JavaScript / TypeScript
Introduction
JFrog Xray provides security and compliance analysis for JavaScript and TypeScript applications throughout the software development lifecycle. This page describes the supported scan contexts, package managers, capabilities, and dependency analysis available for JavaScript/TypeScript.
Capabilities
| Capability | Source Code Scanning | Binary Scanning |
|---|---|---|
| Vulnerability Matching (CVEs) | ✅ | ✅ |
| License Detection | ✅ | ✅ |
| Malicious Package Detection | ✅ | ✅ |
| Operational Risk | ✅ | ✅ |
| Smart Remediation | 🔜 | 🔜 |
Source code scanning analyzes your project's dependency manifest files to identify components and their vulnerabilities. This is used by JFrog CLI (jf audit), Frogbot, IDE integrations, and CI pipelines.
Supported Files
| Package Manager | Supported Files |
|---|---|
| npm | package-lock.json (v1, v2, v3), package.json – Handles deduplication, peer/dev/optional dependencies |
| pnpm | pnpm-lock.yaml – Workspace dependencies, scoped packages, peer dependency annotations |
| Yarn | yarn.lock (Yarn 1 Classic and Yarn 2+/Berry), package.json – Workspaces, peer/dev/optional deps |
| Bower | ❌ Not supported |
Dependency Graph
| Package Manager | Dependency Graph |
|---|---|
| npm | ✅ Full – Nested node_modules, multiple version tracking |
| pnpm | ✅ Full – Workspace filtering, root package detection |
| Yarn | ✅ Full – Workspace-aware, constraint resolution |
Updated about 2 months ago
Did this page help you?