Note, that a dependency is not necessarily referred in a file. It may be and frequently is just a sub-dependency of some other component.

Normally, you would build an SBOM using cyclonedx-npm or cdxgen, then either use cdxgen or load it into Dependency-Track which would build a graphical Dependency Graph for you so you can trace the origin. You can indeed explore evinse mode here as well.

If this approach does not work, please provide further information on the issue.