Bug: Incomplete JavaScript/NPM Dependency Resolution

[Jaydeep869]

Description

JavaScriptResolver in pkg/resolver/javascript.go appears biased toward pnpm path layouts (via pnpmPathRe) and does not fully resolve dependencies for standard npm/yarn flattened node_modules layouts.

Steps to Reproduce

1. Use a project that installs dependencies using npm or yarn classic.
2. Run sbomit on that project.
3. Compare expected packages in node_modules/<package> to resolved output.

Expected Behavior

Resolver supports pnpm, npm, and yarn topologies and resolves dependencies from standard node_modules/<package> paths.

Actual Behavior

Dependencies in non-pnpm layouts are missed or incompletely resolved.

Environment

• sbomit version: current main branch
• Go version: any supported version
• OS: Linux/macOS/Windows

Additional Context

• Area: pkg/resolver/javascript.go
• Suggested fix:
  • Expand regex matching to include standard npm/yarn paths.
  • Update resolution logic to normalize package paths across pnpm and non-pnpm structures.

[Jaydeep869]

/bug

[zilosz]

I'm considering picking up this issue, but I'd like some clarification:

The resolver is currently able to deduce a package's version because pnpm path layouts contain the version already. Versioned package names are located in the node_modules/.pnpm folder. However, npm node_modules doesn't contain this information. How should we obtain version info in npm projects?

[Jaydeep869]

@zilosz for npm/yarn layouts, we actually can’t reliably obtain the version from file paths alone since that information isn’t encoded like it is in pnpm.

In this case, the resolver should extract only the package name and leave the version empty. The missing version can be resolved later during SBOM generation by merging with other sources like syft and trivy.

Concretely, this would involve:

• Matching standard node_modules/<package> and scoped node_modules/@<scope>/<package> paths
• Skipping version extraction when it’s not present in the path
• Constructing the PURL without @version when the version is missing
• Updating the file filter to not depend on .pnpm specific paths