example-javascript-npm

Find vulnerabilities, trace reachability, and audit open-source risk in your JavaScript project.

About

This repository is a Bomly example project for JavaScript with npm. Use it to try every Bomly feature — from basic SCA scans to vulnerability audits, reachability analysis, dependency tracing, and policy-driven CI gates.

Dependency manifests

File	Role
package.json	Dependency manifest
package-lock.json	Dependency manifest

Try it with Bomly

1. Discover all dependencies

Map your full dependency graph — direct and transitive:

bomly scan --url https://github.com/bomly-dev/example-javascript-npm

2. Find vulnerabilities

Enrich packages with CVE data and surface real findings:

bomly scan --url https://github.com/bomly-dev/example-javascript-npm --enrich --audit

3. Confirm reachability

Cut alert noise: Bomly traces your call graph to prove which vulnerable code paths your app actually reaches at runtime.

bomly scan --url https://github.com/bomly-dev/example-javascript-npm --enrich --reachability

4. Trace why a dependency exists

Understand every path that pulls lodash into your graph:

bomly explain lodash --url https://github.com/bomly-dev/example-javascript-npm

5. See what changed between releases

Compare dependency graphs across any two refs — commits, branches, or tags:

bomly diff \
--url https://github.com/bomly-dev/example-javascript-npm \
--base v0.9.0 --head v1.0.0 \
--enrich

6. Add a security gate to CI

Fail your pipeline automatically when high-severity vulnerabilities are introduced:

# .github/workflows/bomly-guard.ymlname: Bomly Guardon:
pull_request:
permissions:
contents: readpull-requests: writeissues: writesecurity-events: writejobs:
guard:
runs-on: ubuntu-lateststeps:
- uses: actions/checkout@v5with:
fetch-depth: 0# Add the package-manager setup steps this ecosystem needs before Bomly Guard.
- uses: bomly-dev/bomly-guard@v1with:
fail-on: highcomment-summary-in-pr: always

Made with Bomly — open-source SCA for every ecosystem.