@maverick006/scanner-npm-audit 1.0.4 → 1.0.6

package/package.json

@@ -1,17 +1,18 @@
 {
   "name": "@maverick006/scanner-npm-audit",
-  "version": "1.0.4",
+  "version": "1.0.6",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "scripts": {
-    "build": "tsc",
+    "build": "tsc -b --force",
     "clean": "rm -rf dist",
     "test": "jest",
-    "typecheck": "tsc --noEmit"
+    "typecheck": "tsc --noEmit",
+    "prepack": "npm run build"
   },
   "dependencies": {
-    "@maverick006/types": "*",
-    "@maverick006/security-engine": "*"
+    "@maverick006/types": "^1.0.5",
+    "@maverick006/security-engine": "^1.0.5"
   },
   "devDependencies": {
     "typescript": "^5.0.0",
@@ -19,5 +20,8 @@
     "@types/jest": "^29.5.0",
     "ts-jest": "^29.1.0",
     "@types/node": "^20.0.0"
-  }
+  },
+  "files": [
+    "dist"
+  ]
 }

package/jest.config.js

@@ -1,5 +0,0 @@
-/** @type {import('ts-jest').JestConfigWithTsJest} */
-module.exports = {
-  preset: 'ts-jest',
-  testEnvironment: 'node',
-};

package/src/index.ts

@@ -1,135 +0,0 @@
-import { SecurityScanner, ScannerCapability } from '@maverick006/security-engine';
-import { ScanInput, ScannerResult, ScannerState } from '@maverick006/types';
-import { execFile } from 'child_process';
-import { promisify } from 'util';
-import { parseNpmAuditOutput } from './parser';
-import * as path from 'path';
-import * as fs from 'fs';
-
-const execFileAsync = promisify(execFile);
-
-export class NpmAuditScanner implements SecurityScanner {
-  public name = 'npm-audit';
-  public version = 'unknown';
-
-  public capabilities: ScannerCapability = {
-    category: 'dependencies',
-    detectApplicability: (repoPath: string) => {
-      const safePath = path.resolve(repoPath);
-      return fs.existsSync(path.join(safePath, 'package.json'));
-    }
-  };
-
-  async scan(input: ScanInput): Promise<ScannerResult> {
-    const startTime = new Date();
-    let rawOutput = '';
-    
-    const safePath = path.resolve(input.repositoryPath);
-    const hasPackageJson = fs.existsSync(path.join(safePath, 'package.json'));
-
-    if (!hasPackageJson) {
-      const endTime = new Date();
-      return {
-        scanner: this.name,
-        success: true,
-        state: ScannerState.SKIPPED,
-        reason: 'Skipped: No package.json detected in repository',
-        findings: [],
-        rawOutput: 'No package.json found',
-        startTime,
-        endTime,
-        durationMs: endTime.getTime() - startTime.getTime()
-      };
-    }
-
-    try {
-      const npmCmd = process.platform === 'win32' ? 'npm.cmd' : 'npm';
-      const args = ['audit', '--json'];
-
-      const { stdout } = await execFileAsync(npmCmd, args, {
-        cwd: safePath,
-        timeout: 60000,
-        maxBuffer: 1024 * 1024 * 50,
-        shell: process.platform === 'win32'
-      });
-      
-      rawOutput = stdout;
-      const findings = parseNpmAuditOutput(input.scanId, rawOutput);
-      const endTime = new Date();
-      
-      return {
-        scanner: this.name,
-        success: true,
-        state: ScannerState.SUCCESS,
-        findings,
-        rawOutput,
-        startTime,
-        endTime,
-        durationMs: endTime.getTime() - startTime.getTime()
-      };
-    } catch (error: any) {
-      const endTime = new Date();
-      const durationMs = endTime.getTime() - startTime.getTime();
-
-      if (error.code === 'ENOENT') {
-        return {
-          scanner: this.name,
-          success: false,
-          state: ScannerState.NOT_INSTALLED,
-          reason: 'npm executable was not found on PATH',
-          findings: [],
-          error: error.message,
-          startTime,
-          endTime,
-          durationMs
-        };
-      }
-
-      if (error.code === 'ETIMEDOUT') {
-        return {
-          scanner: this.name,
-          success: false,
-          state: ScannerState.TIMEOUT,
-          reason: 'npm-audit execution timed out',
-          findings: [],
-          error: error.message,
-          startTime,
-          endTime,
-          durationMs
-        };
-      }
-
-      // npm audit exits > 0 if vulnerabilities are found
-      if (error.stdout && error.stdout.includes('"auditReportVersion":')) {
-        try {
-          rawOutput = error.stdout;
-          const findings = parseNpmAuditOutput(input.scanId, rawOutput);
-          return {
-            scanner: this.name,
-            success: true,
-            state: ScannerState.SUCCESS,
-            findings,
-            rawOutput,
-            startTime,
-            endTime,
-            durationMs
-          };
-        } catch {
-          // ignore parsing error
-        }
-      }
-
-      return {
-        scanner: this.name,
-        success: false,
-        state: ScannerState.FAILED,
-        findings: [],
-        error: error.message || 'npm audit execution failed',
-        rawOutput: error.stdout || '',
-        startTime,
-        endTime,
-        durationMs
-      };
-    }
-  }
-}

