anchore / anchore/syft

Identify executable native code files/libraries under `node_modules`

Open
#3,192 0 comments 0 reactions 0 assignees View on GitHub
enhancement unknowns
Dominant language
Go
Stars
9.6k
Forks
954
Avg merge
1d 5h
Merged PRs (30d)
42

Description

**What would you like to be added**:
Identify executables found within `node_modules` providing native code to node runtime.

**Why is this needed**:
In the official Docker images, there are approximately 80 unidentified executable files found in `node_modules` paths, which presumably are native executable code for the node runtime. Syft should be able to identify from the `package.json`, ideally, that these native modules are expected and associate them with the surfaced Node packages.

Contributor guide

Open the contributing guide

Research direction

Start by tracing Syft's existing handling of node_modules and package.json, then inspect how unidentified executable files are surfaced in the official Docker images. Done means native executables found under node_modules are identified and associated with the relevant Node packages.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, node.js
Domain
devtools
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.