NPM Audit Integration with DefectDojo
npm audit is a built-in security auditing tool in the npm package manager that scans Node.js project dependencies by analyzing package.json and package-lock.json files against the GitHub Advisory Database to identify known security vulnerabilities, report severity levels (critical, high, moderate, low, info), and provide actionable remediation guidance with fix commands. The tool runs automatically during package installation and can be executed manually via command-line to generate detailed vulnerability reports with dependency paths, affected versions, and recommendations, while the npm audit fix command attempts to automatically update vulnerable packages to secure versions within semver-compatible ranges to help developers proactively address security risks throughout the development lifecycle.
Data Granularity: What Gets Imported
The following fields are captured from NPM Audit results and surfaced in DefectDojo findings:
| Field | Source | Notes |
|---|---|---|
| Title | Finding name from the scan | Matched to the tool's own naming |
| Severity | Critical / High / Medium / Low / Info | Mapped from the tool's own severity scale |
| Description | Finding detail from the report | Includes what the issue is and why it matters |
| Mitigation | Remediation guidance | Where the tool provides it |
Importing Into DefectDojo
Use the DefectDojo import API to create a new Test under the relevant Engagement for your product. The request body:
{
"scan_type": "NPM Audit",
"engagement": "<engagement-id>",
"file": "results.json"
}