Option to flag bundled dependencies?

[sarnesjo]

In npm, dependencies (including indirect dependencies) may be bundled, meaning they are included in the published package tarball. A bundled dependency may be modified compared to the version that exists in the registry. (We've seen examples of this while working on deps.dev.)

npm marks bundled dependencies in the package-lock.json file, using either an inBundle or bundled field depending on version. Currently, osv-scanner does not read these fields, and therefore does not report whether a dependency is bundled or not.

It'd be neat if osv-scanner could optionally flag bundled dependencies, as they may require further scrutiny, especially once osv-scanner reports issues besides vulnerabilities, for example licenses as mentioned in #477.

[github-actions[bot]]

This issue has not had any activity for 60 days and will be automatically closed in two weeks

[github-actions[bot]]

Automatically closing stale issue