# minder

> Runs NPM or Yarn audit and can be configured to fail tasks if the audit finds vulnerable packages

Latest version **1.1.2** (published 2019-11-30) · MIT license · 0 weekly downloads

## Install

```sh
npm install minder
pnpm add minder
yarn add minder
bun add minder
```

Provides the command `minder`.

## Health

**Score 15/100 (F)** — status: abandoned.

Positive: no vulnerabilities.

Warnings: low downloads; no types; no esm support.

Negative: abandoned; low maintenance score.

## Facts

| | |
|---|---|
| Version | 1.1.2 |
| Published | 2019-11-30 |
| First published | 2019-05-14 |
| Weekly downloads | 0 |
| License | MIT |
| TypeScript types | none |
| Module format | CommonJS |
| Node | >=10.0.0 |
| Dependencies | 3 |
| Unpacked size | 17.5 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| GitHub stars | 6 |
| Author | MatthewCharlton |
| Maintainers | matthewcharlton |
| Keywords | CI, security, audit |

## Links

- npm: https://www.npmjs.com/package/minder
- Repository: https://github.com/MatthewCharlton/minder
- Homepage: https://github.com/MatthewCharlton/minder#readme
- Issues: https://github.com/MatthewCharlton/minder/issues
- npm.io page: https://npm.io/package/minder

## Dependencies (3)

- [npm-run](https://npm.io/package/npm-run.md) ^5.0.1
- [npm-audit-html](https://npm.io/package/npm-audit-html.md) ^1.4.0
- [yarn-audit-html](https://npm.io/package/yarn-audit-html.md) ^1.2.1

## Alternatives

- [random-seedable](https://npm.io/package/random-seedable.md) — 27.9K weekly downloads
- [n2words](https://npm.io/package/n2words.md) — 22.2K weekly downloads
- [@stdlib/math-base-special-factorialln](https://npm.io/package/@stdlib/math-base-special-factorialln.md) — 5.7K weekly downloads
- [@stdlib/math-base-special-abs2](https://npm.io/package/@stdlib/math-base-special-abs2.md) — 1.7K weekly downloads
- [commons-math-interpolation](https://npm.io/package/commons-math-interpolation.md) — 1.4K weekly downloads

## Recent versions

- 1.1.2 (latest) — 2019-11-30
- 1.1.1 — 2019-06-25
- 1.1.0 — 2019-05-19
- 1.0.1 — 2019-05-16
- 1.0.0 — 2019-05-14

## README

# Minder

A Node application to audit project dependencies with security issues before they make it into production

## Overview

**minder** is a wrapper for `npm audit` and `yarn audit`.<br>
You can configure **minder** to call either `npm audit` or `yarn audit` and set it to fail CI builds or a pre-commit hook if the audit finds packages with security issues matching your configured severity level. <br>
You can also output the results to an HTML report courtesy of [npm-audit-html](https://github.com/eventOneHQ/npm-audit-html) and [yarn-audit-html](https://github.com/davityavryan/yarn-audit-html).

### Getting Started

**Usage**: minder

You can create a config file to commit with your project. **minder** looks for a file named `minder.config.json` in the current working directory from which the script was called. <br>
Example: <br>

```javascript
{
  "severity": "high",
  "report": true,
  "html-report-filepath": "audit-report.html",
  "registry": "https://registry.npmjs.org/",
  "whitelisted-advisories": ["803"]
}
```

### Explaination of options

| Option                 | Description                                                                                                        |
| ---------------------- | ------------------------------------------------------------------------------------------------------------------ |
| severity               | configure what severity you would like to fail on. Must be one of: "info", "low", "moderate", "high" or "critical" |
| package-manager        | choose what package manager audit endpoint to use. Must be one of: "npm" or "yarn"                                 |
| registry               | choose what registry URL the audit payload will be sent to                                                         |
| report                 | choose to output a HTML report of the audit results. Must be one of: `true` or `false`                             |
| html-report-filepath   | set a custom file name of HTML report, only applicable if "report" is set to true                                  |
| audit-fail-build       | sets the exit code to 1 when true or 0 when false. Must be one of: `true` or `false`                               |
| whitelisted-advisories | array of advisory IDs to allow/ignore. Must be an array of strings                                                 |

If no config file is passed then the following defaults will be used:

| Option                 | Default value |
| ---------------------- | ------------- |
| severity               | "critical"    |
| package-manager        | "npm"         |
| registry               | ""            |
| report                 | false         |
| html-report-filepath   | ""            |
| audit-fail-build       | false         |
| whitelisted-advisories | []            |

### Add a plugin

You can also extend functionality by writing your own plugin. **minder** looks for a file named `minder-plugin.js` in the current working directory from which the script was called. <br>
The audit response is passed as the first parameter and the config overrides as the second. <br>

Example:

```javascript
module.exports = function minderPlugin(data, config) {
  console.log(`Do something with: ${data} and ${config}`);
};
```

## Built With

- [npm-audit-html](https://github.com/eventOneHQ/npm-audit-html) - NPM Audit HTML Report Generator
- [yarn-audit-html](https://github.com/davityavryan/yarn-audit-html) - Yarn Audit HTML Report Generator
- [npm-run](https://github.com/timoxley/npm-run) - Runs locally-installed node module executables. Used to trigger the HTML Reports

## License

This project is licensed under the MIT License - see the [LICENSE](LICENSE) file for details

---
_Source: https://npm.io/package/minder · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._