@codacy/tools-trivy-0 0.3.0 → 0.4.0

package/README.md

@@ -1,8 +1,11 @@
 # @codacy/tools-trivy-0
 
 ## Table of Contents
+
 - [Overview](#overview)
 - [Umbrella patterns](#umbrella-patterns)
+- [DB update management](#db-update-management)
+- [Malicious package detection](#malicious-package-detection)
 - [Updating patterns](#updating-patterns)
 - [Updating the Trivy version](#updating-the-trivy-version)
 - [Development](#development)
@@ -14,28 +17,52 @@
 
 Security scanner using the [Trivy](https://trivy.dev/) binary. Scans for vulnerabilities in dependencies and hardcoded secrets. Uses the CLI execution strategy with two separate scan modes (vulnerability + secret).
 
-| Property | Value |
-|----------|-------|
-| Tool ID | `Trivy` |
-| Codacy UUID | `2fd7fbe0-33f9-4ab3-ab73-e9b62404e2cb` |
-| Strategy | CLI |
-| Languages | Multi-language (scans dependency manifests) |
-| Binary | `trivy` |
-| File patterns | `*` (auto-detects dependency manifests) |
-| Pattern count | 6 (umbrella patterns) |
+| Property      | Value                                       |
+| ------------- | ------------------------------------------- |
+| Tool ID       | `Trivy`                                     |
+| Codacy UUID   | `2fd7fbe0-33f9-4ab3-ab73-e9b62404e2cb`      |
+| Strategy      | CLI                                         |
+| Languages     | Multi-language (scans dependency manifests) |
+| Binary        | `trivy`                                     |
+| File patterns | `*` (auto-detects dependency manifests)     |
+| Pattern count | 6 (umbrella patterns)                       |
 
 ## Umbrella patterns
 
 Trivy uses umbrella patterns rather than individual CVE patterns:
 
-| Pattern ID | Severity | Description |
-|------------|----------|-------------|
-| `Trivy_vulnerability_critical` | Error | Critical vulnerabilities |
-| `Trivy_vulnerability_high` | High | High-severity vulnerabilities |
-| `Trivy_vulnerability_medium` | Warning | Medium-severity vulnerabilities |
-| `Trivy_vulnerability_minor` | Info | Low-severity vulnerabilities |
-| `Trivy_secret` | Error | Hardcoded secrets |
-| `Trivy_malicious_packages` | Error | Malicious packages (reserved) |
+| Pattern ID                     | Severity | Description                          |
+| ------------------------------ | -------- | ------------------------------------ |
+| `Trivy_vulnerability_critical` | Error    | Critical vulnerabilities             |
+| `Trivy_vulnerability_high`     | High     | High-severity vulnerabilities        |
+| `Trivy_vulnerability_medium`   | Warning  | Medium-severity vulnerabilities      |
+| `Trivy_vulnerability_minor`    | Info     | Low-severity vulnerabilities         |
+| `Trivy_secret`                 | Error    | Hardcoded secrets                    |
+| `Trivy_malicious_packages`     | Error    | Malicious packages (via OSV.dev API) |
+
+## DB update management
+
+The adapter reads Trivy's `metadata.json` (at `{cacheDir}/db/metadata.json`) to
+determine if the vulnerability database is still fresh. The `NextUpdate` field
+tells us when Trivy expects the next DB update.
+
+| Scenario                       | Behavior                                                           |
+| ------------------------------ | ------------------------------------------------------------------ |
+| DB fresh (`now < NextUpdate`)  | `--skip-db-update --skip-java-db-update` passed — no network check |
+| DB stale (`now >= NextUpdate`) | Trivy checks for updates normally                                  |
+| First run (no metadata)        | Trivy downloads the DB (~40MB)                                     |
+| Container mode                 | Always skips DB updates (DBs are pre-baked)                        |
+
+## Malicious package detection
+
+Detects known malicious packages by querying the [OSV.dev batch API](https://api.osv.dev/v1/querybatch).
+This piggybacks on the vulnerability scan output — the package list from `--list-all-pkgs`
+is extracted and cross-referenced against the OpenSSF malicious packages index (`MAL-*` IDs).
+
+- Covers 14 ecosystems: npm, PyPI, Go, RubyGems, crates.io, NuGet, Maven, Packagist, Pub, Hex, ConanCenter, CocoaPods, SwiftURL, conda
+- Uses a 10-second timeout per API call
+- On API failure (network error, timeout), logs a warning and skips — never blocks the core scan
+- Message format: `Malicious package detected: {name}@{version} ({MAL-ID}). {summary}`
 
