# What Dependency File Formats Does SkillSpector Parse? A Complete Guide to Supply Chain Analysis

> SkillSpector parses five dependency file formats requirements.txt, package.json, pyproject.toml, setup.py and Pipfile for Python and Node.js supply chain analysis. Identify vulnerable packages.

- Repository: [NVIDIA Corporation/SkillSpector](https://github.com/NVIDIA/SkillSpector)
- Tags: how-to-guide
- Published: 2026-06-21

---

**SkillSpector parses five primary dependency manifest formats—requirements.txt, package.json, pyproject.toml, setup.py, and Pipfile—using specialized extractors in [`static_patterns_supply_chain.py`](https://github.com/NVIDIA/SkillSpector/blob/main/static_patterns_supply_chain.py) to identify vulnerable or abandoned packages in Python and Node.js projects.**

NVIDIA's SkillSpector is a static supply chain analyzer that examines **dependency file formats** to surface security risks and abandoned dependencies. Understanding which manifest files SkillSpector supports is essential for developers auditing Python and JavaScript codebases. The tool's parsing logic resides primarily in [`src/skillspector/nodes/analyzers/static_patterns_supply_chain.py`](https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/nodes/analyzers/static_patterns_supply_chain.py), where dedicated helper functions extract package names, versions, and line numbers from common configuration files.

## Supported Dependency File Formats

SkillSpector recognizes both Python and Node.js ecosystems through specific file-type heuristics. The analyzer consolidates detection logic around line 457, where it checks file names against a predefined list to determine which extractor to invoke.

### requirements.txt (Python)

The tool processes any file containing the substring "requirements" in its name—including [`requirements.txt`](https://github.com/NVIDIA/SkillSpector/blob/main/requirements.txt), [`requirements-dev.txt`](https://github.com/NVIDIA/SkillSpector/blob/main/requirements-dev.txt), or [`requirements-prod.txt`](https://github.com/NVIDIA/SkillSpector/blob/main/requirements-prod.txt). The helper function `_extract_packages_from_requirements` handles the parsing logic, extracting tuples of `(package_name, version_or_None, line_number)` from traditional pip requirement specifiers.

### package.json (Node.js/npm)

SkillSpector supports standard npm manifest files through the `_extract_packages_from_package_json` function. This parser reads the JSON structure and pulls dependencies from `dependencies`, `devDependencies`, and `peerDependencies` objects, capturing both production and development packages.

### pyproject.toml (PEP 518/621)

For modern Python projects, SkillSpector treats paths containing "pyproject.toml" as candidates. The analyzer parses both `[project]` and `[tool.poetry]` tables to collect package entries, supporting PEP 518/621 compliant projects and Poetry-managed repositories.

### setup.py (Legacy Python)

When a file path ends with "setup.py", SkillSpector runs a lightweight AST (Abstract Syntax Tree) inspection to locate the `install_requires` list. This approach extracts package specifications without executing the Python file, providing safe static analysis of legacy setuptools configurations.

### Pipfile (Pipenv)

The analyzer recognizes "pipfile" (case-insensitive) and parses the `[packages]` and `[dev-packages]` sections to retrieve dependencies managed by Pipenv. This covers the modern Python packaging workflow that uses Pipfile instead of requirements.txt.

## How SkillSpector Detects Dependency Files

The file-type detection block at line 457 in [`static_patterns_supply_chain.py`](https://github.com/NVIDIA/SkillSpector/blob/main/static_patterns_supply_chain.py) implements a simple but effective heuristic matching system:

```python
for n in ["requirements", "package.json", "pyproject.toml", "setup.py", "pipfile"]

```

This loop checks the lower-cased file name against the list, determining which specialized extractor to invoke. The generic "requirements" string ensures that variants like [`requirements-test.txt`](https://github.com/NVIDIA/SkillSpector/blob/main/requirements-test.txt) or [`requirements_docs.txt`](https://github.com/NVIDIA/SkillSpector/blob/main/requirements_docs.txt) are processed by the requirements parser, providing broad coverage of Python dependency specifications.

