JavaScript

JavaScript package analysis and vulnerability scanning capabilities

Package analysis

Cataloger + Evidence License Dependencies Package Manager Claims
Depth Edges Kinds Files Digests Integrity Hash
javascript-lock-cataloger
pnpm-lock.yaml
transitive runtime
javascript-lock-cataloger
yarn.lock
transitive runtime, dev
javascript-lock-cataloger
package-lock.json
transitive runtime
javascript-package-cataloger
package.json
direct runtime
Syft Configuration
Configuration Key Description
javascript.include-dev-dependencies Controls whether development dependencies should be included in the catalog results, in addition to production dependencies.
javascript.npm-base-url Specifies the base URL for the NPM registry API used when searching for remote license information.
javascript.search-remote-licenses Enables querying the NPM registry API to retrieve license information for packages that are missing license data in their local metadata.

Vulnerability scanning

Data Source Disclosures Fixes Track by
Source
Package
Affected Date Versions Date
GitHub Security Advisories (GHSA)
National Vulnerability Database (NVD)
Grype Configuration
Configuration Key Description
match.javascript.using-cpes Use CPE package identifiers to find vulnerabilities

Next steps

Last modified October 23, 2025: fix section ref (9417a27)