@maverick006/scanner-npm-audit 1.0.2

package/dist/index.d.ts

@@ -0,0 +1,8 @@
+import { SecurityScanner } from '@maverick006/security-engine';
+import { ScanInput, ScannerResult } from '@maverick006/types';
+export declare class NpmAuditScanner implements SecurityScanner {
+    name: string;
+    version: string;
+    scan(input: ScanInput): Promise<ScannerResult>;
+}
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAQ9D,qBAAa,eAAgB,YAAW,eAAe;IAC9C,IAAI,SAAe;IACnB,OAAO,SAAa;IAErB,IAAI,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC;CAuDrD"}

package/dist/index.js

@@ -0,0 +1,99 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NpmAuditScanner = void 0;
+const child_process_1 = require("child_process");
+const util_1 = require("util");
+const parser_1 = require("./parser");
+const path = __importStar(require("path"));
+const execAsync = (0, util_1.promisify)(child_process_1.exec);
+class NpmAuditScanner {
+    name = 'npm-audit';
+    version = 'unknown';
+    async scan(input) {
+        const startTime = new Date();
+        let rawOutput = '';
+        try {
+            const safePath = path.resolve(input.repositoryPath);
+            // npm audit --json outputs audit data. We run it in the repository path.
+            // Note: this assumes package.json exists. If it doesn't, npm audit will fail, which we can catch.
+            const { stdout } = await execAsync(`npm audit --json --prefix "${safePath}"`, {
+                timeout: 300000,
+                maxBuffer: 1024 * 1024 * 50
+            });
+            rawOutput = stdout;
+            const findings = (0, parser_1.parseNpmAuditOutput)(input.scanId, rawOutput);
+            return {
+                scanner: this.name,
+                success: true,
+                findings,
+                rawOutput,
+                startTime,
+                endTime: new Date()
+            };
+        }
+        catch (error) {
+            // npm audit returns exit code > 0 if vulnerabilities are found
+            if (error.stdout && error.stdout.includes('"auditReportVersion":')) {
+                try {
+                    rawOutput = error.stdout;
+                    const findings = (0, parser_1.parseNpmAuditOutput)(input.scanId, rawOutput);
+                    return {
+                        scanner: this.name,
+                        success: true,
+                        findings,
+                        rawOutput,
+                        startTime,
+                        endTime: new Date()
+                    };
+                }
+                catch (parseError) {
+                    // ignore parsing error
+                }
+            }
+            return {
+                scanner: this.name,
+                success: false,
+                findings: [],
+                error: error.message || 'npm audit execution failed',
+                rawOutput: error.stdout || '',
+                startTime,
+                endTime: new Date()
+            };
+        }
+    }
+}
+exports.NpmAuditScanner = NpmAuditScanner;
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEA,iDAAqC;AACrC,+BAAiC;AACjC,qCAA+C;AAC/C,2CAA6B;AAE7B,MAAM,SAAS,GAAG,IAAA,gBAAS,EAAC,oBAAI,CAAC,CAAC;AAElC,MAAa,eAAe;IACnB,IAAI,GAAG,WAAW,CAAC;IACnB,OAAO,GAAG,SAAS,CAAC;IAE3B,KAAK,CAAC,IAAI,CAAC,KAAgB;QACzB,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;QAC7B,IAAI,SAAS,GAAG,EAAE,CAAC;QAEnB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;YAEpD,yEAAyE;YACzE,kGAAkG;YAClG,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,8BAA8B,QAAQ,GAAG,EAAE;gBAC5E,OAAO,EAAE,MAAM;gBACf,SAAS,EAAE,IAAI,GAAG,IAAI,GAAG,EAAE;aAC5B,CAAC,CAAC;YAEH,SAAS,GAAG,MAAM,CAAC;YACnB,MAAM,QAAQ,GAAG,IAAA,4BAAmB,EAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YAE9D,OAAO;gBACL,OAAO,EAAE,IAAI,CAAC,IAAI;gBAClB,OAAO,EAAE,IAAI;gBACb,QAAQ;gBACR,SAAS;gBACT,SAAS;gBACT,OAAO,EAAE,IAAI,IAAI,EAAE;aACpB,CAAC;QACJ,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,+DAA+D;YAC/D,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,CAAC;gBACnE,IAAI,CAAC;oBACH,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC;oBACzB,MAAM,QAAQ,GAAG,IAAA,4BAAmB,EAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;oBAC9D,OAAO;wBACL,OAAO,EAAE,IAAI,CAAC,IAAI;wBAClB,OAAO,EAAE,IAAI;wBACb,QAAQ;wBACR,SAAS;wBACT,SAAS;wBACT,OAAO,EAAE,IAAI,IAAI,EAAE;qBACpB,CAAC;gBACJ,CAAC;gBAAC,OAAO,UAAU,EAAE,CAAC;oBACpB,uBAAuB;gBACzB,CAAC;YACH,CAAC;YAED,OAAO;gBACL,OAAO,EAAE,IAAI,CAAC,IAAI;gBAClB,OAAO,EAAE,KAAK;gBACd,QAAQ,EAAE,EAAE;gBACZ,KAAK,EAAE,KAAK,CAAC,OAAO,IAAI,4BAA4B;gBACpD,SAAS,EAAE,KAAK,CAAC,MAAM,IAAI,EAAE;gBAC7B,SAAS;gBACT,OAAO,EAAE,IAAI,IAAI,EAAE;aACpB,CAAC;QACJ,CAAC;IACH,CAAC;CACF;AA3DD,0CA2DC"}

package/dist/parser.d.ts

@@ -0,0 +1,3 @@
+import { NormalizedFinding } from '@maverick006/types';
+export declare function parseNpmAuditOutput(scanId: string, output: string): NormalizedFinding[];
+//# sourceMappingURL=parser.d.ts.map

package/dist/parser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parser.d.ts","sourceRoot":"","sources":["../src/parser.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAwB,MAAM,oBAAoB,CAAC;AAE7E,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,iBAAiB,EAAE,CAoDvF"}

package/dist/parser.js

@@ -0,0 +1,53 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseNpmAuditOutput = parseNpmAuditOutput;
+const types_1 = require("@maverick006/types");
+function parseNpmAuditOutput(scanId, output) {
+    try {
+        const data = JSON.parse(output);
+        const findings = [];
+        // npm audit JSON output format: version 2
+        if (data.auditReportVersion !== 2 || !data.vulnerabilities) {
+            return findings;
+        }
+        for (const [pkgName, vulnData] of Object.entries(data.vulnerabilities)) {
+            const viaArray = Array.isArray(vulnData.via) ? vulnData.via : [];
+            // Some 'via' entries are just strings (referencing other packages), 
+            // we look for objects that contain actual vulnerability details.
+            for (const via of viaArray) {
+                if (typeof via === 'object' && via.title) {
+                    let severity = types_1.Severity.INFO;
+                    if (via.severity === 'critical')
+                        severity = types_1.Severity.CRITICAL;
+                    else if (via.severity === 'high')
+                        severity = types_1.Severity.HIGH;
+                    else if (via.severity === 'moderate')
+                        severity = types_1.Severity.MEDIUM;
+                    else if (via.severity === 'low')
+                        severity = types_1.Severity.LOW;
+                    const finding = {
+                        scanId,
+                        scanner: 'npm-audit',
+                        scannerVersion: 'v2', // refers to report version
+                        ruleId: via.url || `npm-audit-${pkgName}`,
+                        title: via.title,
+                        description: `Dependency vulnerability in ${pkgName}. Range: ${via.range}. Fix: ${vulnData.fixAvailable ? (typeof vulnData.fixAvailable === 'object' ? vulnData.fixAvailable.name + '@' + vulnData.fixAvailable.version : 'Available') : 'None'}`,
+                        severity,
+                        confidence: types_1.Confidence.HIGH, // SCA scans matching a CVE have high confidence
+                        category: 'dependency',
+                        file: 'package.json', // Best guess for location
+                        line: 1, // Doesn't map well to line numbers
+                        cwe: Array.isArray(via.cwe) ? via.cwe.join(', ') : via.cwe,
+                        owasp: 'A06:2021', // Vulnerable and Outdated Components
+                    };
+                    findings.push(finding);
+                }
+            }
+        }
+        return findings;
+    }
+    catch (error) {
+        throw new Error('Failed to parse npm audit JSON output');
+    }
+}
+//# sourceMappingURL=parser.js.map

