How to Scan, Analyze and Fix Security Vulnerabilities using NPM AUDIT & Retire.js. (2023)

Introduction

npm audit is a new feature, introduced with npm@6
Update npm version: npm i -g npm@latest

Please like, share and subscribe if you found the video useful.

Checkout the Playlists:

👉 FrontEnd JavaScript Interview Questions: www.youtube.com/watch
👉 JavaScript Tutorials:
www.youtube.com/watch
👉 Essentials for Web developers:
www.youtube.com/watch
👉 React Hooks & Latest concepts:
www.youtube.com/watch
👉 HTML Tutorials:
www.youtube.com/watch
👉 CSS Tutorials:
www.youtube.com/watch
👉 Coding Challenges:
www.youtube.com/watch
👉 Best Practices & Common mistakes:
www.youtube.com/watch
👉 React js for Beginners:
www.youtube.com/watch
👉 Things To Know As JavaScript/FrontEnd Developer:
www.youtube.com/watch

LIKE | SHARE | SUBSCRIBE 😊
#javascript #reactjs #react #webdevelopment #frontenddevelopment #uidevelopment
#javascriptinterviewquestions #interviewquestions #codingchallenges

👇👇👇
Follow me on
Telegram: t.me/+HTxs0I-Jvu75RxWM
Instagram: www.instagram.com/rethinkingui/
Twitter: twitter.com/suresh9058
LinkedIn: www.linkedin.com/in/suresh-mende-a1a20459/

Content

Hi, all in this video we'll learn how to scan and fix the security issues in our project.

So.

This is a sample reactjs project.

So, not only reactjs project if it is angular view or any of the projects which has package JSON file and all the dependencies are declared like this.

It's good to do the security scan test on this.

So.

We need to scan all these third party dependencies.

Why, to scan the dependencies, dev dependencies.

Optional.

Tendencies means these are third party dependencies where this code is open source and with the help of this code, hackers may enter into the application and they can do a huge loss for us.

So.

These are the reasons we need to do a security scan before going to the production environment, because this causes a loss for us to the business and the production environment as well.

So.

We need to do a security scan for all these third party dependencies and we need to find what all the issues are.

There.

Uh, security issues are there in this third party dependencies.

So thereafter, we'll show you how to fix them.

So.

Before going to that, I mean whenever we have NPM.

Package dot JSON file, we'll be doing that NPM install.

I've taken this from the git repo.

This project.

So now to run to work on this project.

I need to do NPM, install.

So.

Let me do that., NPM, NPM, install and nbmi.

Both are the same.

So.

Once you do NPM I, it installs all the dependencies and finally, it will automatically run NPM audit, as well.

NPM audit will run and it will give the report.

So to have NPM audit.

We need to have NPM version 6, because NPM audit is available from 6 dot.

X version.

So from this version, 6 dot, X version.

Only NPM audit is available.

So.

If you have lower versions, then please update your NPM version to the latest.

So.

This is the command for that.

So I'm, providing you NPM, install NPM at the rate latest hyphen GG stands for the globally.

We are trying to install NPM globally so that you will be getting the latest version of six so that you can use NPM, audit.

So, fine, so., Have, taken a new project.

NPM I am installing all the dependencies once it installs all.

The dependencies.

It will provide us NPM audit under the hood.

What happens.

NPM will be installing all the dependencies 1 by 1 and it will check in the NPM registry whether this dependency has any security threats or not.

If.

There are any security threats.

It will provide us the NPM audit as well.

So let me show you: that.

I will directly run the NPM audit.

So.

If you run NPM audit, it will show list of options.

Like this.

I mean now we got NPM audit.

So these are the four.

If you can observe here.

There are four security threats: 2 or low, two or high.

Here.

There will be 4 security, levels, I mean severity levels high and critical.

Issues.

Security issues should be fixed as soon as possible, but that's coming to the low and moderate can be fixed when in the next releases, or we can take some time- to.

Fix them.

So there would be 4 security, threats.

So, as we got too high issues.

We need to address it as soon as possible.

So now check.

We have 4 security issues from 4.

Three of them require a semantic versioning major dependency, update.

So, what it? What does it? Mean? So? Let's check, that.

So and the another one one is.

