v3.0.1 does not work with NodeJS

v3.0.1 of dependency-check no longer works on NodeJS/NPM projects.

Reproduce the issue by following these steps using both dependency-check@v2.0.1 and dependency-check@v3.0.1:

• Set up an example NodeJS/NPM project and install a package with a known vulnerability
  • I used an old version of uglify-js, any version before 2.6.0 has vulnerabilities:
  • mkdir test && cd test && npm init -y && npm i -D uglify-js@2.4.1
• Run dependency-check on the project:
  • dependency-check --enableExperimental --project test --log ./log.txt -f ALL -o ./ -s ./

---

v2.0.1 Scan Info and Results:

• dependency-check version: 2.0.1
• Dependencies Scanned: 24 (8 unique)
• Vulnerable Dependencies: 1
• Vulnerabilities Found: 3
• Vulnerabilities Suppressed: 0
• Vulnerabilities:
  • cpe:/a:uglifyjs_project:uglifyjs:2.4.1
  • CVE-2015-8858
  • NSP-48
  • NSP-39

v3.0.1Scan Info and Results:

• dependency-check version: 3.0.1
• Dependencies Scanned: 9 (8 unique)
• Vulnerable Dependencies: 0
• Vulnerabilities Found: 0
• Vulnerabilities Suppressed: 0
• Vulnerabilities:
  • NONE

[stefanneuhaus]

@stevespringett Maybe this one? 😬

see rxaviers/gist:7360908 :octocat:

[lock[bot]]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.