# Steps for Performing npm Application Analysis

This topic covers the steps for performing npm application analysis using the Sonatype IQ CLI, Jenkins plugin, or Bamboo plugin.

For details on how our IQ-powered solutions evaluate npm applications, see [npm Application Analysis](https://help.sonatype.com/en/npm-application-analysis.html "npm Application Analysis")

## npm Application Analysis Using the Sonatype IQ CLI

### Run a scan

Invoke a Nexus IQ CLI scan of a directory or subdirectories containing yarn.lock, pnpm-lock.yaml, package-lock.json, or npm-shrinkwrap.json.

Example `pnpm-lock.yaml` file

```
lockfileVersion: 5.3

specifiers:
  '@angular-devkit/schematics': 8.3.26
  '@angular/common': 8.2.14
  '@angular/compiler': 8.2.14
  '@angular/core': 8.2.14
  '@angular/router': 8.2.14
  '@ng-bootstrap/ng-bootstrap': 5.3.0
    bootstrap: 4.5.0
    jquery: 1.9.1
    rxjs: ^6.4.0
    zone.js: ~0.9.1

dependencies:
  '@angular-devkit/schematics': 8.3.26_@angular+core@8.2.14+rxjs@6.4.0
  '@angular/common': 8.2.14
  '@angular/compiler': 8.2.14
  '@angular/core': 8.2.14_rxjs@6.4.0+zone.js@0.9.1
  '@angular/router': 8.2.14_ed906ac8447aa5d4a7a8ac33fedcf709
  '@ng-bootstrap/ng-bootstrap': 5.3.0_ed906ac8447aa5d4a7a8ac33fedcf709
    bootstrap: 4.5.0_jquery@1.9.1
    jquery: 1.9.1
    rxjs: 6.4.0
    zone.js: 0.9.1

packages:
  /@angular-devkit/core/8.3.26:
    resolution: {integrity: sha512-b1ng9091o33s55/cwQYh1kboiJtj8y8z8xQWATDI9kRmNIQkWYVwVa/MzgPRJ4bzbEGG3zIUHCsp52A6vuGr2A==}
    engines: {node: '>= 10.9.0', npm: '>= 6.2.0'}
    dependencies:
      ajv: 6.10.2
      fast-json-stable-stringify: 2.0.0
      magic-string: 0.25.3
      rxjs: 6.4.0
      source-map: 0.7.3
      dev: false
```

## npm Application Analysis Using the Jenkins plugin

By default, the Jenkins plugin will not evaluate the `yarn.lock`, `pnpm-lock.yaml`, `package-lock.json` or `npm-shrinkwrap.json` files. A custom Scan Target is needed.

**Example Pipeline Script with Scan Patterns**

```
nexusPolicyEvaluation iqApplication: 'SampApp' , iqScanPatterns: [[scanPattern: '**/npm-shrinkwrap.json' ], [scanPattern: '**/package-lock.json'], [scanPattern: '**/yarn.lock'], [scanPattern: '**/pnpm-lock.yaml']], iqStage: 'build'
```

## npm Application Analysis Using the Bamboo plugin

By default, the Bamboo plugin will not evaluate the `yarn.lock`, `pnpm-lock.yaml`, `package-lock.json` or `npm-shrinkwrap.json` files. A custom Scan Target is needed.

|     |
| --- |
|  |

## Search results

No results found.