dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/NspAnalyzer.java
/**
     * Processes a part of package.json (as defined by JsonObject) and update
     * the specified dependency with relevant info.
     *
     * @param dependency the Dependency to update
     * @param jsonObject the jsonObject to parse
     * @param depType the dependency type
     */
Processes a part of package.json (as defined by JsonObject) and update
the specified dependency with relevant info.

@param dependency the Dependency to update
@param jsonObject the jsonObject to parse
@param depType the dependency type
Processes a part of package . json ( as defined by JsonObject ) and update the specified dependency with relevant info . @param dependency the Dependency to update @param jsonObject the jsonObject to parse @param depType the dependency type
private void processPackage(Dependency dependency, JsonObject jsonObject, String depType) {
        for (int i = 0; i < jsonObject.size(); i++) {
            for (Map.Entry<String, JsonValue> entry : jsonObject.entrySet()) {
                /*
                 * Create identifies that include the npm module and version. Since these are defined,
                 * assign the highest confidence.
                 */
                final Identifier moduleName = new Identifier("npm", "Module", null, entry.getKey());
                moduleName.setConfidence(Confidence.HIGHEST);
                String version = "";
                if (entry.getValue() != null && entry.getValue().getValueType() == JsonValue.ValueType.STRING) {
                    version = ((JsonString) entry.getValue()).getString();
                }
                final Identifier moduleVersion = new Identifier("npm", "Version", null, version);
                moduleVersion.setConfidence(Confidence.HIGHEST);
                final Identifier moduleDepType = new Identifier("npm", "Scope", null, depType);
                moduleVersion.setConfidence(Confidence.HIGHEST);
                /*
                 * Create related dependencies for each module defined in package.json. The path to the related
                 * dependency will not actually exist but needs to be unique (due to the use of Set in Dependency).
                 * The use of related dependencies is a way to specify the actual software BOM in package.json.
                 */
                final Dependency nodeModule = new Dependency(new File(dependency.getActualFile() + "#" + entry.getKey()), true);
                nodeModule.setDisplayFileName(entry.getKey());
                nodeModule.setIdentifiers(new HashSet<>(Arrays.asList(moduleName, moduleVersion, moduleDepType)));
                dependency.addRelatedDependency(nodeModule);
            }
        }
    }
private void processPackage ( Dependency dependency , JsonObject jsonObject , String depType ) { for ( int i = 0 ; i < jsonObject . size ( ) ; i ++ ) { for ( Map . Entry < String , JsonValue > entry : jsonObject . entrySet ( ) ) { /*
                 * Create identifies that include the npm module and version. Since these are defined,
                 * assign the highest confidence.
                 */ final Identifier moduleName = new Identifier ( "npm" , "Module" , null , entry . getKey ( ) ) ; moduleName . setConfidence ( Confidence . HIGHEST ) ; String version = "" ; if ( entry . getValue ( ) != null && entry . getValue ( ) . getValueType ( ) == JsonValue . ValueType . STRING ) { version = ( ( JsonString ) entry . getValue ( ) ) . getString ( ) ; } final Identifier moduleVersion = new Identifier ( "npm" , "Version" , null , version ) ; moduleVersion . setConfidence ( Confidence . HIGHEST ) ; final Identifier moduleDepType = new Identifier ( "npm" , "Scope" , null , depType ) ; moduleVersion . setConfidence ( Confidence . HIGHEST ) ; /*
                 * Create related dependencies for each module defined in package.json. The path to the related
                 * dependency will not actually exist but needs to be unique (due to the use of Set in Dependency).
                 * The use of related dependencies is a way to specify the actual software BOM in package.json.
                 */ final Dependency nodeModule = new Dependency ( new File ( dependency . getActualFile ( ) + "#" + entry . getKey ( ) ) , true ) ; nodeModule . setDisplayFileName ( entry . getKey ( ) ) ; nodeModule . setIdentifiers ( new HashSet < > ( Arrays . asList ( moduleName , moduleVersion , moduleDepType ) ) ) ; dependency . addRelatedDependency ( nodeModule ) ; } } }
Processes a part of package.json (as defined by JsonObject) and update
 the specified dependency with relevant info.
Processes a part of package . json ( as defined by JsonObject ) and update the specified dependency with relevant info .