@quantakrypto/core 0.4.4 → 0.6.0

package/src/crypto-agility.ts

@@ -0,0 +1,407 @@
+/**
+ * Crypto-agility manifest: an agent-consumable crypto-posture document.
+ *
+ * A small, versioned JSON manifest a project publishes at a well-known URL
+ * (`/.well-known/crypto-agility.json`, see docs/CRYPTO-AGILITY-MANIFEST.md) so any
+ * agent, scanner, or CI bot can read the project's cryptographic posture the way it
+ * reads `security.txt` or `robots.txt`. It is a compact, decision-oriented summary
+ * DERIVED from a qScan result: the readiness score, the count of quantum-vulnerable
+ * findings by severity, the CBOM's algorithm families, an optional attestation URL,
+ * and the migration-policy deadlines.
+ *
+ * This module owns two pure operations and their shared schema:
+ *   - {@link buildCryptoAgilityManifest}: derive a manifest from a {@link ScanResult}.
+ *   - {@link validateCryptoAgilityManifest}: check an untrusted value against the
+ *     schema, returning a list of problems (used by the local validator; a network
+ *     fetch-and-validate lives on the website, never in this offline-boundary tool).
+ *
+ * Zero dependencies; hand-rolled JSON shape and validation so the package stays
+ * runtime-dependency-free.
+ */
+
+import { toCbom } from "./cbom.js";
+import { PQC_STANDARDS } from "./standards.js";
+import { SEVERITY_ORDER } from "./severity.js";
+import type { CryptoPolicy } from "./policy.js";
+import type { ScanResult, Severity } from "./types.js";
+import { VERSION } from "./version.js";
+
+/**
+ * Schema version of the manifest this module emits and validates. Bumped only on a
+ * breaking change to the manifest shape; consumers key their parsing off it.
+ */
+export const CRYPTO_AGILITY_MANIFEST_VERSION = 1;
+
+/** The conventional path a manifest is served from, relative to the site origin. */
+export const CRYPTO_AGILITY_WELL_KNOWN_PATH = "/.well-known/crypto-agility.json";
+
+/** A single algorithm family in use, mirroring the CBOM's grouping. */
+export interface CryptoAgilityFamily {
+  /** The algorithm family (e.g. `RSA`, `ECDH`, `ECDSA`), or `unknown`. */
+  family: string;
+  /** How many findings referenced this family. */
+  count: number;
+  /** Always true today: every detected family is classical (Shor-broken). */
+  quantumVulnerable: boolean;
+}
+
+/** The project's cryptographic posture, distilled from the scan inventory. */
+export interface CryptoAgilityPosture {
+  /** qScan readiness score, 0–100 (100 = no classical asymmetric crypto found). */
+  readinessScore: number;
+  /**
+   * Whether the project negotiates hybrid post-quantum key exchange. qScan is a
+   * static scanner and cannot observe a negotiated TLS group, so this is `null`
+   * ("not determined by this generator") unless the operator asserts it
+   * (`--hybrid-kex` / `--no-hybrid-kex`). A live probe (qProbe) or the website can
+   * fill it authoritatively.
