NodeJS static code security analysis

Use the ESLint security plugin to find out potential vulnerabilities in your nodejs code and the node security package (nsp) to find vulnerabilities in your dependencies. Here is a quickest way to get an idea where you are: Install eslint and the security plugin: Have a minimal eslint-sec.json file somewhere locally. Note that there is an issue I reported with one of the rules: Without messing with your project details use the plugin to get a report of where your code is in terms of common possible vulnerabilities:

eslint --no-eslintrc -c /path/to/eslint-sec.json /path/to/project/source/code/dir/

Here is a quick intro to nsp: Up to you to automate this and include it in your pipeline. No kidding, do it!