Skip to content
SPECIFICTION
Get listed

NodeJsScan

github.com

Free plan WebmacOSLinuxAPISelf-hosted
Visit github.com
Spec score 7.8 #10 of 24 in Static Application Security Testing Sast

What it is

NodeJsScan is a static application security testing scanner for Node.js application source code. Its detection engine uses libsast and Semgrep, and the project provides a web interface, command-line interface, and Python API through njsscan. A local setup runs the web interface at http://127.0.0.1:9090. CLI results can be exported as JSON, SARIF 2.1.0, SonarQube, DefectDojo, GitLab SAST, or HTML. The .njsscan configuration file lets users set scanned file types, ignored paths and rules, severity filters, and severity overrides. Documented CI/CD integrations include GitHub Actions, GitHub Code Scanning, GitLab CI/CD, Travis CI, and CircleCI. Alerts can go to Slack through a webhook or to email using SMTP settings. Teams can run a prebuilt Docker image or build the image locally. The project describes use in CI/CD and DevSecOps pipelines. NodeJsScan is free and licensed under GPL-3.0. The current njsscan package requires Python 3.10 or newer and supports macOS and Linux; NodeJsScan version 4 onward dropped Windows support.

Spec sheet

Purpose
NodeJsScan is a static application security testing scanner for Node.js applications.Read 8 Oct 2026 · github.com
Intended users
The project describes use in CI/CD and DevSecOps pipelines to scan Node.js application code.Read 8 Oct 2026 · github.com
Deployment
The project documents running a prebuilt Docker image or building its Docker image locally.Read 8 Oct 2026 · github.com
Integrations
Documented CI/CD integrations include GitHub Actions, GitHub Code Scanning, GitLab CI/CD, Travis CI, and CircleCI.Read 8 Oct 2026 · github.com
License
The NodeJsScan repository identifies its license as GPL-3.0.Read 8 Oct 2026 · github.com
Headquarters
Vancouver, CanadaRead 28 Sep 2026 · github.com
Alerts
NodeJsScan supports Slack alerts using a webhook URL and email alerts using SMTP settings.Read 8 Oct 2026 · github.com
CLI and API
The project provides a command-line interface and a Python API through njsscan.Read 8 Oct 2026 · github.com
Configuration
Users can configure scanned file types, ignored paths and rules, severity filters, and severity overrides with a .njsscan file.Read 8 Oct 2026 · github.com
Detection engine
It is powered by libsast and Semgrep.Read 8 Oct 2026 · github.com
Maintainer support
The repository invites users to support the project through PayPal donations or sponsorship.Read 8 Oct 2026 · github.com
Maker location
OpenSecurity lists Bangalore, India and Vancouver, Canada as its locations.Read 8 Oct 2026 · opensecurity.in
Output formats
The CLI supports JSON, SARIF 2.1.0, SonarQube, DefectDojo, GitLab SAST, and HTML output.Read 8 Oct 2026 · github.com
Supported systems
The current njsscan package requires Python 3.10 or newer and supports macOS and Linux; NodeJsScan version 4 onward dropped Windows support.Read 8 Oct 2026 · github.com
Web interface
The local setup runs a web user interface at http://127.0.0.1:9090.Read 8 Oct 2026 · github.com

Plans and prices

NodeJsScan Free Open source · self-hosted · Docker or local setup Read 8 Oct 2026 · github.com

Every NodeJsScan plan and price →

Strong points and limits

Strong points

  • Detection engine uses libsast and Semgrep
  • Supports JSON, SARIF, and other output formats
  • Integrates with five documented CI/CD systems
  • Configurable file types, rules, and severity
  • Free and open source under GPL-3.0

Limits

  • Current package requires Python 3.10 or newer
  • Supported systems are macOS and Linux
  • NodeJsScan version 4 onward dropped Windows support

Who it suits

NodeJsScan suits teams that want to scan Node.js source code in CI/CD or DevSecOps workflows. Its CLI, API, Docker options, and integrations may fit teams prepared to run it locally or self-host it.

Verdict

NodeJsScan offers configurable source scanning with several interfaces, report formats, and CI/CD integrations. Teams should account for the Python requirement and the current package’s macOS and Linux support.

Where Specifiction places it

Alternatives to NodeJsScanAll alternatives →