js-vuln-auditor

Multi-language security auditor for React, Next.js, Node.js, Django, Flask, FastAPI, and any JS/TS or Python project. Auto-detects the project language(s), runs both pipelines in parallel when needed, and writes prioritized findings with fixes to fixme.md.

Install & Run

# No install — run directly
npx js-vuln-auditor

# Or install globally
npm install -g js-vuln-auditor
vuln-auditor

Python prerequisites (only needed for Python projects):

pip install pip-audit bandit

CLI Options

| Flag | Default | Description | | --------------------- | -------------------- | ------------------------- | | --path, -p <dir> | cwd | Project directory to scan | | --output, -o <file> | <project>/fixme.md | Report output path | | --skip-deps | — | Skip dependency audit | | --skip-ast | — | Skip ESLint AST analysis | | --help, -h | — | Show help |

Language Detection

The tool inspects the project root and auto-selects which pipelines to run:

| Signal | Pipeline triggered | | ------------------------------------------------------------------------------- | ------------------------------ | | package.json present | JS/TS pipeline | | requirements.txt, pyproject.toml, Pipfile, setup.py, or any *.py file | Python pipeline | | Both present (monorepo) | Both pipelines run in parallel |

What Gets Scanned

📦 Dependencies

Runs npm / yarn / pnpm audit, filters to high and critical CVEs, and maps the exact fix command per lockfile type.

🔑 Environment & Secrets

• .env tracked by Git
• Missing .gitignore entries (node_modules, .env)
• NODE_ENV=development or DEBUG=* in .env
• Real secrets committed in .env.example

💻 Static Code Analysis (18 rules)

| Rule | Severity | | ----------------------------------------------- | -------- | | eval() / new Function() | Critical | | child_process.exec with template literal | Critical | | Hardcoded secrets (password, token, api_key…) | Critical | | require() with user-controlled path | Critical | | fs methods with user input (path traversal) | Critical | | dangerouslySetInnerHTML | High | | innerHTML = | High | | document.write() | High | | Object.assign(req.body) (prototype pollution) | High | | Math.random() used for tokens/secrets | High | | localStorage storing JWT / session tokens | High | | cors({ origin: "*" }) wildcard | High | | window.location = userInput (open redirect) | High | | setTimeout("string") | High | | Unvalidated JSON.parse(req.body) | High | | Security TODO / FIXME / bypass comment | High |

🐍📦 Python Dependencies (pip-audit)

Invokes pip-audit against requirements.txt / requirements-dev.txt / pyproject.toml. Parses results from the OSV database, maps each CVE to a fix version, and links the advisory URL.

If pip-audit is not installed, the report flags a single HIGH finding with install instructions.

🐍💻 Python Source Flaw (bandit)

Runs bandit -r . -ll programmatically (medium severity and above). Ships with a 60+ rule fix-hint dictionary covering:

| Category | Examples | | ------------------- | --------------------------------------------------------------------------------------------- | | Injection | eval() (B307), subprocess shell=True (B602), os.system (B605), SQL string concat (B608) | | Deserialization | pickle.loads (B301), yaml.load (B506) | | Cryptography | MD5/SHA1 (B303), weak ciphers (B304), random for secrets (B311), small key sizes (B505) | | Framework | Flask DEBUG=True (B201), Django mark_safe (B308/B703), Jinja2 autoescape off (B701) | | Secrets | Hardcoded password (B105/B106/B107), binding 0.0.0.0 (B104) | | SSL/TLS | verify=False (B501), weak protocol versions (B502/B503), unverified host keys (B507) | | XML/XXE | All xml.* stdlib parsers (B313–B320) — recommends defusedxml |

🔍 AST / ESLint Analysis

Runs eslint-plugin-security and eslint-plugin-react programmatically — catches patterns regex misses: timing attacks, unsafe regex (ReDoS), object injection, react/jsx-no-script-url, react/jsx-no-target-blank.

⚙️ Framework Configs

| Target | Checks | | ---------------- | ------------------------------------------------------------------------------------- | | Next.js | poweredByHeader, missing CSP, ignoreBuildErrors: true, ignoreDuringBuilds: true | | Express | Missing helmet, no rate limiting, unbounded express.json() body size | | Webpack | Full source maps potentially enabled in production | | package.json | Wildcard deps (*, latest), curl\|bash in scripts, missing lockfile |

🐳 Docker Security (10 rules)

| Rule | Severity | | --------------------------------------------------- | -------- | | No USER directive (runs as root) | Critical | | Secrets in ENV or ARG | Critical | | curl / wget \| bash (pipe to shell) | Critical | | Sensitive file in COPY / ADD (.env, .pem…) | Critical | | ADD with remote URL (no checksum) | High | | Base image uses :latest tag | High | | chmod 777 | High | | No HEALTHCHECK | High | | apt-get install without --no-install-recommends | High | | Missing .dockerignore | High |

Output — fixme.md

# ⚠️ ACTION REQUIRED: Security Vulnerabilities Found

> Generated: 2026-06-05

## 📊 Summary

| Severity    | Count |
| ----------- | ----- |
| 🔴 Critical | 3     |
| 🟠 High     | 7     |

## 🔑 Environment & Secrets

### 1. [🔴 CRITICAL] `.env` is tracked by Git

- **Possible Fix:** `git rm --cached .env` then add to `.gitignore`. Rotate exposed secrets.

## 📦 Vulnerable Dependencies

### 1. [🔴 CRITICAL] lodash — Prototype Pollution

- **Possible Fix:** Run `npm audit fix`

## 💻 Source Code Flaw

### 1. [🔴 CRITICAL] RCE via eval()

- **Location:** `src/utils/parser.ts:42`
- **Possible Fix:** Replace with JSON.parse() or direct property access.

CI/CD Integration

# .github/workflows/security.yml
- name: Security Audit
  run: npx js-vuln-auditor --skip-ast

- name: Upload Report
  uses: actions/upload-artifact@v4
  if: always()
  with:
    name: security-report
    path: fixme.md

The process exits with code 1 if any high or critical issues are found.

Supported Frameworks

| Framework | Coverage | | ------------------------ | ----------------------------------------------------------------------------------------------- | | React | dangerouslySetInnerHTML, jsx-no-script-url, jsx-no-target-blank, localStorage tokens | | Next.js | poweredByHeader, CSP headers, ignoreBuildErrors, ignoreDuringBuilds | | Express / Node | helmet, rate limiting, body limits, child_process injection, fs path traversal | | Any JS/TS | eval, new Function, hardcoded secrets, prototype pollution, insecure random, CORS wildcards | | Flask | DEBUG=True (B201), SSTI via render_template_string, hardcoded secrets | | Django | mark_safe XSS (B308/B703), RawSQL injection (B611), extra() injection (B610) | | FastAPI / Any Python | eval, pickle, yaml.load, subprocess shell=True, weak crypto, hardcoded creds | | Docker | Root user, unpinned images, ARG secrets, curl \| bash, .dockerignore |

License

MIT