Detect malicious node js packages

[kohldampfer]

In the last days, there were in the news that some NodeJS / NPM packages were compromised (see here for more information: npm debug and chalk packages compromised )

Is it possible with SonarQube to find out if one of our projects is using a compromised version? What would I need for that?

[bill.nottingham]

Thanks for the interest - ihis is not directly in the product at this time, but is on the roadmap.