@lateos/npm-scan 0.8.0 → 0.9.0

package/backend/db.js

@@ -1,42 +1,88 @@
-import Database from 'better-sqlite3';
+import initSqlJs from 'sql.js';
 import fs from 'fs';
 import path from 'path';
+import { fileURLToPath } from 'url';
 
-const DB_PATH = 'npm-scan.db';
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const DB_PATH = path.join(process.cwd(), 'npm-scan.db');
+const SCHEMA_PATH = path.join(__dirname, 'db', 'schema.sql');
 
-let db;
+let db = null;
+let initPromise = null;
 
-function init() {
-  db = new Database(DB_PATH);
-  const schemaPath = path.join(process.cwd(), 'backend', 'db', 'schema.sql');
-  const schema = fs.readFileSync(schemaPath, 'utf8');
-  db.exec(schema);
+async function ensureInit() {
+  if (db) return;
+  if (initPromise) return initPromise;
+  initPromise = (async () => {
+    const SQL = await initSqlJs();
+    if (fs.existsSync(DB_PATH)) {
+      db = new SQL.Database(fs.readFileSync(DB_PATH));
+    } else {
+      db = new SQL.Database();
+    }
+    if (fs.existsSync(SCHEMA_PATH)) {
+      db.run(fs.readFileSync(SCHEMA_PATH, 'utf8'));
+    }
+  })();
+  return initPromise;
 }
 
-init();
+function queryAll(sql, params = []) {
+  const stmt = db.prepare(sql);
+  if (params.length) stmt.bind(params);
+  const rows = [];
+  while (stmt.step()) {
+    rows.push(stmt.getAsObject());
+  }
+  stmt.free();
+  return rows;
+}
 
-export function saveScan(pkgName, version = 'latest', findings = []) {
-  const scanStmt = db.prepare('INSERT INTO scans (package_name, version) VALUES (?, ?)');
-  const scanId = scanStmt.run(pkgName, version).lastInsertRowid;
-  const findStmt = db.prepare('INSERT INTO findings (scan_id, atk_id, severity, description, evidence) VALUES (?, ?, ?, ?, ?)');
+function queryOne(sql, params = []) {
+  return queryAll(sql, params)[0] || null;
+}
+
+function lastId() {
+  const r = db.exec("SELECT last_insert_rowid()");
+  return Number(r[0].values[0][0]);
+}
+
+function persist() {
+  fs.writeFileSync(DB_PATH, Buffer.from(db.export()));
+}
+
+export async function saveScan(pkgName, version = 'latest', findings = []) {
+  await ensureInit();
+  db.run("INSERT INTO scans (package_name, version) VALUES (?, ?)", [pkgName, version]);
+  const scanId = lastId();
+  const stmt = db.prepare("INSERT INTO findings (scan_id, atk_id, severity, description, evidence) VALUES (?, ?, ?, ?, ?)");
   for (const f of findings) {
-    findStmt.run(scanId, f.id, f.severity, f.title || f.description, f.evidence || '');
+    stmt.run([scanId, f.id, f.severity, f.title || f.description, f.evidence || '']);
   }
+  stmt.free();
+  persist();
   return scanId;
 }
 
-export function getRecentScans(limit = 10) {
-  return db.prepare('SELECT * FROM scans ORDER BY scanned_at DESC LIMIT ?').all(limit);
+export async function getRecentScans(limit = 10) {
+  await ensureInit();
+  return queryAll("SELECT * FROM scans ORDER BY scanned_at DESC LIMIT ?", [limit]);
 }
 
-export function getFindings(scanId) {
-  return db.prepare('SELECT * FROM findings WHERE scan_id = ?').all(scanId);
+export async function getFindings(scanId) {
+  await ensureInit();
+  return queryAll("SELECT * FROM findings WHERE scan_id = ?", [scanId]);
 }
 
-export function getScan(scanId) {
-  return db.prepare('SELECT * FROM scans WHERE id = ?').get(scanId);
+export async function getScan(scanId) {
+  await ensureInit();
+  return queryOne("SELECT * FROM scans WHERE id = ?", [scanId]);
 }
 
-export function close() {
-  db.close();
+export async function close() {
+  if (db) {
+    persist();
+    db.close();
+    db = null;
+  }
 }

package/cli/cli.js

@@ -15,7 +15,7 @@ function requirePremium(feature, licenseKey) {
 const program = new Command()
   .name('npm-scan')
   .description('npm supply chain security scanner')
-  .version('0.8.0');
+  .version('0.9.0');
 
 program
   .command('scan')
@@ -41,7 +41,7 @@ program
       const { pkgJson, jsFiles, tmpDir } = await import('../backend/fetch.js').then(m => m.fetchPackage(target));
       const findings = await import('../backend/detectors/index.js').then(m => m.runAll(pkgJson, jsFiles));
       const { saveScan } = await import('../backend/db.js');
-      const scanId = saveScan(target, 'latest', findings);
+      const scanId = await saveScan(target, 'latest', findings);
 
       let outputFindings = findings;
       let blocked = false;
@@ -100,8 +100,8 @@ program
     const { getRecentScans, getFindings, getScan } = await import('../backend/db.js');
 
     if (options.id) {
-      const findings = getFindings(options.id);
-      const scanInfo = getScan(options.id);
+      const findings = await getFindings(options.id);
+      const scanInfo = await getScan(options.id);
       const pkgName = scanInfo?.package_name || 'scan-' + options.id;
       const pkgVer = scanInfo?.version || 'unknown';
       const pkg = { name: pkgName, version: pkgVer };
@@ -137,8 +137,8 @@ program
         console.log(JSON.stringify(findings, null, 2));
       }
     } else {
-      const scans = getRecentScans();
-      const scansWithFindings = scans.map(s => ({ ...s, findings: getFindings(s.id) }));
+      const scans = await getRecentScans();
+      const scansWithFindings = await Promise.all(scans.map(async s => ({ ...s, findings: await getFindings(s.id) })));
 
       if (options.siem) {
         requirePremium('siem', licenseKey);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@lateos/npm-scan",
-  "version": "0.8.0",
-    "description": "Modern npm supply chain security scanner — detects obfuscated payloads, credential stealers, conditional triggers, sandbox evasion, and worm-like propagation. 11 attack types, SBOM, NIST/EU CRA compliance reporting.",
+  "version": "0.9.0",
+  "description": "Modern npm supply chain security scanner — detects obfuscated payloads, credential stealers, conditional triggers, sandbox evasion, and worm-like propagation. 11 attack types, SBOM, NIST/EU CRA compliance reporting.",
   "main": "backend/index.js",
   "bin": {
     "npm-scan": "cli/cli.js"
@@ -34,12 +34,12 @@
   },
   "dependencies": {
     "acorn": "^8.16.0",
-    "better-sqlite3": "^11.10.0",
     "commander": "^14.0.3",
     "glob": "^13.0.6",
     "js-yaml": "^4.1.1",
     "node-fetch": "^3.3.2",
     "pdf-lib": "^1.17.1",
+    "sql.js": "^1.11.0",
     "tar": "^7.5.15"
   }
 }