# Does grype covers urls instead of version in npm?

**URL:** <https://anchorecommunity.discourse.group/t/does-grype-covers-urls-instead-of-version-in-npm/583>\
**Category:** Grype\
**Created:** [November 2, 2025, 6:27pm UTC](https://anchorecommunity.discourse.group/t/does-grype-covers-urls-instead-of-version-in-npm/583 "2025-11-02T18:27:09Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![TimBrown1611](https://yyz2.discourse-cdn.com/free1/user_avatar/anchorecommunity.discourse.group/timbrown1611/32/223_2.png) [@TimBrown1611](https://anchorecommunity.discourse.group/u/TimBrown1611)\
**Post date:** [November 2, 2025, 6:27pm UTC](https://anchorecommunity.discourse.group/t/does-grype-covers-urls-instead-of-version-in-npm/583/1 "2025-11-02T18:27:09Z")

</div>

I recently read an article here about ‘hidden’ dependencies.

i wonder if grype alerts on this kind of vulnerabilities?

> **[PhantomRaven: NPM Malware Hidden in Invisible Dependencies | Koi Blog](https://www.koi.ai/blog/phantomraven-npm-malware-hidden-in-invisible-dependencies)**

---

<div class="post-metadata">

**Author:** ![kzantow](https://yyz2.discourse-cdn.com/free1/user_avatar/anchorecommunity.discourse.group/kzantow/32/17_2.png) [@kzantow](https://anchorecommunity.discourse.group/u/kzantow)\
**Post date:** [November 3, 2025, 9:13pm UTC](https://anchorecommunity.discourse.group/t/does-grype-covers-urls-instead-of-version-in-npm/583/2 "2025-11-03T21:13:35Z")

</div>

@TimBrown1611 Syft should surface these dependencies, with a version containing the URL.