## Parsing Implementation Details

### Extracting Packages from requirements.txt

The `_extract_packages_from_requirements` function at lines 389-390 parses traditional pip requirement syntax. It handles version specifiers (==, >=, <=, etc.) and extracts line numbers for precise vulnerability tracking.

```python
from skillspector.nodes.analyzers.static_patterns_supply_chain import (
    _extract_packages_from_requirements,
)

content = """\
flask==2.3.2
numpy>=1.21
pyyaml
"""
packages = _extract_packages_from_requirements(content)

# packages -> [('flask', '2.3.2', 1), ('numpy', '1.21', 2), ('pyyaml', None, 3)]

```

### Parsing package.json Dependencies

For Node.js projects, the `_extract_packages_from_package_json` function at lines 404-405 reads the JSON structure and iterates through dependency objects. It preserves semantic versioning prefixes (like ^ and ~) while recording the line numbers where each dependency appears.

```python
from skillspector.nodes.analyzers.static_patterns_supply_chain import (
    _extract_packages_from_package_json,
)

content = """{
  "dependencies": {
    "express": "^4.17.1",
    "lodash": "4.17.21"
  },
  "devDependencies": {
    "mocha": "9.0.0"
  }
}"""
packages = _extract_packages_from_package_json(content)

# packages -> [('express', '^4.17.1', 2), ('lodash', '4.17.21', 3), ('mocha', '9.0.0', 6)]

```

## Summary

- SkillSpector supports **five primary dependency file formats**: requirements.txt, package.json, pyproject.toml, setup.py, and Pipfile.
- The detection logic resides in [`src/skillspector/nodes/analyzers/static_patterns_supply_chain.py`](https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/nodes/analyzers/static_patterns_supply_chain.py) around line 457.
- **Python projects** are covered through requirements.txt (including variants), pyproject.toml (PEP 518/621 and Poetry), setup.py (AST-based extraction), and Pipfile.
- **Node.js projects** are supported via package.json parsing of dependencies, devDependencies, and peerDependencies.
- Unit tests for these parsers exist in [`tests/unit/test_patterns_new.py`](https://github.com/NVIDIA/SkillSpector/blob/main/tests/unit/test_patterns_new.py), validating the extraction logic for each format.

## Frequently Asked Questions

### Which Python dependency formats does SkillSpector support?

SkillSpector supports requirements.txt (and any file containing "requirements" in the name), pyproject.toml, setup.py, and Pipfile. This covers pip, setuptools, Poetry, and Pipenv workflow scenarios according to the source code in [`static_patterns_supply_chain.py`](https://github.com/NVIDIA/SkillSpector/blob/main/static_patterns_supply_chain.py).

### How does SkillSpector parse Node.js dependencies?

The analyzer parses [`package.json`](https://github.com/NVIDIA/SkillSpector/blob/main/package.json) files using the `_extract_packages_from_package_json` function, which extracts packages from `dependencies`, `devDependencies`, and `peerDependencies` objects. It captures both the version strings and their line numbers in the file.

### Does SkillSpector handle development dependencies?

Yes. For Node.js, it explicitly parses `devDependencies` and `peerDependencies` in package.json. For Python, it recognizes `dev-packages` in Pipfile and processes any requirements file variant (such as [`requirements-dev.txt`](https://github.com/NVIDIA/SkillSpector/blob/main/requirements-dev.txt)) through the generic requirements parser.

### Where is the dependency parsing logic implemented in the codebase?

The core parsing logic resides in [`src/skillspector/nodes/analyzers/static_patterns_supply_chain.py`](https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/nodes/analyzers/static_patterns_supply_chain.py). The file-type detection occurs around line 457, while the specific extraction helpers `_extract_packages_from_requirements` and `_extract_packages_from_package_json` are defined at lines 389-390 and 404-405 respectively.