@quantakrypto/core 0.3.0 → 0.4.0

package/src/dependencies.ts

@@ -1,17 +1,56 @@
 /**
- * Curated database of npm packages that primarily expose classical asymmetric
- * cryptography (and are therefore quantum-vulnerable), plus a manifest scanner
- * that flags any of them found in package.json / package-lock.json.
+ * Curated database of packages that primarily expose classical asymmetric
+ * cryptography (and are therefore quantum-vulnerable), across multiple
+ * ecosystems (npm, PyPI, crates.io, Go modules, Maven, RubyGems), plus a
+ * manifest scanner that flags any of them found in the corresponding manifest
+ * (package.json, requirements.txt, Cargo.toml, go.mod, pom.xml, Gemfile, …).
  *
  * The list is intentionally focused on libraries whose *purpose* is classical
- * public-key crypto. General-purpose packages that merely call out to Node's
- * crypto are out of scope here (those are caught by the source detectors).
+ * public-key crypto. General-purpose packages that merely call the language's
+ * stdlib crypto are out of scope here (those are caught by the source detectors).
+ * Extraction is generous but every finding must match a curated entry, so a new
+ * manifest format is cheap to add (see `manifestEcosystem` + `candidateNames`).
  */
-import type { AlgorithmFamily, Finding, VulnerableDependency } from "./types.js";
+import type {
+  AlgorithmFamily,
+  DependencyEcosystem,
+  Finding,
+  RuleMeta,
+  VulnerableDependency,
+} from "./types.js";
 import { makeFinding } from "./detect-utils.js";
-import { remediationText } from "./remediation.js";
+import { isConfidentialityFamily, isSignatureFamily, remediationText } from "./remediation.js";
 import { CWE_BROKEN_CRYPTO } from "./cwe.js";
 
