A zero-setup CodeQL pre-commit scanner for JavaScript/TypeScript.
npm install qlscanbash
npm install -g qlscan
`
Usage
Run a security scan in your JavaScript/TypeScript project:
`bash
qlscan scan
`
The tool will:
1. Set up CodeQL if not already installed
2. Download and manage required query packages
3. Create and analyze a CodeQL database
4. Generate a detailed security report in your project root
Requirements
- Node.js 22.x or higher
- Git installed and available in PATH
- Read/write permissions for the project directory
How It Works
QLScanner simplifies the CodeQL setup and scanning process by:
1. Managing the CodeQL CLI installation
2. Handling query pack downloads and updates
3. Creating and analyzing CodeQL databases
4. Converting complex results into readable reports
5. Maintaining a clean project structure with .gitignore integration
Output
Scan results are saved in codeql-results.md` in your project root, containing: