Minder

A Node application to audit project dependencies with security issues before they make it into production

Overview

minder is a wrapper for npm audit and yarn audit.
You can configure minder to call either npm audit or yarn audit and set it to fail CI builds or a pre-commit hook if the audit finds packages with security issues matching your configured severity level.
You can also output the results to an HTML report courtesy of npm-audit-html and yarn-audit-html.

Getting Started

Usage: minder

You can create a config file to commit with your project. minder looks for a file named minder.config.json in the current working directory from which the script was called.
Example:

{
  "severity": "high",
  "report": true,
  "html-report-filepath": "audit-report.html",
  "registry": "https://registry.npmjs.org/",
  "whitelisted-advisories": ["803"]
}

Explaination of options

Option	Description
severity	configure what severity you would like to fail on. Must be one of: "info", "low", "moderate", "high" or "critical"
package-manager	choose what package manager audit endpoint to use. Must be one of: "npm" or "yarn"
registry	choose what registry URL the audit payload will be sent to
report	choose to output a HTML report of the audit results. Must be one of: true or false
html-report-filepath	set a custom file name of HTML report, only applicable if "report" is set to true
audit-fail-build	sets the exit code to 1 when true or 0 when false. Must be one of: true or false
whitelisted-advisories	array of advisory IDs to allow/ignore. Must be an array of strings

If no config file is passed then the following defaults will be used:

Option	Default value
severity	"critical"
package-manager	"npm"
registry	""
report	false
html-report-filepath	""
audit-fail-build	false
whitelisted-advisories	[]

Add a plugin

You can also extend functionality by writing your own plugin. minder looks for a file named minder-plugin.js in the current working directory from which the script was called.
The audit response is passed as the first parameter and the config overrides as the second.

Example:

module.exports = function minderPlugin(data, config) {
  console.log(`Do something with: ${data} and ${config}`);
};

Built With

• npm-audit-html - NPM Audit HTML Report Generator
• yarn-audit-html - Yarn Audit HTML Report Generator
• npm-run - Runs locally-installed node module executables. Used to trigger the HTML Reports

License

This project is licensed under the MIT License - see the LICENSE file for details