+/**
+ * Catalog entry for the `dep-vulnerable` rule. Dependency findings are produced
+ * by the manifest scanner rather than a registered {@link Detector}, so this
+ * rule is absent from `defaultRegistry.ruleCatalog()`. Reporters (SARIF) merge
+ * it in so the rule advertises a GENERIC description — the per-package specifics
+ * (title/severity/HNDL/remediation) live on each individual finding/result, not
+ * on the shared rule. Without this, SARIF would leak the first dependency's
+ * package-specific text into the rule-level `shortDescription` for every dep.
+ */
+export const DEP_VULNERABLE_RULE: RuleMeta = {
+  id: "dep-vulnerable",
+  title: "Quantum-vulnerable dependency",
+  category: "dependency",
+  // Representative default; each SARIF result carries its own per-package level.
+  severity: "high",
+  confidence: "high",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "A dependency implements classical public-key cryptography that is broken by " +
+    "quantum computers. Replace or upgrade it to a post-quantum alternative.",
+  remediation:
+    "Move to a post-quantum alternative — ML-KEM-768 (FIPS 203) for key exchange/" +
+    "encryption and ML-DSA-65 (FIPS 204) for signatures, ideally via a hybrid.",
+  description:
+    "Flags packages in a dependency manifest known to implement quantum-vulnerable " +
+    "public-key cryptography (RSA, ECDH/ECDSA, DH, EdDSA, …).",
+};
+
 /** Known quantum-vulnerable npm dependencies. */
 export const vulnerableDependencies: VulnerableDependency[] = [
   {
@@ -259,50 +298,367 @@ export const vulnerableDependencies: VulnerableDependency[] = [
     algorithms: ["ECDSA"],
     severity: "low",
   },
+
+  // --- PyPI (Python) ---
+  {
+    name: "pycryptodome",
+    ecosystem: "pypi",
+    reason: "RSA / ECC / DSA public-key crypto for Python.",
+    algorithms: ["RSA", "ECDSA", "DSA"],
+    severity: "high",
+  },
+  {
+    name: "pycryptodomex",
+    ecosystem: "pypi",
+    reason: "RSA / ECC / DSA public-key crypto (the `Cryptodome` namespace).",
+    algorithms: ["RSA", "ECDSA", "DSA"],
+    severity: "high",
+  },
+  {
+    name: "rsa",
+    ecosystem: "pypi",
+    reason: "Pure-Python RSA encryption and signing.",
+    algorithms: ["RSA"],
+    severity: "high",
+  },
+  {
+    name: "ecdsa",
+    ecosystem: "pypi",
+    reason: "Pure-Python ECDSA/ECDH over NIST + secp256k1 curves.",
+    algorithms: ["ECDSA", "ECDH"],
+    severity: "high",
+  },
+  {
+    name: "cryptography",
+    ecosystem: "pypi",
+    reason: "General crypto library exposing classical RSA/EC/DH/DSA (also symmetric/PQC).",
+    algorithms: ["RSA", "ECDH", "ECDSA", "DSA"],
+    severity: "medium",
+  },
+  {
+    name: "pyjwt",
+    ecosystem: "pypi",
+    reason: "JWT signing with classical RS*/ES* algorithms.",
+    algorithms: ["RSA", "ECDSA"],
+    severity: "medium",
+  },
+  {
+    name: "python-jose",
+    ecosystem: "pypi",
+    reason: "JOSE/JWT with classical RSA/ECDSA algorithms.",
+    algorithms: ["RSA", "ECDSA"],
+    severity: "medium",
+  },
+  {
+    name: "paramiko",
+    ecosystem: "pypi",
+    reason: "SSH client/server with classical RSA/ECDSA/Ed25519/DSA host + user keys.",
+    algorithms: ["RSA", "ECDSA", "EdDSA", "DSA"],
+    severity: "medium",
+  },
+  {
+    name: "pyopenssl",
+    ecosystem: "pypi",
+    reason: "OpenSSL bindings for classical RSA/EC X.509 + TLS.",
+    algorithms: ["RSA", "ECDSA"],
+    severity: "medium",
+  },
+  {
+    name: "pynacl",
+    ecosystem: "pypi",
+    reason:
+      "libsodium bindings — X25519 key agreement and Ed25519 signatures (modern but classical).",
+    algorithms: ["X25519", "EdDSA"],
+    severity: "low",
+  },
+
+  // --- crates.io (Rust) ---
+  {
+    name: "rsa",
+    ecosystem: "cargo",
+    reason: "Pure-Rust RSA encryption and signing.",
+    algorithms: ["RSA"],
+    severity: "high",
+  },
+  {
+    name: "ring",
+    ecosystem: "cargo",
+    reason: "RSA / ECDSA / Ed25519 / ECDH primitives.",
+    algorithms: ["RSA", "ECDSA", "EdDSA", "ECDH"],
+    severity: "medium",
+  },
+  {
+    name: "openssl",
+    ecosystem: "cargo",
+    reason: "OpenSSL bindings for classical RSA/EC crypto.",
+    algorithms: ["RSA", "ECDSA"],
+    severity: "medium",
+  },
+  {
+    name: "p256",
+    ecosystem: "cargo",
+    reason: "NIST P-256 ECDSA signatures and ECDH key agreement.",
+    algorithms: ["ECDSA", "ECDH"],
+    severity: "high",
+  },
+  {
+    name: "p384",
+    ecosystem: "cargo",
+    reason: "NIST P-384 ECDSA signatures and ECDH key agreement.",
+    algorithms: ["ECDSA", "ECDH"],
+    severity: "high",
+  },
+  {
+    name: "k256",
+    ecosystem: "cargo",
+    reason: "secp256k1 ECDSA signatures and ECDH key agreement.",
+    algorithms: ["ECDSA", "ECDH"],
+    severity: "high",
+  },
+  {
+    name: "ed25519-dalek",
+    ecosystem: "cargo",
+    reason: "Ed25519 signatures (modern but classical).",
+    algorithms: ["EdDSA"],
+    severity: "low",
+  },
+  {
+    name: "x25519-dalek",
+    ecosystem: "cargo",
+    reason: "X25519 key agreement (modern but classical).",
+    algorithms: ["X25519"],
+    severity: "low",
+  },
+
+  // --- Go modules ---
+  {
+    name: "golang.org/x/crypto",
+    ecosystem: "go",
+    reason: "SSH, OpenPGP, and classical curve helpers on top of the Go stdlib.",
+    algorithms: ["RSA", "ECDSA", "EdDSA", "ECDH"],
+    severity: "medium",
+  },
+
+  // --- Maven (Java) ---
+  {
+    name: "bcprov-jdk18on",
+    ecosystem: "maven",
+    reason: "BouncyCastle provider — full classical RSA/ECDSA/ECDH/DSA suite.",
+    algorithms: ["RSA", "ECDSA", "ECDH", "DSA"],
+    severity: "high",
+  },
+  {
+    name: "bcprov-jdk15on",
+    ecosystem: "maven",
+    reason: "BouncyCastle provider (JDK 1.5+) — classical RSA/ECDSA/ECDH/DSA.",
+    algorithms: ["RSA", "ECDSA", "ECDH", "DSA"],
+    severity: "high",
+  },
+  {
+    name: "bcpkix-jdk18on",
+    ecosystem: "maven",
+    reason: "BouncyCastle PKIX — classical X.509 / CMS with RSA/ECDSA.",
+    algorithms: ["RSA", "ECDSA"],
+    severity: "medium",
+  },
+  {
+    name: "java-jwt",
+    ecosystem: "maven",
+    reason: "Auth0 JWT with classical RS*/ES* algorithms.",
+    algorithms: ["RSA", "ECDSA"],
+    severity: "medium",
+  },
+
+  // --- RubyGems ---
+  {
+    name: "jwt",
+    ecosystem: "rubygems",
+    reason: "Ruby JWT with classical RS*/ES* algorithms.",
+    algorithms: ["RSA", "ECDSA"],
+    severity: "medium",
+  },
+  {
+    name: "rbnacl",
+    ecosystem: "rubygems",
+    reason: "libsodium bindings — X25519 key agreement and Ed25519 signatures.",
+    algorithms: ["X25519", "EdDSA"],
+    severity: "low",
+  },
+  {
+    name: "ed25519",
+    ecosystem: "rubygems",
+    reason: "Ed25519 signatures (modern but classical).",
+    algorithms: ["EdDSA"],
+    severity: "low",
+  },
 ];
 
