Package-lock.json Parsing

Overview

The package-lock.json file is an npm lock file that records exact dependency versions used in a project. It enables reproducible installs and is essential for vulnerability scanning.

File Structure

The package-lock.json follows this structure:

{
  "name": "project-name",
  "version": "1.0.0",
  "lockfileVersion": 3,
  "packages": {
    "": {
      "name": "project-name",
      "version": "1.0.0",
      "dependencies": {
        "express": "^4.18.0"
      }
    },
    "node_modules/express": {
      "version": "4.18.2",
      "resolved": "https://registry.npmjs.org/express/-/express-4.18.2.tgz"
    }
  }
}

Key Properties

• packages: Contains all packages (root + node_modules)
• version: The installed version of each package
• dependencies: Direct dependencies of a package

Extraction Pattern

import json

def parse_package_lock(file_path):
    with open(file_path, 'r') as f:
        lock_data = json.load(f)

    packages = {}
    for pkg_path, pkg_info in lock_data.get('packages', {}).items():
        # Skip root package
        if pkg_path == '':
            continue

        pkg_name = pkg_path.split('/')[-1]
        version = pkg_info.get('version')
        packages[pkg_name] = version

    return packages

Usage

Use this skill when:

• Extracting dependency lists from package-lock.json
• Building vulnerability scanning pipelines
• Analyzing dependency versions for compliance
• Creating inventory reports of installed packages

Related Skills

• trivy-vulnerability-scanning: Use parsed packages as input to vulnerability scanner
• security-audit-csv-reporting: Output results in structured CSV format