secureCodeBox · Reet00 · Jul 18, 2025 · Jul 18, 2025 · Jul 18, 2025 · Jul 18, 2025
diff --git a/auto-discovery/kubernetes/pull-secret-extractor/Dockerfile b/auto-discovery/kubernetes/pull-secret-extractor/Dockerfile
@@ -2,9 +2,12 @@
 #
 # SPDX-License-Identifier: Apache-2.0
 
-FROM python:3.11-alpine
+FROM python:3.13-alpine
 
+RUN addgroup -g 1001 nikto \
+  && adduser -G nikto -s /bin/sh -D -u 1001 nikto
 COPY requirements.txt .
 RUN pip install -r requirements.txt
-COPY docker_image.py secret_extraction.py ./
-CMD ["python", secret_extraction.py]
+COPY --chown=root:root --chmod=755 docker_image.py secret_extraction.py ./
+USER 1001
+CMD ["python", "secret_extraction.py"]
diff --git a/documentation/docs/contributing/integrating-a-hook/dockerfile.md b/documentation/docs/contributing/integrating-a-hook/dockerfile.md
@@ -16,7 +16,7 @@ FROM node:22-alpine as build
 RUN mkdir -p /home/app
 WORKDIR /home/app
 COPY package.json package-lock.json ./
-RUN npm ci --omit=dev
+RUN npm ci --omit=dev --ignore-scripts --ignore-scripts
 
 FROM securecodebox/hook-sdk-nodejs:${baseImageTag:-latest}
 WORKDIR /home/app/hook-wrapper/hook/

diff --git a/documentation/docs/contributing/integrating-a-scanner/parser-dir.md b/documentation/docs/contributing/integrating-a-scanner/parser-dir.md
@@ -20,7 +20,7 @@ FROM node:22-alpine as build
 RUN mkdir -p /home/app
 WORKDIR /home/app
 COPY package.json package-lock.json ./
-RUN npm ci --omit=dev
+RUN npm ci --omit=dev --ignore-scripts
 
 FROM securecodebox/parser-sdk-nodejs:${baseImageTag:-latest}
 WORKDIR /home/app/parser-wrapper/parser/

diff --git a/documentation/package-lock.json b/documentation/package-lock.json
diff --git a/hook-sdk/nodejs/Dockerfile b/hook-sdk/nodejs/Dockerfile
@@ -5,7 +5,7 @@
 FROM node:22-alpine AS build
 WORKDIR /home/app
 COPY package.json package-lock.json ./
-RUN npm ci --omit=dev
+RUN npm ci --omit=dev --ignore-scripts
 
 FROM node:22-alpine
 ARG NODE_ENV

diff --git a/hooks/cascading-scans/hook/Dockerfile b/hooks/cascading-scans/hook/Dockerfile
@@ -8,7 +8,7 @@ FROM node:22-alpine AS install
 RUN mkdir -p /home/app
 WORKDIR /home/app
 COPY package.json package-lock.json ./
-RUN npm ci --omit=dev
+RUN npm ci --omit=dev --ignore-scripts
 
 FROM node:22-alpine AS build
 RUN mkdir -p /home/app

diff --git a/hooks/finding-post-processing/hook/Dockerfile b/hooks/finding-post-processing/hook/Dockerfile
@@ -8,7 +8,7 @@ FROM node:22-alpine AS build
 RUN mkdir -p /home/app
 WORKDIR /home/app
 COPY package.json package-lock.json ./
-RUN npm ci --omit=dev
+RUN npm ci --omit=dev --ignore-scripts
 
 FROM ${namespace:-securecodebox}/hook-sdk-nodejs:${baseImageTag:-latest}
 WORKDIR /home/app/hook-wrapper/hook/

diff --git a/hooks/notification/hook/Dockerfile b/hooks/notification/hook/Dockerfile
@@ -8,7 +8,7 @@ FROM node:22-alpine AS install
 RUN mkdir -p /home/app
 WORKDIR /home/app
 COPY package.json package-lock.json ./
-RUN npm ci --omit=dev
+RUN npm ci --omit=dev --ignore-scripts
 
