XRay doesn't scan dependencies in NPM builds

I'm trying to integrate build scan feature to CI for our npm-based projects. Here're the steps in my pipeline

script:
    - curl -fL https://install-cli.jfrog.io | sh
    - CI=true jf config add my-server --url https://my-server.jfrog.io --user ${ARTIFACTORY_USERNAME} --password ${ARTIFACTORY_PASSWORD}
    - jf npm-config --server-id-resolve my-server --server-id-deploy my-server --repo-resolve npm-local --repo-deploy npm-local
    - npm install
    - jf npm install --build-name=my-build --build-number=$CI_COMMIT_SHORT_SHA
    - jf npm publish --build-name=my-build --build-number=$CI_COMMIT_SHORT_SHA
    - jf rt build-publish my-build $CI_COMMIT_SHORT_SHA
    - jf build-scan my-build $CI_COMMIT_SHORT_SHA

I have to do plain npm install first to pull dependencies from the public registry (registry.npmjs.org) because my artifactory repo is empty and jf npm install fails with 404 error

All my dependencies are listed in package.json file and if I run npm audit it says that I have some vulnerabilities. However, when I publishing build to artifactory and scan it with an XRay, no vulnerabilities/licenses found. Looks like XRay doesn't scan dependencies.

Is it because I download dependencies from public registry? How can I manage to scan dependencies in this case?

Start by reproducing the pipeline with package.json, plain npm install, jf npm install, build-publish, and build-scan, then compare the published build with the npm audit results. Trace how dependencies obtained from the public registry are represented in the build, and consider the issue done when those dependencies are included in the XRay scan with their vulnerabilities and licenses reported.