Is there any tools for software composition analysis with nested package.json files

As we discovered npm audit works only with top-level package.json in the project folder. I've already tested snyk and retire and it seems that they work a similar way. Perhaps some of you faced the problem before since it is not convenient to check every subfolder in the project for vulnerabilities.