Static Application Security Testing (SAST) Tool for JavaScript

Question

I'm looking for software that I can integrate into a CI pipeline of a javascript project. The tool should check the code for security issues.

For Python code, I'm happy with bandit. For JavaScript, I have seen ESLint, but I think it is only about formatting. Similar to Flake8 in Python.

I'm primarily looking for gratis tools, but if somebody can strongly recommend a non-gratis tools from personal experience that would be interesting as well.

What I've tried

• eslint-plugin-security, but that is not maintained.
• semgrep, but I'm uncertain if there are good security testing rules for JavaScript
• nodejsscan: Based on semgrep; looks good but takes way too long to run

Answer 1

I think sonarqube could be a nice fit. It's meant to integrate with CI and spots certain security problems in javascript.

Answer 2

There are a number of aspects to static analysis in JS:

• Linting (e.g. eslint & plugins);
• Code coverage (e.g. jest);
• Supply Chain Analysis (e.g. yarn audit)
• Code smells, anti-patterns etc (e.g. SonarQube)

Here is an article on the topic which I found useful. It's about TypeScript, but most of it should apply to plain JavaScript. It goes in depth about how to set up the tools.