Does anyone know how the scanner is handling npms package.json / package-lock.json? Im trying to throw it into the hosting nginx but the CVEs don't show up