package/src/parser.ts

@@ -1,55 +0,0 @@
-import { NormalizedFinding, Severity, Confidence } from '@maverick006/types';
-
-export function parseNpmAuditOutput(scanId: string, output: string): NormalizedFinding[] {
-  try {
-    const data = JSON.parse(output);
-    const findings: NormalizedFinding[] = [];
-
-    // npm audit JSON output format: version 2
-    if (data.auditReportVersion !== 2 || !data.vulnerabilities) {
-      return findings;
-    }
-
-    for (const [pkgName, vulnData] of Object.entries<any>(data.vulnerabilities)) {
-      
-      const viaArray = Array.isArray(vulnData.via) ? vulnData.via : [];
-      
-      // Some 'via' entries are just strings (referencing other packages), 
-      // we look for objects that contain actual vulnerability details.
-      for (const via of viaArray) {
-        if (typeof via === 'object' && via.title) {
-          
-          let severity = Severity.INFO;
-          if (via.severity === 'critical') severity = Severity.CRITICAL;
-          else if (via.severity === 'high') severity = Severity.HIGH;
-          else if (via.severity === 'moderate') severity = Severity.MEDIUM;
-          else if (via.severity === 'low') severity = Severity.LOW;
-
-          const finding: NormalizedFinding = {
-            scanId,
-            scanner: 'npm-audit',
-            scannerVersion: 'v2', // refers to report version
-            ruleId: via.url || `npm-audit-${pkgName}`,
-            title: via.title,
-            description: `Dependency vulnerability in ${pkgName}. Range: ${via.range}. Fix: ${
-              vulnData.fixAvailable ? (typeof vulnData.fixAvailable === 'object' ? vulnData.fixAvailable.name + '@' + vulnData.fixAvailable.version : 'Available') : 'None'
-            }`,
-            severity,
-            confidence: Confidence.HIGH, // SCA scans matching a CVE have high confidence
-            category: 'dependency',
-            file: 'package.json', // Best guess for location
-            line: 1, // Doesn't map well to line numbers
-            cwe: Array.isArray(via.cwe) ? via.cwe.join(', ') : via.cwe,
-            owasp: 'A06:2021', // Vulnerable and Outdated Components
-          };
-
-          findings.push(finding);
-        }
-      }
-    }
-
-    return findings;
-  } catch (error) {
-    throw new Error('Failed to parse npm audit JSON output');
-  }
-}

