Vulnerability scanning

Finding known vulnerabilities in the npm packages a UI5 project's tooling and dependencies install, before the application is deployed. npm audit reports them for any project with a package.json.

Overview

SAP SHIPS

No core answer is documented.

Not covered: The check before deployment is npm's own npm audit for a project with a package.json, which sends the project's dependencies to the registry and reports known vulnerabilities; on BTP, deployed applications are the Application Vulnerability Report's.

Sourcenpm audit, npm Docschecked 2026-10-26