-/** Fast lookup map by package name. */
-const BY_NAME = new Map<string, VulnerableDependency>(
-  vulnerableDependencies.map((d) => [d.name, d]),
-);
+/**
+ * Normalise a package name for matching within its ecosystem. PyPI is
+ * case-insensitive and folds runs of `-_.` to a single `-` (PEP 503); cargo /
+ * maven / rubygems are effectively lower-case; npm and go module paths are
+ * matched verbatim (npm scopes and go paths are case-sensitive).
+ */
+function normalizeName(ecosystem: DependencyEcosystem, name: string): string {
+  const n = name.trim();
+  if (ecosystem === "pypi") return n.toLowerCase().replace(/[-_.]+/g, "-");
+  if (ecosystem === "npm" || ecosystem === "go") return n;
+  return n.toLowerCase();
+}
+
+/** ecosystem → (normalised name → entry). Scoped so `rsa` (pypi) ≠ `rsa` (cargo). */
+const BY_ECOSYSTEM: Map<DependencyEcosystem, Map<string, VulnerableDependency>> = (() => {
+  const m = new Map<DependencyEcosystem, Map<string, VulnerableDependency>>();
+  for (const d of vulnerableDependencies) {
+    let em = m.get(d.ecosystem);
+    if (!em) {
+      em = new Map();
+      m.set(d.ecosystem, em);
+    }
+    em.set(normalizeName(d.ecosystem, d.name), d);
+  }
+  return m;
+})();
 
 /**
- * Precompiled `"name":` lookup regex per known package (P1-9): the package set
- * is static, so we build the (escaped-name → RegExp) map once at module load
- * rather than recompiling a fresh RegExp per found package per manifest.
+ * Precompiled `"name":` lookup regex per known npm package (P1-9): the set is
+ * static, so build the (name → RegExp) map once rather than per manifest. Only
+ * npm uses the JSON-key form; other ecosystems locate names generically.
  */
 const KEY_REGEX_BY_NAME = new Map<string, RegExp>(
-  vulnerableDependencies.map((d): [string, RegExp] => {
-    const escaped = d.name.replace(/[.*+?^${}()|[\]\\/]/g, "\\$&");
-    return [d.name, new RegExp(`"${escaped}"\\s*:`)];
-  }),
+  vulnerableDependencies
+    .filter((d) => d.ecosystem === "npm")
+    .map((d): [string, RegExp] => {
+      const escaped = d.name.replace(/[.*+?^${}()|[\]\\/]/g, "\\$&");
+      return [d.name, new RegExp(`"${escaped}"\\s*:`)];
+    }),
 );
 
-/** Algorithm families that expose confidentiality (HNDL) rather than only signing. */
-const CONFIDENTIALITY_FAMILIES: ReadonlySet<AlgorithmFamily> = new Set<AlgorithmFamily>([
-  "RSA",
-  "ECDH",
-  "DH",
-  "ECIES",
-  "X25519",
-  "X448",
-]);
-
 /**
  * Build a remediation string covering ALL families a package exposes (C5),
- * rather than only `algorithms[0]`. De-duplicates the per-family recommendation
- * strings and joins them, so a signature+KEM library points at both replacements.
+ * rather than only `algorithms[0]`. De-duplicates by PQC *target* — the KEM
+ * target and the signature target are each named at most once — so a library
+ * exposing both a confidentiality family and a signature family reads
+ * "ML-KEM-768 … for key exchange/encryption; ML-DSA-65 (FIPS 204) for
+ * signatures" instead of repeating ML-DSA (the old per-string Set couldn't
+ * collapse "ML-DSA-65 for signatures" against a standalone "ML-DSA-65 (FIPS 204)").
  */
 function multiFamilyRemediation(algorithms: readonly AlgorithmFamily[]): string {
-  const parts = new Set<string>();
-  for (const a of algorithms) parts.add(remediationText(a));
-  return [...parts].join("; ");
+  let needsKem = false;
+  let needsSig = false;
+  let needsReview = false;
+  for (const a of algorithms) {
+    if (isConfidentialityFamily(a)) needsKem = true;
+    if (isSignatureFamily(a)) needsSig = true;
+    if (a === "unknown") needsReview = true;
+  }
+  const parts: string[] = [];
+  if (needsKem)
+    parts.push("ML-KEM-768 (FIPS 203, hybrid X25519MLKEM768) for key exchange/encryption");
+  if (needsSig) parts.push("ML-DSA-65 (FIPS 204) for signatures");
+  // Only fall back to the generic "review" line when nothing concrete applied.
+  if (needsReview && parts.length === 0) parts.push(remediationText("unknown"));
+  return parts.join("; ");
+}
+
+/**
+ * The dependency ecosystem a manifest filename belongs to, or null when the file
+ * is not a manifest we parse. Drives both {@link isManifestFile} and the scanner
+ * dispatch — one place to add a manifest format.
+ */
+export function manifestEcosystem(file: string): DependencyEcosystem | null {
+  const base = (file.split("/").pop() ?? file).toLowerCase();
+  if (
+    base === "package.json" ||
+    base === "package-lock.json" ||
+    base === "npm-shrinkwrap.json" ||
+    base === "yarn.lock" ||
+    base === "pnpm-lock.yaml"
+  ) {
+    return "npm";
+  }
+  if (base === "requirements.txt" || /^requirements[\w.-]*\.txt$/.test(base)) return "pypi";
+  if (base === "pyproject.toml" || base === "pipfile") return "pypi";
+  if (base === "cargo.toml") return "cargo";
+  if (base === "go.mod") return "go";
+  if (base === "pom.xml" || base === "build.gradle" || base === "build.gradle.kts") return "maven";
+  if (base === "gemfile" || base.endsWith(".gemspec")) return "rubygems";
+  return null;
 }
 
