dependency-vulnerability-scanner

name	dependency_vulnerability_scanner
description	Analyze /root/package-lock.json to identify HIGH and CRITICAL vulnerabilities using automated security audit tools and database lookups.

1. Execute npm audit --json or audit-ci on /root/package-lock.json to generate a report of dependency vulnerabilities.
2. Filter the raw output to retain only vulnerabilities with severity set to high or critical.
3. For each identified vulnerability, extract the following:
   • Package: The name of the vulnerable package.
   • Version: The installed version found in the dependency tree.
   • CVE ID: The CVE identifier associated with the vulnerability.
   • Severity: The level (High or Critical).
   • CVSS Score: Retrieve the score by prioritizing sources in the order: NVD -> GHSA -> RedHat. Parse the nested cvss object specifically looking for cvssV3.baseScore or cvssV3.score. If unavailable, search for cvssV2.score.
   • Fixed Version: The first version where the patch is applied; if no patch is available, record as "N/A".
   • Title/Description: A summary of the vulnerability.
   • Url: The reference link provided by the audit source.
4. Format the extracted data into a CSV structure exactly matching: Package,Version,CVE_ID,Severity,CVSS_Score,Fixed_Version,Title,Url.