# JavaScript and TypeScript

What licenseal reads in an npm project. The rules that hold for every ecosystem are under [How a scan works](<https://licenseal.shcherbak.ai/concepts/index.md>).

- **Registry:** npm
- **Manifests:** `package.json` (`dependencies`, `devDependencies`, `peerDependencies`, `optionalDependencies`)
- **Lockfiles:** `package-lock.json` (v1/v2/v3), `pnpm-lock.yaml`, `yarn.lock`, `bun.lock`

## What is read

- `peerDependencies` and `optionalDependencies` are read as production, like `dependencies`.
- A package installed under an npm alias is reported under its real name.
- A package that another `package.json` in the tree defines (a monorepo or pnpm workspace member) is not reported; a stderr line says how many were excluded.

## Dev dependencies

`devDependencies` are dev dependencies.

## Off-registry dependencies

These are reported as [off-registry dependencies](<https://licenseal.shcherbak.ai/concepts/off-registry/index.md>), in `package.json` and in every lockfile format:

- a git URL;
- a hosting shorthand (`github:user/repo`, a bare `user/repo`);
- a tarball URL;
- a `file:` / `link:` / `portal:` or bare path (`../pkg`, `C:\pkg`, `pkg-1.0.0.tgz`) the scan does not read.

One exception: a lockfile's `resolved` tarball URL in the layout registries serve (`<host>/<name>/-/<file>.tgz`, on any host) is a package of another registry, looked up on registry.npmjs.org.

## Not evaluated

- `engines`.
- `overrides`, Yarn `resolutions`, and pnpm `overrides` in `package.json` are not read: see [What is not read](<https://licenseal.shcherbak.ai/concepts/off-registry/#what-is-not-read>).

## See also

- [Dependency resolution](<https://licenseal.shcherbak.ai/concepts/dependency-resolution/index.md>) and [Versions and estimates](<https://licenseal.shcherbak.ai/concepts/version-resolution/index.md>), which apply to every ecosystem
- [What is scanned](<https://licenseal.shcherbak.ai/concepts/discovery/#lockfiles-are-read-wherever-they-are-found>), for which npm lockfile is read when a directory holds several
- [Alternate registries](<https://licenseal.shcherbak.ai/concepts/off-registry/#alternate-registries>), for a package from a private npm registry
- [Network egress](<https://licenseal.shcherbak.ai/security/network/index.md>), for the hosts contacted and what each is asked