Detecting dependency vulnerabilities

Thanks to the wealth of modules on npm, we're able to mostly focus on application logic, relying on the ecosystem for canned solutions. This does, however, lead to large dependency trees and security vulnerabilities can be discovered at any time, even for the most conscientious, mature, and popular modules and frameworks.

In this recipe, we will demonstrate how to detect vulnerabilities in a project's dependency tree.

Getting ready

We'll create a folder called app, initialize it as a package, and install express:

$ mkdir app
$ cd app
$ npm init -y 
$ npm install express

We don't need to add any of our own code since we're only checking dependencies.

...