typescript language

JavaScript Overview

JavaScript is a high-level, interpreted programming language primarily used for creating interactive and dynamic web content widely used by developers. Endor Labs supports the scanning and monitoring of JavaScript projects. Using Endor Labs, application security engineers and developers can:

• Scan their software for potential security issues and violations of organizational policy.
• Prioritize vulnerabilities in the context of their applications.
• Understand the relationships between software components in their applications.

System Specifications for Deep Scan

Before you proceed to run a deep scan, ensure that your system meets the following specifications.

Software Prerequisites

• Install the following software before you scan:
  • Yarn: Any version
  • npm: 6.14.18 or higher versions
  • pnpm: 3.0.0 or higher versions
  • Rush: 5.90.0 or higher versions. To enable Rush support, set the environment variable ENDOR_RUSH_ENABLED=true.
• Install Bazel version 5.x.x, 6.x.x, 7.x.x, 8.x.x, or 9.x.x if your project uses Bazel. Endor Labs supports Bzlmod with Bazel aspects.
• Make sure your repository includes one or more files with .js or .ts extension.

To run deep scanning for JavaScript and TypeScript projects make sure you have the following prerequisites installed:

• Install endorctl version 1.7.0 or higher.
• Install Node.js version 4.2.6 or higher to support the required TypeScript version.
• Install a TypeScript version greater than 4.9 and up to 6.X.X.
• Install tsserver. TypeScript includes tsserver, so installing the right TypeScript version also installs tsserver.

• Use the following command based on your Node.js version to install typescript:

• 14.17 or higher

npm install -g typescript@6

• Between 12.2 and 14.17

npm install -g typescript@5.0

• Lower than 12.2

npm install -g typescript@4.9

• Run the following command to verify the tsserver installation:

  which tsserver

If you are running the endorctl scan with --install-build-tools, you don’t need to install tsserver.

Build JavaScript Projects

You can build your JavaScript projects before running a scan. Building first creates a package-lock.json, yarn.lock, or pnpm-lock.yaml file, which speeds up the scan. Ensure your repository has package.json and run the following command:

• For npm

npm install

• For Yarn

yarn install

• For pnpm

pnpm install

If the project is not built, endorctl builds the project during the scan and generates package-lock.json, yarn.lock, or pnpm-lock.yaml file. Make sure that npm, Yarn, or pnpm is available on your system. If your repository includes a lock file, endorctl uses the existing file for dependency resolution and does not create it again. The npm install command may fail in a subdirectory if your project has a package-lock.json file at the root of the repository but not in sub-packages.

To avoid scan failures in monorepo setups, set the following environment variable before you run the scan.

export ENDOR_JS_USE_ROOT_DIR_LOCK_FILE=true

Specify a Custom Lock File Location

Use ENDOR_JS_LOCK_FILE_PATH to specify the exact lock file for endorctl to use during a scan. The variable applies to npm, Yarn, pnpm, and Rush projects.

export ENDOR_JS_LOCK_FILE_PATH=locks/yarn.lock

Scan Rush Monorepos

Rush is a monorepo management tool for JavaScript/TypeScript. Endor Labs detects Rush repositories and scans them with the standard JavaScript workflow. To scan Rush monorepos, you must first enable Rush detection.

export ENDOR_RUSH_ENABLED=true

Run endorctl scan to discover Rush dependencies:

endorctl scan

Configure Call Graph Generation Timeout

When generating call graphs for JavaScript/TypeScript projects, endorctl uses tsserver to analyze the code. You may need to increase the timeout.

export ENDOR_JS_TSSERVER_TIMEOUT=30

Override JavaScript Package Manager Detection

You can override the automatic JavaScript package manager detection by setting the ENDOR_JS_PACKAGE_MANAGER environment variable to npm, yarn, pnpm, or lerna.

export ENDOR_JS_PACKAGE_MANAGER=npm

Scan Bazel Projects

Endor Labs supports Bazel scans for JavaScript and TypeScript.

Scan TypeScript Projects with rules_ts

Ensure that the following prerequisites are in place:

• A Bazel workspace (WORKSPACE or MODULE.bazel)
• rules_ts >= 1.0.0 in your workspace
• endorctl with --use-bazel-aspects

Run the following command to discover and scan TypeScript targets:

bazel query 'kind(ts_project, //...)'

Run a Scan

Perform a scan to get visibility into your software composition and resolve dependencies:

endorctl scan

Understand the Scan Process

Dependency analysis tools analyze the lock file of an npm, yarn, pnpm, or Rush based package. Endor Labs surpasses mere manifest file analysis by expertly resolving JavaScript dependencies and identifies:

• Dependencies listed in the manifest file but not used by the application.
• Dependencies used by the application but not listed in the manifest file.
• Dependencies categorized as test in the manifest, but used directly by the application.

Configure Private NPM Package Repositories

Endor Labs supports fetching and scanning dependencies from private npm package registries.

Known Limitations

• Endor Labs doesn’t currently support local package references.
• If a dependency cannot resolve from the lock file, building that specific package may fail.

Troubleshoot Errors

• Unresolved dependency errors: The manifest file package.json is not buildable. Try running npm install, yarn install, pnpm install, or rush install in the root project to debug this error.
• Resolved dependency errors: A dependency version does not exist or cannot be found.