⚡ Node.js Ecosystem SCA CLI

Node.js Dependency Audit CLI: Fast, Zero-Dependency SCA for NPM

Q: How does Kevlar-CheckDeps differ from npm audit?

npm audit queries NPM's private registry. Kevlar-CheckDeps is an independent cross-platform CLI querying Google's public OSV database directly, supporting multiple Node.js lockfiles (package-lock.json, yarn.lock v1-v4, pnpm-lock.yaml), auditing cryptographic checksums, and breaking CI/CD builds with granular threshold policies without depending on Node.js.

Q: Do I need Python or NPM dependencies installed to use Kevlar-CheckDeps?

Kevlar-CheckDeps requires only Python 3.11 or higher using its standard library. Zero external PyPI or NPM packages are required. It operates directly by parsing static manifest and lockfile formats.

Q: How does Kevlar-CheckDeps query security vulnerabilities without an API Key?

Kevlar-CheckDeps interacts with the public Google OSV DB batch endpoint (POST /v1/querybatch). Instead of sending single requests for each package, Kevlar batches up to 1,000 dependencies into a single lightweight HTTP POST request without API keys or authentication.

Q: Can Kevlar-CheckDeps break CI/CD pipeline builds if vulnerabilities are detected in Node.js?

Yes. Kevlar-CheckDeps includes the --fail-on-vulns flag, returning exit code 1 to break CI/CD pipelines. You can configure granular severity limits (e.g., --fail-on-vulns 'critical:1,high:3') as well as failure policies for outdated or deprecated packages.

Audit direct and transitive dependencies in Node.js projects, detect vulnerabilities in the Google OSV database, and validate lockfile integrity—without external packages or API keys.

$ python kevlar.py --tech npm --path ./my-node-app --all --vuls

npm (`package-lock.json`) Yarn Berry (`yarn.lock` v1-v4) pnpm (`pnpm-lock.yaml`) Node.js Engine EOL

bash - kevlar-checkdeps (npm)

user@devsecops ~/my-node-app

$ python kevlar.py --tech npm --path . --all --vuls

[INFO] Detected Ecosystem: Node.js (npm)

[INFO] Reading package.json & package-lock.json...

[INFO] Checking 142 packages against Google OSV DB...

[INFO] Validating lockfile SHA-512 integrity hashes...

[ALERT] Checked: 142 packages in 1.84s.

Vulnerabilities: 3 (1 Critical, 2 High). Lockfile Weak Hash: 1.

Status: ❌ FAIL (Threshold Breach)

The Problem with Traditional SCA Tools in Node.js

Why do tools like Snyk or `npm audit` introduce friction into the DevSecOps workflow?

Traditional Tools

(Snyk / npm audit)

Limitations

Heavy Runtime & Dependency Overhead

Requires Node.js runtime and downloads hundreds of MB in `node_modules` just to audit security.
Mandatory Accounts & SaaS API Keys

SaaS platforms require registration, CI/CD secret token management, and uploading manifests to external servers.
Noisy & Imprecise Alerts

`npm audit` generates massive advisories without adaptable severity thresholds for pipelines (`--fail-on-vulns`).
No Cryptographic Lockfile Hash Auditing

Fails to verify if lockfile hashes have been tampered with or use weak/obsolete algorithms like SHA-1.

Kevlar-CheckDeps

(Node.js Audit)

Solution

Zero External Dependencies (Pure Python)

Runs on standard Python 3.11+ library. No `pip install` or `npm install` required.
Direct Batch Queries to Google OSV DB

Sends HTTP POST batch requests (`/v1/querybatch`) to audit up to 1,000 packages without credentials or API keys.
Multi-Package Manager Support (npm, Yarn, pnpm)

Audits `package-lock.json`, Yarn Berry (`yarn.lock` v1-v4), and pnpm (`pnpm-lock.yaml` v5-v9) without false positives.
100% Local Hash & Integrity Auditing

Cross-validates package signatures against the official npm registry while keeping source code 100% private.

Quick Usage Guide & Practical Example

How to run local scans, export executable reports, and integrate Kevlar into your CI/CD pipeline.

Full Local Scan

Audit direct and transitive dependencies while querying the Google OSV DB:

Scan Command:


                                        $ python kevlar.py --tech npm --path ./ --all --vuls

Export HTML / SARIF

Generate interactive HTML dashboards or standard SARIF v2.1.0 reports:

Report HTML:


                                            $ python kevlar.py --tech npm --path ./ --all --vuls --output report.html

Report SARIF:


                                            $ python kevlar.py --tech npm --path ./ --all --vuls --output report.sarif

CI/CD Build Breaking

Fail CI/CD pipelines automatically if severe vulnerabilities are detected:

Pipeline Command:


                                        $ python kevlar.py --tech npm --path ./ --all --vuls --fail-on-vulns "critical:1,high:2"

Quick Comparison Matrix

Compare Kevlar-CheckDeps with common alternatives in the Node.js ecosystem.

Feature / Criterion	Kevlar-CheckDeps Featured	npm audit	Snyk CLI	OWASP Dep-Check
Execution Speed	⚡ Ultra-fast (Multi-threaded & OSV Batch)	Medium Bound to npm CLI	Slow SaaS Cloud Analysis	Very Slow Full NVD Download
External Dependencies	Zero (Python 3.11+ Std Lib)	Requires Node.js / npm	Requires Node.js / CLI Binary	Requires Java Runtime (JRE)
API Keys / Accounts	Not Required (Public Google OSV)	Not Required	Mandatory (Account & SaaS Token)	Optional (NVD API Key)
Code & Manifest Privacy	100% Local Execution	Local / NPM Registries	Manifests Sent to SaaS	100% Local Execution
Lockfile Checksum Audit	Yes (SHA-1 & Mismatch Audit)	No	No	No
Cost & License	Free & Open Source (Apache 2.0 License)	Free (Bundled in npm)	Freemium / Commercial	Free & Open Source (Apache 2.0)

Frequently Asked Questions (FAQ)

Quick answers to common questions about Node.js dependency auditing.

Node.js Dependency Audit CLI: Fast, Zero-Dependency SCA for NPM

The Problem with Traditional SCA Tools in Node.js

Traditional Tools

Heavy Runtime & Dependency Overhead

Mandatory Accounts & SaaS API Keys

Noisy & Imprecise Alerts

No Cryptographic Lockfile Hash Auditing

Kevlar-CheckDeps

Zero External Dependencies (Pure Python)

Direct Batch Queries to Google OSV DB

Multi-Package Manager Support (npm, Yarn, pnpm)

100% Local Hash & Integrity Auditing

Quick Usage Guide & Practical Example

Full Local Scan

Export HTML / SARIF

CI/CD Build Breaking

Quick Comparison Matrix

Frequently Asked Questions (FAQ)

How does Kevlar-CheckDeps differ from npm audit? +

Do I need Python or NPM dependencies installed to use Kevlar-CheckDeps? +

How does Kevlar-CheckDeps query security vulnerabilities without an API Key? +

Can Kevlar-CheckDeps break CI/CD pipeline builds if vulnerabilities are detected in Node.js? +