# Vulnerabilities changed from transitive to other?

**URL:** <https://community.sonatype.com/t/vulnerabilities-changed-from-transitive-to-other/9319>\
**Category:** Sonatype Lifecycle & Firewall\
**Tags:** help, nexus-iq\
**Created:** [September 17, 2022, 9:25am UTC](https://community.sonatype.com/t/vulnerabilities-changed-from-transitive-to-other/9319 "2022-09-17T09:25:26Z")\
**Posts on this page:** 1\
**Showing post:** 1

<div class="post-metadata">

**Author:** ![muhammadsmasood2000](https://avatars.discourse-cdn.com/v4/letter/m/50afbb/32.png) [@muhammadsmasood2000](https://community.sonatype.com/u/muhammadsmasood2000)\
**Post date:** [September 17, 2022, 9:25am UTC](https://community.sonatype.com/t/vulnerabilities-changed-from-transitive-to-other/9319/1 "2022-09-17T09:25:26Z")

</div>

Hello everyone, hoping someone here can clarify my lack of understanding.

Context: Running SAST scan locally through _nexus-iq-cli_ on a web project (using react). Had a bunch of transitive vulnerabilities show up with _react-scripts_, addressed issue by moving import from _dependencies_ to _devDependencies_ (as devDependencies are not picked up on sonatype scan)

Issue 1: Moving _react-scripts_ from dependencies to devDependencies changed the vulnerabilities type from transitive to blank (Not sure what this indicates, could use an explanation). Why are vulnerabilities still picked up on the scan?  
Before (Shown as transitive issues)- \> After (moving react-scripts to devDep section of package.json file, now no longer transitive issues):

 ![MergedImages](https://canada1.discourse-cdn.com/flex047/uploads/communitysonatype/original/2X/e/e2ef39961418d5ef3d572a104d12a2a025454edd.png)

---

_[View the full topic](https://community.sonatype.com/t/vulnerabilities-changed-from-transitive-to-other/9319)._