NPM support

Detector properties

Detect has the following NPM detectors:

• NPM package shrinkwrap detector

• NPM package lock detector

• NPM Package Json Parse detector

• NPM CLI detector

Detect offers the ability to exclude package manager specific dependency types from the BOM. NPM dependency types can be filtered with the detect.npm.dependency.types.excluded property.

The NPM shrinkwrap detector uses the npm-shrinkwrap.json file.

Is the same as a package-lock.json but is a publishable lockfile. Though both have high accuracy, Detect prioritizes shrinkwrap over package lock.

The NPM package lock runs when it finds a package-lock.json generated by NPM.

For accurate filtering with the detect.npm.dependency.types.excluded property, a package.json file is also required.

NPM automatically generates the package-lock.json after an npm install which should be run prior to scanning.

The NPM CLI detector requires a package.json and an npm executable.

Executes npm ls -json, and verifies success by ensuring that no messages were written to stderr, and that the exit code was 0. If both conditions are met, it parses the output for dependencies.

If npm ls -json does write messages to stderr (for example, lint messages) that you would like Detect to ignore, you can silence errors by adding the --silent npm argument to the npm command using Detect property --detect.npm.arguments.

This detector is only invoked if the more accurateNPM detectors (above) cannot be run.

This is the least accurate of the NPM detectors.

It requires, and parses, a package.json file.

The NPM Package Json Parse detectable is unable to discover transitive dependencies.

When generating BDIO files, the NPM Package Json Parse detectable uses version strings exactly as it finds them in package.json in addition to matching components whose versions are specified in the package.json using wildcards ("^", etc.)