Ecosystems
npm projects
Argus has early support for npm projects, using package-lock.json as the resolved dependency graph and the same OSV, qualification, merge-request, and reconciliation controls as Maven.
Supported shape
Argus detects an npm project when package.json and package-lock.json are present and no pom.xml is present in the same directory. Lockfile versions 2 and 3 are supported. Yarn and pnpm lockfiles are refused in this release with an explicit message, and npm workspaces should be run as individual package roots until workspace-aware planning is expanded.
npm ladder
The Maven ladder is preserved conceptually, but npm has one cheaper first step. If the declared range already admits the fixed version, Argus refreshes only package-lock.json. If the direct range excludes the fix, Argus edits the range in dependencies or devDependencies and regenerates the lockfile. For transitive findings, Argus adds a root overrides entry plus an argus.overrides marker so the override can be proven stale and removed later.
Policy
The unified libraries schema does not yet express npm-specific policy: package freezes and per-package advisory ignores (the 2.x offlimits.npm block) have no 3.0 equivalent, and a config still carrying that block is refused at startup. npm policy support in the unified schema is on the roadmap; until it lands, npm projects run fully managed.
Qualification
npm remediation candidates are staged in an isolated copy of the project. Argus regenerates the lockfile with npm install --package-lock-only or npm update <pkg> --package-lock-only, verifies the resolved version actually moved, repeats regeneration to catch nondeterminism, and then maps validation strategies to npm commands.
compile runs npm ci and npm run build --if-present. test runs npm ci and, by default, npm test. If your package uses a different script for CI qualification, set ARGUS_NPM_TEST_SCRIPT or pass --npm-test-script; Argus will run npm run <script> instead. Every Argus-owned npm invocation includes --ignore-scripts, --no-audit, and --no-fund.
Registries and auth
Version discovery reads npm packuments from the configured registry. Project .npmrc settings override user settings, scoped registries such as @scope:registry are honoured, and auth tokens can use the same ${{secret:key}} secret references documented in Secrets. General Argus policy still lives in config.yml; npm registry auth stays in npm’s native .npmrc model.
Mixed repositories
If the command root is not itself a Maven or npm project, Argus walks child directories and runs each detected Maven or npm project independently. Reports, patch directories, and branch prefixes are scoped by child directory so a repository with backend/ Maven and frontend/ npm projects does not cross the streams.