Your One Dependency Is Actually 67 Packages

Description and use

A single npm package can pull in dozens of transitive dependencies. Using Trivy in CI quickly produces an SBOM and vulnerability report.

Problem

Developers often assume a single dependency means a small attack surface, but a single npm package can pull in dozens of transitive packages, many of which are unexamined.

Outcome

A single npm dependency can expand to dozens of components; using Trivy in CI produces an SBOM and vulnerability report in under a minute.

Workflow

• Create a new directory and init npm
• Install [email protected] with --package-lock-only
• Run Trivy fs with --scanners vuln --format cyclonedx --output sbom.json package-lock.json
• Parse sbom.json to count components and vulnerabilities

Evidence

CycloneDX spec : 1.7 components : 67 vulnerabilities: 0

Source

For inventory, Syft and Trivy both emit SPDX and CycloneDX

Source