JavaScript
JavaScript package analysis and vulnerability scanning capabilities
Package analysis
| Cataloger + Evidence | License | Dependencies | Package Manager Claims | ||||
|---|---|---|---|---|---|---|---|
| Depth | Edges | Kinds | Files | Digests | Integrity Hash | ||
javascript-lock-cataloger pnpm-lock.yaml |
transitive | runtime | |||||
javascript-lock-cataloger yarn.lock |
transitive | runtime, dev | |||||
javascript-lock-cataloger package-lock.json |
transitive | runtime | |||||
javascript-package-cataloger package.json |
direct | runtime | |||||
Syft Configuration
| Configuration Key | Description |
|---|---|
javascript.include-dev-dependencies |
Controls whether development dependencies should be included in the catalog results, in addition to production dependencies. |
javascript.npm-base-url |
Specifies the base URL for the NPM registry API used when searching for remote license information. |
javascript.search-remote-licenses |
Enables querying the NPM registry API to retrieve license information for packages that are missing license data in their local metadata. |
Vulnerability scanning
| Data Source | Disclosures | Fixes | Track by Source Package |
||
|---|---|---|---|---|---|
| Affected | Date | Versions | Date | ||
| GitHub Security Advisories (GHSA) | |||||
| National Vulnerability Database (NVD) | |||||
Grype Configuration
| Configuration Key | Description |
|---|---|
match.javascript.using-cpes |
Use CPE package identifiers to find vulnerabilities |