It is saying that it needs a manual review.

So, let's.

Check, both of them.

So.

If you go to the top.

So, the issues would be in this.

Manner.

This is one of the issue, as we have four issues.

Two are high and two are low.

The high issues.

Here it will provide the security, I mean severity level and the cause of the issue.

Remote code, execution.

Where, this security I mean where this issue is present, means in this package.

Serialize JavaScript.

In this package we got an issue.

Security threat is there, but this.

Package was not directly installed by us.

We have installed React Scripts from this React Scripts.

This package was came.

You can find the path here.

We have, in short, only react.

Kids React scripts is dependent upon this webpack plugin, and this webpack plugin is dependent upon this JavaScript.

So.

This is the reason we got this issue, and this is saying the dependency on this.

So.

Like this, you can understand.

And the project.

So this is how we are going to scan.

So the first step of scanning.

The project was done.

Now.

You need to analyze what all the issues and what all the fixes.

So.

If you go to the top it will, it is showing NPM audit security report, and you can see here run this command.

It is, it is.

It will provide.

NPM will provide us maximum help to resolve all the security.

Issues.

It is asking us to install React Scripts to 4.0 dot version so that three security threats would be resolved.

It is giving an hint for us, but it is saying that there would be a potential potentially there., Breaking changes.

Why this is a warning us this because.

Here in the React scripts, we have 3.4 dot, 1 version.

In.

This version we have issue.

It is asking us to move to 4.0 dot, 1 version.

Here, we know summer in the semantic versioning.

First would be the major release.

Second, one is minor, release.

And.

Third, one is a patch as from three major version we are shifting to the four major version.

It is warning us whether it would be an breaking changes.

So.

We need to check like so don't install or multiple security.

Issues.

Don't try to resolve multiple security issues at a time, because all these security issues may resolve some breaking issues where your project may not work where your application may not work as earlier.

So resolve each each security issue at a time, so that and test your application once again.

Whether there are any breaking changes or not.

In that way it is uh.

It is very good to track all the system, all the application flow as well.

Here.

There is more information on tab.

Also, let me show it control.

Click, so it will open.

It will open in the browser.

So.

There are some more information and some advisers as well how to resolve this.

So.

He will give certain description why this is an attack, and here he will give a solution to upgrade to three dot 1.0 or later.

So.

These are the hints like you need to understand whether this is a really an issue for you or it.

It occurs only to particular operating system or in particular domain.

Like that.

So, here the.

The solution is, we need to upgrade to three dot.

1.0.

Also.

You can see the versions tab.

So.

It is showing what all? What are all the affected? Versions.

So, all these versions.

If anyone are using all the any of these versions, this security threat would be there for them.

So.

These are the unaffected versions.

So.

We need to use one of these version.

According to our project dependency, such that our project should not break.

So try using unaffected versions.

So, let's go back, here.

So.

This is how you need to analyze your security issues.

So.

You can also do NPM.

Audit fix, where NPM will help us to fix any of the automatically fixed issues.

If.

There are any small issues.

It would be fixed, automatically.

So.

We need to do NPM audit fix for that.

So.

Never do a NPM audit fix force like let me show you.

So.

This is a warning he's throwing NPM audit fix, hyphen F force.

So.

If you do this, it will try to forcefully install all the dependencies.

Even though those are major major dependencies as well, it will install.

Where.

The breaking changes may occur and your application may not work as earlier.

So don't do.

Npm fix hyphen force.

Anytime.

So try to do the suggestion.

What he has given.

So.

This is a suggestion.

It was given in PM is asking to install us react scripts to the latest version.

So.

Let's do that in PM install.

React scripts to the latest version.

Happiness, so., To, install this, I means high stands here for the install and have an S means I'm.

Installing this dependency under dependencies.

Hyphen, D, capital, D means dev, dependencies.

We are asking to install in the dev dependencies.

Here hyphen capital S means we are asking to.

React scripts to installing the dependencies.

So.

Now we we could able to install React Scripts latest.

So.

You can check all the three issues would be gone.

Here.

We have four issues as we are updating to the.

Major updates.

Three issues should be gone in three issues.

Two are the high issues.

So.

Now we would be having only one lower issue.

So.

This is how we need to fix.

So.

