# danger-plugin-audit

> Danger plugin for yarn audit summary

Latest version **0.1.4** (published 2022-01-13) · MIT license · 0 weekly downloads

## Install

```sh
npm install danger-plugin-audit
pnpm add danger-plugin-audit
yarn add danger-plugin-audit
bun add danger-plugin-audit
```

## Health

**Score 25/100 (F)** — status: abandoned.

Positive: has types; no vulnerabilities; high quality score.

Warnings: low downloads; no esm support; pre 1.0.

Negative: abandoned; low maintenance score.

## Facts

| | |
|---|---|
| Version | 0.1.4 |
| Published | 2022-01-13 |
| First published | 2022-01-11 |
| Weekly downloads | 0 |
| License | MIT |
| TypeScript types | bundled |
| Module format | CommonJS |
| Node | >=10 |
| Dependencies | 1 |
| Unpacked size | 21.7 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| GitHub stars | 0 |
| Author | Yandimirkin Vladislav |
| Maintainers | trycontrolmymind |
| Keywords | danger, danger-plugin, danger-yarn, yarn audit, danger yarn audit |

## Links

- npm: https://www.npmjs.com/package/danger-plugin-audit
- Repository: https://github.com/trycontrolmymind/danger-plugin-yarn-audit
- Issues: https://github.com/trycontrolmymind/danger-plugin-yarn-audit/issues
- npm.io page: https://npm.io/package/danger-plugin-audit

## Dependencies (1)

- [ejs](https://npm.io/package/ejs.md) ^3.1.6

## Recent versions

- 0.1.4 (latest) — 2022-01-13
- 0.1.3 — 2022-01-11
- 0.1.1 — 2022-01-11

## README

## danger-plugin-audit

Danger plugin which will create notification when found any vulnerable `yarn audit` summary

## Usage

Install:

```sh
yarn add -D danger-plugin-audit
```

dangerfile.js:

```typescript
const { schedule } = require("danger");
const { yarnAudit } = require("danger-plugin-audit");

// Note: You need to use schedule() check
schedule(yarnAudit());
```

## Options

### Filter by vulnerability level

Applying the level flag will limit the audit table to vulnerabilities of the corresponding level and above.

https://classic.yarnpkg.com/en/docs/cli/audit/#toc-commands

```javascript
schedule(yarnAudit({ level: "high" }));
```

### Group by type

Applying the groups flag will limit the audit table to vulnerabilities of the corresponding dependency groups (e.g dependencies, devDependencies).

https://classic.yarnpkg.com/en/docs/cli/audit/#toc-commands

```javascript
schedule(yarnAudit({ groups: "dependencies devDependencies" }));
```

## Example

| title                              | path          | patched in         | more          |
| ---                                | ---           | ---                | ---           |
| ⚠️ Prototype Pollution in node-jsonpointer | danger > jsonpointer | >=5.0.0 | [https://github.com/advisories/GHSA-282f-qqgm-c34q](https://github.com/advisories/GHSA-282f-qqgm-c34q) |
| ❗ Uncontrolled Resource Consumption in parse-link-header | danger > parse-link-header | >=2.0.0 | [https://github.com/advisories/GHSA-q674-xm3x-2926](https://github.com/advisories/GHSA-q674-xm3x-2926) |


2 vulnerabilities found - Package audited 167.  
Severity:  0 info |  0 low |  1 moderate |  1 high |  0 critical | 

Full example you can find here:
https://gitlab.com/vlaad360/example-project-danger/-/merge_requests/1

---
_Source: https://npm.io/package/danger-plugin-audit · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._