Does grype covers urls instead of version in npm?

Grype
1

I recently read an article here about ‘hidden’ dependencies.

i wonder if grype alerts on this kind of vulnerabilities?

2

@TimBrown1611 Syft should surface these dependencies, with a version containing the URL.

1 Like