Node Security Platform Integration with DefectDojo

Node Security Platform Integration with DefectDojo

Node Security Platform (nsp) was a software composition analysis service and command-line tool that checked Node.js projects against a database of known vulnerabilities in npm packages. It was built by ^Lift Security, acquired by npm, Inc. in 2018, and retired the same year: npm announced that the service would stop working on September 28, 2018, and folded its advisory data into the npm audit command that ships with npm 6 and later. DefectDojo still parses nsp's JSON output, which matters mainly for teams holding historical reports.

Node Security Platform Integration with DefectDojo

Let's be direct about where Node Security Platform stands: nsp is deprecated, and nobody should be producing new nsp reports in 2026. We keep the DefectDojo integration around for one reason. Some of our older Node.js applications have years of nsp results in archived CI artifacts, and importing them into DefectDojo puts that dependency history on the right Asset with dates, severities, and fixes attached. For anything we scan today, we use npm audit and DefectDojo's NPM Audit parsers, and we import both into the same Asset so the old and new records live side by side.

Why Node Security Platform Matters

nsp mattered because it was one of the first tools to make npm dependency risk visible in a build. Its relevance now is historical, and that's still worth something.

• Archived nsp reports show which vulnerable packages an application shipped with and when, which can answer questions during an incident review or audit.
• Its advisories became the foundation of the npm advisory database behind npm audit, so the findings map naturally onto what current tools report.
• Importing old results gives a baseline for comparing how dependency hygiene has changed over time.
• Leaving those reports in CI storage means nobody can search them, filter them, or connect them to the Asset that owns the code.

Advantages of This Integration

What we got from importing legacy nsp results into DefectDojo:

• Historical record on the right Asset. Each advisory becomes a Finding attached to the application that shipped the vulnerable module.
• Readable descriptions. The parser folds the advisory overview, vulnerable and patched version ranges, dependency path, and CVSS score and vector into the Finding description.
• Remediation guidance carried over. nsp's recommendation text becomes the Finding's mitigation, and the advisory URL becomes its reference.
• Continuity with npm audit. Current npm audit imports land on the same Asset, so security leads can see legacy and current dependency findings in one report.
• Standard triage. Findings that still apply can be assigned, pushed to Jira, or risk-accepted, and stale ones can be closed with notes explaining why.

How This Integration Works

DefectDojo imports nsp output with the Node Security Platform Scan scan type. The parser expects the JSON array nsp produced, one object per advisory, with fields such as title, module, version, overview, recommendation, advisory, cvss_score, cvss_vector, and path.

1. Locate the archived JSON report. Because the nsp service is shut down, you can't generate new reports. Use JSON files saved from past builds.

2. Import it. In the UI, open the Engagement, choose Import Scan Results, select Node Security Platform Scan, and upload the file. To script a backfill of many archived reports, use the API in Community Edition or DefectDojo Pro:

curl "https://YOUR_INSTANCE/api/v2/import-scan/" \
  -H "Authorization: Token $DD_API_TOKEN" \
  -F "scan_type=Node Security Platform Scan" \
  -F "file=@nsp-report.json" \
  -F "product_name=legacy-storefront" \
  -F "engagement_name=nsp History" \
  -F "auto_create_context=true" \
  -F "tags=nsp,legacy"

DefectDojo Pro users can do the same with Universal Importer:

universal-importer import \
  --defectdojo-url "https://YOUR_INSTANCE.cloud.defectdojo.com/" \
  --scan-type "Node Security Platform Scan" \
  --report-path "./nsp-report.json" \
  --product-name "legacy-storefront" \
  --engagement-name "nsp History" \
  --auto-create-context

3. Move current scanning to npm audit. For new results, run npm audit --json and import with NPM Audit v7+ Scan (npm 7 and later) or NPM Audit Scan (npm 6 and older reports).

Data Granularity: What Gets Imported

Within one report, entries with the same title and dependency path are imported once.

Use Cases

Backfilling dependency history: A team consolidating security data for a set of older Node.js services imports archived nsp reports into an Engagement per year. The Asset then shows which advisories were present before the move to npm audit.

Retiring an old pipeline step: Some long-lived repositories still carry an nsp step in their CI configuration that silently produces nothing. Importing the last useful report before removing the step keeps the final known state on record, and the replacement npm audit import starts the next chapter on the same Asset.

Supporting an incident review: When a vulnerable package is suspected in an old incident, imported nsp Findings show whether that module appeared in builds from the period in question, with the advisory text attached.

During a migration audit: A security lead confirms that every advisory from the last nsp report was fixed, accepted, or superseded by comparing those Findings with current npm audit results on the same Asset.

Operational Tips

• Watch the severity edges. The parser's CVSS bands leave gaps, so a score of exactly 4.0 or 7.0 (or anything between 3.9 and 4.0) falls through to Critical. Review those Findings after import and adjust severity if needed.
• Put nsp imports in their own Engagement and tag them (for example tags=nsp,legacy) so historical Findings don't skew current SLA metrics.
• Consider importing archived reports with active=false if you only need them as history, then reactivate anything you confirm is still present.
• The parser doesn't populate CVE or component fields, so cross-tool deduplication with npm audit Findings is unlikely. Expect some overlap and close duplicates manually with a note.
• If you backfill several reports from the same project, import them in date order into the same Test with reimport. Advisories that disappear between reports are mitigated, and the import history shows which report they dropped out of.
• Stop at backfill. Any project still running nsp in a pipeline is getting no new data, so replace that step with npm audit --json and the matching DefectDojo scan type.