Guarddog is scanning all dependency versions

[nicogomezpomelo]

We observed the application takes a package.json and analyzes all the versions from the pinned one. This error occurs with the verify option. Example command: gg npm verify --exit-non-zero-on-finding package.json

Here is an extract of the package.json used:

The following image shows how the app starts to scan multiple versions of apollo/subgraph:

We also tried to remove all the ^ symbols to fix one particular version and force the app to scan that version, but we couldn't hit the nail. For now, our fix is to iterate over all the dependencies and use the scan flag

Searching in the code, we detected this behavior is referenced here:

• https://github.com/DataDog/guarddog/blob/main/guarddog/scanners/npm_project_scanner.py#L62

Is this an issue or are we doing something wrong? Thanks

[sobregosodd]

Hello @nicogomezpomelo , Thanks for the suggestion, we agree that guarddog should be honouring the pinned package dependencies and also that the all possible versions scanning might be undesired in some cases. We'll discuss this internally and circle back here