 ## Updating patterns
 
@@ -62,10 +89,11 @@ pnpm test     # Run tests (requires trivy in PATH or auto-install)
 
 ## Notes for maintainers
 
-- Trivy runs **two separate scan invocations**: one for vulnerabilities (`--scanners vuln`) and one for secrets (`--scanners secret`). Which scans run depends on which umbrella patterns are enabled.
-- The vulnerability database is downloaded lazily on first run to `--cache-dir ~/.codacy/cache/trivy/`. Internet access is required on first use.
+- Trivy runs **two separate scan invocations**: one for vulnerabilities (`--scanners vuln`) and one for secrets (`--scanners secret`). Malicious package detection piggybacks on the vuln scan output (no extra invocation). Which scans run depends on which umbrella patterns are enabled.
+- The vulnerability database is downloaded lazily on first run to `--cache-dir ~/.codacy/cache/trivy/`. Internet access is required on first use. DB staleness is managed via `metadata.json` → `NextUpdate`.
 - Trivy scans **whole directories**, not individual files. Results are filtered to `ctx.targetFiles` after scanning.
 - The binary is downloaded from GitHub releases as a `.tar.gz` archive.
 - Vulnerability severity (CRITICAL/HIGH/MEDIUM/LOW) maps to the corresponding umbrella pattern.
 - Message format: `Insecure dependency {pkg}@{version} ({CVE}: {title}). Update to {fixedVersion}.`
+- Malicious package detection uses the OSV.dev batch API. On failure, it degrades gracefully (warning only).
 - Config file: checks for `trivy.yaml` in the repo root.

