Your One Dependency Is Actually 67 Packages

说明与用途

单个 npm 包可能包含数十个传递依赖。使用 Trivy 在 CI 中快速生成 SBOM 和漏洞报告。

问题

Developers often assume a single dependency means a small attack surface, but a single npm package can pull in dozens of transitive packages, many of which are unexamined.

结果

A single npm dependency can expand to dozens of components; using Trivy in CI produces an SBOM and vulnerability report in under a minute.

工作流

• Create a new directory and init npm
• Install [email protected] with --package-lock-only
• Run Trivy fs with --scanners vuln --format cyclonedx --output sbom.json package-lock.json
• Parse sbom.json to count components and vulnerabilities

证据

CycloneDX spec : 1.7 components : 67 vulnerabilities: 0

来源

For inventory, Syft and Trivy both emit SPDX and CycloneDX

来源