Forum Discussion
Improved local detection for Node.js modules Background...
Improved local detection for Node.js modules
Background
Previously, the initial detection for Node.js on Linux systems via plugin 178772, reported all Node.js modules and did not distinguish between top level modules and those that are installed as dependencies. This often resulted in the output showing multiple installs of the same module. While this was technically correct, it caused some confusion in terms of modules that could or could not be directly patched/updated by the user. Because Node.js is used by many web applications, the previous plugin output had a negative impact of bloating our users’ scan results.
Changes
To address these problems, optimize this detection, and reduce the size of the relevant scan artefacts, this plugin has been updated so that it now only reports top level modules that are installed, while modules installed as dependencies are reported separately, via a CSV attachment in the plugin output. For Tenable Security Center, attachments in plugin outputs are not possible, so the dependency module will be reported as text output. These change will provide focused customer advisement on the Node.js modules that can and should (when necessary) be updated.
During scanning, we have taken steps to optimize the commands this plugin runs, and how their outputs are stored and processed.
Impact
Users should expect to see smaller, more cohesive output for plugin 178772, as the plugin now only reports top level modules that are installed. Modules installed as dependencies are now reported via a CSV attachment in the plugin. In terms of scan performance and footprint, the changes made here have significantly reduced the relative size of the overall scan database, KB and logs associated with this plugin (attached in the output of plugin 84239, Debugging Log Report).
Impacted Plugins
Target Release Date
January 8, 2024
4 Replies
Correct me if I am wrong, but to have a list in CSV in Security Center user would have to trigger a debugging scan?
Hi @Mateusz Wolanski ,
You are correct. For now, the attachment will not be available in Tenable Security Centre. We are aware of this issue, and currently investigating alternative approaches to solve this, but it may not be ready for the January 8 release date. If not, we will update the plugin again at a later date (to be confirmed) .
Thank you very much for taking the time to post this!
Hello again @Mateusz Wolanski ,
We have found a solution to this issue, so Tenable Security Centre will now display the dependency modules in the regular output, and not in an attached CSV. This will be included in today's release.
Thanks again for your time!
Love it! Thank you! Can't wait for the details ;)
