Local caching of vulnerabilities

[bufferoverflow]

Node security wg is planning to create a dedicated repo for the known vulnerabilities, see https://github.com/nodejs/security-wg/issues/359#issuecomment-410079404

Using that sources instead of redirecting to upstream npm could be a nice option for verdaccio-audit.

[juanpicado]

Thanks @bufferoverflow for let me know 👍

[juanpicado]

@bufferoverflow do you know how to proceed with this? I'm a bit outdated.

[thib3113]

I'm also interrested by this, because I'm using dependency-check ... And it .. spam the audit api ...

As I'm understanding, you need to clone the repo ( or add it in dependency, but package.json version seems not updated ) .

After :

• read files in the core folder to search vulnerabilities with the nodejs version ( but maybe not appropriate for audit api ).
• read files in /ecosystem/<dependency>/ and get the vulnerable_versions in the json, compare it with the received version ( I didn't really know what npm send to audit api ) .

The problem, will maybe the need of git ( to install the repo ) .

[bufferoverflow]

I guess we have to wait until https://github.com/nodejs/security-advisories is shipped as a npm package or on a web site.

[thib3113]

@bufferoverflow not sure a npm package was a good idea .

Maybe better to do :

• use github api to check if update each 4 (?) hours
• if update, update local database ( clone/"download archive" in a local folder )

It's what do dependency-check with NVD database ( if database is some hours old, it update it ) .

I'm not sure they want to do a website with an api for this, I thin they just want to do a website to search a vulnerability, or a package to see if it contain vulnerabilities and wich version

[bufferoverflow]

@thib3113 valid points, worth to do!

[thib3113]

@bufferoverflow I've just checking a little this way ( before answering on this thread ) . And, I think I didn't have the time to do it, but this can be usefull for you :

• github api to get last master commit : https://api.github.com/repos/nodejs/security-advisories/commits/master
• url to download the zip : https://github.com/nodejs/security-advisories/archive/master.zip

[DanielRuf]

Not sure but http://registry.npmjs.com/-/v1/search?text=is:insecure&size=250 seems to contain all advisories.

[DanielRuf]

https://github.com/nodejs/security-advisories/archive/master.tar.gz would be probably better to save some bandwidth.

[thib3113]

@DanielRuf yes, It's what I said ( about the master.tar.gz ... just with a .zip )

[wzrdtales]

Just got blocked by npm completely on a CI b/c of the stupid audit API of them... . Having this use the current db and downloading it, or at least caching the result for some time is something that needs to be added. Will see if I can put some time into this...