Resolve and display dependency trees

[Feature Request]

dependency-track 3.4.0 cyclonedx-node-module 0.2.4 npm 5.4.2 node 8.6.0

The below is a post from the cyclonedx-node-module issues.

I have a web project using npm to load dependencies. I have the cyclonedx-node-module running on my build server generating a bom file for my project. I’m seeing a dependency in the list that was flagged as critical, and I didn’t recognize the package, so naturally I tried to find where it was being referenced.

See “macaddress” dependency in this image:

When I run a scan on my project folder I do not find a direct reference to the “macaddress” dependency in package.json, but I do find it in the package-lock.json file.

"macaddress": {
      "version": "0.2.8",
      "resolved": "https://registry.npmjs.org/macaddress/-/macaddress-0.2.8.tgz",
      "integrity": "sha1-WQTcU3w57G2+/q6QIycTX6hRHxI="
    },

I then found that there was a second reference under package-lock.json for “macaddress”

"uniqid": {
      "version": "4.1.1",
      "resolved": "https://registry.npmjs.org/uniqid/-/uniqid-4.1.1.tgz",
      "integrity": "sha1-iSIN32t1GuUrX3JISGNShZa7hME=",
      "requires": {
        "macaddress": "0.2.8"
      }
    },

Which appears to be the parent dependency pulling “macaddress” in. And that comes from…

 "postcss-filter-plugins": {
      "version": "2.0.2",
      "resolved": "https://registry.npmjs.org/postcss-filter-plugins/-/postcss-filter-plugins-2.0.2.tgz",
      "integrity": "sha1-bYWGJTTXNaxCDkqFgG4fXUKG2Ew=",
      "requires": {
        "postcss": "5.2.18",
        "uniqid": "4.1.1"
      },
      "dependencies": {

And so on… Eventually, this builds out to a dependency tree like this:

css-loader (referenced in "dependencies" section of package.json)
|-cssnano
 |--postcss-filter-plugins
  |---uniqid
   |----macaddress

My question is how can we resolve this dependency tree in the cyclonedx-node-module bom generation? Either that or dependency-track itself should resolve this. I’m going to have people asking about critical vuln dependencies and I would love to figure out how the heck these are getting pulled in without doing the time-intensive dirty work. Seems like this should be possible.

Let me know if I need to elaborate further.

Thanks! Drew

[stevespringett]

https://github.com/CycloneDX/specification/issues/14

[stevespringett]

Initial support for dependency graphs are complete. Future enhancements are planned.