njsscan Integration Guide

Integrate njsscan with Vulnetix. Scan Node.js applications for security vulnerabilities using semantic analysis with SARIF output.

Install & scan

$ uv run --with njsscan njsscan --version
$ uv run --with njsscan njsscan --sarif -o njsscan.sarif .

Run njsscan in CI

Scan on every push and upload the report as a workflow artifact:

- name: Run njsscan
  run: |
    pip install njsscan
    njsscan --sarif -o njsscan.sarif .

- name: Upload report
  uses: actions/upload-artifact@v6
  with:
    name: njsscan
    path: njsscan.sarif
    if-no-files-found: warn

Then one publish job hands every artifact in the run to Vulnetix, recorded under njsscan's own name and version. Written once per workflow, however many scanners you run:

publish:
  name: Publish to Vulnetix
  runs-on: ubuntu-latest
  needs: [scan]        # every scanner job, or its report is never published
  if: always()         # or one failing scanner suppresses all the others
  permissions:
    contents: read
    actions: read      # required to list the run's artifacts
  env:
    VULNETIX_ORG_ID: ${{ secrets.VULNETIX_ORG_ID }}
    VULNETIX_API_KEY: ${{ secrets.VULNETIX_API_KEY }}
  steps:
    - uses: actions/checkout@v5
    - name: Install Vulnetix CLI
      run: |
        curl -fsSL https://cli.vulnetix.com/install.sh | sh -s -- --install-dir "$HOME/.local/bin"
        echo "$HOME/.local/bin" >> "$GITHUB_PATH"
    - name: Publish scanner reports
      env:
        GITHUB_TOKEN: ${{ github.token }}
      run: vulnetix gha upload --org-id "$VULNETIX_ORG_ID" --json

After the run, vulnetix gha status reports what was actually recorded.

How Vulnetix compares: better together

Vulnetix does not replace njsscan. Keep running it. Vulnetix sits on top of njsscan (and every other scanner you already own) turning disconnected tool outputs into one prioritised, fixable queue.

✓ full · ~ partial · ✗ not covered

What njsscan does well

• Purpose-built semantic SAST for Node.js: ships curated semgrep/libsast rules for Express misconfig, insecure JWT, XSS/template injection, NoSQL injection and SSRF patterns
• Combines fast pattern matching (libsast) with syntax-aware semantic search (semgrep) for lower false positives than plain regex grepping
• Lightweight, free/open-source CLI that drops cleanly into CI and pre-commit for Node.js/JavaScript projects
• From the MobSF author, so rules are maintained by an established application-security team

Where Vulnetix adds to it: njsscan is a focused Node.js code scanner with no dependency (SCA), container, IaC, SBOM, malware, dedup, exploit-intel or VEX capability. Vulnetix runs its own SAST (built-in rules + Semgrep) plus SCA across 40+ ecosystems and ingests njsscan's SARIF, deduping it into one prioritised queue with EPSS/KEV/LEV scoring, reachability and versioned VEX, complementing rather than replacing njsscan's Node-specific rule depth.

No migration, no rip-and-replace. njsscan keeps doing what it does best; Vulnetix adds the orchestration, exploit-intelligence prioritisation and remediation layer built for the way AppSec works today.

Centralise njsscan results in Vulnetix

Upload njsscan SARIF output to the Vulnetix platform to deduplicate findings, prioritise them with EPSS, CISA KEV and Coalition ESS exploit intelligence, and track remediation across every scanner in a single queue.

njsscan documentation ↗  ·  Source repository ↗

Wire njsscan into your CI/CD pipeline →