According to the documentation, You should try this setting: --detect.npm.dependency.types.excluded=DEV
https://documentation.blackduck.com/bundle/detect/page/properties/detectors/npm.html