Capabilities

JavaScript

JavaScript package analysis and vulnerability scanning capabilities

Package analysis

Cataloger + EvidenceLicenseDependenciesPackage Manager Claims
DepthEdgesKindsFilesDigestsIntegrity Hash
javascript-lock-cataloger
pnpm-lock.yaml
TransitiveRuntime
javascript-lock-cataloger
yarn.lock
TransitiveRuntime, Dev
javascript-lock-cataloger
package-lock.json
TransitiveRuntime
javascript-package-cataloger
package.json
DirectRuntime

Syft Configuration
Configuration KeyDescription
javascript.include-dev-dependenciesControls whether development dependencies should be included in the catalog results, in addition to production dependencies.
javascript.npm-base-urlSpecifies the base URL for the NPM registry API used when searching for remote license information.
javascript.search-remote-licensesEnables querying the NPM registry API to retrieve license information for packages that are missing license data in their local metadata.

Vulnerability scanning

Data SourceDisclosuresFixesTrack by
Source
Package
AffectedDateVersionsDate
GitHub Security Advisories (GHSA)
National Vulnerability Database (NVD)

Grype Configuration
Configuration KeyDescription
match.javascript.using-cpesUse CPE package identifiers to find vulnerabilities

Next steps

Last modified November 26, 2025: allow local too invocation (d20d613)