AuditJS

AuditJS Integration with DefectDojo

AuditJS is a focused, lightweight open-source tool for auditing JavaScript and Node.js dependencies against Sonatype's OSS Index — a vulnerability database covering hundreds of thousands of open source components. For teams with Node.js applications, it provides fast, low-friction dependency scanning that integrates cleanly into CI pipelines without the overhead of a full commercial SCA platform. The gap, as with any point-in-time scanner, is what happens after the audit completes. AuditJS output lives in CLI logs or JSON files; it doesn't track whether findings were remediated, whether they've been open for 90 days, or whether a risk acceptance decision was made last quarter. Integrating AuditJS with DefectDojo closes that gap — bringing JavaScript dependency findings into a persistent vulnerability management workflow with SLA enforcement, remediation tracking, and portfolio-level reporting.

Why AuditJS Matters

AuditJS fills a specific and practical role in the Node.js ecosystem: fast, accurate, dependency-level vulnerability scanning with no licensing cost and minimal configuration overhead.

• AuditJS queries Sonatype's OSS Index, one of the most comprehensive open source vulnerability databases available, covering CVEs and Sonatype-specific vulnerability research across npm packages and other ecosystems
• It operates on package.json and package-lock.json files, scanning both direct and transitive dependencies — the transitive layer is where the majority of real-world SCA findings originate
• Sonatype IQ Server integration is available for teams that have it, providing policy-based evaluation and more detailed component intelligence beyond OSS Index's public data
• AuditJS output is available in JSON format via the --json flag, producing structured data that DefectDojo can ingest directly without preprocessing
• Its lightweight nature makes it practical to run on every commit or pull request in CI, giving teams a continuous view of dependency risk rather than periodic batch scans
• The tool is straightforward to install and invoke — npm install -g auditjs, auditjs ossi — reducing the time-to-first-scan for Node.js teams from days to minutes

Advantages of This Integration

AuditJS identifies vulnerable JavaScript dependencies. DefectDojo tracks what your team decided to do about them — and whether they followed through.

• Persistent finding records across scan cycles: Each time AuditJS runs against an application, reimporting into DefectDojo updates existing findings rather than generating a new pile of unrelated records. You can see which CVEs have been present across multiple dependency scans, which were resolved by a package upgrade, and which have been deferred for weeks without action.
• SLA enforcement for JavaScript vulnerabilities: DefectDojo applies configurable SLA policies by severity across all imported AuditJS findings. Critical npm CVEs get a 7-day remediation target; High severity findings get 30 days. Breach tracking surfaces overdue findings in dashboards and weekly reports — turning AuditJS severity ratings into enforceable deadlines rather than informational output.
• Deduplication across projects and repositories: The same CVE in lodash appearing across fifteen Node.js services doesn't generate fifteen independent findings if your DefectDojo product structure is organized appropriately. Patterns in shared dependencies get surfaced as systemic issues worth addressing at the dependency policy level, not just one service at a time.
• False positive management that survives reimports: Findings marked as false positives or risk-accepted in DefectDojo are retained across reimports. If AuditJS reports the same package vulnerability on the next CI run, DefectDojo recognizes the existing record and doesn't re-open it — eliminating repetitive triage for known, documented decisions.
• Cross-repository portfolio visibility: Organizations running AuditJS across many Node.js repositories get aggregated metrics across their entire JavaScript portfolio in DefectDojo — open findings by severity, package, age, and SLA status — without manually reviewing individual scan outputs per repository.
• Developer-facing remediation tickets: Triaged AuditJS findings push from DefectDojo to Jira, GitHub Issues, or ServiceNow with CVE details, affected package name and version, and fix version guidance — giving developers what they need to upgrade the right dependency without requiring access to security tooling.
• Audit trail for compliance: For applications subject to software composition analysis requirements — PCI DSS, SSDF, or internal AppSec policy — DefectDojo's engagement history and finding lifecycle records provide documented evidence of continuous dependency scanning and remediation tracking across your JavaScript portfolio.

How This Integration Works

AuditJS produces JSON output via its CLI that DefectDojo's AuditJS parser consumes directly.

Step 1 — Run AuditJS and capture JSON output

Install AuditJS globally if not already present:

npm install -g auditjs

Run against your project and capture JSON output:

# Scan against Sonatype OSS Index (default)

auditjs ossi --json > auditjs-results.json

# Scan a specific directory

auditjs ossi --json /path/to/project > auditjs-results.json

# With Sonatype IQ Server (if available)

auditjs iq --json \

--server https://<iq-server-host> \

--application <app-id> \

--stage build \

> auditjs-iq-results.json

For CI pipeline integration, capture the output file as an artifact before the import step:

