diff --git a/package.json b/package.json
new file mode 100644
index 0000000..eccfe79
--- /dev/null
+++ b/package.json
@@ -0,0 +1,38 @@
+{
+  "name": "java-ai-vulnerable",
+  "version": "1.0.0",
+  "description": "Intentionally vulnerable application for security testing and SCA scanning demos",
+  "main": "test.js",
+  "scripts": {
+    "start": "node test.js",
+    "test": "echo \"Error: no test specified\" && exit 1"
+  },
+  "keywords": ["vulnerable", "security", "demo"],
+  "author": "",
+  "license": "MIT",
+  "dependencies": {
+    "lodash": "4.17.4",
+    "express": "4.16.0",
+    "axios": "0.18.0",
+    "node-serialize": "0.0.4",
+    "serialize-javascript": "1.7.0",
+    "minimist": "1.2.0",
+    "ini": "1.3.5",
+    "path-parse": "1.0.6",
+    "json-schema": "0.2.3",
+    "marked": "0.3.6",
+    "dot": "1.1.2",
+    "handlebars": "4.0.11",
+    "mysql": "2.16.0",
+    "morgan": "1.9.0",
+    "jsonwebtoken": "8.1.0",
+    "bcrypt": "1.0.3",
+    "request": "2.85.0",
+    "tar": "4.4.1",
+    "underscore": "1.9.0"
+  },
+  "devDependencies": {
+    "mocha": "5.2.0",
+    "eslint": "4.18.2"
+  }
+}