dependonme

Informed about the actuality and security of used npm packages

Please note: The solution is still under development and undergoing early adopter testing. Feel free to test with up to 20 registered client applications; however, please be aware that no functionality is guaranteed at this stage.

Integrate DependOnMe into your application to effectively track dependencies defined and installed client-side.
Triggered by npm postinstall, DependOnMe gathers information from the client's node runtime, package.json and package-lock.json, transmitting it to the DependOnMe Server.

After an application got registered, you will receive periodic emails containing available updates and potential security risks related to your dependencies.

The web interface allows you to check the status of your applications at any time and manage all your registered packages conveniently. Access the platform at dependonme.ch.

Usage / Install

Register

To use DependOnMe, you will have to register with your email address first. This must be done here: dependonme.ch.

Install

Define dependonme as a dependency of your application in your package.json.

"dependencies": {
    "dependonme": "^0.2.0"
}

Alternatively, you can install it with:

npm install dependonme

To get DependOnMe executing autonomously after every execution of npm install, you have to add the following line to the "scripts" property of your package.json file.

  "postinstall": "node ./node_modules/dependonme/index.js",

Configuration

It is important to configure DependOnMe correctly. You will find everything regarding its configuration in the package.json of your application.
An property called "dependonme" is the home of all mandatory and optional parameters.

Mandatory

"accountMail": "[e-mail]", (string)

• Provide the email address you registered with on DependOnMe.

Optional

"uuid": "fxxxxxxf-4xxf-4xx4-bxx9-2xxxxxxxxxx0" (string)

• The DependOnMe UUID is a unique identifier for your client application combination.
• After you first connect your client application with the server, this UUID gets automatically added to your package.json.
• If you want to specifically update data from an already registered client, copy the UUID found in the web interface and provide it here.

"forceNew": true (default: false) (boolean: true, false)

• When you register or send additional data of an application installed on a client, DependOnMe checks if it already exists.
• This is done by comparing the information provided with existing registered applications (MAC address, OS hostname, OS platform, application name, and account).
• In case there is a match, this is prompted in your console.
• Set "forceNew" to true if you want to force a new registration and get a new UUID.

"server": "https://mycustomserverexample.com" (default: https://dependonme.ch) (string)

• This Parameter defines the address of the central DependOnMe server your application sends the information to.
• For testing purposes and feature use, a custom server can be specified

Notification settings:

"vulnerability": "low" (default: "moderate") (string enum: "low", "moderate", "high", "critical")

• This option sets the minimum severity of vulnerabilities you want to be actively notified about.

"updates-defined": true (default: true) (boolean: true, false)

• This option sets whether you want to be actively notified about available updates of packages you defined in your package.json or not.

"updates-installed": true (default: false) (boolean: true, false)

• This option sets whether you want to be actively notified about available updates of packages you installed on the registered client (package-lock.json) or not.

"frequency": "daily" (default: "weekly") (string enum: "daily", "weekly", "monthly")

• This option sets how often you want to be notified via email about the latest findings of DependOnMe for your registered application.

Example

This is an example of how your first package.json with a correct DependOnMe configuration could look:

{
  "name": "app-example",
  "version": "1.2.3",
  "description": "Application with example configuration",
  "main": "index.js",
  "scripts": {
    "start": "node index.js",
    "postinstall": "node ./node_modules/dependonme/index.js"
  },
  "dependonme": {
    "accountMail": "[e-mail]"
  },
  "author": "ragetetechnik",
  "dependencies": {
    "dependonme": "^0.2.0"
  }
}

If you already registered your application, got your uuid and configured all optional parameters, the package.json will contain much more information and could look like the following example:

{
  "name": "app-example",
  "version": "1.2.3",
  "description": "Application with example configuration",
  "main": "index.js",
  "scripts": {
    "start": "node index.js",
    "postinstall": "node ./node_modules/dependonme/index.js"
  },
  "dependonme": {
    "accountMail": "[e-mail]",
    "uuid": "fxxxxxxf-4xxf-4xx4-bxx9-2xxxxxxxxxx0",
    "vulnerability": "low",
    "updates-defined": true,
    "updates-installed": false,
    "frequency": "daily",
    "forceNew": false,
    "server": "https://mycustomserverexample.com"
  },
  "author": "ragetetechnik",
  "dependencies": {
    "dependonme": "^0.2.0"
  }
}

Hints

You can find important information about the actions of DependOnMe in your console after you run npm install.

Directly use the command npm postinstall to only send data to DependOnMe without changing your local installation.

If you install your application on a system without access to the default or defined server, DependOnMe provides you with a batch script containing all important information for a later registration.
Check the output of the console in that case for further instructions.

ISC License

Copyright © 2023 Simon Dietrich

Permission to use, copy, modify, and/or distribute this software for any purpose with or without fee is hereby granted, provided that the above copyright notice and this permission notice appear in all copies.

THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.