Support NPM package aliases

[Utsav2]

It's trivially easy for users to alias packages and have them stop showing up in dependency scans.

Repro repo: https://github.com/SyntraInc/public_demo/tree/main

For npm: the aliased package is not tested, but its dependencies are correctly tested.

https://github.com/SyntraInc/public_demo/blob/main/snyk_npm_repro/package.json

...
  "dependencies": {
    "my_vulnerable_request": "npm:[email protected]"
  },
...

$ snyk test

Tested 47 dependencies for known issues, found 1 issue, 1 vulnerable path.


Issues with no direct upgrade or patch:
  ✗ Prototype Pollution [Medium Severity][https://security.snyk.io/vuln/SNYK-JS-TOUGHCOOKIE-5672873] in [email protected]
    introduced by [email protected] > [email protected]
  This issue was fixed in versions: 4.1.3

For pnpm, I believe because of #248, the aliased package is tested, but for some reason, none of its dependencies are tested.

https://github.com/SyntraInc/public_demo/blob/main/snyk_pnpm_repro/package.json

  "dependencies": {
    "my_vulnerable_request": "npm:[email protected]"
  },

$ snyk test

Testing /Users/utsavshah/p/vulns/public_demo/snyk_pnpm_repro...

Tested 1 dependencies for known issues, found 1 issue, 1 vulnerable path.


Issues with no direct upgrade or patch:
  ✗ Server-side Request Forgery (SSRF) [Medium Severity][https://security.snyk.io/vuln/SNYK-JS-REQUEST-3361831] in [email protected]
    introduced by [email protected]
  No upgrade or patch available

I think in both cases, the ideal behavior would be for both vulnerabilities - request and tough-cookie to be present.

I tested on the Snyk dashboard, and the results are the same as the CLI.

[ignat-tw]

I'm affected by this and it looks extreme in my case.

my resolutions/dependencies look like

"resolutions": {
    "cross-spawn": "6.0.6",
    "http-proxy-middleware": "^3.0.3",
    "path-to-regexp": "0.1.12",
    "cookie": "0.7.0",
    "nanoid": "^5.0.9",
    "react-intl": "^6.6.8",
    "react-intl-next": "npm:react-intl@^6.6.8",
    "follow-redirects": "^1.15.6",
    "serialize-javascript": "6.0.2",
    "braces": "^3.0.3",
    "browserify-sign": "4.2.2",
    "ws": "8.17.1",
    "body-parser": "^1.20.3",
    "express": "^4.20.0",
    "micromatch": "^4.0.8",
    "next": "^14.2.15"
  },

And there is no actual react-intl-next in my distribution as this depenendency has been long purged.