package/dist/parser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parser.js","sourceRoot":"","sources":["../src/parser.ts"],"names":[],"mappings":";;AAEA,kDAoDC;AAtDD,8CAA6E;AAE7E,SAAgB,mBAAmB,CAAC,MAAc,EAAE,MAAc;IAChE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAChC,MAAM,QAAQ,GAAwB,EAAE,CAAC;QAEzC,0CAA0C;QAC1C,IAAI,IAAI,CAAC,kBAAkB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;YAC3D,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,KAAK,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAM,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;YAE5E,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAEjE,qEAAqE;YACrE,iEAAiE;YACjE,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;gBAC3B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;oBAEzC,IAAI,QAAQ,GAAG,gBAAQ,CAAC,IAAI,CAAC;oBAC7B,IAAI,GAAG,CAAC,QAAQ,KAAK,UAAU;wBAAE,QAAQ,GAAG,gBAAQ,CAAC,QAAQ,CAAC;yBACzD,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM;wBAAE,QAAQ,GAAG,gBAAQ,CAAC,IAAI,CAAC;yBACtD,IAAI,GAAG,CAAC,QAAQ,KAAK,UAAU;wBAAE,QAAQ,GAAG,gBAAQ,CAAC,MAAM,CAAC;yBAC5D,IAAI,GAAG,CAAC,QAAQ,KAAK,KAAK;wBAAE,QAAQ,GAAG,gBAAQ,CAAC,GAAG,CAAC;oBAEzD,MAAM,OAAO,GAAsB;wBACjC,MAAM;wBACN,OAAO,EAAE,WAAW;wBACpB,cAAc,EAAE,IAAI,EAAE,2BAA2B;wBACjD,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,aAAa,OAAO,EAAE;wBACzC,KAAK,EAAE,GAAG,CAAC,KAAK;wBAChB,WAAW,EAAE,+BAA+B,OAAO,YAAY,GAAG,CAAC,KAAK,UACtE,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,OAAO,QAAQ,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,GAAG,GAAG,GAAG,QAAQ,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,MACzJ,EAAE;wBACF,QAAQ;wBACR,UAAU,EAAE,kBAAU,CAAC,IAAI,EAAE,gDAAgD;wBAC7E,QAAQ,EAAE,YAAY;wBACtB,IAAI,EAAE,cAAc,EAAE,0BAA0B;wBAChD,IAAI,EAAE,CAAC,EAAE,mCAAmC;wBAC5C,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG;wBAC1D,KAAK,EAAE,UAAU,EAAE,qCAAqC;qBACzD,CAAC;oBAEF,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACzB,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC"}

package/jest.config.js

@@ -0,0 +1,5 @@
+/** @type {import('ts-jest').JestConfigWithTsJest} */
+module.exports = {
+  preset: 'ts-jest',
+  testEnvironment: 'node',
+};

package/package.json

@@ -0,0 +1,23 @@
+{
+  "name": "@maverick006/scanner-npm-audit",
+  "version": "1.0.2",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "scripts": {
+    "build": "tsc",
+    "clean": "rm -rf dist",
+    "test": "jest",
+    "typecheck": "tsc --noEmit"
+  },
+  "dependencies": {
+    "@maverick006/types": "*",
+    "@maverick006/security-engine": "*"
+  },
+  "devDependencies": {
+    "typescript": "^5.0.0",
+    "jest": "^29.5.0",
+    "@types/jest": "^29.5.0",
+    "ts-jest": "^29.1.0",
+    "@types/node": "^20.0.0"
+  }
+}

