SkillFed](https://skillfed.io/packages/njsscan) · [View on PyPI](https://pypi.org/project/njsscan/)