 FROM node:22-alpine AS build
 RUN mkdir -p /home/app

diff --git a/hooks/persistence-defectdojo/hook/Dockerfile b/hooks/persistence-defectdojo/hook/Dockerfile
@@ -8,7 +8,7 @@ WORKDIR /home/gradle/src
 RUN ./gradlew build -x test
 
 FROM gcr.io/distroless/java17-debian12:nonroot
-COPY --from=build --chown=nonroot:nonroot /home/gradle/src/build/libs/defectdojo-persistenceprovider-*.jar /app/defectdojo-persistenceprovider.jar
+COPY --from=build --chown=root:root --chmod=755 /home/gradle/src/build/libs/defectdojo-persistenceprovider-*.jar /app/defectdojo-persistenceprovider.jar
 WORKDIR /app
 # TLS Config works around an issue in OpenJDK... See: https://github.com/kubernetes-client/java/issues/854
 ENTRYPOINT ["java", "-Djdk.tls.client.protocols=TLSv1.2", "-jar", "/app/defectdojo-persistenceprovider.jar"]
diff --git a/hooks/persistence-elastic/hook/Dockerfile b/hooks/persistence-elastic/hook/Dockerfile
@@ -8,7 +8,7 @@ FROM node:22-alpine AS build
 RUN mkdir -p /home/app
 WORKDIR /home/app
 COPY package.json package-lock.json ./
-RUN npm ci --omit=dev
+RUN npm ci --omit=dev --ignore-scripts
 
 FROM ${namespace:-securecodebox}/hook-sdk-nodejs:${baseImageTag:-latest}
 WORKDIR /home/app/hook-wrapper/hook/

diff --git a/hooks/update-field-hook/hook/Dockerfile b/hooks/update-field-hook/hook/Dockerfile
@@ -8,7 +8,7 @@ FROM node:22-alpine AS build
 RUN mkdir -p /home/app
 WORKDIR /home/app
 COPY package.json package-lock.json ./
-RUN npm ci --omit=dev
+RUN npm ci --omit=dev --ignore-scripts
 
 FROM ${namespace:-securecodebox}/hook-sdk-nodejs:${baseImageTag:-latest}
 WORKDIR /home/app/hook-wrapper/hook/

diff --git a/scanners/gitleaks/parser/Dockerfile b/scanners/gitleaks/parser/Dockerfile
@@ -2,16 +2,8 @@
 #
 # SPDX-License-Identifier: Apache-2.0
 
-# Commented out the dependency management as there are no dependencies in the
-# parser at the moment. Add the commented-out parts of the Dockerfile again
-# if the parser starts needing packages once again.
 ARG namespace
 ARG baseImageTag
-# FROM node:22-alpine as build
-# RUN mkdir -p /home/app
-# WORKDIR /home/app
-# COPY package.json package-lock.json ./
-# RUN npm ci --omit=dev
 
 FROM ${namespace:-securecodebox}/parser-sdk-nodejs:${baseImageTag:-latest}
 WORKDIR /home/app/parser-wrapper/parser/

diff --git a/scanners/ncrack/parser/Dockerfile b/scanners/ncrack/parser/Dockerfile
@@ -8,7 +8,7 @@ FROM node:22-alpine AS build
 RUN mkdir -p /home/app
 WORKDIR /home/app
 COPY package.json package-lock.json ./
-RUN npm ci --omit=dev
+RUN npm ci --omit=dev --ignore-scripts
 
 FROM ${namespace:-securecodebox}/parser-sdk-nodejs:${baseImageTag:-latest}
 WORKDIR /home/app/parser-wrapper/parser/

diff --git a/scanners/nikto/scanner/Dockerfile b/scanners/nikto/scanner/Dockerfile
@@ -11,15 +11,15 @@ FROM alpine:3.22
 
 ENV PATH=${PATH}:/nikto
 
-COPY wrapper.sh /wrapper.sh
+COPY --chown=root:root --chmod=755 wrapper.sh /wrapper.sh
 
