JavaScript
JavaScript package analysis and vulnerability scanning capabilities
Package analysis
| Cataloger + Evidence | Package URL Type | License | Dependencies | Package Manager Claims | ||||
|---|---|---|---|---|---|---|---|---|
| Depth | Edges | Kinds | Files | Digests | Integrity Hash | |||
javascript-lock-cataloger deno.lock | pkg:npm | Transitive | Runtime | |||||
javascript-lock-cataloger bun.lock | pkg:npm | Transitive | Runtime, Dev | |||||
javascript-lock-cataloger pnpm-lock.yaml | pkg:npm | Transitive | Runtime | |||||
javascript-lock-cataloger yarn.lock | pkg:npm | Transitive | Runtime, Dev | |||||
javascript-lock-cataloger package-lock.json | pkg:npm | Transitive | Runtime, Dev | |||||
javascript-package-cataloger package.json | pkg:npm | Direct | Runtime, Dev | |||||
Syft Configuration
| Configuration Key | Description |
|---|---|
javascript.include-dev-dependencies | Controls whether development dependencies should be included in the catalog results, in addition to production dependencies. |
javascript.npm-base-url | Specifies the base URL for the NPM registry API used when searching for remote license information. |
javascript.search-remote-licenses | Enables querying the NPM registry API to retrieve license information for packages that are missing license data in their local metadata. |
Vulnerability scanning
| Data Source | Disclosures | Fixes | Track by Source Package | ||
|---|---|---|---|---|---|
| Affected | Date | Versions | Date | ||
| GitHub Security Advisories (GHSA) | |||||
| National Vulnerability Database (NVD) | |||||
Grype Configuration
| Configuration Key | Description |
|---|---|
match.javascript.using-cpes | Use CPE package identifiers to find vulnerabilities |