Security vulnerability analysis

Inspiration

Security vulnerabilities in open-source npm packages and GitHub repositories are a major concern due to frequent supply chain attacks and malicious packages targeting developers and organizations. The motivation is to create an automated, scalable solution that analyzes GitHub repositories for security weaknesses using trusted npm packages and tools, thereby proactively identifying issues before exploitation.

What it does

This microservice scans GitHub repositories to detect security vulnerabilities in their npm package dependencies, configuration files, and CI workflows. It automates vulnerability auditing, flags suspicious or malicious npm packages, detects typosquatting attempts, and reports security risks in dependency trees. The service integrates best practices such as npm audit, Snyk database checks, and typosquatting detection to provide continuous monitoring and alerts.

How we built it

• Integrated three key npm packages widely used for security analysis:
  • npm audit (built-in npm CLI tool for dependency vulnerability reports),
  • Snyk vulnerability database API for comprehensive vulnerability data,
  • A typosquatting detection package to catch suspicious package names.
• Connected the microservice to GitHub repositories through GitHub API for automated scanning on push events.
• Employed Node.js for backend processing and REST API provision.
• Designed a user interface for visualizing vulnerability reports and remediation suggestions.
• Leveraged existing GitHub security advisories and npm best practices to harden the analysis accuracy.

Challenges we ran into

• Handling complex dependency trees with nested packages that obscure vulnerability origin.
• Checking transient vulnerabilities in rapidly updated npm packages.
• Filtering false positives from legitimate but newly published or less-known packages.
• Ensuring performance efficiency to analyze large repositories without excessive delay.
• Managing rate limits for GitHub API and Snyk API during frequent scans.

Accomplishments that we're proud of

• Developed a functional microservice that seamlessly integrates multiple security tools to automate thorough vulnerability detection.
• Successfully detected real-world malicious npm packages mimicking legitimate ones (typosquatting).
• Provided actionable, clear reports that help developers prioritize fixes.
• Created a scalable architecture ready for integration in CI/CD pipelines.
• Demonstrated the value of combining open-source tooling with custom logic for enhanced security monitoring.

What we learned

• Security auditing requires continuous update on vulnerability databases and package health signals.
• Collaboration with community resources like Snyk and GitHub advisories enhances reliability.
• Automating scans reduces manual overhead but requires robust heuristics for accuracy.
• Security microservices must balance thoroughness and performance for developer adoption.
• Detecting supply chain threats like typosquatting can significantly reduce risk in software ecosystems.

What's next for Security Vulnerability Analysis

• Extend coverage to other package managers beyond npm (e.g., yarn, pnpm).
• Integrate machine learning models for anomaly detection in package behaviors.
• Automate remediation suggestions such as safe package version upgrades.
• Add scanning capabilities for secrets exposed in code and environment variables.
• Develop plugin support for IDEs and developer tools to provide real-time vulnerability alerts.
• Collaborate with GitHub Actions and other CI/CD platforms for deeper workflow security integration.

Code Security Analysis: Detects common vulnerabilities

SQL Injection (CWE-89) Cross-Site Scripting (CWE-79) Command Injection (CWE-78) Hardcoded Credentials (CWE-798) Weak Random Number Generation (CWE-338) Code Injection via eval() (CWE-95) Insecure Transport (CWE-319) Exposed Secrets (CWE-540) Dependency Vulnerability Scanning: Checks for known vulnerabilities in dependencies

Security Score: Calculates overall security score (0-100)

Detailed Reports: Provides file, line, and remediation information

Multiple Languages: Supports JavaScript, TypeScript, Python, Java, Go, PHP, Ruby

This approach highlights the technical depth, practical implementation, and future roadmap of your security vulnerability analysis microservice project for GitHub repositories, positioning it effectively for the Perplexity hackathon showcase.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20## Inspiration

Built With

• access-token-required
• axios
• gihub-api
• npmjs
• octokit/rest
• octokit/restaxioschalkcommander
• react
• sync
• types/nodetsxtypescript
• typescript