How to Fix Security Vulnerabilities with NPM ?

Node Package Manager(npm) is a package manager provided by NodeJS which is a JavaScript runtime environment. Using npm you can add packages to your project. When you install any package you get the count of security vulnerabilities, this vulnerabilities are exposed weaknesses that can be a security threat by attackers.

We will discuss How to Fix Security Vulnerabilities with NPM:

Getting an audit

Use the npm audit command in your project directory. This will scan your project’s dependencies for possible security vulnerabilities.

Example: To get a report of vulnerabilities run the npm audit command and you will get the results as follows:

npm audit command result

Inspecting and fixing the vulnerabilities

To fix the problems you can use the following methods:

• Automatic update: Use npm audit fix to automatically update vulnerable dependencies to patched versions. Be cautious as this might cause compatibility issues due to breaking changes in newer versions.
• Manual update: Review the report and update specific dependencies. You can update to minor or patch versions to potentially address only the vulnerabilities and minimizing possible breaking changes.
  • Use npm update <package-name> command to update to the latest version of the package.
  • Use npm install <package-name>@<version-number> command to replace that particular package to the specified version.
• Manual fix: For complex vulnerabilities or those requiring code changes, you might need to dive deeper. Check the vulnerable packages’ repository for existing fixes or raise an issue if one doesn’t exist.

Example: To fix the vulnerabilities using automatic update run the npm audit fix command and you will get results as follows:

npm audit fix command result

Common Types of Issues

The various common security issues are:

• Denial of Service (DoS): A vulnerable package can be used to crash your site or consume excessive resources which leads to users unable to use your services.
• Malicious Prototype: If a package is open sourced attackers can make changes into a trusted package’s prototype to inject malicious code.
• Cross-Site Scripting (XSS): Sometimes vulnerable using package can allow attacker to run malicious script into trusted sites in intention to stealing of user data.
• Similar Packages: The attackers can publish malicious packages with names similar to original ones thus tricking the developers into installing them and resulting in addition of malicious code or some kind of backdoor into there code.

Best Practices for Management

Some practices that should be followed to manage security vulnerabilities are:

• Have frequent Audits: You can use npm audit command to frequently scan your project for packages with vulnerabilities. This will ensure your project have no vulnerabilities and if it’s there then follow the above steps to fix it.
• Check before Updating: You should always check the update notes referred in the audit before updating because updating carelessly can have breaking changes for your project.
• Documentation: Always document the version of packages before and after changes and if possible copy the package.json file before every change to ensure that you always have a backup of working dependencies information.
• Testing for Changes: You must test for the expected behaviors in the parts of your project where the dependencies that you updated is used. After update testing makes sure there is no breaking changes in your project.

Automated Tools for Detection

The various automated tools for detection and fixing of security vulnerabilities are:

• Snyk: The tool offers free and paid plans to scan for vulnerabilities and automate patching in your code, open-source dependencies, and containers.
• WhiteSource Bolt: It runs on GitHub and on Azure DevOps, scanning your projects and provide real-time vulnerability detection and find security issues in your project or dependencies.
• JFrog: It provides end to end solution for your npm packages management and deployment but it also does vulnerability analysis which allows to check for possible vulnerabilities.

Updating and Patching

The ways for updating the packages for patching the security vulnerabilities are:

• Using the audit fix: You can use the npm audit fix command to automatically update all vulnerable packages to the fixed version but use it if all fully confident about the changes because updating packages can lead to breaking changes.
• Using npm update: You can update all the dependencies of your project to the latest version using the npm update command but be careful as it may bring breaking changes. If you want to update individual package just add the package name in the end of the command i.e npm update <package_name>.

Access Controls

You can also add access controls to control who can install, publish, and modify npm packages. Some ways to implement access controls are:

• Restrictions: You can add restriction in user account management on your development machines or package managers such that only selected members who have permission can use npm install, npm publish, or other npm commands.
• Multi-Factor Authentication (MFA): You can add MFA to you npm account to add extra layers of security by requiring a other verification factor along with username and password.
• Private Packages: You can create private packages for personal, team or for a whole organization and these packages can be used by developers who are having read/write access.
• Permission Management Tools: You can also permission management tools such as Verdaccio. These tools allows users or organization to control access to to private NPM packages through configuration files.

Monitoring Advisories

Mostly package managers finds possible security vulnerabilities in their packages and fixes it in a newer version and also notify it, so to monitor this announcements you can follow the respective methods:

• Subscribe to security advisories: You can subscribe for security advisories from npm itself or other security providers like Snyk or WhiteSource. They provide notification or have web pages to keep you informed about possible vulnerabilities of packages.
• Automate Vulnerability Scanning: You can integrate automated vulnerability scanning tools like Jfrog into your CI/CD pipeline. This makes sure your project vulnerabilities are identified as early as possible.
• Personally view the advisories: You can personally check regular reviews of security advisories to identify and check for package vulnerabilities and fixing them thus only focusing on the packages you are using.