Most of the cases, all the security issues will have two fixes.

So in the way we need to fix or two things number one would be.

Updating the upgrading the version and the number 2 is finding a best alternative and moving to that.

If.

You can't fix, or if there is no fix in that part, for that particular package.

Then it's better to find an alternative or you can raise an pull request in the GitHub.

For, the particular package as well.

We have that option as well.

So.

Let me show you this once it is done.

So.

Meanwhile, I will show you how to manually.

So I.

This is a manual review, so it is asking us to manually review this dependency because it is unable to take any decision on this security.

Threat.

It is not able to give an advice on this.

So.

For that you need to you have few options, so it is showing an issuing node fetch.

Ok.

Let me show you once it is fixed.

Yep.

Now it was fixed.

So.

We have only found one lower severity, issue.

So.

Let's get that report.

To get the report.

You need to run NPM audit.

Now.

You will be getting 1 lower, issue.

Yep.

We got one.

So.

It will clearly mention like this manual.

Review.

It means it is not able to take an action to resolve this dependency.

So.

Now we need to take an action on this.

So.

As I said, in.

They should severity is low.

This is because of DDoS attack.

This security threat is present in node fetch.

And.

These are the possible updates.

So.

It is saying the patch is available in the below updates.

So, from where this issue is coming means it is coming from the React Google Maps.

So.

This is a path.

This is the main path react Google Maps, where this map is depend.

All.

These are the dependency libraries for this map.

So, it is exist in the node fetch.

Issue is exist in the node fetch.

So.

Try to open this command.

So.

It will give more information on the particular security.

Issue.

We can read this so few of the issues.

So.

This is a fix.

It is saying so you can fix means you can upgrade to the next level or the second option is if you are not able to find any of the fix for this, you need to find the best alternative.

So for that you can go to the same website and you can find alternatives for that.

For example.

If there is some issue in the QR code package, which you are using.

So, you can go to the number of QR code packages with the quality.

So.

You can filter here the quality, popularity and maintenance.

So.

We need to go to the quality.

I mean I'm, sorting by quality, so the most popular quality, I mean there won't be any security, less security, issues.

So those comes to the top.

So.

You need to find the best alternative for that and you can use that library in place of a security threat, library.

Yeah.

In that way, you need to manually review each and everything.

In some cases you need to upgrade the immediate library like.

If, if there is no solution to update to the node fetch, there is an option to update isomorphic fetch package such that this issue may fix automatically.

If not.

You can also update FBJS, as well.

So here in this website has been provided these options.

So.

If there is a package and the dependent package package with the vulnerabilities, so you you can update the dependent package.

Here.

So he's asking to update this to fix this manual review security issues as well.

So, the one more option we have so this is regarding NPM audit how to scan how to fix.

So one more.

We have is retry.

Like, NPM, install, I'm, trying to install globally retire.

So.

This is another package, so it scans for the more security issues than what NPM does.

So just run.

Read uh, retire in the project, which you are there.

So.

It will give a number of issues same as NPM audit with the high severity and issue number and why the issue was happened so also he will be providing.

The.

Fix as well in the GitHub link, will be providing the GitHub link.

So.

Let's check this.

There is an issue with the.

JQuery 3.2 dot.

One so he's asking us to migrate.

To.

The fix is available in three dot 5.0 it seems.

So we are using 3.2 dot.

One here.

So he's asking us to migrate from 3.2 dot, one to three dot: 5.0.

Where, the security? Issue has an fix.

In 3.2 dot one.

He is mentioning that there is an chance of cross.

Site cross site.

Scripting here is mentioned.

There is a chance of cross site, scripting.

So! That's the reason he's asking us to upgrade.

So.

You can also install a reader to check for more security.

Issues.

It is also same as what we have done for NPM audit.

Also security issues means not fixing once.

You need to keep this NPM audit in your continuous integration and deployment lifecycle as well.

Because.

You know, day by day the security issues would be coming and the patches would be coming at the same.

Time.

We need to update our packages to make sure that.

We don't expose our code to the security threats and we are up to date with all the packages security packages.

So that's the way we'll be safe.

So.

This is all about the how to scan and how to fix, how to analyze the security issues.

So thanks for watching.

Please, subscribe for more videos.