# sonarqube-scanner

> SonarQube/SonarCloud Scanner for the JavaScript world

Latest version **5.0.0** (published 2026-07-20) · LGPL-3.0-only license · 0 weekly downloads

## Install

```sh
npm install sonarqube-scanner
pnpm add sonarqube-scanner
yarn add sonarqube-scanner
bun add sonarqube-scanner
```

Provides the command `sonar-scanner-npm`.

## Health

**Score 70/100 (B)** — status: active.

Positive: has types; esm support; no vulnerabilities; has provenance; recently updated; high maintenance score.

Warnings: low downloads.

## Facts

| | |
|---|---|
| Version | 5.0.0 |
| Published | 2026-07-20 |
| First published | 2016-10-16 |
| Weekly downloads | 0 |
| License | LGPL-3.0-only |
| TypeScript types | bundled |
| Module format | ESM + CommonJS |
| Node | >=22.12.0 |
| Dependencies | 10 |
| Unpacked size | 98.3 KB |
| Known vulnerabilities | 0 (+1 in 1 direct dependencies) |
| Install scripts | no |
| Provenance | attested (GitHub Actions) |
| GitHub stars | 55 |
| Author | SonarSource |
| Maintainers | saberduck, gabssnake, andrea-guarino-sonarsource, gregaubert, sonar-jay, philippe-perrin-sonarsource, xay.tanovan, wouter-admiraal-sonarsource, mathieu-sonar, tomverin, jcarsique-sonar, yassin-kammoun-sonarsource, sonartech, lucio.merotta.sonarsource, lpaulger_sonarsource |
| Keywords | sonarqube, sonarcloud, sonarqube-scanner, sonarqube-runner, sonar-scanner, sonar-runner |

## Links

- npm: https://www.npmjs.com/package/sonarqube-scanner
- Repository: https://github.com/SonarSource/sonar-scanner-npm
- Homepage: https://docs.sonarsource.com/sonarqube-server/latest/analyzing-source-code/scanners/npm/introduction/
- Issues: https://community.sonarsource.com/tag/scanner
- npm.io page: https://npm.io/package/sonarqube-scanner

## Dependencies (10)

- [axios](https://npm.io/package/axios.md) 1.18.1
- [semver](https://npm.io/package/semver.md) 7.8.5
- [adm-zip](https://npm.io/package/adm-zip.md) 0.6.0
- [hpagent](https://npm.io/package/hpagent.md) 1.2.0
- [slugify](https://npm.io/package/slugify.md) 1.6.9
- [commander](https://npm.io/package/commander.md) 15.0.0
- [node-forge](https://npm.io/package/node-forge.md) 1.4.0
- [tar-stream](https://npm.io/package/tar-stream.md) 3.2.0
- [proxy-from-env](https://npm.io/package/proxy-from-env.md) 2.1.0
- [properties-file](https://npm.io/package/properties-file.md) 5.0.5

## Alternatives

- [jsforce](https://npm.io/package/jsforce.md) — 851.2K weekly downloads
- [react-native-qrcode-svg](https://npm.io/package/react-native-qrcode-svg.md) — 693.5K weekly downloads
- [@salesforce/plugin-data](https://npm.io/package/@salesforce/plugin-data.md) — 394.9K weekly downloads
- [@backstage/plugin-search-common](https://npm.io/package/@backstage/plugin-search-common.md) — 308.5K weekly downloads
- [@chain-registry/types](https://npm.io/package/@chain-registry/types.md) — 38.4K weekly downloads

## Recent versions

- 5.0.0 (latest) — 2026-07-20
- 4.4.0-alpha.1 (next) — 2026-01-20
- 4.4.0 — 2026-07-16
- 4.3.8 — 2026-06-19
- 4.3.6 — 2026-04-15
- 4.3.5 — 2026-03-11
- 4.3.4 — 2026-01-08
- 4.3.3 — 2026-01-07
- 4.3.2 — 2025-09-25
- 4.3.1 — 2025-09-24
- 4.3.0 — 2025-03-24
- 4.2.8 — 2025-02-28
- 4.2.7 — 2025-02-18
- 4.2.7-alpha.16 — 2025-02-18
- 4.2.7-alpha.15 — 2025-02-18
- … 46 more at https://npm.io/package/sonarqube-scanner/versions

## README

# NPM module to run SonarQube Server and Cloud analyses

`@sonar/scan` makes it very easy to trigger SonarQube [Server](https://www.sonarqube.org)
and [Cloud](https://sonarcloud.io) analyses on a JavaScript code base, without needing
to install any specific tool or (Java) runtime.

