SCA Results: WARN Attempt to invoke npm failed; falling back to lockfile

DFaustino (Community Member) asked a question.

June 19, 2023 at 2:03 PM

When submitting repositories for SCA (Software Composition Analysis) verification, an interruption occurs and we receive the following error message:

Veracode SCA agent scanning engine ready

Running the NPM scanner

2023-06-15/14:53:48.128 com.sourceclear.engine.component.collectors.npm.NPMNativeCollector WARN Attempt to invoke npm failed; falling back to lockfile

Processing results...

Processing results complete

We deleted the package-lock.json file and reinstalled the libraries, but it didn't solve it.

Does anyone know a solution?

Jason M., Veracode Support (Veracode)
3 years ago
Hello @DFaustino (Community Member),

There is a help center article JavaScript SCA Agent-Based Scanning, that has some information that can be helpful and when it comes to NPM, please keep these requirements in mind:
Meet the requirements for the Veracode SCA agent.
Have NPM 2.10.0 or later installed on the local path.
Include the package.json, package-lock.json, or npm-shrinkwrap.json file in the repository to scan.
If neither npm-shrinkwrap.json nor package-lock.json exist, be able to run the npm ls command from the root of the project where you perform scans.
If you are still experiencing issues, I would advise opening up a case with Support in order for an engineer to help troubleshoot the issue.

Jason
Veracode Support Engineer
Expand Post