I’d like to work on adding support for npm overrides. Does anyone have guidance or a preferred approach before I begin?

In the issue, you mentioned:

"We should design how to handle these [overrides], as they do not apply to a detected package, but to other packages in the dependency tree and only in specific conditions."

I have a few questions regarding this:

1. Should we only capture the raw overrides data, or should we also apply it to the final dependency graph so that sub- dependency versions are replaced?
2. Would it be better to represent an override as a DependentPackage with a special scope (e.g., scope="overrides"), or should we store it in package.extra_data['overrides'] as raw JSON?
3. Is there an example test file or any existing approach for Go’s replace feature that I could model for npm overrides?

Update: I’ve added support for npm overrides in package.json within ScanCode Toolkit. Specifically, the NpmPackageJsonHandler now detects an "overrides" field (if present) and stores it in the package’s extra_data. I also added a dedicated test (test_parse_npm_package_json_with_overrides) to confirm this behavior and updated the .expected file for the alias test to ensure all tests pass.
At this stage, we’re not applying overrides to the dependency graph—only capturing them for reference. If you’d like me to integrate overrides further into the dependency resolution logic, please let me know, and I can work on that next!