cve-report.js

#!/usr/bin/env node
const graphql = require('graphql-request');
const argparse = require('argparse').ArgumentParser;

const GITHUB_GRAPHQL_ENDPOINT = 'https://api.github.com/graphql';

const parser = new argparse({
  version: '1.0.0',
  addHelp: true,
  description: 'Pass in a list of orgs and generate a report of the repos and the CVEs opened against its packages.'
});

parser.addArgument(
  [ '-o', '--org' ],
  {
    help: 'The orgs that you want to run against',
    nargs: '*',
    required: true
  }
);

parser.addArgument(
  [ '-t', '--token' ],
  {
    help: 'GitHub developer token to query GitHub.',
    required: true
  }
);

const args = parser.parseArgs();

const client = new graphql.GraphQLClient(GITHUB_GRAPHQL_ENDPOINT, {
  headers: {
    Accept: 'application/vnd.github.vixen-preview+json',
    Authorization: `token ${args.token}`,
  }
});

getOrgCVE = async (org) => {
  const query = `{
    organization(login: "${org}") {
      repositories(first:100) {
        edges {
          node {
            owner {
              id
            }
            name
            vulnerabilityAlerts ( first: 100 ) {
              edges {
                node {
                  affectedRange
                  dismissReason
                  dismissedAt
                  externalIdentifier
                  externalReference
                  fixedIn
                  id
                  packageName
                }
              }
            }
          }
        }
      }
    }
  }`;

  return await client.request(query);
};

run = async () => {
  const orgList = args.org;
  if (orgList.length) {
    for (const org of args.org) {
      const data = await getOrgCVE(org).catch(error => console.error(error));
      for (const repo of data.organization.repositories.edges) {
        if (repo.node.vulnerabilityAlerts.edges.length) {
          console.log('\n', org, ' - ', repo.node.name,'\n', repo.node.vulnerabilityAlerts.edges, '\n');
        }
      };
    };
  } else {
    console.log('At least one GitHub org must be provided');
  };
};

run();