Missing version for packages installed by npm in docker image

[jcfiorenzano]

Hi I have a question related with some packages found by tern that have missing versions, this packages are from a layer that runs npm install, this is the dockerfile

FROM node:12.16-alpine
RUN npm install -g serve 

and example of a package that doesn't have a version is:

{
                        "diff_id": "3063c35ca42be8c1fa62e5088384904c373b2060690a4f9dfc4a77bfef1e253e",
                        "fs_hash": "89cd0e9751f294b4714f307a2f5a0556aa23e2368e3233525988fb8c8a55b544",
                        "tar_file": "8996d1f6470fbc2886ea502ed165842da1b112961d5b12099b0a91a9883072c2/layer.tar",
                        "created_by": "/bin/sh -c npm install -g serve",
                        "packages": [
                            {
                                "name": "npm",
                                "version": "",
                                "pkg_license": "",
                                "copyright": "",
                                "proj_url": "",
                                "download_url": "",
                                "checksum": "",
                                "origins": [
                                    {
                                        "origin_str": "npm",
                                        "notices": [
                                            {
                                                "message": "No metadata for key: version",
                                                "level": "warning"
                                            },
                                            {
                                                "message": "No metadata for key: pkg_license",
                                                "level": "warning"
                                            },
                                            {
                                                "message": "No metadata for key: copyright",
                                                "level": "warning"
                                            },
                                            {
                                                "message": "No metadata for key: proj_url",
                                                "level": "warning"
                                            },
                                            {
                                                "message": "No metadata for key: download_url",
                                                "level": "warning"
                                            },
                                            {
                                                "message": "No metadata for key: checksum",
                                                "level": "warning"
                                            },
                                            {
                                                "message": "No metadata for key: files",
                                                "level": "warning"
                                            },
                                            {
                                                "message": "No metadata for key: pkg_licenses",
                                                "level": "warning"
                                            }
                                        ]
                                    }
                                ],
                                "files": [],
                                "pkg_licenses": []
                            },

I wanted to understand if this behavior is expected? The version of tern that I am using is 2.4.0 and the OS is Ubuntu 20.04

[nishakm]

It's not expected. Could you file a bug? I can check it out.