 /** True if a file path looks like a manifest we can parse for dependencies. */
 export function isManifestFile(file: string): boolean {
-  const base = file.split("/").pop() ?? file;
-  return base === "package.json" || base === "package-lock.json";
+  return manifestEcosystem(file) !== null;
+}
+
+/**
+ * Extract candidate package names from a non-npm manifest. Extraction is
+ * deliberately GENEROUS — every finding still has to match a curated DB entry,
+ * so over-extracting harmless tokens (e.g. a TOML `version = …` key) costs
+ * nothing while keeping the parsers tiny and format-tolerant.
+ */
+function candidateNames(ecosystem: DependencyEcosystem, content: string): string[] {
+  const names: string[] = [];
+  const lines = content.split("\n");
+  switch (ecosystem) {
+    case "pypi": {
+      // requirements.txt / Pipfile / pyproject.toml: leading token per line, plus
+      // quoted deps in arrays/tables. Skip comments and `-r/-e/--flag` lines.
+      for (const raw of lines) {
+        const line = raw.trim();
+        if (!line || line.startsWith("#") || line.startsWith("-")) continue;
+        const lead = /^["']?([A-Za-z][A-Za-z0-9._-]+)/.exec(line);
+        if (lead) names.push(lead[1]);
+        for (const m of line.matchAll(/["']([A-Za-z][A-Za-z0-9._-]+)/g)) names.push(m[1]);
+      }
+      break;
+    }
+    case "cargo": {
+      // Cargo.toml: dependency-table keys `name = …` and `[…dependencies.name]`.
+      for (const raw of lines) {
+        const line = raw.trim();
+        if (!line || line.startsWith("#")) continue;
+        const key = /^([A-Za-z0-9][A-Za-z0-9_-]+)\s*=/.exec(line);
+        if (key) names.push(key[1]);
+        const table = /^\[[\w.-]*dependencies\.([A-Za-z0-9][A-Za-z0-9_-]+)\]/.exec(line);
+        if (table) names.push(table[1]);
+      }
+      break;
+    }
+    case "go": {
+      // go.mod: `require path v1.2.3` (single or in a require( … ) block).
+      for (const m of content.matchAll(/(?:^|\s)([a-z0-9][\w.\-/]+)\s+v\d/gm)) names.push(m[1]);
+      break;
+    }
+    case "maven": {
+      // pom.xml <artifactId> tags + gradle `group:artifact:version` strings.
+      for (const m of content.matchAll(/<artifactId>\s*([\w.-]+)\s*<\/artifactId>/g)) {
+        names.push(m[1]);
+      }
+      for (const m of content.matchAll(/["']([\w.-]+):([\w.-]+):[\w.$-]+["']/g)) names.push(m[2]);
+      break;
+    }
+    case "rubygems": {
+      // Gemfile `gem 'name'` + gemspec `add_*dependency 'name'`.
+      for (const m of content.matchAll(/\bgem\s+["']([\w.-]+)["']/g)) names.push(m[1]);
+      for (const m of content.matchAll(
+        /add(?:_runtime|_development)?_dependency\s+["']([\w.-]+)["']/g,
+      )) {
+        names.push(m[1]);
+      }
+      break;
+    }
+    case "npm":
+      break; // npm uses the JSON path, not this extractor.
+  }
+  return names;
+}
+
+/** First offset of a package `name` as a whole token in the manifest text (or 0). */
+function offsetOfName(content: string, name: string): number {
+  const escaped = name.replace(/[.*+?^${}()|[\]\\/]/g, "\\$&");
+  const m = new RegExp(`(?<![\\w./-])${escaped}(?![\\w-])`).exec(content);
+  return m ? m.index : 0;
 }
 
 /**
@@ -327,7 +683,7 @@ function dependencyFinding(
     confidence: "high",
     algorithm,
     // Confidentiality libs are HNDL-exposed; signature-only ones are not.
-    hndl: dep.algorithms.some((a) => CONFIDENTIALITY_FAMILIES.has(a)),
+    hndl: dep.algorithms.some(isConfidentialityFamily),
     cwe: CWE_BROKEN_CRYPTO,
     message: `${dep.name} — ${dep.reason}`,
     remediation: multiFamilyRemediation(dep.algorithms),
@@ -346,16 +702,56 @@ function offsetOfKey(content: string, name: string): number {
   return m ? m.index : 0;
 }
 
+/** Sort findings by title for deterministic output. */
+function sortByTitle(findings: Finding[]): Finding[] {
+  findings.sort((a, b) => (a.title < b.title ? -1 : a.title > b.title ? 1 : 0));
+  return findings;
+}
+
 /**
- * Scan a single manifest file's contents for vulnerable dependencies.
- *
- * - `package.json`: dependencies / devDependencies / peerDependencies / optionalDependencies.
- * - `package-lock.json` (v2/v3): the `packages` map keys (node_modules/<name>),
- *   plus legacy `dependencies` map for v1.
- *
- * Returns one finding per distinct vulnerable package name found in the file.
+ * Scan a single manifest file for vulnerable dependencies, dispatching by the
+ * file's ecosystem ({@link manifestEcosystem}). npm manifests are parsed as
+ * JSON; every other ecosystem uses the generous {@link candidateNames} extractor
+ * filtered against the ecosystem-scoped database. Returns one finding per
+ * distinct vulnerable package.
  */
 export function scanManifest(file: string, content: string): Finding[] {
+  const ecosystem = manifestEcosystem(file);
+  if (!ecosystem) return [];
+  const db = BY_ECOSYSTEM.get(ecosystem);
+  if (!db) return [];
+
+  if (ecosystem === "npm") {
+    const base = (file.split("/").pop() ?? file).toLowerCase();
+    // yarn.lock / pnpm-lock.yaml are not JSON — extract names from their text.
+    if (base === "yarn.lock" || base === "pnpm-lock.yaml") {
+      return scanNpmLockfile(content, file, db);
+    }
+    return scanNpmManifest(content, file, db);
+  }
+
+  const found = new Map<string, VulnerableDependency>(); // dedupe by entry
+  for (const raw of candidateNames(ecosystem, content)) {
+    const dep = db.get(normalizeName(ecosystem, raw));
+    if (dep) found.set(dep.name, dep);
+  }
+  const findings: Finding[] = [];
+  for (const dep of found.values()) {
+    findings.push(dependencyFinding(dep, file, content, offsetOfName(content, dep.name)));
+  }
+  return sortByTitle(findings);
+}
+
+/**
+ * npm manifest scan.
+ * - `package.json`: dependencies / devDependencies / peerDependencies / optionalDependencies.
+ * - `package-lock.json` (v2/v3): the `packages` map keys (node_modules/<name>).
+ */
+function scanNpmManifest(
+  content: string,
+  file: string,
+  db: Map<string, VulnerableDependency>,
+): Finding[] {
   let json: unknown;
   try {
     json = JSON.parse(content);
@@ -370,17 +766,15 @@ export function scanManifest(file: string, content: string): Finding[] {
   const collectFromRecord = (rec: unknown): void => {
     if (rec === null || typeof rec !== "object") return;
     for (const key of Object.keys(rec as Record<string, unknown>)) {
-      if (BY_NAME.has(key)) found.add(key);
+      if (db.has(key)) found.add(key);
     }
   };
 