This module is analyzed on SonarQube Cloud.

[![Build](https://github.com/SonarSource/sonar-scanner-npm/actions/workflows/build.yml/badge.svg)](https://github.com/SonarSource/sonar-scanner-npm/actions/workflows/build.yml) [![Quality Gate](https://sonarcloud.io/api/project_badges/measure?project=SonarSource_sonar-scanner-npm&metric=alert_status)](https://sonarcloud.io/project/overview?id=SonarSource_sonar-scanner-npm) [![Maintainability](https://sonarcloud.io/api/project_badges/measure?project=SonarSource_sonar-scanner-npm&metric=sqale_rating)](https://sonarcloud.io/project/overview?id=SonarSource_sonar-scanner-npm) [![Reliability](https://sonarcloud.io/api/project_badges/measure?project=SonarSource_sonar-scanner-npm&metric=reliability_rating)](https://sonarcloud.io/project/overview?id=SonarSource_sonar-scanner-npm) [![Security](https://sonarcloud.io/api/project_badges/measure?project=SonarSource_sonar-scanner-npm&metric=security_rating)](https://sonarcloud.io/project/overview?id=SonarSource_sonar-scanner-npm) [![Releases](https://img.shields.io/github/release/SonarSource/sonar-scanner-npm.svg)](https://github.com/SonarSource/sonar-scanner-npm/releases) [![npm version](https://badge.fury.io/js/@sonar%2Fscan.svg)](https://badge.fury.io/js/@sonar%2Fscan)

This is the documentation for v5. If you are using v4, refer to
[the v4 documentation](https://github.com/SonarSource/sonar-scanner-npm/tree/4.3.8). If
you are using v3, refer to
[the v3 documentation](https://github.com/SonarSource/sonar-scanner-npm/tree/3.5.0).

## Installation

_Prerequisite: Node v22.12.0+ (for v5 and above)_

_Prerequisite: Node v18+ (for
[v4](https://github.com/SonarSource/sonar-scanner-npm/tree/4.3.8))_

_Prerequisite: Node v16+ (for
[v3](https://github.com/SonarSource/sonar-scanner-npm/tree/3.5.0), otherwise use
sonarqube-scanner
[v2.9.1](https://github.com/SonarSource/sonar-scanner-npm/tree/2.9.1))_

This package is available on npm as: [`@sonar/scan`](https://www.npmjs.com/package/@sonar/scan)

To install the scanner globally and be able to run analyses on the command line:

```sh
npm install -g @sonar/scan
```

## Getting Started

If you want to run an analysis without having to configure anything in the first place,
simply run the `sonar-scanner-npm` command. The following example assumes that you have
installed SonarQube Server locally:

```
cd my-project
sonar-scanner-npm
```

The deprecated `sonar` and `sonar-scanner` executable aliases were removed in v5. Update
global invocations and package scripts to use `sonar-scanner-npm` instead.

or you can use `npx` without installing:

```
cd my-project
npx @sonar/scan
```

## JavaScript API

`@sonar/scan` v5 is published as an ES module. Use `import` syntax when calling it
from ESM JavaScript:

```js
import { scan } from '@sonar/scan';

await scan({
  serverUrl: 'http://localhost:9000',
  token: process.env.SONAR_TOKEN,
});
```

To force the scanner to use a locally installed `sonar-scanner` executable:

```js
import { customScanner } from '@sonar/scan';

await customScanner({
  serverUrl: 'http://localhost:9000',
  token: process.env.SONAR_TOKEN,
});
```

For CommonJS projects, load `@sonar/scan` with dynamic `import()` instead of
`require()`:

```js
async function run() {
  const { scan } = await import('@sonar/scan');
  await scan({
    serverUrl: 'http://localhost:9000',
    token: process.env.SONAR_TOKEN,
  });
}

run();
```

## Documentation

For the extended information, please refer to its [documentation](https://docs.sonarsource.com/sonarqube-server/latest/analyzing-source-code/scanners/npm/introduction/).

## License

`@sonar/scan` is licensed under the [LGPL v3 License](http://www.gnu.org/licenses/lgpl.txt).

---
_Source: https://npm.io/package/sonarqube-scanner · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._