Skip to main content

JavaScript support

tip

Semgrep’s JavaScript coverage leverages framework-specific analysis capabilities that are not present in Semgrep CE. As a result, many framework specific Pro rules will fail to return findings if run on Semgrep CE. To ensure full security coverage, run: semgrep login && semgrep ci.

JavaScript support in Semgrep Code

Semgrep Code is a static application security testing (SAST) tool that detects security vulnerabilities in your first-party code.

Analyses and frameworks

  • Framework-specific control flow analysis
  • Interfile analysis (cross-file)
  • Interprocedural analysis (cross-function)

Coverage

Semgrep aims to provide comprehensive and accurate detection of common OWASP Top 10 issues in source code. Semgrep uses rules, which are instructions based on which it detects patterns in code. These rules are usually organized in rulesets.

By default, Semgrep Code provides you with the p/comment and p/default rulesets. These rulesets provide the most accurate and comprehensive coverage across Semgrep's supported languages.

In addition to rules, the Semgrep engine itself can analyze code and implicit dataflows in the context of the following supported frameworks:

Supported frameworksType of framework
ExpressWeb framework
KoaWeb framework
HapiWeb framework
NestJSWeb framework
Semgrep Code supports 50+ libraries & frameworks based on their overall popularity.
Supported librariesType of library
axiosNetwork library
nodemailNetwork library
node-fetchNetwork library
needleNetwork library
httpNetwork library
httpsNetwork library
netNetwork library
http2Network library
gotNetwork library
requestNetwork library
markedMarkdown library
dotTemplate engine
child-processOS interaction library
nestjsWeb framework
expressWeb framework
koaWeb framework
hapiWeb framework
sqliteDatabase library
sqlite3Database library
typeormDatabase library
mongooseDatabase library
mongodbDatabase library
knexDatabase library
mikro-ormDatabase library
@mikro-orm/coreDatabase library
@mikro-orm/better-sqliteDatabase library
@mikro-orm/entity-generatorDatabase library
@mikro-orm/knexDatabase library
@mikro-orm/libsqlDatabase library
@mikro-orm/mariadbDatabase library
@mikro-orm/migrations-mongodbDatabase library
@mikro-orm/migrationsDatabase library
@mikro-orm/mongodbDatabase library
@mikro-orm/mssqlDatabase library
@mikro-orm/mysqlDatabase library
@mikro-orm/postgresqlDatabase library
@mikro-orm/reflectionDatabase library
@mikro-orm/seederDatabase library
@mikro-orm/sqliteDatabase library
pgDatabase library
pg-nativeDatabase library
pg-poolDatabase library
mysqlDatabase library
mysql2Database library
sequelizeDatabase library
libxmlXML parsing library
xpathXML parsing library
puppeteerLibrary with code execution capabilities
vm2Library with code execution capabilities
vmLibrary with code execution capabilities
rimrafFile System Library
papaparseFile system library
fs-extraFile system library
fsFile system library
sharpFile system library
pathFile system library
webcryptoCryptographic library
cryptoCryptographic library
http-bodyExpress middleware
corsExpress middleware
express-sessionExpress middleware
helmetExpress middleware
@koa/corsKoa middleware
lodashUtility library
validatorString validation library
escape-string-regexpString sanitization library
date-fnsDate manipulation library
momentDate manipulation library
luxonDate manipulation library
dayjsfnsDate manipulation library
mongo-sanitizeString sanitization library
express-mongo-sanitizeString sanitization library

Benchmark results exclusive of AI processing

Semgrep's benchmarking process involves scanning open source repositories, triaging the findings, and making iterative rule updates. This process was developed and is used internally by the Semgrep security research team to monitor and improve rule performance.

Results as of February 25, 2025:

BenchmarkValue
True positive rate (before AI processing) for latest p/default ruleset63%
Lines of code scanned~8 million
Repositories scanned153
Findings triaged to date~600

JavaScript support in Semgrep Supply Chain

Semgrep Supply Chain is a software composition analysis (SCA) tool that detects security vulnerabilities in your codebase introduced by open source dependencies.

Supported package managers

Semgrep supports the following JavaScript package managers:

  • npm
  • Yarn
  • pnpm

Analyses and features

The following analyses and features are available for JavaScript:

Reachability analysis

Reachability refers to whether or not a vulnerable code pattern from a dependency is used in the codebase that imports it. In Semgrep Supply Chain, both a dependency's vulnerable version and code pattern must match for a vulnerability to be considered reachable.

License detection

Semgrep Supply Chain's license compliance feature enables you to explicitly allow or disallow (block) a package's use in your repository based on its license. For example, your company policy may disallow the use of packages with the Creative Commons Attribution-NonCommercial (CC-BY-NC) license. Semgrep can help enforce this restriction.

Malicious dependency detection

Semgrep is able to detect malicious dependencies in your projects and in pull requests (PRs) or merge requests (MRs).

SBOM generation

Semgrep enables you to generate a software bill of materials (SBOM) to assess your third-party dependencies and comply with auditing procedures. Semgrep Supply Chain (SSC) can generate an SBOM for each repository you have added to Semgrep AppSec Platform.

JavaScript support in Semgrep CE

Semgrep CE is a fast, lightweight program analysis tool that can help you detect bugs in your code. It makes use of Semgrep's LGPL 2.1 open source engine.

Analyses

  • Single-file, cross-function constant propagation
  • Single-function taint analysis
  • Semantic analysis

Coverage

tip
  • Check the license of a rule to ensure it meets your licensing requirements. See Licensing for more details.

The Semgrep Registry provides the following JavaScript rulesets:

Sample usage:

semgrep scan --config p/javascript

Not finding what you need in this doc? Ask questions in our Community Slack group, or see Support for other ways to get help.