Find source (in package.json) of vulnerability (in package-lock.json)
GitHub sent me an email today warning me of a vulnerability in my package-lock.json file. However, as I understand it, this file is generated during npm install from package.json . How can I find out which package (from package.json ) is linked to the vulnerable one (in package-lock.json )? Related questions: How to update package-lock.json How can I find out which package (from package.json ) is linked to the vulnerable one (in package-lock.json )? (Answering my own question): The vulnerable package was named growl . So, the command npm ls growl shows the packages that depend on it: $ npm ls