package/dist/index.js

@@ -126,6 +126,52 @@ var PATTERN_TO_SEVERITY = {
   Trivy_vulnerability_medium: "MEDIUM",
   Trivy_vulnerability_minor: "LOW"
 };
+var TRIVY_TYPE_TO_OSV_ECOSYSTEM = {
+  npm: "npm",
+  pip: "PyPI",
+  pipenv: "PyPI",
+  poetry: "PyPI",
+  conda: "conda",
+  gomod: "Go",
+  gem: "RubyGems",
+  bundler: "RubyGems",
+  cargo: "crates.io",
+  nuget: "NuGet",
+  pom: "Maven",
+  gradle: "Maven",
+  composer: "Packagist",
+  pub: "Pub",
+  hex: "Hex",
+  conan: "ConanCenter",
+  cocoapods: "CocoaPods",
+  swift: "SwiftURL"
+};
+var OSV_BATCH_SIZE = 1e3;
+var OSV_TIMEOUT_MS = 1e4;
+async function queryOsvBatch(queries) {
+  const allResults = [];
+  for (let i = 0; i < queries.length; i += OSV_BATCH_SIZE) {
+    const batch = queries.slice(i, i + OSV_BATCH_SIZE);
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), OSV_TIMEOUT_MS);
+    try {
+      const response = await fetch("https://api.osv.dev/v1/querybatch", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ queries: batch }),
+        signal: controller.signal
+      });
+      if (!response.ok) {
+        throw new Error(`OSV API returned HTTP ${response.status}: ${response.statusText}`);
+      }
+      const data = await response.json();
+      allResults.push(...data.results ?? []);
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+  return { results: allResults };
+}
 var BINARY = "trivy";
 var PLATFORM_MAP = {
   "darwin-arm64": "macOS-ARM64",
@@ -176,6 +222,24 @@ async function ensureCacheDir(globalDir) {
   await import_promises.default.mkdir(cacheDir, { recursive: true });
   return cacheDir;
 }
+async function checkDbFreshness(cacheDir) {
+  const metadataPath = import_path.default.join(cacheDir, "db", "metadata.json");
+  try {
+    const raw = await import_promises.default.readFile(metadataPath, "utf-8");
+    const meta = JSON.parse(raw);
+    if (!meta.NextUpdate) {
+      return { fresh: false, error: "metadata.json missing NextUpdate field" };
+    }
+    const nextUpdateMs = Date.parse(meta.NextUpdate);
+    if (Number.isNaN(nextUpdateMs)) {
+      return { fresh: false, error: `Invalid NextUpdate timestamp: ${meta.NextUpdate}` };
+    }
+    return Date.now() < nextUpdateMs ? { fresh: true, nextUpdate: meta.NextUpdate } : { fresh: false, nextUpdate: meta.NextUpdate };
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    return { fresh: false, error: message };
+  }
+}
 async function runTrivyScan(binary, args, cwd, errors) {
   const { stdout, stderr, exitCode } = await (0, import_tooling.spawnTool)(binary, args, { cwd });
   if (exitCode !== 0) {
@@ -286,6 +350,103 @@ async function parseSecrets(output, enabledPatterns, targetFilesSet, repositoryR
   }
   return issues;
 }
+async function parseMaliciousPackages(output, enabledPatterns, targetFilesSet, repositoryRoot, logger) {
+  const issues = [];
+  const errors = [];
+  const patternId = "Trivy_malicious_packages";
+  if (enabledPatterns.size > 0 && !enabledPatterns.has(patternId)) {
+    return { issues, errors };
+  }
+  if (!output.Results) return { issues, errors };
+  const meta = PATTERN_META.get(patternId) ?? {
+    category: "Security",
+    severity: "Error"
+  };
+  const packages = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const result of output.Results) {
+    if (!result.Packages || !result.Type) continue;
+    const ecosystem = TRIVY_TYPE_TO_OSV_ECOSYSTEM[result.Type];
+    if (!ecosystem) continue;
+    const relPath = result.Target;
+    if (targetFilesSet.size > 0 && !targetFilesSet.has(relPath)) continue;
+    for (const pkg of result.Packages) {
+      const key = `${ecosystem}:${pkg.Name}:${pkg.Version}:${relPath}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      const line = pkg.Locations && pkg.Locations.length > 0 && pkg.Locations[0].StartLine > 0 ? pkg.Locations[0].StartLine : 1;
+      packages.push({ ecosystem, name: pkg.Name, version: pkg.Version, filePath: relPath, line });
+    }
+  }
+  if (packages.length === 0) return { issues, errors };
+  const queryMap = /* @__PURE__ */ new Map();
+  for (const pkg of packages) {
+    const queryKey = `${pkg.ecosystem}:${pkg.name}:${pkg.version}`;
+    if (!queryMap.has(queryKey)) {
+      queryMap.set(queryKey, {
+        package: { name: pkg.name, ecosystem: pkg.ecosystem },
+        version: pkg.version
+      });
+    }
+  }
+  const queries = Array.from(queryMap.values());
+  let osvResponse;
+  try {
+    logger.debug("Querying OSV.dev for malicious packages", { packageCount: queries.length });
+    osvResponse = await queryOsvBatch(queries);
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    logger.warn(`Malicious package check skipped: ${message}`);
