Detecting dependency vulnerabilities

Throughout this book, we’ve leveraged modules from the npm registry to form a foundation for the applications we build. We’ve learned how the vast module ecosystem enables us to focus on application logic and not have to reinvent common technical solutions repeatedly.

This ecosystem is key to Node.js’s success. However, it does lead to large, nested dependency trees within our applications. Not only must we be concerned with the security of the application code that we write ourselves, but we must also consider the security of the code included in the modules in our dependency tree. Even the most mature and popular modules and frameworks may contain security vulnerabilities.

In this recipe, we’ll demonstrate how to detect vulnerabilities in a project’s dependency tree.

Getting ready

For this recipe, we’ll create a directory named audit-deps where we can install some Node.js modules:

$ mkdir...