## JavaScript Overview

JavaScript is a high-level, interpreted programming language primarily used for creating interactive and dynamic web content widely used by developers. Endor Labs supports the scanning and monitoring of JavaScript projects. Using Endor Labs, application security engineers and developers can:

- Scan their software for potential security issues and violations of organizational policy.
- Prioritize vulnerabilities in the context of their applications.
- Understand the relationships between software components in their applications.

## System Specifications for Deep Scan

Before you proceed to run a deep scan, ensure that your system meets the following specifications.

| Project Size       | Processor            | Memory  |
|-------------------|---------------------|---------|
| Small projects     | 4-core processor    | 16 GB   |
| Mid-size projects  | 8-core processor    | 32 GB   |
| Large projects     | 16-core processor   | 64 GB   |

### Software Prerequisites

- Install the following software before you scan:
  - Yarn: Any version
  - npm: 6.14.18 or higher versions
  - pnpm: 3.0.0 or higher versions
  - Rush: 5.90.0 or higher versions. To enable Rush support, set the environment variable `ENDOR_RUSH_ENABLED=true`.
- Install Bazel version `5.x.x`, `6.x.x`, `7.x.x`, `8.x.x`, or `9.x.x` if your project uses Bazel. Endor Labs supports Bzlmod with Bazel aspects.
- Make sure your repository includes one or more files with `.js` or `.ts` extension.

To run deep scanning for JavaScript and TypeScript projects make sure you have the following prerequisites installed:

- Install endorctl version 1.7.0 or higher.
- Install Node.js version 4.2.6 or higher to support the required TypeScript version.
- Install a TypeScript version greater than 4.9 and up to 6.X.X.
- Install `tsserver`. TypeScript includes `tsserver`, so installing the right TypeScript version also installs `tsserver`.

| Nodejs Version                   | TypeScript Version               |
|----------------------------------|----------------------------------|
| Lower than 12.2                  | 4.9                             |
| Between 12.2 and 14.17           | 5.0                             |
| Higher than or equal to 14.17    | "Greater than 4.9 up to 6.X.X" |

- Use the following command based on your Node.js version to install typescript:

- 14.17 or higher

```
npm install -g typescript@6
```

- Between 12.2 and 14.17

```
npm install -g typescript@5.0
```

- Lower than 12.2

```
npm install -g typescript@4.9
```

- Run the following command to verify the `tsserver` installation:

```
  which tsserver
  ```

If you are running the endorctl scan with `--install-build-tools`, you don’t need to install `tsserver`.

### Build JavaScript Projects

You can build your JavaScript projects before running a scan. Building first creates a `package-lock.json`, `yarn.lock`, or `pnpm-lock.yaml` file, which speeds up the scan. Ensure your repository has `package.json` and run the following command:

- For npm

```
npm install
```

- For Yarn

```
yarn install
```

- For pnpm

```
pnpm install
```

If the project is not built, endorctl builds the project during the scan and generates `package-lock.json`, `yarn.lock`, or `pnpm-lock.yaml` file. Make sure that npm, Yarn, or pnpm is available on your system. If your repository includes a lock file, endorctl uses the existing file for dependency resolution and does not create it again. The `npm install` command may fail in a subdirectory if your project has a `package-lock.json` file at the root of the repository but not in sub-packages.

To avoid scan failures in monorepo setups, set the following environment variable before you run the scan.

```bash
export ENDOR_JS_USE_ROOT_DIR_LOCK_FILE=true
```

### Specify a Custom Lock File Location

Use `ENDOR_JS_LOCK_FILE_PATH` to specify the exact lock file for endorctl to use during a scan. The variable applies to npm, Yarn, pnpm, and Rush projects.

```bash
export ENDOR_JS_LOCK_FILE_PATH=locks/yarn.lock
```

### Scan Rush Monorepos

Rush is a monorepo management tool for JavaScript/TypeScript. Endor Labs detects Rush repositories and scans them with the standard JavaScript workflow. To scan Rush monorepos, you must first enable Rush detection.

```bash
export ENDOR_RUSH_ENABLED=true
```

Run `endorctl scan` to discover Rush dependencies:

```bash
endorctl scan
```

### Configure Call Graph Generation Timeout

When generating call graphs for JavaScript/TypeScript projects, endorctl uses `tsserver` to analyze the code. You may need to increase the timeout.

```bash
export ENDOR_JS_TSSERVER_TIMEOUT=30
```

### Override JavaScript Package Manager Detection

You can override the automatic JavaScript package manager detection by setting the `ENDOR_JS_PACKAGE_MANAGER` environment variable to `npm`, `yarn`, `pnpm`, or `lerna`.

```bash
export ENDOR_JS_PACKAGE_MANAGER=npm
```

## Scan Bazel Projects

Endor Labs supports Bazel scans for JavaScript and TypeScript.

### Scan TypeScript Projects with rules_ts

Ensure that the following prerequisites are in place:

- A Bazel workspace (WORKSPACE or `MODULE.bazel`)
- `rules_ts` >= 1.0.0 in your workspace
- endorctl with `--use-bazel-aspects`

Run the following command to discover and scan TypeScript targets:

```bash
bazel query 'kind(ts_project, //...)'
```

### Run a Scan

Perform a scan to get visibility into your software composition and resolve dependencies:

```bash
endorctl scan
```

### Understand the Scan Process

Dependency analysis tools analyze the lock file of an npm, yarn, pnpm, or Rush based package. Endor Labs surpasses mere manifest file analysis by expertly resolving JavaScript dependencies and identifies:

- Dependencies listed in the manifest file but not used by the application.
- Dependencies used by the application but not listed in the manifest file.
- Dependencies categorized as test in the manifest, but used directly by the application.

### Configure Private NPM Package Repositories

Endor Labs supports fetching and scanning dependencies from private npm package registries.

### Known Limitations
- Endor Labs doesn’t currently support local package references.
- If a dependency cannot resolve from the lock file, building that specific package may fail.

### Troubleshoot Errors
- **Unresolved dependency errors**: The manifest file `package.json` is not buildable. Try running `npm install`, `yarn install`, `pnpm install`, or `rush install` in the root project to debug this error.
- **Resolved dependency errors**: A dependency version does not exist or cannot be found.