-  // package.json dependency sections.
   collectFromRecord(obj.dependencies);
   collectFromRecord(obj.devDependencies);
   collectFromRecord(obj.peerDependencies);
   collectFromRecord(obj.optionalDependencies);
 
-  // package-lock.json v2/v3 "packages" map: keys are "node_modules/<name>".
   const packages = obj.packages;
   if (packages !== null && typeof packages === "object") {
     for (const key of Object.keys(packages as Record<string, unknown>)) {
@@ -388,17 +782,55 @@ export function scanManifest(file: string, content: string): Finding[] {
       const marker = "node_modules/";
       const idx = key.lastIndexOf(marker);
       const name = idx >= 0 ? key.slice(idx + marker.length) : key;
-      if (BY_NAME.has(name)) found.add(name);
+      if (db.has(name)) found.add(name);
     }
   }
 
   const findings: Finding[] = [];
   for (const name of found) {
-    const dep = BY_NAME.get(name);
+    const dep = db.get(name);
     if (!dep) continue;
     findings.push(dependencyFinding(dep, file, content, offsetOfKey(content, name)));
   }
-  // Deterministic ordering by package name.
-  findings.sort((a, b) => (a.title < b.title ? -1 : a.title > b.title ? 1 : 0));
-  return findings;
+  return sortByTitle(findings);
+}
+
+/**
+ * Extract candidate package names from a yarn.lock / pnpm-lock.yaml text body.
+ * Generous — every `name@…` (and pnpm's `/name/version`) token is captured; the
+ * caller filters against the vulnerable-dependency DB, so over-capture is safe.
+ * Handles yarn v1 (`elliptic@^6.5.4:`), yarn berry (`"elliptic@npm:^6.5.4":`),
+ * and pnpm (`/elliptic@6.5.4:`, scoped `/@noble/curves@1.2.0:`).
+ */
+function npmLockfileCandidates(content: string): string[] {
+  const names = new Set<string>();
+  const at = /(?:^|[\s,"'/])((?:@[a-z0-9._-]+\/)?[a-z0-9][a-z0-9._-]*)@/gm;
+  let m: RegExpExecArray | null;
+  while ((m = at.exec(content)) !== null) names.add(m[1].toLowerCase());
+  // pnpm's older `/name/version` form (name followed by a version digit).
+  const slash = /(?:^|\s)\/((?:@[a-z0-9._-]+\/)?[a-z0-9][a-z0-9._-]*)\/\d/gm;
+  while ((m = slash.exec(content)) !== null) names.add(m[1].toLowerCase());
+  return [...names];
+}
+
+/**
+ * npm lockfile scan (yarn.lock / pnpm-lock.yaml): match every package token in
+ * the lockfile text against the vulnerable-dependency DB. Catches transitive
+ * dependencies that never appear in package.json.
+ */
+function scanNpmLockfile(
+  content: string,
+  file: string,
+  db: Map<string, VulnerableDependency>,
+): Finding[] {
+  const found = new Map<string, VulnerableDependency>();
+  for (const name of npmLockfileCandidates(content)) {
+    const dep = db.get(name);
+    if (dep) found.set(dep.name, dep);
+  }
+  const findings: Finding[] = [];
+  for (const dep of found.values()) {
+    findings.push(dependencyFinding(dep, file, content, offsetOfName(content, dep.name)));
+  }
+  return sortByTitle(findings);
 }