randomman (Community Member) asked a question.
I have a Javascript/Typescript app (npm), I need to do a scan programmatically which will populate the Third-Party Components table (in the Software Composition Analyses section on the Veracode site).
Is the SCA scan what I need for this?
Is the SCA scan what I need for this?
And can the SCA scan be launched by the Veracode CLI? and can the result of the SCA scan be uploaded to Veracode so its available to view in the Software Composition Analyses section of the site? Thanks
.png){kind=logo}
Hi @randomman (Community Member) -
For JavaScript/TypeScript app, we need the package-lock.json for SCA U/S - or you can run SCA Agent on the source project. So if you are doing a Static Scan on the platform, you can just make sure to include the package-lock.json in their upload to get both Static and SCA in the same scan request.
You can leverage the CLI for auto-packaging but it's not guaranteed that will yield an artifact that will get SCA results because it's dependent on having package-lock.json in the project folder or the auto-packager being able to run npm on the project.