nodejs/is-my-node-vulnerable

nodejsscan is a static security code scanner for Node.js applications.

High fidelity detection mechanism for node2shell (CVE-2026-111497)

NPMscan MCP Plugin

JavaScript security CLI that allow you to deeply analyze the dependency tree of a given package or local Node.js project.

GitHub Action that detects the Shai-Hulud 2.0 (Nov 2025) and ChainDrop (Aug 2026) npm supply-chain attacks. Scans dependencies, lockfiles and CI workflows against a daily-updated database of 1,200+ compromised packages, flags malicious install scripts, TruffleHog secret theft and SHA1HULUD runners. SARIF output for GitHub Code Scanning.

njsscan is a semantic aware SAST tool that can find insecure code patterns in your Node.js applications.

scanner detecting the use of JavaScript libraries with known vulnerabilities. Can also generate an SBOM of the libraries it finds.

A simple project to detect the Shai-Hulud npm supply chain attack

deptrust is a CLI that checks package versions for known vulnerabilities across npm, PyPI, crates.io, Go modules, RubyGems, NuGet, Maven, Packagist, pub.dev, CocoaPods, Hex.pm, Hackage, GitHub Actions, and more. It runs locally as a CLI and as an MCP server, comes with a skill, and a hook.