trivy-vulnerability-scanning git:20260424.d50cf5aA

Immutable. This exact content never changes and is served at /api/v1/blob/6450bf6730e7af09.

---
name: trivy-vulnerability-scanning
description: Use Trivy vulnerability scanner in offline mode to detect CVEs in npm dependencies and generate structured JSON reports.
---

# Trivy Vulnerability Scanning

## Overview
Trivy is a simple, comprehensive vulnerability scanner that can analyze npm package-lock.json files for known security vulnerabilities. It works offline with a local vulnerability database.

## Installation

```bash
# Install Trivy
apt-get update && apt-get install -y trivy

# Verify installation
trivy --version
```

## Database Setup

Trivy requires a vulnerability database. For offline mode:

```bash
# Download the vulnerability database
trivy image download-db --severity HIGH,CRITICAL

# Or let Trivy auto-download on first use
trivy config /root/package-lock.json
```

## Scanning Modes

### Scan package-lock.json
```bash
trivy config /root/package-lock.json \
  --format json \
  --output results.json \
  --severity HIGH,CRITICAL
```

### Scan Options
- `--format json`: Output JSON format (best for parsing)
- `--severity HIGH,CRITICAL`: Only HIGH and CRITICAL vulnerabilities
- `--output file.json`: Write to file
- `--offline-db`: Use offline database if downloaded
- `--skip-update`: Skip database update (offline mode)

## Output Structure

Trivy JSON output contains:

```json
{
  "Results": [
    {
      "Target": "package-lock.json",
      "Type": "npm",
      "Misconfigurations": null,
      "Vulnerabilities": [
        {
          "VulnerabilityID": "CVE-2021-12345",
          "PkgName": "lodash",
          "InstalledVersion": "4.17.20",
          "FixedVersion": "4.17.21",
          "Severity": "HIGH",
          "Title": "Prototype pollution",
          "Description": "...",
          "References": ["https://nvd.nist.gov/vuln/detail/CVE-2021-12345"]
        }
      ]
    }
  ]
}
```

## Parsing Results

```python
import json

def parse_trivy_results(json_file):
    with open(json_file, 'r') as f:
        data = json.load(f)

    vulnerabilities = []
    for result in data.get('Results', []):
        for vuln in result.get('Vulnerabilities', []):
            if vuln['Severity'] in ['HIGH', 'CRITICAL']:
                vulnerabilities.append({
                    'package': vuln['PkgName'],
                    'version': vuln['InstalledVersion'],
                    'cve_id': vuln['VulnerabilityID'],
                    'severity': vuln['Severity'],
                    'title': vuln['Title'],
                    'fixed_version': vuln.get('FixedVersion', 'N/A'),
                    'references': vuln.get('References', [])
                })

    return vulnerabilities
```

## Usage

Use this skill when:
- Scanning npm package-lock.json for vulnerabilities
- Need offline vulnerability detection
- Building security audit pipelines
- Filtering for specific severity levels

## Related Skills

- `cvss-score-extraction`: Extract CVSS scores for detected vulnerabilities
- `security-audit-csv-reporting`: Convert results to CSV format