Title: SonarQube - JS Dependencies Security Vulnerability Scanning
Tags: jenkins;sonarqube;jenkins-plugins;sonarqube-scan;javascript-security
Question: I have a large project which includes a front end portion downloading dependencies through NPM/Yarn and was looking for security vulnerability scanning for these third party dependencies defined in package.json.
I am already aware of options such as Snyk, retireJS, NSP (now acquired by NPM) and the like, however was wondering whether there is a decent plugin which I can use to add to SonarQube.  The idea would be to scan the list of dependencies, check it with a CVE database and generate an HTML report with the vulnerabilities identifying the level of risk for each one of them.
Thanks


Here is another answer: How about using OWASP Dependency Check and integrate the report into SonarQube using this plugin?
It would be using the info from NSP and RetireJS to do the scan.

{'source': 'StackExchangeDataset', 'subset': 'stackoverflow.com', 'metadata': {'AnswerCount': 1, 'CommentCount': 0, 'ContentLicense': 'CC BY-SA 4.0', 'CreationDate': '2018:00:07/13/18', 'FavoriteCount': 2.0, 'PostTypeId': 1, 'Tags': '<jenkins><sonarqube><jenkins-plugins><sonarqube-scan><javascript-security>', 'Title': 'SonarQube - JS Dependencies Security Vulnerability Scanning', 'ViewCount': 2029, 'id': 51325214, 'user_AboutMe': None, 'user_AccountId': 2024332.0, 'user_DisplayName': 'user1809790', 'user_Reputation': 1339.0, 'user_Views': 151.0, 'user_id': 1809790.0}}