SOOS is an independent software security company, located in Winooski, VT USA, building security software for your team. SOOS, Software security, simplified.
Use SOOS to scan your software for vulnerabilities and open source license issues with SOOS Core SCA. Generate and ingest SBOMs. Export reports to industry standards. Govern your open source dependencies. Run the SOOS DAST vulnerability scanner against your web apps or APIs. Scan your Docker containers for vulnerabilities. Check your source code for issues with SAST Analysis.
Demo SOOS or Register for a Free Trial.
If you maintain an Open Source project, sign up for the Free as in Beer SOOS Community Edition.
NPM package to run SOOS Core SCA
Our full list of supported manifest formats can be found here.
Visit soos.io to create your trial account.
run npm i -g @soos-io/soos-sca@latest
Then Run soos-sca
from any terminal and add the parameters you want.
run npm install --prefix ./soos @soos-io/soos-sca
Then run from the same terminal node ./soos/node_modules/@soos-io/soos-sca/bin/index.js
See Script Knowlege Base Documentation
Argument | Default | Description |
---|---|---|
--apiKey |
SOOS API Key - get yours from SOOS Integration. Uses SOOS_API_KEY env value if present. |
|
--branchName |
The name of the branch from the SCM System. | |
--branchURI |
The URI to the branch from the SCM System. | |
--buildURI |
URI to CI build info. | |
--buildVersion |
Version of application build artifacts. | |
--clientId |
SOOS Client ID - get yours from SOOS Integration. Uses SOOS_API_CLIENT env value if present. |
|
--commitHash |
The commit hash value from the SCM System. | |
--directoriesToExclude |
**/node_modules/**, "**/bin/**", "**/obj/**", "**/lib/** |
Listing of directories or patterns to exclude from the search for manifest files. eg: bin/start/, /start/ |
--filesToExclude |
Listing of files or patterns to exclude from the search for manifest files. eg: /req.txt/, **/requirements.txt | |
--logLevel |
Minimum level to show logs: DEBUG, INFO, WARN, FAIL, ERROR. | |
--onFailure |
continue_on_failure |
Action to perform when the scan fails. Options: fail_the_build, continue_on_failure. |
--operatingEnvironment |
Set Operating environment for information purposes only. | |
--outputFormat |
Output format for vulnerabilities: only the value SARIF is available at the moment. | |
--packageManagers |
A list of package managers, delimited by comma, to include when searching for manifest files. | |
--projectName |
Project Name - this is what will be displayed in the SOOS app. | |
--sarif |
Generates SARIF report. | |
--scriptVersion |
None provided. | |
--sourceCodePath |
process.cwd() |
Root path to begin recursive search for manifests. |
--workingDirectory |
process.cwd() |
Absolute path where SOOS may write and read persistent files for the given build. eg Correct: /tmp/workspace/ |