Joern vs NodeJsScan

Joern analyzes source code, bytecode and binary code for vulnerability discovery and static program analysis research. It converts programs into code property graphs, providing a common structure for cross-language analysis. Users query those graphs with a strongly typed, extensible Scala-based domain-specific language. Features include parsing, taint analysis, search queries and passes that extend the graph representation. Joern Scan runs predefined queries and reports matching issues with their locations; queries can be selected by tag or name, and community contributions are accepted in the default database. Queries can be wrapped into custom scanners for CI. Joern also works as a library or through REST and HTTP APIs, including a server for graph construction and querying. Documented frontends cover C, C++, C#, Go, Java, JavaScript, Kotlin, PHP, Python, Ruby, Swift, x86/x64 and JVM bytecode, with varying maturity. Distributions target Linux, macOS and Windows on x86_64 and ARM64. Joern is free, Apache-2.0 licensed and requires JDK 21.

NodeJsScan is a static application security testing scanner for Node.js application source code. Its detection engine uses libsast and Semgrep, and the project provides a web interface, command-line interface, and Python API through njsscan. A local setup runs the web interface at http://127.0.0.1:9090. CLI results can be exported as JSON, SARIF 2.1.0, SonarQube, DefectDojo, GitLab SAST, or HTML. The .njsscan configuration file lets users set scanned file types, ignored paths and rules, severity filters, and severity overrides. Documented CI/CD integrations include GitHub Actions, GitHub Code Scanning, GitLab CI/CD, Travis CI, and CircleCI. Alerts can go to Slack through a webhook or to email using SMTP settings. Teams can run a prebuilt Docker image or build the image locally. The project describes use in CI/CD and DevSecOps pipelines. NodeJsScan is free and licensed under GPL-3.0. The current njsscan package requires Python 3.10 or newer and supports macOS and Linux; NodeJsScan version 4 onward dropped Windows support.