@lateos/npm-scan 0.12.0 → 0.12.1

package/README.md

@@ -205,6 +205,15 @@ npm-scan scan-lockfile --fail-on low
 # Generate SARIF v2.1 output for GitHub Advanced Security / VS Code
 npm-scan scan-lockfile --sarif results.sarif
 
+# Watch for changes and auto-rescan (single lockfile)
+npm-scan scan-lockfile --watch
+
+# Watch with faster debounce (500ms) — great for dev workflows
+npm-scan scan-lockfile --watch --debounce 500
+
+# Watch monorepo (all package-lock.json files in workspace)
+npm-scan scan-lockfile --watch --monorepo
+
 # Output only risk score (0-10) for dashboards/thresholds
 npm-scan scan-lockfile --score-only
 ```
@@ -621,6 +630,7 @@ See the [Docker quick-start section](#-run-lateosnpm-scan-anywhere-with-docker--
 - GitHub Action
 - Pre-commit hook (husky + lint-staged)
 - Docker images + Compose pipeline
+- Watch mode (--watch / --monorepo for auto-rescan)
 
 ### Premium (🔐 license key)
 

package/cli/cli.js

@@ -1,6 +1,10 @@
 #!/usr/bin/env node
 
 import { Command } from 'commander';
+import { watch } from 'fs';
+import { statSync } from 'fs';
+import { execSync } from 'child_process';
+import { glob } from 'glob';
 import { isFeatureEnabled, generateKey } from '../backend/license.js';
 
 function requirePremium(feature, licenseKey) {
@@ -164,8 +168,76 @@ program
   .option('--fail-on <level>', 'Exit with code 1 if findings >= level (low|medium|high|critical)', 'none')
   .option('--csv [file]', 'Output CSV format to file or stdout')
   .option('--sarif [file]', 'Output SARIF v2.1 format to file or stdout')
-  .action((options) => {
-    console.log('Scanning lockfile:', options.file);
+  .option('--watch', 'Watch for changes and re-scan automatically')
+  .option('--debounce <ms>', 'Debounce delay in ms before rescanning (default: 1000)', '1000')
+  .option('--silent', 'Suppress stdout output (useful for piping)')
+  .option('--monorepo', 'Scan all package-lock.json files in workspace')
+  .action(async (options) => {
+    const silent = options.silent;
+    const debounce = parseInt(options.debounce, 10) || 1000;
+    const isWatch = options.watch;
+    const isMonorepo = options.monorepo;
+
+    if (isWatch) {
+      if (isMonorepo) {
+        const lockfiles = await glob('**/package-lock.json', { ignore: 'node_modules/**' });
+
+        if (!silent) {
+          console.log(`\x1b[32m✔\x1b[0m npm-scan watch mode (monorepo) — ${lockfiles.length} lockfiles`);
+          console.log(`  Debounce: ${debounce}ms | Press Ctrl+C to stop\n`);
+        }
+
+        let timers = {};
+        for (const lf of lockfiles) {
+          if (!silent) console.log(`  Watching: ${lf}`);
+          const watcher = watch(lf, (eventType) => {
+            if (eventType !== 'change') return;
+            clearTimeout(timers[lf]);
+            timers[lf] = setTimeout(() => {
+              if (!silent) {
+                console.log(`\n\x1b[90m[${new Date().toLocaleTimeString()}]\x1b[0m ${lf} changed — scanning...`);
+              }
+              try {
+                execSync(`node cli/cli.js scan-lockfile -f "${lf}" --fail-on ${options.failOn || 'high'} --silent`, { stdio: silent ? 'ignore' : 'inherit' });
+              } catch (e) {}
+            }, debounce);
+          });
+        }
+
+        process.on('SIGINT', () => {
+          if (!silent) console.log('\n\x1b[33m✖\x1b[0m Stopped.');
+          process.exit(0);
+        });
+      } else {
+        const lockfile = options.file;
+        let lastSize = 0;
+        try { lastSize = statSync(lockfile).size; } catch {}
+
+        if (!silent) {
+          console.log(`\x1b[32m✔\x1b[0m npm-scan watch mode — ${lockfile}`);
+          console.log(`  Debounce: ${debounce}ms | Press Ctrl+C to stop\n`);
+        }
+
+        const watcher = watch(lockfile, (eventType) => {
+          if (eventType !== 'change') return;
+          const size = statSync(lockfile).size;
+          if (size === lastSize) return;
+          lastSize = size;
+          if (!silent) console.log(`\n\x1b[90m[${new Date().toLocaleTimeString()}]\x1b[0m ${lockfile} changed — rescanning...`);
+          try {
+            execSync(`node cli/cli.js scan-lockfile --fail-on ${options.failOn || 'high'} --silent`, { stdio: silent ? 'ignore' : 'inherit' });
+          } catch (e) {}
+        });
+
+        process.on('SIGINT', () => {
+          watcher.close();
+          if (!silent) console.log('\n\x1b[33m✖\x1b[0m Stopped.');
+          process.exit(0);
+        });
+      }
+    } else {
+      console.log('Scanning lockfile:', options.file);
+    }
   });
 
 program

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lateos/npm-scan",
-  "version": "0.12.0",
+  "version": "0.12.1",
   "description": "Modern npm supply chain security scanner — detects obfuscated payloads, credential stealers, conditional triggers, sandbox evasion, and worm-like propagation. 11 attack types, SBOM, NIST/EU CRA compliance reporting.",
   "main": "backend/index.js",
   "bin": {