Node Security service shutdown: getaddrinfo ENOTFOUND api.nodesecurity.io

Question

The Node Security Platform service has been depreciated since 30 September this year. I have been continuing using the NSP package until it finally failed today. I'd like to document the error in public so others can find it later.

The error I got today:

Error: Client request error: getaddrinfo ENOTFOUND api.nodesecurity.io api.nodesecurity.io:443

> eslint . && nsp check

(+) Error: Client request error: getaddrinfo ENOTFOUND api.nodesecurity.io api.nodesecurity.io:443
npm ERR! code ELIFECYCLE
npm ERR! errno 1
npm ERR! [email protected] lint: `eslint . && nsp check`
npm ERR! Exit status 1
npm ERR!
npm ERR! Failed at the [email protected] lint script.
npm ERR! This is probably not a problem with npm. There is likely additional logging output above.

Answer 1

"beginning with npm@6, a new command, npm audit, recursively analyzes your dependency trees to identify specifically what’s insecure, recommend a replacement, or fix it automatically with npm audit fix."

Hence, updating

nsp check

to

npm audit --audit-level high

Other configurations and options can be found here

Note that --audit-level high flag might only work for NPM version > v6.4.0 (read v6.4.0-next.0 commits)

Configurable audit level for non-zero exit npm audit currently exits with exit code 1 if any vulnerabilities are found of any level. Added a flag of --audit-level to npm audit to allow it to pass if only vulnerabilities below a certain level are found.

Example: npm audit --audit-level=high will exit with 0 if only low or moderate level vulns are detected.

---

NPM Docs: https://docs.npmjs.com/auditing-package-dependencies-for-security-vulnerabilities

Official blog: https://blog.npmjs.org/post/175511531085/the-node-security-platform-service-is-shutting

---

Updates about ignoring security advisory

There are NPM packages made available to extend features of the new npm-audit command (like ignoring certain advisories), for examples:

• audit-filter
• better-npm-audit (couldn't get the above package working, so created this package myself)