Skip to main content
Version: 6.x (latest)

Using NCM3 with N|Solid

N|Solid integrates NodeSource Certified Modules v3 (NCM 3) in two ways: the N|Solid Console shows NCM package reports for the modules each process loads, and the nsolid-strict command stops an application from starting when its dependencies violate NCM policies. This page covers both.

Use NCM 3 in the Console​

The N|Solid Console has a dedicated view for NodeSource Certified Modules v3.

  1. Open the process detail view of a process and select the Modules tab.

    Process Detail

  2. Click the magnifying glass icon next to a package to open the Module Details dialog, which shows the package's NCM report and dependency tree.

    NCM detailed report

  3. To have N|Solid Copilot generate a report and summary for the package, click the Generate AI report icon next to the package name in the Module Details dialog.

    NCM AI report

Learn more about NCM 3 reports.

N|Solid strict mode​

Strict mode checks your application's dependencies against NodeSource Certified Modules v3 before the application starts. To use it, run nsolid-strict instead of nsolid. If any dependency has a vulnerability or violates a policy rule, strict mode stops the application. Otherwise, the application starts normally.

nsolid-strict is available on macOS and Linux.

For example, a vulnerable application is stopped:

nsolid-strict vulnerable-node-app.js
nsolid STRICT MODE verifying...
nsolid STRICT MODE access denied due to policy violation:
{
  "package": "unsecure-pkg",
  "version": "1.19.4",
  "group": "risk",
  "name": "has-install-scripts",
  "pass": false,
  "severity": "CRITICAL",
  "title": "This package version has install scripts: postinstall."
}

The same application runs when you start it with nsolid:

nsolid vulnerable-node-app.js
Unsecure server running normally :)

A secure application passes the check and starts:

nsolid-strict secure-node-app.js
nsolid STRICT MODE verifying...
nsolid STRICT MODE PASSED
Secure server running normally :)

To choose which rules strict mode enforces, or to allow specific package versions, edit the strict-mode configuration file. Open it in your default editor with:

nsolid-strict --config
NodeSource Support