cli VS scorecard

📢 By the way NodeSecure CLI has a first-class support of the scorecard.

Those information are visible in the NodeSecure CLI interface:

@nodesecure/cli, a CLI that allow you to deeply analyze the dependency tree of a given package or local Node.js project

Fun fact: its first contribution 🐤 on NodeSecure was also on the old version of the code Scanner that managed vulnerabilities.

When NodeSecure was a single project the AST analysis was at most a few hundred lines in two or three JavaScript files. All the logic was coded with if and else conditions directly in the walker 🙈.

View on GitHub

NodeSecure can now detect packages created by Marak and it will generate a global warning ⚠️.

After more than ten long months of work we are finally there 😵! Version 0.9.0 has been released on npm 🚀.

Nsecure

For general open source hygiene, I'd recommend running OpenSSF scorecards on your github repo and following-up on anything it suggests. https://github.com/ossf/scorecard.

The OSSF scorecard initiative is really good to assess your project against security best practices. I am not the first to write about this.

Each area has its own associated risk, so the overall score is the average of the five areas. Here, you can check the details of each by consulting the documentation in detail.

Mitigation, according to Sean, is a combination of appropriate (network) access control, SCA (Software Composition Analysis) tooling to manage your policies around CVEs, and purging “all the things”. He also thinks MFA (multi-factor authentication) for authors of (critical) packages should be required. Sean gets his vulnerability insights from deps.dev, ossindex.sonatype, and cvedetails.com, and closely monitors interesting initiatives such as the OpenSSF Security Scorecards - a tool to assess open source projects for security risks through a series of automated checks.

Give feedback on new security standards: The various security standards like OpenSSF Scorecard and SLSA.dev can be a lot to digest, but they are likely going to be very influential in developing government standards. Take a peek at them, and if you have concerns or questions, file issues. The people behind them want to hear from a broad range of maintainers, so your feedback really does matter. (If you're a Tidelift maintainer partner, you can also bring the feedback to us—we are participating in these discussions, and may be able to either point to existing discussions, explain them more deeply, or bring your feedback to the appropriate places.)

Security Scorecards

I recommend using https://deps.dev to get a feeling for what you are bringing into your project. It also integrates with OSSF Scorecards, which gives a good overview over how healthy the project is, and whether it employs industry best practices.