Supporting webjars and other re-packagings of software artifacts from other ecosystems about advisory-database HOT 1 OPEN

I think this would be beneficial to the current security vulnerability universe to do this. It should be acknowledged that this is not technically correct behavior, but it would help solve a very real problem in the short term.

The technically correct behavior is for various SBOM and vulnerability scanners to correctly reach inside a webjar and report the NPM findings as NPM findings, not as java findings.

However, this is not how much of the current scanners work. They will probably get there someday, but the space is still too new and there are other larger rocks to move first.

I believe this is one of those instances where doing something that isn't technically correct, but solves an existing problem makes sense.

from advisory-database.