Yarn Integration with DefectDojo

Yarn Audit Integration with DefectDojo

Yarn is an open source package manager for JavaScript and Node.js projects, first released by Facebook in 2016 and now developed by the Yarn community. Its audit command checks the packages resolved in a project's lockfile against the advisory data published through the npm registry and reports vulnerable dependencies with severity, affected versions, and dependency paths. Yarn Classic (1.x) provides yarn audit, while Yarn 2 and later (often called Berry) provide yarn npm audit. Both can emit JSON, which DefectDojo imports as a software composition analysis report.

Yarn Audit Integration with DefectDojo

Our frontend and Node.js services already use Yarn, so running its audit in CI costs nothing extra, and DefectDojo makes the results something we can manage. A raw audit run lists every advisory on every build with no memory of what we saw last week. Imported into DefectDojo, each advisory becomes a Finding on the right Asset, matched against earlier imports, given an owner and an SLA, and closed when an upgrade removes it. We can also see JavaScript dependency risk next to findings from our other scanners.

Why Yarn Audit Matters

JavaScript projects pull in hundreds of transitive packages, and most of the vulnerabilities in a typical web application live in code nobody on the team wrote.

• The audit runs against the lockfile, so it reports what will actually be installed, not what package.json loosely allows.
• Yarn Classic output includes the dependency paths that pulled in each vulnerable module, which tells you which direct dependency to upgrade.
• It uses the same advisory data as the npm ecosystem, so findings line up with GitHub and npm advisories.
• It needs no extra tooling for teams already on Yarn.
• Its output is per run. Without a platform behind it, nobody tracks which advisories are new, which are accepted, or which have been open for months.

Advantages of This Integration

What we get from routing Yarn audit results through DefectDojo:

• Deduplication across builds. DefectDojo hashes each Yarn finding on title, severity, file path, vulnerability IDs, and CWE, so a nightly audit doesn't create a new copy of every advisory.
• Upgrade tracking. Reimporting into the same Test mitigates advisories that disappeared after a dependency bump and reactivates any that came back.
• SLAs on dependency risk. Yarn's low, moderate, high, and critical ratings map to DefectDojo severities, so dependency findings follow the same deadlines as everything else.
• Triage that sticks. Risk acceptance and false positive decisions stay attached to the Finding across future imports, which matters for advisories in development-only packages.
• Tickets for real work. Findings can go to Jira from DefectDojo, so the upgrade lands in the owning team's backlog.

How This Integration Works

DefectDojo imports Yarn results with the Yarn Audit Scan scan type. The parser detects the report layout from its content and supports three shapes: Yarn Classic line-delimited JSON, Yarn Berry line-delimited JSON, and a single JSON document with a top-level advisories object.

1. Produce a JSON report. With Yarn Classic:

yarn audit --json > yarn-audit.json

With Yarn 2 or later, include transitive dependencies:

yarn npm audit --recursive --json > yarn-audit.json

Yarn Classic writes one JSON object per line, and the parser keeps the auditAdvisory entries. If the file contains an error entry, the import fails with that error rather than importing a partial result, so check the audit actually ran.

2. Import the report. In the UI, open the Engagement, choose Import Scan Results, select Yarn Audit Scan, and upload the file. From CI with the API (Community Edition and DefectDojo Pro):

curl "https://YOUR_INSTANCE/api/v2/import-scan/" \
  -H "Authorization: Token $DD_API_TOKEN" \
  -F "scan_type=Yarn Audit Scan" \
  -F "file=@yarn-audit.json" \
  -F "product_name=storefront-web" \
  -F "engagement_name=CI" \
  -F "auto_create_context=true"

DefectDojo Pro users can use Universal Importer instead:

universal-importer import \
  --defectdojo-url "https://YOUR_INSTANCE.cloud.defectdojo.com/" \
  --scan-type "Yarn Audit Scan" \
  --report-path "./yarn-audit.json" \
  --product-name "storefront-web" \
  --engagement-name "CI" \
  --auto-create-context

3. Reimport on each build. Send later reports to /api/v2/reimport-scan/ for the same Test so advisories fixed by an upgrade are closed instead of piling up as separate Tests.

Data Granularity: What Gets Imported

The richest mapping comes from Yarn Classic output. Differences for the other layouts are noted.

Yarn Classic output can repeat an advisory for the same module. The parser keys on advisory ID and module name, so each pair is imported once per file.

Use Cases

In a CI pipeline: Each merge to main runs the audit and reimports the result into a Test for that repository. Developers see only what changed since the last build, and a release gate can ask the DefectDojo API whether any new High or Critical advisories appeared.

In a monorepo: A team with a dozen workspaces audits each one and imports into a matching Asset, so dependency findings land with the team that owns each package rather than in one shared list.

When a major advisory drops: Security can filter DefectDojo by CVE or module name across every Asset to see which applications carry the vulnerable package and which have already upgraded.

For audit evidence: Dependency findings keep their discovery date, owner, SLA status, and closure date, which answers the question of how quickly vulnerable libraries get patched.

Operational Tips

• Pick one Yarn generation per repository and stick with it. Classic and Berry produce different titles for the same advisory, so switching formats looks like every finding closed and reopened.
• Berry output carries no CVE, CWE, or file path, so its deduplication rests on title and severity alone. Use the advisory ID title to cross-reference GitHub or npm advisory pages.
• Berry can report deprecated packages as advisories, and those import as findings too. Triage them separately or accept them with an expiration date.
• In Classic output, the file path is the first dependency path Yarn reports. A restructured dependency tree can change it, which DefectDojo will see as a new finding.
• Use minimum_severity if low-rated advisories in development tooling bury the important ones.
• Tag imports with the branch or release (for example tags=main,release-2026.10) so you can report on what shipped.