Skip to main content

Steps for Performing npm Application Analysis

This topic covers the steps for performing npm application analysis using the Sonatype IQ CLI, Jenkins plugin, or Bamboo plugin.

For details on how our IQ-powered solutions evaluate npm applications, see npm Application Analysis

npm Application Analysis Using the Sonatype IQ CLI

Run a scan

Invoke a Nexus IQ CLI scan of a directory or subdirectories containing yarn.lock, pnpm-lock.yaml, package-lock.json, or npm-shrinkwrap.json.

For a Yarn workspace monorepo analyzed in manifest mode, scan the workspace root so that the scan target includes the root yarn.lock, the root package.json, and each workspace member’s package.json. A node_modules directory is not required for manifest-based analysis.

For details about supported Yarn workspace behavior and known limitations, see Preparing to Run npm Application Analysis.

Example pnpm-lock.yaml file

lockfileVersion: 5.3 

specifiers: 
  '@angular-devkit/schematics': 8.3.26 
  '@angular/common': 8.2.14 
  '@angular/compiler': 8.2.14 
  '@angular/core': 8.2.14 
  '@angular/router': 8.2.14 
  '@ng-bootstrap/ng-bootstrap': 5.3.0 
    bootstrap: 4.5.0 
    jquery: 1.9.1 
    rxjs: ^6.4.0 
    zone.js: ~0.9.1 

dependencies: 
  '@angular-devkit/schematics': 8.3.26 
  '@angular/common': 8.2.14_@[email protected][email protected] 
  '@angular/compiler': 8.2.14 
  '@angular/core': [email protected][email protected] 
  '@angular/router': 8.2.14_ed906ac8447aa5d4a7a8ac33fedcf709 
  '@ng-bootstrap/ng-bootstrap': 5.3.0_ed906ac8447aa5d4a7a8ac33fedcf709 
    bootstrap: [email protected] 
    jquery: 1.9.1 
    rxjs: 6.4.0 
    zone.js: 0.9.1 

packages: 
  /@angular-devkit/core/8.3.26: 
    resolution: {integrity: sha512-b1ng9091o33s55/cwQYh1kboiJtj8y8z8xQWATDI9kRmNIQkWYVwVa/MzgPRJ4bzbEGG3zIUHCsp52A6vuGr2A==} 
    engines: {node: '>= 10.9.0', npm: '>= 6.2.0'} 
    dependencies: 
      ajv: 6.10.2 
      fast-json-stable-stringify: 2.0.0 
      magic-string: 0.25.3 
      rxjs: 6.4.0 
      source-map: 0.7.3 
      dev: false

npm Application Analysis Using the Jenkins plugin

By default, the Jenkins plugin will not evaluate the yarn.lock, pnpm-lock.yaml, package-lock.json or npm-shrinkwrap.json files. A custom Scan Target is needed.

Example Pipeline Script with Scan Patterns

nexusPolicyEvaluation iqApplication: 'SampApp' , iqScanPatterns: [[scanPattern: '**/npm-shrinkwrap.json' ], [scanPattern: '**/package-lock.json'], [scanPattern: '**/yarn.lock'], [scanPattern: '**/pnpm-lock.yaml']], iqStage: 'build'

npm Application Analysis Using the Bamboo plugin

By default, the Bamboo plugin will not evaluate the yarn.lock, pnpm-lock.yaml, package-lock.json or npm-shrinkwrap.json files. A custom Scan Target is needed.

87198517.png