diff --git a/src/core/engine/ecosystems/npm/internal/discover_project_dependencies.rs b/src/core/engine/ecosystems/npm/internal/discover_project_dependencies.rs
index 14bff9c..8c7977e 100644
--- a/src/core/engine/ecosystems/npm/internal/discover_project_dependencies.rs
+++ b/src/core/engine/ecosystems/npm/internal/discover_project_dependencies.rs
@@ -95,6 +95,9 @@ pub async fn run(repo: &dyn ProjectRepositorySnapshot) -> Result<Vec<DiscoveredD
         if let Some(deps) = pkg.get("dependencies").and_then(|d| d.as_object()) {
             for (name, req) in deps {
                 if let Some(req_str) = req.as_str() {
+                    if req_str.starts_with("workspace:") {
+                        continue;
+                    }
                     let version = locked_versions.get(name).cloned();
                     let (namespace, parsed_name) = if name.starts_with('@') {
                         let parts: Vec<&str> = name.splitn(2, '/').collect();
@@ -125,6 +128,9 @@ pub async fn run(repo: &dyn ProjectRepositorySnapshot) -> Result<Vec<DiscoveredD
         if let Some(deps) = pkg.get("devDependencies").and_then(|d| d.as_object()) {
             for (name, req) in deps {
                 if let Some(req_str) = req.as_str() {
+                    if req_str.starts_with("workspace:") {
+                        continue;
+                    }
                     let version = locked_versions.get(name).cloned();
                     let (namespace, parsed_name) = if name.starts_with('@') {
                         let parts: Vec<&str> = name.splitn(2, '/').collect();
diff --git a/src/core/http_agent.rs b/src/core/http_agent.rs
index 2ce83b0..27d3e2c 100644
--- a/src/core/http_agent.rs
+++ b/src/core/http_agent.rs
@@ -83,11 +83,20 @@ impl HttpAgent {
         }
 
         let response = self.get(url).await?;
+        let status = response.status();
         let bytes = response.bytes().await?;
 
         let mut cache = self.cache.write().await;
         cache.insert(url.to_string(), bytes.clone());
 
+        if !status.is_success() {
+            return Err(anyhow::anyhow!(
+                "HTTP error: {} - {}",
+                status,
+                String::from_utf8_lossy(&bytes)
+            ));
+        }
+
         let json = serde_json::from_slice(&bytes)?;
 
         Ok(json)