Node-Protect 🛡️

A lightweight, zero-config security scanner for Node.js applications.
Detects vulnerabilities from the OWASP Top 10 without blocking your workflow.

🚀 Key Features

• Non-blocking: Runs in the background and warns you about issues. It never crashes your app.
• Zero Config: Works out of the box. Just install and run.
• Comprehensive Coverage: Checks for issues across the OWASP Top 10 (2021).

What it Checks

| Category | Description | | :--- | :--- | | A01 Broken Access Control | Permissive CORS, hardcoded role checks | | A02 Cryptographic Failures | Weak hashing (MD5/SHA1), hardcoded IVs | | A03 Injection | eval(), innerHTML, unsafe SQL interpolation | | A04 Insecure Design | Leaky headers (X-Powered-By) | | A05 Misconfiguration | Debug mode on, hardcoded ports | | A06 Vulnerable Components | Wraps npm audit to check dependencies | | A07 Authentication Failures | Hardcoded Secrets (AWS keys, API tokens, passwords) | | A08 Integrity Failures | Missing SRI, integrity checks | | A09 Logging Failures | console.log usage, empty catch blocks | | A10 SSRF | Unsafe data fetching in axios/fetch |

📦 Installation

Install as a development dependency:

npm install --save-dev node-protect

💻 Usage

1. As a CLI Tool

Great for CI/CD pipelines or local checks.

# Scan current directory
npx protect scan .

# Scan specific folder
npx protect scan ./src

# Scan only for secrets and code issues (skip dependencies)
npx protect scan . --type=secrets,code

2. As a Library (Programmatic)

Perfect for adding a security check to your server startup sequence. It runs asynchronously ("fire-and-forget").

Example: Express Server Integration

/* index.js */
const http = require('http');
const { protect } = require('node-protect');

console.log('--- Server Startup ---');

// 1. Run security scan in background
// It will log warnings if found, but won't stop the server
protect();

// 2. Start your server immediately
http.createServer((req, res) => {
    res.writeHead(200);
    res.end('Hello Secure World!');
}).listen(3000, () => {
    console.log('Server running on port 3000');
});

Custom Handling

If you want to wait for results or handle them manually:

const { protect, printReport } = require('node-protect');

// Await the results
protect(process.cwd(), { types: ['full'], log: false }).then(results => {
  if (results.length > 0) {
    console.error(`🚨 Found ${results.length} vulnerabilities!`);
    printReport(results); // Pretty print to console
    // process.exit(1); // Optional: Exit if you want to block
  } else {
    console.log('✅ App is secure.');
  }
});

🛠️ Configuration

The protect() function accepts an options object:

interface ScanOptions {
    log?: boolean;       // Default: true (Auto-print warnings to console)
    types?: string[];    // Default: ['full']. Options: 'secrets', 'code', 'dependencies'
}

📝 License

ISC