registry VS js-x-ray

More important than the namespace is who published the package. I'm more inclined to trust an individual I know who takes security than a namespace that may change hands.

NPM exposes that info in the _npmUser field: https://github.com/npm/registry/blob/master/docs/REGISTRY-AP.... That gives "name" (NPM username) and email.

While there are thousands of packages, I bet there's a much smaller number of publishers to worry about.

I can't find anything about it in their docs. https://github.com/npm/registry/blob/master/docs/REGISTRY-API.md

https://github.com/npm/registry/blob/master/docs/REGISTRY-API.md here are the docs. I was getting 122ms responses instead of 9000 on the old one.

My first instinct was to work with the public API of the npm registry. This sounds like a very good idea, but you will soon run into a set of problems (cache, private registry etc..).

There is no need to obtain an API key or token for querying NPM registry API. For the dashboard, I use only the endpoint that provides the data about a package downloads count - https://api.npmjs.org/downloads/. You can read more about it here.

While many people regularly use npm's website to discover packages, only a few know that npm also provides a public REST API accessible at registry.npmjs.org.

Or roll your own, docs here: https://github.com/npm/registry/blob/master/docs/download-counts.md

If you are new in town, JS-X-Ray is an open source JavaScript SAST (Static Application Security Testing). The tool analyzes your JavaScript sources for patterns that may affect the security and quality of your project 😎.

@nodesecure/js-x-ray, a SAST scanner (A static analyser for detecting most common malicious patterns)

I'm back at writing for a new technical article on NodeSecure. This time I want to focus on the SAST JS-X-Ray 🔬.

And it is happening right now. Github is opening the GitHub Advisory Database to community submissions. Awesome community NodeSecure builds cool things like scanner and js-x-ray. There are also lockfile-lint, LavaMoat, Jfrog-npm-tools (and I am sure there is more).

Static Analysis is powered by @nodesecure/js-x-ray and @nodesecure/scanner.

Execute NodeSecure/JS-X-Ray on each JavaScript files.

JS-X-Ray - SAST Scanner

I have been working every night of the week on a new major version of my open-source JavaScript SAST JS-X-Ray. I've been looking forward to making significant changes to the code for several months now...