Does 'package.json' get scanned when using the Snyk CLI