Demo Setup and Run Dependency Scanning

In this tutorial, you’ll configure Jenkins to scan project dependencies using two methods:

1. NPM Audit (critical-level checks)
2. OWASP Dependency-Check (via Jenkins plugin)

These scans help you catch vulnerabilities early and enforce quality gates in your CI pipeline.

Table of Contents

• 1. NPM Dependency Audit
• 2. OWASP Dependency-Check Plugin
  • 2.1 Install the Plugin
  • 2.2 Global Tool Configuration
  • 2.3 Generate Pipeline Snippet
• 3. Running the Pipeline
• 4. Enforcing Quality Gates
• Conclusion

1. NPM Dependency Audit

Add an NPM audit stage to your Jenkinsfile:

pipeline {
  tools {
    nodejs 'nodejs-22-6-0'
  }
  stages {
    stage('Install Dependencies') {
      steps {
        sh 'npm install --no-audit'
      }
    }
    stage('NPM Dependency Audit') {
      steps {
        sh '''
          npm audit --audit-level=critical
          echo $?
        '''
      }
    }
  }
}

What happens:

• npm install --no-audit installs dependencies without auditing.
• npm audit --audit-level=critical checks for critical vulnerabilities and exits 1 if found.

Sample package.json

{
  "scripts": {
    "start": "node app.js",
    "test": "mocha app-test.js --timeout 10000 --reporter mocha-junit-reporter --exit",
    "coverage": "nyc --reporter cobertura --reporter lcov --reporter text --reporter json-summary mocha app-test.js"
  },
  "nyc": {
    "check-coverage": true,
    "lines": 90
  },
  "dependencies": {
    "cors": "^2.8.5",
    "express": "^4.18.2",
    "mocha-junit-reporter": "^2.2.1",
    "mongoose": "^5.13.20",
    "nyc": "^15.1.0",
    "serverless-http": "^3.2.0"
  },
  "devDependencies": {
    "chai": "*",
    "chai-http": "*"
  }
}

CLI Output Example

# npm audit --audit-level=critical
@babel/traverse <7.23.2
Severity: critical
...

2. OWASP Dependency-Check Plugin

The OWASP Dependency-Check plugin scans multiple formats (HTML, XML, JSON, CSV) and supports quality gates.

2.1 Install the Plugin

1. Manage Jenkins > Manage Plugins > Available
2. Search OWASP Dependency-Check, install, and restart.

2.2 Global Tool Configuration

After restarting, go to Manage Jenkins > Global Tool Configuration.
Add a Dependency-Check installation (e.g., version 10.0.3) and enable auto-install from GitHub.

2.3 Generate Pipeline Snippet

In Pipeline Syntax > Snippet Generator:

• Step: Invoke Dependency-Check
• Installation: OWASP-DepCheck-10
• Arguments:

  --scan ./
  --out ./
  --format 'ALL'
  --prettyPrint
  

Insert into your Jenkinsfile:

stage('OWASP Dependency Check') {
  steps {
    dependencyCheck additionalArguments: '''
      --scan ./
      --out ./
      --format 'ALL'
      --prettyPrint
    ''', odcInstallation: 'OWASP-DepCheck-10'
  }
}

3. Running the Pipeline

Commit and push your Jenkinsfile. The first run downloads the NVD database (~263 000 records), taking about 20–30 minutes. Look for logs like:

[INFO] Checking for updates
[WARNING] An NVD API Key has not been provided ...
[INFO] NVD API has 263,560 records in this update
...
[INFO] Writing report to /workspace/.../dependency-check-report.html

Reports generated in the workspace:

By default, findings don’t fail the build:

4. Enforcing Quality Gates

Fail builds if thresholds are exceeded:

1. In Snippet Generator, select Publish Dependency-Check results
2. Configure:
   • XML report pattern: dependency-check-report.xml
   • Stop build on threshold violation
   • Failed total critical: 1

Generated snippet:

dependencyCheckPublisher failedTotalCritical: 1,
                       pattern: 'dependency-check-report.xml',
                       stopBuild: true

Combine both scans in parallel:

pipeline {
  stages {
    stage('Dependency Scanning') {
      parallel {
        stage('NPM Dependency Audit') {
          steps {
            sh '''
              npm audit --audit-level=critical
              echo $?
            '''
          }
        }
        stage('OWASP Dependency Check') {
          steps {
            dependencyCheck additionalArguments: '''
              --scan ./
              --out ./
              --format 'ALL'
              --prettyPrint
            ''', odcInstallation: 'OWASP-DepCheck-10'
            dependencyCheckPublisher failedTotalCritical: 1,
                                  pattern: 'dependency-check-report.xml',
                                  stopBuild: true
          }
        }
      }
    }
  }
}

On the next build you’ll see:

[INFO] Skipping the NVD API Update as it was completed within the last 240 minutes
...
Findings exceed configured thresholds

Conclusion

In this guide, we have:

• Integrated NPM Audit to catch critical Node.js vulnerabilities.
• Configured OWASP Dependency-Check for comprehensive scanning.
• Parallelized both stages to reduce build time.
• Enforced quality gates to automatically fail on critical findings.

Address the flagged vulnerabilities to keep your application secure.