- Home
- Static Application Security Testing Sast
- NodeJsScan
NodeJsScan
Vancouver, Canada
What it is
NodeJsScan is a static application security testing scanner for Node.js application code. Its detection engine is powered by libsast and Semgrep, and it offers a web interface, command-line interface, and Python API through njsscan. A local setup serves the web interface at http://127.0.0.1:9090. The CLI can produce JSON, SARIF 2.1.0, SonarQube, DefectDojo, GitLab SAST, and HTML output. Users can configure file types, ignored paths and rules, severity filters, and severity overrides in a .njsscan file. Documented pipeline integrations include GitHub Actions, GitHub Code Scanning, GitLab CI/CD, Travis CI, and CircleCI; alerts can be sent to Slack or email. Deployment options include a prebuilt Docker image or a locally built image. The software is free and open source under GPL-3.0. The current njsscan package requires Python 3.10 or newer and supports macOS and Linux. NodeJsScan version 4 onward no longer supports Windows. The project describes its use in CI/CD and DevSecOps pipelines.
For and against
For
- Offers CLI, web interface, and Python API
- Supports several CI/CD integrations
- Exports JSON, SARIF, and other report formats
- Allows custom rules and severity settings
Against
- Requires Python 3.10 or newer
- Current package supports macOS and Linux
- NodeJsScan version 4 onward dropped Windows support
The verdict
NodeJsScan combines source scanning with configurable rules, multiple report formats, and pipeline integrations. Its Python requirement and platform limits matter when choosing where to run it.
Who it suits
It suits teams scanning Node.js source as part of pull request reviews or CI/CD and DevSecOps pipelines. Users should be prepared to run it locally or with Docker on macOS or Linux.
Plans and prices
NodeJsScan
Open source · self-hosted · Docker or local setup
Read 8 Oct 2026 · github.com
On the record
- Alerts
- NodeJsScan supports Slack alerts using a webhook URL and email alerts using SMTP settings.github.com · read 8 Oct 2026
- CLI and API
- The project provides a command-line interface and a Python API through njsscan.github.com · read 8 Oct 2026
- Configuration
- Users can configure scanned file types, ignored paths and rules, severity filters, and severity overrides with a .njsscan file.github.com · read 8 Oct 2026
- Deployment
- The project documents running a prebuilt Docker image or building its Docker image locally.github.com · read 8 Oct 2026
- Detection engine
- It is powered by libsast and Semgrep.github.com · read 8 Oct 2026
- Integrations
- Documented CI/CD integrations include GitHub Actions, GitHub Code Scanning, GitLab CI/CD, Travis CI, and CircleCI.github.com · read 8 Oct 2026
- Intended users
- The project describes use in CI/CD and DevSecOps pipelines to scan Node.js application code.github.com · read 8 Oct 2026
- License
- The NodeJsScan repository identifies its license as GPL-3.0.github.com · read 8 Oct 2026
- Maintainer support
- The repository invites users to support the project through PayPal donations or sponsorship.github.com · read 8 Oct 2026
- Maker location
- OpenSecurity lists Bangalore, India and Vancouver, Canada as its locations.opensecurity.in · read 8 Oct 2026
- Output formats
- The CLI supports JSON, SARIF 2.1.0, SonarQube, DefectDojo, GitLab SAST, and HTML output.github.com · read 8 Oct 2026
- Purpose
- NodeJsScan is a static application security testing scanner for Node.js applications.github.com · read 8 Oct 2026
- Supported systems
- The current njsscan package requires Python 3.10 or newer and supports macOS and Linux; NodeJsScan version 4 onward dropped Windows support.github.com · read 8 Oct 2026
- Web interface
- The local setup runs a web user interface at http://127.0.0.1:9090.github.com · read 8 Oct 2026