package/tests/fixtures/npm-audit-output.json

@@ -1,87 +0,0 @@
-{
-  "auditReportVersion": 2,
-  "vulnerabilities": {
-    "express": {
-      "name": "express",
-      "severity": "high",
-      "isDirect": true,
-      "via": [
-        {
-          "source": 1085149,
-          "name": "express",
-          "dependency": "express",
-          "title": "Path Traversal in express",
-          "url": "https://github.com/advisories/GHSA-9234-5678",
-          "severity": "high",
-          "cwe": [
-            "CWE-22"
-          ],
-          "cvss": {
-            "score": 7.5,
-            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
-          },
-          "range": "<4.19.2"
-        }
-      ],
-      "effects": [],
-      "range": "<4.19.2",
-      "nodes": [
-        "node_modules/express"
-      ],
-      "fixAvailable": {
-        "name": "express",
-        "version": "4.19.2",
-        "isSemVerMajor": false
-      }
-    },
-    "lodash": {
-      "name": "lodash",
-      "severity": "critical",
-      "isDirect": false,
-      "via": [
-        {
-          "source": 1012345,
-          "name": "lodash",
-          "dependency": "lodash",
-          "title": "Prototype Pollution in lodash",
-          "url": "https://github.com/advisories/GHSA-1234-abcd",
-          "severity": "critical",
-          "cwe": [
-            "CWE-1321"
-          ],
-          "cvss": {
-            "score": 9.8,
-            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
-          },
-          "range": "<4.17.21"
-        }
-      ],
-      "effects": [
-        "some-other-pkg"
-      ],
-      "range": "<4.17.21",
-      "nodes": [
-        "node_modules/lodash"
-      ],
-      "fixAvailable": true
-    }
-  },
-  "metadata": {
-    "vulnerabilities": {
-      "info": 0,
-      "low": 0,
-      "moderate": 0,
-      "high": 1,
-      "critical": 1,
-      "total": 2
-    },
-    "dependencies": {
-      "prod": 10,
-      "dev": 20,
-      "optional": 0,
-      "peer": 0,
-      "peerOptional": 0,
-      "total": 30
-    }
-  }
-}

package/tests/parser.test.ts

@@ -1,41 +0,0 @@
-import { parseNpmAuditOutput } from '../src/parser';
-import * as fs from 'fs';
-import * as path from 'path';
-import { Severity, Confidence } from '@maverick006/types';
-
-describe('npm audit Parser', () => {
-  it('should parse npm audit json output correctly', () => {
-    const fixturePath = path.join(__dirname, 'fixtures', 'npm-audit-output.json');
-    const output = fs.readFileSync(fixturePath, 'utf8');
-    
-    const findings = parseNpmAuditOutput('test-scan-123', output);
-    
-    expect(findings.length).toBe(2);
-    
-    // Check first finding (express Path Traversal)
-    const expressVuln = findings[0];
-    expect(expressVuln.scanId).toBe('test-scan-123');
-    expect(expressVuln.scanner).toBe('npm-audit');
-    expect(expressVuln.title).toBe('Path Traversal in express');
-    expect(expressVuln.severity).toBe(Severity.HIGH);
-    expect(expressVuln.confidence).toBe(Confidence.HIGH);
-    expect(expressVuln.cwe).toContain('CWE-22');
-    expect(expressVuln.file).toBe('package.json');
-    expect(expressVuln.category).toBe('dependency');
-    expect(expressVuln.description).toContain('Fix: express@4.19.2');
-    
-    // Check second finding (lodash Prototype Pollution)
-    const lodashVuln = findings[1];
-    expect(lodashVuln.title).toBe('Prototype Pollution in lodash');
-    expect(lodashVuln.severity).toBe(Severity.CRITICAL);
-    expect(lodashVuln.cwe).toContain('CWE-1321');
-    expect(lodashVuln.description).toContain('Fix: Available');
-  });
-
-  it('should handle malformed output gracefully', () => {
-    expect(() => parseNpmAuditOutput('123', '{ invalid json }')).toThrow();
-    
-    const emptyFindings = parseNpmAuditOutput('123', '{"auditReportVersion": 2, "vulnerabilities": {}}');
-    expect(emptyFindings.length).toBe(0);
-  });
-});

package/tsconfig.json

@@ -1,15 +0,0 @@
-{
-  "extends": "../../tsconfig.json",
-  "compilerOptions": {
-    "outDir": "./dist",
-    "rootDir": "./src",
-    "declaration": true,
-    "declarationMap": true,
-    "sourceMap": true
-  },
-  "references": [
-    { "path": "../../packages/types" },
-    { "path": "../../packages/security-engine" }
-  ],
-  "include": ["src/**/*"]
-}