kazuki-tam/PackageScanner analyze

Send package.json and/or a lockfile to the PackageScanner hosted API (POST /api/ci/analyze).

Trust Signals

name	description	required	default
working-directory	Directory to resolve lockfile and package.json paths against.	no	.
lockfile	Path to a lockfile relative to working-directory. If omitted, auto-detects package-lock.json, pnpm-lock.yaml, pnpm-lock.yml, yarn.lock, or bun.lock.	no	""
package-json	Path to package.json relative to working-directory. Defaults to package.json when that file exists.	no	""
package-manager	Lockfile package manager (npm, pnpm, yarn, bun). If omitted, inferred from the lockfile file name when possible.	no	""
fail-on-malware	Exit with failure when any malware is reported.	no	true
fail-on-vulnerability-severity	Lowest vulnerability severity that fails the step: off, low, moderate, high, or critical.	no	high
enable-metadata-check	Enable npm registry metadata checks (requires package.json in the request).	no	false

name	description
analysis-id	Analysis id from the API response.
malware-count	Number of malware findings.
vulnerability-count	Number of OSV vulnerability findings (CVE/GHSA etc.).
vulnerability-unknown-count	Number of vulnerability findings with unknown severity.
vulnerability-low-count	Number of low severity vulnerability findings.
vulnerability-moderate-count	Number of moderate severity vulnerability findings.
vulnerability-high-count	Number of high severity vulnerability findings.
vulnerability-critical-count	Number of critical severity vulnerability findings.