+    errors.push({
+      toolId: TOOL_ID,
+      phase: "toolInvoke",
+      kind: "NetworkError",
+      message: `OSV.dev API call failed: ${message}. Malicious package detection skipped.`,
+      level: "warning"
+    });
+    return { issues, errors };
+  }
+  const maliciousByPkg = /* @__PURE__ */ new Map();
+  const queryList = Array.from(queryMap.keys());
+  for (let i = 0; i < osvResponse.results.length; i++) {
+    const result = osvResponse.results[i];
+    if (!result.vulns) continue;
+    const malVulns = result.vulns.filter((v) => v.id.startsWith("MAL-"));
+    if (malVulns.length > 0 && i < queryList.length) {
+      maliciousByPkg.set(queryList[i], malVulns);
+    }
+  }
+  if (maliciousByPkg.size === 0) {
+    logger.debug("No malicious packages detected");
+    return { issues, errors };
+  }
+  const linesCache = /* @__PURE__ */ new Map();
+  for (const pkg of packages) {
+    const queryKey = `${pkg.ecosystem}:${pkg.name}:${pkg.version}`;
+    const malVulns = maliciousByPkg.get(queryKey);
+    if (!malVulns) continue;
+    if (!linesCache.has(pkg.filePath)) {
+      linesCache.set(pkg.filePath, await readFileLines(import_path.default.join(repositoryRoot, pkg.filePath)));
+    }
+    const lines = linesCache.get(pkg.filePath);
+    for (const vuln of malVulns) {
+      const summary = vuln.summary ? ` ${vuln.summary}` : "";
+      issues.push({
+        filePath: pkg.filePath,
+        patternId,
+        toolId: TOOL_ID,
+        line: pkg.line,
+        column: 1,
+        message: `Malicious package detected: ${pkg.name}@${pkg.version} (${vuln.id}).${summary}`,
+        lineContent: getLineContent(lines, pkg.line),
+        category: meta.category,
+        severity: meta.severity
+      });
+    }
+  }
+  logger.info("Malicious package check complete", { issuesFound: issues.length });
+  return { issues, errors };
+}
 var adapter = {
   id: TOOL_ID,
   displayName: "Trivy",
@@ -471,9 +632,28 @@ var adapter = {
     const enabledPatterns = new Set(codacyConfig.patterns.map((p) => p.patternId));
     const targetFilesSet = new Set(ctx.targetFiles);
     const vulnPatternIds = Object.values(VULN_SEVERITY_TO_PATTERN);
-    const runVulnScan = enabledPatterns.size === 0 || vulnPatternIds.some((id) => enabledPatterns.has(id));
+    const runMaliciousScan = enabledPatterns.size === 0 || enabledPatterns.has("Trivy_malicious_packages");
+    const runVulnScan = enabledPatterns.size === 0 || vulnPatternIds.some((id) => enabledPatterns.has(id)) || runMaliciousScan;
     const runSecretScan = enabledPatterns.size === 0 || enabledPatterns.has("Trivy_secret");
     const baseArgs = ["filesystem", "--format", "json", "--cache-dir", cacheDir];
+    if (runVulnScan) {
+      if (ctx.runner === "container") {
+        baseArgs.push("--skip-db-update", "--skip-java-db-update");
+        ctx.logger.debug("Container mode: skipping DB updates");
+      } else {
+        const dbStatus = await checkDbFreshness(cacheDir);
+        if (dbStatus.fresh) {
+          baseArgs.push("--skip-db-update", "--skip-java-db-update");
+          ctx.logger.debug("Trivy DB is fresh, skipping update check", {
+            nextUpdate: dbStatus.nextUpdate
+          });
+        } else {
+          ctx.logger.info(
+            dbStatus.error?.includes("ENOENT") ? "Trivy vulnerability database not found. Downloading (~40MB)..." : "Trivy DB update due, checking for new data..."
+          );
+        }
+      }
+    }
     if (codacyConfig.useLocalConfigurationFile && codacyConfig.localConfigurationFile) {
       baseArgs.push("--config", codacyConfig.localConfigurationFile);
     }
@@ -511,6 +691,17 @@ var adapter = {
               ctx.repositoryRoot
             )
           );
+          if (runMaliciousScan && ctx.runner !== "container") {
+            const malResult = await parseMaliciousPackages(
+              vulnOutput,
+              enabledPatterns,
+              targetFilesSet,
+              ctx.repositoryRoot,
+              ctx.logger
+            );
+            issues.push(...malResult.issues);
+            errors.push(...malResult.errors);
+          }
         }
       }
       if (runSecretScan) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codacy/tools-trivy-0",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Trivy adapter — CLI-mode security scanner",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -8,7 +8,7 @@
     "dist"
   ],
   "dependencies": {
-    "@codacy/tooling": "0.3.0"
+    "@codacy/tooling": "0.4.0"
   },
   "license": "MIT",
   "author": "Codacy <support@codacy.com> (https://www.codacy.com)",