The OWASP Dependency-Check tool is a free open-source Software Composition Analysis (SCA) tool that attempts to detect publicly disclosed vulnerabilities contained within a project's dependencies. It does this by determining if there is a Common Platform Enumeration (CPE) identifier for a given dependency.
Yesterday I explained how to integrate the OWASP Dependency Check extension in your build pipeline and use to scan .NET applications; Today I want to show how to use it for Angular applications.
For Angular applications dependencies can be found in the package.json or package-lock.json. I updated the build task scan path to check for these files:
Important: before you run this tool for your Angular application, make sure you first have installed all dependencies using npm install otherwise the tool will not work.
Here is an example HTML output for one of our applications:
