syft fails to resolve npm package aliases

[EricHripko]

Please provide a set of steps on how to reproduce the issue

• Create a package.json with the following contents:

{
  "name": "tmp",
  "version": "1.0.0",
  "description": "",
  "main": "index.js",
  "scripts": {
    "test": "echo \"Error: no test specified\" && exit 1"
  },
  "author": "",
  "license": "ISC",
  "dependencies": {
    "@vue/cli-service": "^5.0.8"
  }
}

• Generate a package-lock.json by running npm install --package-lock-only
• Run syft .

What happened:
Running syft on such project generates incorrect SBOM because the dependency uses a package alias:

...
@vue/component-compiler-utils             3.3.0                   npm
@vue/vue-loader-v15                       npm:vue-loader@15.10.0  npm
@vue/web-component-wrapper                1.3.0                   npm
...

What you expected to happen:
I expected syft to correctly resolve the npm package alias (from @vue/vue-loader-v15 to vue-loader@15.10.0) and recognise that my project has a dependency on vue-loader@15.10.0.

Anything else we need to know?:

Environment:

• Output of syft version:

Application:        syft
Version:            0.60.2
JsonSchemaVersion:  4.1.0
BuildDate:          2022-11-02T14:43:28Z
GitCommit:          35f0f2931e310882fe7117c41d57a185d72ca498
GitDescription:     v0.60.2
Platform:           linux/amd64
GoVersion:          go1.18.7
Compiler:           gc

• OS (e.g: cat /etc/os-release or similar):

NAME="Ubuntu"
VERSION="20.04 LTS (Focal Fossa)"
ID=ubuntu
ID_LIKE=debian
PRETTY_NAME="Ubuntu 20.04 LTS"
VERSION_ID="20.04"
HOME_URL="https://www.ubuntu.com/"
SUPPORT_URL="https://help.ubuntu.com/"
BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
VERSION_CODENAME=focal
UBUNTU_CODENAME=focal

[kzantow]

Thanks @EricHripko -- we definitely can figure out a way to handle these aliases (I haven't ever encountered them before!). Do you happen to know if this is specific to npm or also something supported yarn or other package managers?

[EricHripko]

Thank you for a prompt response, @kzantow 👍 I similarly didn't know about aliases until encountering this SBOM quirk; from what I can tell, yarn also supports package aliases.

[EricHripko]

Thank you for fixing this up - really appreciate it 🙌