 RUN apk add --update --no-cache --virtual .build-deps \
      perl \
      perl-net-ssleay \
   && addgroup -g 1001 nikto \
   && adduser -G nikto -s /bin/sh -D -u 1001 nikto
 
-COPY --from=build --chown=nikto:nikto /nikto/program /nikto
+COPY --from=build --chown=root:root --chmod=755 /nikto/program /nikto
 
 USER 1001
 

diff --git a/scanners/nmap/parser/Dockerfile b/scanners/nmap/parser/Dockerfile
@@ -8,7 +8,7 @@ FROM node:22-alpine AS build
 RUN mkdir -p /home/app
 WORKDIR /home/app
 COPY package.json package-lock.json ./
-RUN npm ci --omit=dev
+RUN npm ci --omit=dev --ignore-scripts
 
 FROM ${namespace:-securecodebox}/parser-sdk-nodejs:${baseImageTag:-latest}
 WORKDIR /home/app/parser-wrapper/parser/

diff --git a/scanners/nuclei/templates/nuclei-update-cache-job.yaml b/scanners/nuclei/templates/nuclei-update-cache-job.yaml
@@ -21,6 +21,7 @@ spec:
     spec:
       template:
         spec:
+          automountServiceAccountToken: false
           restartPolicy: OnFailure
           containers:
             - name: nuclei
@@ -61,6 +62,7 @@ metadata:
 spec:
   template:
     spec:
+      automountServiceAccountToken: false
       restartPolicy: OnFailure
       containers:
         - name: nuclei

diff --git a/scanners/nuclei/tests/__snapshot__/scanner_test.yaml.snap b/scanners/nuclei/tests/__snapshot__/scanner_test.yaml.snap
@@ -159,6 +159,7 @@ matches the snapshot:
         spec:
           template:
             spec:
+              automountServiceAccountToken: false
               containers:
                 - command:
                     - nuclei
@@ -201,6 +202,7 @@ matches the snapshot:
     spec:
       template:
         spec:
+          automountServiceAccountToken: false
           containers:
             - command:
                 - nuclei

diff --git a/scanners/ssh-audit/parser/parser.js b/scanners/ssh-audit/parser/parser.js
@@ -239,9 +239,11 @@ export async function parse(fileContent) {
   const location = "ssh://" + destination[0];
   let ipAddress = null;
   let hostname = null;
-  isIPaddress(destination[0])
-    ? (ipAddress = destination[0])
-    : (hostname = destination[0]);
+  if (isIPaddress(destination[0])) {
+    ipAddress = destination[0]
+  } else {
+    hostname = destination[0]
+  }
 
   const recommendationsArray = Object.entries(report.recommendations);
   const policyViolationFindings = recommendationsArray.flatMap(

diff --git a/scanners/trivy/integration-tests/trivy.test.js b/scanners/trivy/integration-tests/trivy.test.js
@@ -27,7 +27,7 @@ test(
 test(
   "trivy filesystem scan with exiting files should not fail",
   async () => {
-    const { categories, severities, count } = await scan(
+    const { severities, count } = await scan(
       "trivy-filesystem-test",
       "trivy-filesystem",
       ["/repo/"],
@@ -78,7 +78,7 @@ test(
 test(
   "trivy repo scan with exiting repo should not fail",
   async () => {
-    const { categories, severities, count } = await scan(
+    const { severities, count } = await scan(
       "trivy-repo-test",
       "trivy-repo",
       ["https://github.com/knqyf263/trivy-ci-test"],

diff --git a/scanners/zap-automation-framework/parser/Dockerfile b/scanners/zap-automation-framework/parser/Dockerfile
@@ -8,7 +8,7 @@ FROM node:22-alpine AS build
 RUN mkdir -p /home/app
 WORKDIR /home/app
 COPY package.json package-lock.json ./
-RUN npm ci --omit=dev
+RUN npm ci --omit=dev --ignore-scripts
 
 FROM ${namespace:-securecodebox}/parser-sdk-nodejs:${baseImageTag:-latest}
 WORKDIR /home/app/parser-wrapper/parser/