npm-vulnerability-scanning

name	npm-vulnerability-scanning
description	Scan npm package-lock.json files for vulnerabilities using Trivy in offline mode. Extracts HIGH and CRITICAL severity vulnerabilities with detailed metadata (CVE, CVSS, fix versions). Use this skill whenever you need to audit npm dependencies for security issues, especially when an offline vulnerability database is available.

NPM Vulnerability Scanning with Trivy

Overview

This skill enables security scanning of npm package-lock.json files using Trivy's offline mode. It focuses on extracting HIGH and CRITICAL severity vulnerabilities with complete metadata.

Prerequisites

• Trivy installed and available in PATH
• Trivy database cached locally (or downloadable)
• npm package-lock.json file to scan
• jq or Python for JSON parsing

Workflow

1. Verify Trivy Installation and Database

trivy version
trivy db info

Check that the vulnerability database is available. If not cached, Trivy can download it during the first scan.

2. Scan package-lock.json

Run Trivy with JSON output for programmatic processing:

trivy config /root/package-lock.json \
  --format json \
  --severity HIGH,CRITICAL \
  --output /tmp/trivy_results.json

Key flags:

• --format json: Machine-readable output
• --severity HIGH,CRITICAL: Filter to target severity levels only
• --scanners vuln: Focus on vulnerability scanning
• --offline-db: Use offline database (if available)

3. Parse and Extract Vulnerability Data

The JSON output contains nested results. Extract this structure:

Results[].Vulnerabilities[] → {
  VulnerabilityID (CVE ID),
  Severity,
  Title,
  Description,
  CVSS scores (multiple sources),
  FixedVersion,
  PkgName,
  InstalledVersion,
  References[] (URLs)
}

4. Handling Multiple CVSS Score Sources

Trivy reports CVSS scores from multiple sources (NVD, GHSA, RedHat). Extract in priority order:

1. NVD (National Vulnerability Database) - most common
2. GHSA (GitHub Security Advisory)
3. RedHat

Store the first available score with its source metadata.

5. Expected Output Fields

For each vulnerability, collect:

• Package: Package name from PkgName
• Version: InstalledVersion
• CVE_ID: VulnerabilityID (format: CVE-YYYY-XXXXX)
• Severity: HIGH or CRITICAL
• CVSS_Score: Primary CVSS v3 score (numeric, e.g., 7.5)
• Fixed_Version: FixedVersion field (or "N/A" if not available)
• Title: Vulnerability title/description
• Url: First valid reference URL from References array

6. Edge Cases

• No fixed version: Set to "N/A"
• Missing CVSS score: Record as "N/A" (rare for HIGH/CRITICAL)
• Multiple package types: Trivy treats npm as npm, yarn as npm
• Duplicate CVEs: May appear if reported by multiple sources — deduplicate by CVE ID

Offline Mode Considerations

If running in strict offline mode:

trivy config /root/package-lock.json \
  --offline-db \
  --format json \
  --severity HIGH,CRITICAL

Ensure the database file exists at $HOME/.cache/trivy/db/trivy.db before running offline scans.

Common Issues

Issue	Solution
Database not found	Run trivy db download or allow online access for first scan
No results returned	Verify package-lock.json path and format are valid
CVSS missing	May indicate vulnerability data is incomplete — use what's available
Permission denied	Ensure read access to package-lock.json and /tmp directory

Next Steps

After scanning, pass the JSON results to the vulnerability-data-processing skill for formatting and CSV export.