package/src/index.ts

@@ -0,0 +1,69 @@
+import { SecurityScanner } from '@maverick006/security-engine';
+import { ScanInput, ScannerResult } from '@maverick006/types';
+import { exec } from 'child_process';
+import { promisify } from 'util';
+import { parseNpmAuditOutput } from './parser';
+import * as path from 'path';
+
+const execAsync = promisify(exec);
+
+export class NpmAuditScanner implements SecurityScanner {
+  public name = 'npm-audit';
+  public version = 'unknown';
+
+  async scan(input: ScanInput): Promise<ScannerResult> {
+    const startTime = new Date();
+    let rawOutput = '';
+    
+    try {
+      const safePath = path.resolve(input.repositoryPath);
+      
+      // npm audit --json outputs audit data. We run it in the repository path.
+      // Note: this assumes package.json exists. If it doesn't, npm audit will fail, which we can catch.
+      const { stdout } = await execAsync(`npm audit --json --prefix "${safePath}"`, {
+        timeout: 300000,
+        maxBuffer: 1024 * 1024 * 50
+      });
+      
+      rawOutput = stdout;
+      const findings = parseNpmAuditOutput(input.scanId, rawOutput);
+      
+      return {
+        scanner: this.name,
+        success: true,
+        findings,
+        rawOutput,
+        startTime,
+        endTime: new Date()
+      };
+    } catch (error: any) {
+      // npm audit returns exit code > 0 if vulnerabilities are found
+      if (error.stdout && error.stdout.includes('"auditReportVersion":')) {
+        try {
+          rawOutput = error.stdout;
+          const findings = parseNpmAuditOutput(input.scanId, rawOutput);
+          return {
+            scanner: this.name,
+            success: true,
+            findings,
+            rawOutput,
+            startTime,
+            endTime: new Date()
+          };
+        } catch (parseError) {
+          // ignore parsing error
+        }
+      }
+
+      return {
+        scanner: this.name,
+        success: false,
+        findings: [],
+        error: error.message || 'npm audit execution failed',
+        rawOutput: error.stdout || '',
+        startTime,
+        endTime: new Date()
+      };
+    }
+  }
+}

package/src/parser.ts

@@ -0,0 +1,55 @@
+import { NormalizedFinding, Severity, Confidence } from '@maverick006/types';
+
+export function parseNpmAuditOutput(scanId: string, output: string): NormalizedFinding[] {
+  try {
+    const data = JSON.parse(output);
+    const findings: NormalizedFinding[] = [];
+
+    // npm audit JSON output format: version 2
+    if (data.auditReportVersion !== 2 || !data.vulnerabilities) {
+      return findings;
+    }
+
+    for (const [pkgName, vulnData] of Object.entries<any>(data.vulnerabilities)) {
+      
+      const viaArray = Array.isArray(vulnData.via) ? vulnData.via : [];
+      
+      // Some 'via' entries are just strings (referencing other packages), 
+      // we look for objects that contain actual vulnerability details.
+      for (const via of viaArray) {
+        if (typeof via === 'object' && via.title) {
+          
+          let severity = Severity.INFO;
+          if (via.severity === 'critical') severity = Severity.CRITICAL;
+          else if (via.severity === 'high') severity = Severity.HIGH;
+          else if (via.severity === 'moderate') severity = Severity.MEDIUM;
+          else if (via.severity === 'low') severity = Severity.LOW;
+
+          const finding: NormalizedFinding = {
+            scanId,
+            scanner: 'npm-audit',
+            scannerVersion: 'v2', // refers to report version
+            ruleId: via.url || `npm-audit-${pkgName}`,
+            title: via.title,
+            description: `Dependency vulnerability in ${pkgName}. Range: ${via.range}. Fix: ${
+              vulnData.fixAvailable ? (typeof vulnData.fixAvailable === 'object' ? vulnData.fixAvailable.name + '@' + vulnData.fixAvailable.version : 'Available') : 'None'
+            }`,
+            severity,
+            confidence: Confidence.HIGH, // SCA scans matching a CVE have high confidence
+            category: 'dependency',
+            file: 'package.json', // Best guess for location
+            line: 1, // Doesn't map well to line numbers
+            cwe: Array.isArray(via.cwe) ? via.cwe.join(', ') : via.cwe,
+            owasp: 'A06:2021', // Vulnerable and Outdated Components
+          };
+
+          findings.push(finding);
+        }
+      }
+    }
+
+    return findings;
+  } catch (error) {
+    throw new Error('Failed to parse npm audit JSON output');
+  }
+}

