ACS's scanner supports scanning npm package.json files for vulnerabilities. ACS is looking to add this ability to ClairCore.

ClairCore now has the ability to obtain language-specific vulnerability data from OSV. OSV's database includes npm data, so ClairCore has a datasource for npm packages.