# threat-model-manager

> Threat model documentation

Latest version **1.1.7** (published 2021-03-29) · Apache-2.0 license · 0 weekly downloads

## Install

```sh
npm install threat-model-manager
pnpm add threat-model-manager
yarn add threat-model-manager
bun add threat-model-manager
```

Provides the command `threat-model-manager`.

## Health

**Score 15/100 (F)** — status: abandoned.

Positive: no vulnerabilities.

Warnings: low downloads; no types; no esm support.

Negative: abandoned; low maintenance score.

## Facts

| | |
|---|---|
| Version | 1.1.7 |
| Published | 2021-03-29 |
| First published | 2020-08-26 |
| Weekly downloads | 0 |
| License | Apache-2.0 |
| TypeScript types | none |
| Module format | CommonJS |
| Dependencies | 8 |
| Unpacked size | 79.8 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| GitHub stars | 0 |
| Author | Isotoma |
| Maintainers | winjer |

## Links

- npm: https://www.npmjs.com/package/threat-model-manager
- Repository: https://github.com/isotoma/threat-model-manager
- Homepage: https://github.com/isotoma/threat-model-manager#readme
- Issues: https://github.com/isotoma/threat-model-manager/issues
- npm.io page: https://npm.io/package/threat-model-manager

## Dependencies (8)

- [fp-ts](https://npm.io/package/fp-ts.md) ^2.8.1
- [io-ts](https://npm.io/package/io-ts.md) ^2.2.10
- [ramda](https://npm.io/package/ramda.md) ^0.27.1
- [yargs](https://npm.io/package/yargs.md) ^15.4.1
- [js-yaml](https://npm.io/package/js-yaml.md) ^3.14.0
- [monocle-ts](https://npm.io/package/monocle-ts.md) ^2.3.3
- [newtype-ts](https://npm.io/package/newtype-ts.md) ^0.3.4
- [io-ts-types](https://npm.io/package/io-ts-types.md) ^0.5.10

## Recent versions

- 1.1.7 (latest) — 2021-03-29
- 1.1.6 — 2021-03-29
- 1.1.5 — 2021-03-29
- 1.1.4 — 2021-03-29
- 1.1.3 — 2021-03-29
- 1.1.2 — 2020-09-07
- 1.1.1 — 2020-09-07
- 1.1.0 — 2020-08-28
- 1.0.3 — 2020-08-28
- 1.0.2 — 2020-08-26
- 1.0.1 — 2020-08-26
- 1.0.0 — 2020-08-26

## README

# threat-model-manager

Documentation management for threat models

## Building it

You can install from npm:

    npm i threat-model-manager

Or build from source:

    npm i
    npm run build

If you build from source you will need to run:

    node lib/cli.js generate filename.yaml

## Running it

If installed from npm.

Currently there is only one command, `generate`:

    threat-model-manager generate filename.yaml

## Input file format

The input file is a YAML file of the following format:

    classes:
      node-class-a:
        label: Class A
        threats:
        - type: <threat type>
          threat: text for threat
          notes: some text
          risk: a number
          ticket: a reference to a ticket for resolution/mitigation
    components:
      component-a:
        label: Component A
    nodes:
      node-name-a:
        label: The name for node a
        component: component-a
        classes:
        - node-class-a
        threats:
        - type: <threat type>
          threat: text for threat
          notes: some text
          risk: a number
          ticket: a reference to a ticket for resolution/mitigation
        flows:
        - to: node-name-b
          threats:
          - type: <threat type>
            threat: text for threat
            notes: some text
            risk: a number
            ticket: a reference to a ticket for resolution/mitigation

The threat types are one of:

- spoofing
- tampering
- repudiation
- information
- denial
- elevation

node names are only used for references between flows and nodes, but the model is checked to ensure there are no dangling references, but orphans are ok.

## Output

The output is a graphviz dot file per component, and one overall, plus pngs for each.

Numeric references are generated on the fly, but are not stable if you add or remove nodes or flows.

---
_Source: https://npm.io/package/threat-model-manager · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._