# Avoid The Node.js Security Storm

Nov 17, 2016 ~ 2 min read

Avoid The Node.js Security Storm
================================

share this story on

[](https://twitter.com/share?url=https://lirantal.com/blog/avoid-the-node-js-security-storm-b073171a663f/&text=%22Avoid%20The%20Node.js%20Security%20Storm%22&via=liran_tal)[](https://www.facebook.com/sharer.php?u=https://lirantal.com/blog/avoid-the-node-js-security-storm-b073171a663f/)[](https://www.linkedin.com/shareArticle?url=https://lirantal.com/blog/avoid-the-node-js-security-storm-b073171a663f/&title=Avoid%20The%20Node.js%20Security%20Storm)[](https://wa.me/?text=Avoid%20The%20Node.js%20Security%20Storm%20https://lirantal.com/blog/avoid-the-node-js-security-storm-b073171a663f/)

![Keeping your 3rd party project dependencies secured is such an important task that you can’t under-estimate.](https://cdn.hashnode.com/res/hashnode/image/upload/v1692640032599/3838ea5f-618f-45c4-b5a5-b8877c7bf209.jpeg)

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1692640034393/59ee4350-cb1c-4cba-aa2c-a8e37bd39646.jpeg)

Keeping your 3rd party project dependencies secured is such an important task that you can’t under-estimate.

[Snyk](https://www.snyk.io/) is a great tool for monitoring and tracking security vulnerabilities within your Node.js dependencies (and their dependencies).

It’s a stand-alone tool, a platform, and also an active community of security researchers who provide you with patches to insecure code until an upstream package will get an update. This is extremely valuable as you don’t have to wait until an update is made to a package, or just if you don’t want to upgrade to new, possibly breaking features, and get patched the security hole.

### Test for Vulnerabilities

Install snyk as a global dependency so you can set it to monitor your project through snyk’s own dashboard.

Installing snyk:

    npm install -i snyk

Next up, running **_snyk test_** in your project will check **all** dependencies in your project:

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1692640036094/084d695b-b022-426d-bd04-b49e2bfb8453.png)

Luckily I don’t have any vulnerabilities :-)

### Monitoring your GitHub projects

Login to your [snyk.io](https://snyk.io/) account and browse to the Projects area.  
There you should locate a _Test my GitHub repositories_ button on the right side, just click it:

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1692640037493/2d18a730-656d-4ce8-b5a4-8e40769fe1b9.png)

Your GitHub repositories will then show up and you can click on the _Watch_ button to start tracking them, getting notifications on insecure vulnerabilities found there:

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1692640038981/c4927ff5-6912-4561-9a03-a08323e1ff74.png)

### Monitoring your project from the CLI

This is useful as you track the project with every change that happens, get notifications, etc.

> All monitoring added from the CLI will automatically show up as private projects in your account’s dashboard.

Authenticate to snyk.io so you can track your package:

    snyk auth

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1692640040498/9f0b8a21-f6eb-4873-9be8-bbeebec21010.png)

Now to monitor and track the project dependencies run:

    snyk monitor

Then you can view it in the dashboard as one of your projects at: [https://snyk.io](https://snyk.io/)

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1692640041566/24a393b6-30da-4f04-9b32-e925ab51da00.png)

### CI/CD Integration

Installing snyk for the build:

    before_install:  
      - npm install snyk -g

It’s great to also add a badge to your README file so that quality is visible to anyone who explores the project in GitHub or npmjs.com.

Modify the following markdown to match your project’s GitHub’s **_USER_** and repo **_REPONAME:_**

[![Known Vulnerabilities](https://snyk.io/test/github/USER/REPONAME/badge.svg)](https://snyk.io/test/github/USER/REPONAME)

Here’s how it looks like in my own project —   
it’s the last badge specifying 0 vulnerabilities.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1692640045205/4ea5ab67-8728-4e89-93d3-5314b1798b71.png)

Also, I invite you to read my newly published book [Essential Node.js Security](http://bit.ly/securenodejs)

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1692640047168/6e293912-e53a-4efc-9ef6-684e0ae2fee5.png)