Your One Dependency Is Actually 67 Packages

Описание и применение

Один npm‑пакет может включать десятки транзитивных зависимостей. Используя Trivy в CI, можно быстро получить SBOM и отчёт о уязвимостях.

Задача

Developers often assume a single dependency means a small attack surface, but a single npm package can pull in dozens of transitive packages, many of which are unexamined.

Результат

A single npm dependency can expand to dozens of components; using Trivy in CI produces an SBOM and vulnerability report in under a minute.

Рабочий процесс

• Create a new directory and init npm
• Install [email protected] with --package-lock-only
• Run Trivy fs with --scanners vuln --format cyclonedx --output sbom.json package-lock.json
• Parse sbom.json to count components and vulnerabilities

Доказательства

CycloneDX spec : 1.7 components : 67 vulnerabilities: 0

Источник

For inventory, Syft and Trivy both emit SPDX and CycloneDX

Источник