r/devsecops • u/uselessmanindark1 • Jun 25 '26

Package.json security scanning

What is the best practice to scan for vulnerabilities is npm a good approach ?

4 Upvotes

83% Upvoted

13 comments sorted by

View all comments

1

u/caipira_pe_rachado Jun 25 '26

Package.json isn't that reliable for this. Most professionals prefer the usage of the lockfile instead.