run2_npm-vulnerability-scanning-enhanced

Enhanced npm Dependency Vulnerability Scanning

Purpose

Scan npm package-lock.json files for vulnerabilities using Trivy with complete metadata extraction, including severity sources, vendor data, and multiple reference URLs.

Key Improvements Over V1

1. Multiple Severity Sources: Track severity from different vendors (GHSA, NVD, RedHat)
2. Vendor-specific Scoring: Extract vendor severity codes for better analysis
3. Multiple References: Capture all reference URLs, not just primary
4. Data Enrichment: Include DataSource information for audit trail
5. Timestamp Tracking: Record publication and modification dates

Installation & Setup

Prerequisites

• Trivy 0.40.0+ installed
• npm package-lock.json file
• Access to offline vulnerability database

Setup

# Install Trivy
curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin

# Verify installation
trivy --version

Scan Configuration

Command with Enhanced Metadata

trivy fs /root/package-lock.json \
  --format json \
  --output vulnerabilities.json \
  --scanners vuln \
  --skip-db-update \
  --severity HIGH,CRITICAL

JSON Output Structure

Enhanced Trivy output includes:

{
  "Results": [
    {
      "Target": "package-lock.json",
      "Type": "npm",
      "Vulnerabilities": [
        {
          "VulnerabilityID": "CVE-2022-25883",
          "PkgName": "semver",
          "InstalledVersion": "7.3.7",
          "FixedVersion": "7.5.2, 6.3.1, 5.7.2",
          "Severity": "HIGH",
          "SeveritySource": "ghsa",
          "VendorSeverity": {
            "ghsa": 3,
            "nvd": 7
          },
          "Title": "nodejs-semver: Regular expression denial of service",
          "Description": "...",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2022-25883",
          "References": [
            "https://nvd.nist.gov/vuln/detail/CVE-2022-25883",
            "https://github.com/advisories/GHSA-c2qf-rxjj-qqgw"
          ],
          "DataSource": {
            "ID": "ghsa",
            "Name": "GitHub Security Advisory npm"
          },
          "PublishedDate": "2022-11-16T14:15:00Z",
          "LastModifiedDate": "2023-09-01T10:00:00Z"
        }
      ]
    }
  ]
}

Data Extraction Fields

For each vulnerability record:

Field	Source	Notes
VulnerabilityID	Direct	Primary CVE ID (handle comma-separated)
PkgName	Direct	Package name (may include scope)
InstalledVersion	Direct	Exact installed version
FixedVersion	Direct	First fixed version (may have multiple)
Severity	Severity field	HIGH or CRITICAL only
SeveritySource	Track source	ghsa, nvd, or other
Title	Direct	Vulnerability title
PrimaryURL	Direct	Primary reference URL
References	Direct	All reference URLs

Severity Filtering

Valid Severities for This Audit

• HIGH
• CRITICAL

Severity Source Priority

1. GHSA (GitHub) - Most recent data
2. NVD (NIST) - Most authoritative
3. RedHat - Vendor-specific
4. Ubuntu - Ubuntu-specific
5. Other sources - Use if available

Vendor Severity Codes

GHSA uses numeric severity codes:

• 0 = LOW
• 1 = MODERATE
• 2 = MEDIUM
• 3 = HIGH
• 4 = CRITICAL

NVD uses numeric CVSS scores (0.0-10.0)

Handling Edge Cases

Multiple CVE IDs

Some vulnerabilities may report multiple CVE IDs separated by commas:

"CVE-2023-XXXXX, CVE-2023-YYYYY"

Split and process each separately while maintaining package/version context.

Multiple Fixed Versions

When multiple branches are maintained:

"FixedVersion": "7.5.2, 6.3.1, 5.7.2"

Extract the first fixed version for the matched major version if possible.

Incomplete FixedVersion Data

Some vulnerabilities may not have fixes:

"FixedVersion": ""

Use "N/A" in reports.

Reference URL Priority

1. PrimaryURL: Use as primary reference
2. References array: Include if primary is missing
3. Construct NVD URL if needed: https://nvd.nist.gov/vuln/detail/{CVE-ID}

Audit Trail Elements

Track for audit purposes:

• DataSource.ID: Which database provided the vulnerability info
• DataSource.Name: Human-readable database name
• PublishedDate: When the CVE was published
• LastModifiedDate: When the record was last updated

This enables tracking which vulnerabilities came from which sources and how current the data is.