Fixing the use of a vulnerable NuGet package

Libraries and components can be installed and consumed from a package manager such as NuGet. VS Code has native support, which eases the installation process for ASP.NET Core web developers. With this, it quickly introduces the risk of installing and using a vulnerable NuGet package.

Getting ready

We will use the Online Banking app we used in the previous recipe. Using VS Code, open the sample OnlineBankingApp folder at \Chapter10\vulnerable-package\before\OnlineBankingApp\.

Let's see how we can use tools to discover vulnerable NuGet packages in our app.

Testing vulnerable NuGet packages

To determine if your application is using a vulnerable NuGet package, we can use another tool such as Dotnet Retire. To begin, we first install the dotnet retire vulnerability scanner in our sample Online Banking app:

1. From the starting exercise folder, launch VS Code by typing the following command:

   code .

2. Navigate to Terminal...