JavaScript / TypeScript
Learn JavaScript and TypeScript source and binary scan support in Xray.
Introduction
JFrog Xray provides security and compliance analysis for JavaScript and TypeScript applications throughout the software development lifecycle. This page describes the supported scan contexts, package managers, capabilities, and dependency analysis available for JavaScript and TypeScript.
Capabilities
The following capabilities are available for JavaScript and TypeScript.
| Capability | Source Code Scanning | Binary Scanning |
|---|---|---|
| Vulnerability Matching (CVEs) |  | |
| License Detection | | |
| Malicious Package Detection | | |
| Operational Risk | | |
| Smart Remediation | 🔜 | 🔜 |
Source code scanning analyzes your project's dependency manifest files to identify components and their vulnerabilities. You can use it with the JFrog CLI jf audit command, Frogbot, IDE integrations, and CI pipelines. For more information, see Scan Your Source Code.
Which files a source scan reads depends on the scan method. For those differences, see Source Scanning Engines and Frogbot Versions.
Supported Files
| Package Manager | Supported Files | Available with |
|---|---|---|
| npm | package-lock.json (required), package.json | Default jf audit |
| npm | package-lock.json (v1, v2, v3), package.json – Handles deduplication, peer/dev/optional dependencies | Frogbot V3 |
| Yarn | yarn.lock (Yarn 3 required) | Default jf audit |
| Yarn | yarn.lock (Yarn 1 Classic and Yarn 2+/Berry), package.json – Workspaces, peer/dev/optional deps | Frogbot V3 |
| pnpm | pnpm-lock.yaml – Workspace dependencies, scoped packages, peer dependency annotations | Frogbot V3 |
| Bower |  Not supported | — |
Dependency Graph
| Package Manager | Dependency Graph | Available with |
|---|---|---|
| npm | Full | Default jf audit |
| npm | Full – Nested node_modules, multiple version tracking | Frogbot V3 |
| Yarn | Flat | Default jf audit |
| Yarn | Full – Workspace-aware, constraint resolution | Frogbot V3 |
| pnpm | Full – Workspace filtering, root package detection | Frogbot V3 |
Binary scanning analyzes built artifacts stored in JFrog Artifactory repositories, extracting package metadata from the artifact format itself. For more information, see Scan Your Binaries.
Supported Files
The following package formats are supported for JavaScript and TypeScript binary scanning.
| Package Manager | Supported Files |
|---|---|
| npm | npm tarballs (.tgz) |
| pnpm | npm tarballs (.tgz) |
| Bower | Bower packages |
Related Topics
Updated 26 days ago