How do you find Microsoft Defender for Cloud node/npm security vulnerabilities in a docker image?

I have a Ubuntu docker image that uses azure-powershell as a base image, which I then install node and npm onto along with some Playwright dependencies. I'm not installing or running any code.

Microsoft Defender for Cloud is flagging up the following vulnerability when I push my image to Azure Container Registry

Nodejs (npm) Security Update for brace-expansion (GHSA-832h-xg76-4gv6)

I have no idea where this 'brace-expansion' package might be installed in the image.

How can I find out where this and other packages like it are installed and find out the versions?

Dockerfile for reference

# Copyright (c) Microsoft Corporation.
# Licensed under the MIT License.

# Docker image file that describes an Ubuntu20.04 image with PowerShell installed from Microsoft APT Repo
FROM mcr.microsoft.com/azure-powershell:ubuntu-18.04

ENV DEBIAN_FRONTEND=noninteractive
RUN echo "APT::Get::Assume-Yes \"true\";" > /etc/apt/apt.conf.d/90assumeyes

# === INSTALL Node.js ===

RUN apt-get update && \
  apt-get install -y \
  ca-certificates \
  curl \
  jq \
  git \
  iputils-ping \
  libcurl4 \
  libicu60 \
  libunwind8 \
  netcat \
  libssl1.0 \
  wget && \
  # clean apt cache
  rm -rf /var/lib/apt/lists/* && \
  # Create the pwuser
  adduser pwuser

RUN curl -fsSL https://deb.nodesource.com/setup_16.x | bash
RUN apt-get install nodejs \
  && node -v \
  && npm -v

RUN npm install -g npm@7.21.1 && npm -v

# === INSTALL Playwright ===

ENV PLAYWRIGHT_BROWSERS_PATH=/ms-playwright

# The version of Playwright should be pinned to the same corresponding version in the 'package.json' within 'tribal.edge.ui'
RUN mkdir /ms-playwright && \
  npx playwright@1.25.2 install --with-deps && rm -rf /var/lib/apt/lists/* && \
  chmod -R 777 /ms-playwright