NPM Audit+ UIS
Forked from https://github.com/freedomofpress/npm-audit-plus
NPM Audit+ UIS is a wrapper around NPM's built-in audit tool. It adds the following functionality:
- Ignore particular advisories
- Specify a project to audit
- Output audit result as JUnit XML, compatible with many CI systems
Installation
Install globally:
npm install -g npm-audit-plus-uisor install locally:
npm install npm-audit-plus-uisEither works!
Usage
npm-audit-plus-uis --ignore=123,456 --xml # If installed globally
$(npm bin)/npm-audit-plus-uis --ignore=123,456 --xml # If installed locallyFor more documentation on NPM Audit+'s flags, run
npm-audit-plus-uis --help # If installed globally
$(npm bin)/npm-audit-plus-uis --help # If installed locallyOther usage
npx npm-audit-plus-uis --production --xml # Ignore vulnerabilities in devDependenciesnpx npm-audit-plus-uis --auditLevel critical --xml # Only exit with code non-zero on high and criticalGitlab example
audit-npm:
script:
- npm ci
- npx npm-audit-plus-uis --xml > npm-audit.junit.xml
allow_failure: true
artifacts:
when: always
paths:
- '*.junit.xml'
reports:
junit: npm-audit.junit.xml
expire_in: 1 day