# Example GitHub Actions step

- name: Run AuditJS

run: auditjs ossi --json > auditjs-results.json || true

# '|| true' prevents pipeline failure on findings; handle gate logic separately

- name: Upload results artifact

uses: actions/upload-artifact@v3

with:

name: auditjs-results

path: auditjs-results.json

Step 2 — Import into DefectDojo

Use AuditJS Scan as the scan type:

curl -X POST https://<defectdojo-host>/api/v2/import-scan/ \

-H "Authorization: Token <your-api-token>" \

-F "scan_type=AuditJS Scan" \

-F "file=@auditjs-results.json" \

-F "engagement=<engagement-id>" \

-F "product=<product-id>" \

-F "active=true" \

-F "verified=false"

Step 3 — Reimport for recurring scans

For repositories scanned on every CI run or merge to main, use the reimport endpoint to update existing findings rather than accumulate redundant test records:

curl -X POST https://<defectdojo-host>/api/v2/reimport-scan/ \

-H "Authorization: Token <your-api-token>" \

-F "scan_type=AuditJS Scan" \

-F "file=@auditjs-results.json" \

-F "test=<test-id>"

DefectDojo marks findings absent from the new scan as resolved, creates records for new findings, and leaves previously false-positived or risk-accepted findings untouched.

Data Granularity: What Gets Imported

Use Cases

In a CI/CD pipeline for Node.js services: AuditJS runs on every pull request and merge to main. Results import into DefectDojo via the API at the end of the scan stage. Security engineers triage new findings weekly in DefectDojo, assign upgrade tickets to the responsible development team, and track SLA compliance through dashboards — without reviewing raw JSON output or maintaining per-repository spreadsheets of open dependency vulnerabilities.

For identifying systemic dependency risk across a JavaScript portfolio: A frontend-heavy organization running dozens of Node.js services discovers through DefectDojo's aggregated view that a critical vulnerability in a widely-shared internal utility package appears in twenty services simultaneously. Rather than addressing each service independently, the security team opens a single tracked initiative in DefectDojo and coordinates a portfolio-wide upgrade — a response that individual AuditJS scan reports would never have surfaced as a pattern.

During a dependency upgrade sprint: Development teams periodically batch-upgrade dependencies as part of technical debt reduction. AuditJS scans run before and after the sprint. The pre-sprint import establishes a baseline of open findings in DefectDojo; the post-sprint reimport automatically closes resolved findings and surfaces any new CVEs introduced by the upgrades. The before-and-after record provides measurable evidence of risk reduction.

For compliance evidence in regulated Node.js applications: Applications handling payment data or personal information require documented SCA coverage. DefectDojo's engagement history, AuditJS finding lifecycle records, and risk acceptance audit trail provide structured compliance evidence for PCI DSS software security requirements and internal AppSec policy — without manual report compilation from CI logs.

Operational Tips

• Use || true in CI to decouple scan failure from pipeline failure: AuditJS exits with a non-zero code when vulnerabilities are found, which fails the pipeline stage by default. Using || true (or equivalent in your CI system) allows the scan to complete and the JSON to be captured even when findings exist. Handle your pipeline gate logic separately — for example, by failing the build only on Critical findings after reviewing DefectDojo's triage output.
• Commit package-lock.json to ensure transitive dependency accuracy: AuditJS relies on the lock file to resolve the full transitive dependency tree. Projects that don't commit their lock file will only surface direct dependency vulnerabilities, missing the transitive layer where a significant proportion of real-world SCA findings originate. Enforce lock file commits as a repository policy.
• Map one DefectDojo product per repository: A one-to-one mapping between Node.js repositories and DefectDojo products keeps deduplication clean, ownership clear, and SLA tracking meaningful. For monorepos with multiple package.json files, consider mapping products to the top-level service or application directories within the monorepo.
• Pair AuditJS with npm audit for complementary coverage: AuditJS queries OSS Index; npm audit queries the npm advisory database. The two databases overlap substantially but not completely — running both and importing results into separate DefectDojo tests within the same engagement gives more comprehensive coverage than either scanner alone, without significant additional overhead.
• Tag findings by package ecosystem and team ownership: DefectDojo supports finding-level tags on import. Tagging by package ecosystem (npm), application tier (frontend, backend, shared-lib), or owning team enables filtering and reporting across your JavaScript portfolio in ways that raw scan output doesn't support.
• Review OSS Index advisory quality before bulk risk acceptance: OSS Index advisory data quality varies across packages — some advisories are well-documented CVEs with clear fix versions; others are CWE-level observations without specific CVEs or confirmed fix versions. During triage, check the referenced OSS Index advisory before accepting risk or assigning remediation, and document the advisory quality assessment in the DefectDojo finding notes.
• Set a regular cadence for reviewing open findings beyond SLA: AuditJS findings for packages with no available fix (no-fix situations) can accumulate as nominally open findings in DefectDojo over time. A monthly review of findings older than your SLA window — specifically to apply risk acceptance or escalate for package replacement — prevents these from becoming invisible noise in the active queue.