NullVoid is a static scanner for malicious code in npm packages and Node.js projects. GitHub data feeds it in three places: live vulnerability lookups during a scan, community signals about a package’s source repository, and the training labels for its machine-learning models.<\/p>\n\n\n\n
For every declared dependency, NullVoid queries the GitHub Advisory Database<\/a> through the GraphQL API ( Each matching advisory becomes a finding carrying:<\/p>\n\n\n\n GHSA is one of several IoC providers, alongside npm advisories, NVD and optionally Snyk. Results are cached and combined with the other sources. It is enabled by default; set Code: When a package’s Code: NullVoid’s dependency and behavioral models are retrained on a schedule by a GitHub Actions workflow ( Code: NullVoid also runs inside GitHub: it can emit SARIF, which GitHub code scanning picks up through Questions or problems: open an issue<\/a> or email caterer.01boars@icloud.com<\/a>. Report vulnerabilities as described in SECURITY.md<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":" NullVoid is a static scanner for malicious code in npm packages and Node.js projects. GitHub data feeds it in three places: live vulnerability lookups during a scan, community signals about a package’s source repository, and the training labels for its machine-learning models. 1. Live advisory lookups (GitHub Security Advisories) For every declared dependency, NullVoid queries […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8],"tags":[179],"class_list":["post-613","post","type-post","status-publish","format-standard","hentry","category-code","tag-nullvoid"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/kurtgrung.com\/blog\/wp-json\/wp\/v2\/posts\/613","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/kurtgrung.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kurtgrung.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kurtgrung.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/kurtgrung.com\/blog\/wp-json\/wp\/v2\/comments?post=613"}],"version-history":[{"count":3,"href":"https:\/\/kurtgrung.com\/blog\/wp-json\/wp\/v2\/posts\/613\/revisions"}],"predecessor-version":[{"id":616,"href":"https:\/\/kurtgrung.com\/blog\/wp-json\/wp\/v2\/posts\/613\/revisions\/616"}],"wp:attachment":[{"href":"https:\/\/kurtgrung.com\/blog\/wp-json\/wp\/v2\/media?parent=613"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kurtgrung.com\/blog\/wp-json\/wp\/v2\/categories?post=613"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kurtgrung.com\/blog\/wp-json\/wp\/v2\/tags?post=613"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}https:\/\/api.github.com\/graphql<\/code>). It asks for npm-ecosystem advisories affecting the package, then checks the installed version against each advisory’s vulnerableVersionRange<\/code> so only advisories that actually apply are reported.<\/p>\n\n\n\n\n
GITHUB_TOKEN<\/code> (or NULLVOID_GITHUB_TOKEN<\/code>) for higher rate limits. See IOC_USAGE.md<\/a> for configuration.<\/p>\n\n\n\nts\/src\/lib\/providers\/ghsa.ts<\/code><\/a><\/p>\n\n\n\n2. Community signals from the source repository<\/h2>\n\n\n\n
repository<\/code> field points at GitHub, NullVoid reads the repository’s public metadata from the REST API (GET \/repos\/{owner}\/{repo}<\/code>) and uses its star count as one input (30% weight, alongside npm downloads and dependents) to a popularity score. That score feeds the dependency-confusion and ML detectors, so a brand-new package with no real repository behind it is treated differently from an established, widely starred project.<\/p>\n\n\n\nts\/src\/lib\/communityAnalysis.ts<\/code><\/a><\/p>\n\n\n\n3. Training data for the ML models<\/h2>\n\n\n\n
ml-model-retrain.yml<\/code><\/a>). The export scripts page through the REST advisories endpoint (GET \/advisories?ecosystem=npm&type=malware<\/code>, plus type=reviewed<\/code>), skip withdrawn advisories, and collect the affected npm packages as labelled examples. GitHub’s curated malware advisories are what let the models learn what real npm supply-chain attacks look like, rather than relying on synthetic samples.<\/p>\n\n\n\nml-model\/export-features.js<\/code><\/a>, ml-model\/export-behavioral-features.js<\/code><\/a><\/p>\n\n\n\nRunning NullVoid on GitHub<\/h2>\n\n\n\n
github\/codeql-action\/upload-sarif<\/code>, so findings show up in a repository’s Security tab and on pull requests. The workflow is in the README<\/a> and CI_INTEGRATION.md<\/a>.<\/p>\n\n\n\nSupport<\/h2>\n\n\n\n