I'm looking for software that I can integrate into a CI pipeline of a project. The tool should check the code for security issues.

For Python code, I'm happy with bandit. For JavaScript, I have seen ESLint, but I think it is only about formatting. Similar to Flake8 in Python.

I'm primarily looking for tools, but if somebody can strongly recommend a non-gratis tools from personal experience that would be interesting as well.

What I've tried

  • eslint-plugin-security, but that is not maintained.
  • semgrep, but I'm uncertain if there are good security testing rules for JavaScript
  • nodejsscan: Based on semgrep; looks good but takes way too long to run

2 Answers 2


I think sonarqube could be a nice fit. It's meant to integrate with CI and spots certain security problems in javascript.


There are a number of aspects to static analysis in JS:

  • Linting (e.g. eslint & plugins);
  • Code coverage (e.g. jest);
  • Supply Chain Analysis (e.g. yarn audit)
  • Code smells, anti-patterns etc (e.g. SonarQube)

Here is an article on the topic which I found useful. It's about TypeScript, but most of it should apply to plain JavaScript. It goes in depth about how to set up the tools.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.