package/tests/fixtures/npm-audit-output.json

@@ -0,0 +1,87 @@
+{
+  "auditReportVersion": 2,
+  "vulnerabilities": {
+    "express": {
+      "name": "express",
+      "severity": "high",
+      "isDirect": true,
+      "via": [
+        {
+          "source": 1085149,
+          "name": "express",
+          "dependency": "express",
+          "title": "Path Traversal in express",
+          "url": "https://github.com/advisories/GHSA-9234-5678",
+          "severity": "high",
+          "cwe": [
+            "CWE-22"
+          ],
+          "cvss": {
+            "score": 7.5,
+            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
+          },
+          "range": "<4.19.2"
+        }
+      ],
+      "effects": [],
+      "range": "<4.19.2",
+      "nodes": [
+        "node_modules/express"
+      ],
+      "fixAvailable": {
+        "name": "express",
+        "version": "4.19.2",
+        "isSemVerMajor": false
+      }
+    },
+    "lodash": {
+      "name": "lodash",
+      "severity": "critical",
+      "isDirect": false,
+      "via": [
+        {
+          "source": 1012345,
+          "name": "lodash",
+          "dependency": "lodash",
+          "title": "Prototype Pollution in lodash",
+          "url": "https://github.com/advisories/GHSA-1234-abcd",
+          "severity": "critical",
+          "cwe": [
+            "CWE-1321"
+          ],
+          "cvss": {
+            "score": 9.8,
+            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+          },
+          "range": "<4.17.21"
+        }
+      ],
+      "effects": [
+        "some-other-pkg"
+      ],
+      "range": "<4.17.21",
+      "nodes": [
+        "node_modules/lodash"
+      ],
+      "fixAvailable": true
+    }
+  },
+  "metadata": {
+    "vulnerabilities": {
+      "info": 0,
+      "low": 0,
+      "moderate": 0,
+      "high": 1,
+      "critical": 1,
+      "total": 2
+    },
+    "dependencies": {
+      "prod": 10,
+      "dev": 20,
+      "optional": 0,
+      "peer": 0,
+      "peerOptional": 0,
+      "total": 30
+    }
+  }
+}

package/tests/parser.test.ts

@@ -0,0 +1,41 @@
+import { parseNpmAuditOutput } from '../src/parser';
+import * as fs from 'fs';
+import * as path from 'path';
+import { Severity, Confidence } from '@maverick006/types';
+
+describe('npm audit Parser', () => {
+  it('should parse npm audit json output correctly', () => {
+    const fixturePath = path.join(__dirname, 'fixtures', 'npm-audit-output.json');
+    const output = fs.readFileSync(fixturePath, 'utf8');
+    
+    const findings = parseNpmAuditOutput('test-scan-123', output);
+    
+    expect(findings.length).toBe(2);
+    
+    // Check first finding (express Path Traversal)
+    const expressVuln = findings[0];
+    expect(expressVuln.scanId).toBe('test-scan-123');
+    expect(expressVuln.scanner).toBe('npm-audit');
+    expect(expressVuln.title).toBe('Path Traversal in express');
+    expect(expressVuln.severity).toBe(Severity.HIGH);
+    expect(expressVuln.confidence).toBe(Confidence.HIGH);
+    expect(expressVuln.cwe).toContain('CWE-22');
+    expect(expressVuln.file).toBe('package.json');
+    expect(expressVuln.category).toBe('dependency');
+    expect(expressVuln.description).toContain('Fix: express@4.19.2');
+    
+    // Check second finding (lodash Prototype Pollution)
+    const lodashVuln = findings[1];
+    expect(lodashVuln.title).toBe('Prototype Pollution in lodash');
+    expect(lodashVuln.severity).toBe(Severity.CRITICAL);
+    expect(lodashVuln.cwe).toContain('CWE-1321');
+    expect(lodashVuln.description).toContain('Fix: Available');
+  });
+
+  it('should handle malformed output gracefully', () => {
+    expect(() => parseNpmAuditOutput('123', '{ invalid json }')).toThrow();
+    
+    const emptyFindings = parseNpmAuditOutput('123', '{"auditReportVersion": 2, "vulnerabilities": {}}');
+    expect(emptyFindings.length).toBe(0);
+  });
+});

package/tsconfig.json

@@ -0,0 +1,15 @@
+{
+  "extends": "../../tsconfig.json",
+  "compilerOptions": {
+    "outDir": "./dist",
+    "rootDir": "./src",
+    "declaration": true,
+    "declarationMap": true,
+    "sourceMap": true
+  },
+  "references": [
+    { "path": "../../packages/types" },
+    { "path": "../../packages/security-engine" }
+  ],
+  "include": ["src/**/*"]
+}