CodeGuru is not able to scan a 3rd party library that has vulnerabilities in it
Hi all,
I would like to use CodeGuru in my codepipeline, and I am trying to test it if it can find out that I am using some library that has vulnerabilities or has been deprecated.
I started with a nodejs project and npm install a library called 'request ', which it has been declared that "This package has been deprecated".
I already got some message after I installed the library
then I zip the project and upload to CodeGuru and asked for a scan. but turns out there is 0 finding. I was expecting it has some warning message to pop up.
Could anyone clarify that I am using CodeGuru in the wrong way because I want to use it like CodeQL
- Newest
- Most votes
- Most comments
Hi,
From this page https://docs.aws.amazon.com/codeguru/latest/profiler-ug/what-is-codeguru-profiler.html, it seems that NodeJS is not supported in CodeGuru: Java/JVM and Python are.
Best,
Didier
Relevant content
- asked 3 years ago
- asked 2 years ago
- AWS OFFICIALUpdated 18 days ago
Thanks Didier! I see... I wonder if there is any alternative that I can use to achieve something like codeQL can do or any similar tool can do scanning on 3rd party library.
Hi Kosa, I don't know of AWS having tools for vuln scanning on NodeJS apps. You'd have to install some OSS tool to do that: see https://medium.com/@manjula.aw/nodejs-security-tools-de0d0c937ec0 Thanks for accepting my answer