Snyk (snyk.io) script to find vulnerabilities and report to slack via webhook, for run this script you should run first `snyk test --docker $IMAGE_BH --file=Dockerfile --json > snyk_docker.json || true` and later ` node -r ts-node/register snykAudit.ts`

SnykAudit.ts

import * as fs from 'fs';
import * as _ from 'lodash';
import { RequestAPI, RequiredUriUrl } from 'request';
import * as request from 'request-promise-native';

export class SnykDockerAudit {
  private client: RequestAPI<
    request.RequestPromise,
    request.RequestPromiseOptions,
    RequiredUriUrl
  >;

  constructor() {
    this.client = request.defaults({
      baseUrl: 'https://slack.com/api/chat.postMessage',
      headers: {
        Authorization: `Bearer ${process.env.YARN_AUDIT_SLACK_TOKEN}`,
      },
      json: true,
    });
  }

  public async sendReport() {
    const dataFile = JSON.parse(fs.readFileSync('snyk_docker.json', 'utf8'));
    const countVulnerabilities: number = dataFile.uniqueCount;
    if (countVulnerabilities > 0) {
      const packages = _.uniqBy(dataFile.vulnerabilities, 'packageName').map(
        (item: any) => item.packageName,
      );
      const stage =
        process.env.CI_COMMIT_REF_NAME === 'master' ? 'pro' : 'staging';
      const postData = {
        attachments: [
          {
            author_name: 'SNYK - Docker',
            color: '#ff0000',
            mrkdwn_in: ['text', 'pretext'],
            text: `Found ${countVulnerabilities} in *NAME_OF_YOUR_COMPANY* docker image - *Packages:* _${packages.join(
              ', ',
            )}_`,
          },
        ],
        channel: `yournamechannel`,
        icon_emoji: ':danger:',
        mrkdwn: true,
        username: 'Snyk Docker Alert',
      };
      const result = await this.client.post('', {
        body: postData,
      });
      // tslint:disable-next-line: no-console
      console.log('OK: ', result.ok);
    }
    // tslint:disable-next-line: no-console
    console.log('Vulnerabilities: ', countVulnerabilities);
  }
}

const report: SnykDockerAudit = new SnykDockerAudit();
report
  .sendReport()
  .then()
  // tslint:disable-next-line: no-console
  .catch((err: any) => console.error(err));