Please consider using NVD for npm packages

If I understand correctly, Dependency Check uses only NSP for checking npm packages. The following command produces a report which refers only to advisories provided by Node Security Project:

${OWASP_DEPENDENCY_CHECK_HOME}/bin/dependency-check.sh --project myproject --out dependency-check --scan package.json

But if NSP analyzer is disabled, then you’ll get an empty report:

${OWASP_DEPENDENCY_CHECK_HOME}/bin/dependency-check.sh --project myproject --out dependency-check --scan package.json --disableNSP

NVD contains CVEs reported against npm packages, for example:

• https://nvd.nist.gov/vuln/detail/CVE-2018-3728
• https://nodesecurity.io/advisories/566

This case is covered by the advisory from Node Security Project. But there may be issues which is not covered by Node Security Project. Furthermore, Node Security Project recently joined nmp, Inc. The advisories are still there, but I am not sure how Node Security Project is going to work in future.

It might make sense to update Dependency Check to be able to use NVD for checking npm packages.

[0x7fh]

NPM Inc. announced to close NSP in September 2018. How will the dependency-checker behave from September on regarding node modules?

[westlakem]

it appears NSP was acquired by NPM, so we’re getting a [ERROR] api.nodesecurity.io now in the logs. Any ideas moving forward on what to use?