@lateos/npm-scan 0.3.2 → 0.3.3

package/backend/db.js

@@ -33,6 +33,10 @@ export function getFindings(scanId) {
   return db.prepare('SELECT * FROM findings WHERE scan_id = ?').all(scanId);
 }
 
+export function getScan(scanId) {
+  return db.prepare('SELECT * FROM scans WHERE id = ?').get(scanId);
+}
+
 export function close() {
   db.close();
 }

package/backend/report.js

@@ -6,7 +6,7 @@ export function generateHTML(scans) {
     const worstLabel = ['', 'info', 'low', 'medium', 'high', 'critical'][worst] || 'clean';
     const color = { critical: '#d73a49', high: '#cb2431', medium: '#f66a0a', low: '#dbab09', clean: '#28a745' }[worstLabel] || '#28a745';
     const findingRows = findings.map(f =>
-      `<tr><td>${f.id}</td><td style="color:${color}">${f.severity}</td><td>${f.title || ''}</td><td>${(f.evidence || '').slice(0, 80)}</td></tr>`
+      `<tr><td>${f.atk_id || f.id}</td><td style="color:${color}">${f.severity}</td><td>${f.description || f.title || ''}</td><td>${(f.evidence || '').slice(0, 80)}</td></tr>`
     ).join('');
     return { name: s.package_name, worstLabel, color, count: findings.length, findingRows };
   });
@@ -65,7 +65,7 @@ th { background: #161b22; font-weight: 600; }
 <h2>NIST SP 800-161 Compliance Summary</h2>
 ${nistMap}
 
-<p class="meta">npm-scan v0.2.5 | Apache-2.0 + Commons Clause | NIST SP 800-161 mapped</p>
+<p class="meta">npm-scan v${process.env.npm_package_version || '0.3.2'} | Apache-2.0 + Commons Clause | NIST SP 800-161 mapped</p>
 </body>
 </html>`;
 }
@@ -74,8 +74,9 @@ function getAtkFindings(scans) {
   const map = {};
   for (const s of scans) {
     for (const f of (s.findings || [])) {
-      if (!map[f.id]) map[f.id] = [];
-      map[f.id].push(f);
+      const key = f.atk_id || f.id;
+      if (!map[key]) map[key] = [];
+      map[key].push(f);
     }
   }
   return map;

package/backend/sbom.js

@@ -15,7 +15,7 @@ function generateCycloneDX(pkgJson, findings) {
         version: pkgJson.version || 'unknown',
         purl: `pkg:npm/${pkgJson.name || 'unknown'}@${pkgJson.version || 'unknown'}`
       },
-      tools: [{ name: 'npm-scan', version: '0.2.5' }]
+      tools: [{ name: 'npm-scan', version: '0.3.2' }]
     },
     vulnerabilities: findings.map(f => {
       const atkId = f.atk_id || f.id;
@@ -60,7 +60,7 @@ function generateSPDX(pkgJson, findings) {
       annotationDate: new Date().toISOString(),
       annotationType: 'OTHER',
       annotator: 'Tool: npm-scan',
-      comment: `[${f.id}] ${f.severity.toUpperCase()}: ${f.title || ''} — ${f.description || ''}`
+      comment: `[${f.atk_id || f.id}] ${f.severity.toUpperCase()}: ${f.description || f.title || ''}`
     }))
   };
   return JSON.stringify(spdx, null, 2);

package/cli/cli.js

@@ -50,17 +50,20 @@ program
   .option('--html', 'HTML report')
   .option('--nist', 'NIST 800-161 compliance report')
   .action(async (options) => {
-    const { getRecentScans, getFindings, db } = await import('../backend/db.js');
+    const { getRecentScans, getFindings, getScan } = await import('../backend/db.js');
     if (options.id) {
       const findings = getFindings(options.id);
-      const pkg = { name: 'scanned-pkg', version: 'unknown' };
+      const scanInfo = getScan(options.id);
+      const pkgName = scanInfo?.package_name || 'scan-' + options.id;
+      const pkgVer = scanInfo?.version || 'unknown';
+      const pkg = { name: pkgName, version: pkgVer };
       if (options.sbom) {
         const { generateSBOM } = await import('../backend/sbom.js');
         const sbom = generateSBOM(pkg, findings, options.sbom === true ? 'json' : options.sbom);
         console.log(sbom);
       } else if (options.html || options.nist) {
         const { generateHTML } = await import('../backend/report.js');
-        const scan = findings.length ? { package_name: 'scan-' + options.id, findings } : null;
+        const scan = findings.length ? { package_name: pkgName, version: pkgVer, findings } : null;
         const html = generateHTML(scan ? [scan] : []);
         console.log(html);
       } else {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lateos/npm-scan",
-  "version": "0.3.2",
+  "version": "0.3.3",
   "description": "Powerful npm supply chain security scanner - detects malicious packages (Shai-Hulud style), behavioral analysis, SBOM, and compliance reporting.",
   "main": "backend/index.js",
   "bin": {