+   */
+  hybridKexInUse: boolean | null;
+  /** Count of quantum-vulnerable findings, total and broken down by severity. */
+  quantumVulnerable: {
+    total: number;
+    bySeverity: Record<Severity, number>;
+  };
+  /** How many findings are exposed to harvest-now-decrypt-later. */
+  hndlExposedCount: number;
+}
+
+/** A compact summary of the full CBOM, linking to it by serial number. */
+export interface CryptoAgilityCbomSummary {
+  /** The CycloneDX `serialNumber` of the full CBOM this summary was derived from. */
+  serialNumber: string;
+  /** Number of distinct cryptographic-asset components in the full CBOM. */
+  assetCount: number;
+  /** Algorithm families in use, most-referenced first. */
+  algorithmFamilies: CryptoAgilityFamily[];
+}
+
+/** The migration policy the project declares it is measured against. */
+export interface CryptoAgilityPolicy {
+  /** Human label for the policy source (a standard name, or `operator-declared`). */
+  source: string;
+  /** Year after which classical public-key crypto is deprecated. */
+  deprecateClassicalAfter: number;
+  /** Year after which classical public-key crypto is disallowed. */
+  disallowClassicalAfter: number;
+  /** Operator-declared migration deadline (ISO date / year), or `null`. */
+  transitionDeadline: string | null;
+  /** Citation for the deadlines (spec / publication). */
+  citation: string;
+}
+
+/** The full crypto-agility manifest. */
+export interface CryptoAgilityManifest {
+  /** Manifest schema version ({@link CRYPTO_AGILITY_MANIFEST_VERSION}). */
+  version: number;
+  /** Discriminator so a consumer can tell this document apart from other JSON. */
+  manifestType: "crypto-agility";
+  /** ISO 8601 timestamp the manifest was generated (caller-supplied). */
+  generatedAt: string;
+  /** What produced the manifest. */
+  generator: { name: string; version: string };
+  /** What the manifest describes. */
+  subject: { root: string; repository: string | null; commit: string | null };
+  /** The distilled cryptographic posture. */
+  posture: CryptoAgilityPosture;
+  /** A compact summary of the CBOM. */
+  cbomSummary: CryptoAgilityCbomSummary;
+  /** Optional link to a quantakrypto (or other) posture credential. */
+  attestation?: { url: string };
+  /** The declared migration policy / deadlines. */
+  policy: CryptoAgilityPolicy;
+}
+
+/** Inputs the CLI/runtime supplies that are not derivable from the scan. */
+export interface CryptoAgilityManifestOptions {
+  /**
+   * ISO 8601 generation timestamp. The caller supplies it (`Date.now()` is fine in
+   * the CLI runtime) so the builder itself stays pure and deterministic.
+   */
+  generatedAt: string;
+  /** Optional URL to a posture credential (recorded verbatim, never fetched here). */
+  attestationUrl?: string;
+  /**
+   * Operator assertion of hybrid-KEX use. `undefined` leaves the manifest's
+   * `hybridKexInUse` as `null` (not determined).
+   */
+  hybridKexInUse?: boolean;
+  /** Optional org crypto policy; its `transitionDeadline` overlays the defaults. */
+  policy?: CryptoPolicy;
+  /** Repository URL (e.g. `GITHUB_REPOSITORY`); omitted → null. */
+  repository?: string;
+  /** Commit SHA (e.g. `GITHUB_SHA`); omitted → null. */
+  commit?: string;
+}
+
+/**
+ * Build a crypto-agility manifest from a scan result. Pure: every runtime input
+ * (timestamp, attestation, hybrid-KEX assertion, policy) arrives via `opts`.
+ *
+ * The posture and CBOM summary are derived straight from the scan's inventory and
+ * its CycloneDX CBOM, so the manifest can never disagree with the full `--cbom` /
+ * `--format json` outputs of the same scan.
+ */
+export function buildCryptoAgilityManifest(
+  result: ScanResult,
+  opts: CryptoAgilityManifestOptions,
+): CryptoAgilityManifest {
+  const cbom = toCbom(result);
+  const inv = result.inventory;
+
+  const algorithmFamilies: CryptoAgilityFamily[] = Object.entries(inv.byAlgorithm)
+    .filter(([, count]) => (count ?? 0) > 0)
+    .map(([family, count]) => ({
+      family,
+      count: count as number,
+      // Every family the detectors surface is classical, hence quantum-vulnerable
+      // by construction (mirrors cbom.ts `isQuantumVulnerable`).
+      quantumVulnerable: true,
+    }))
+    .sort((a, b) => b.count - a.count || a.family.localeCompare(b.family));
+
+  const bySeverity = { ...inv.bySeverity };
+
+  // Default policy: the NIST IR 8547 transition timeline. An operator crypto policy
+  // (`--policy`) does not override the standards deadlines but layers its own
+  // `transitionDeadline` on top and re-labels the source as operator-declared.
+  const timeline = PQC_STANDARDS.transitionTimeline;
+  const policy: CryptoAgilityPolicy = {
+    source: opts.policy ? "operator-declared" : timeline.source,
+    deprecateClassicalAfter: timeline.deprecateAfter,
+    disallowClassicalAfter: timeline.disallowAfter,
+    transitionDeadline: opts.policy?.transitionDeadline ?? null,
+    citation: timeline.source,
+  };
+
+  const manifest: CryptoAgilityManifest = {
+    version: CRYPTO_AGILITY_MANIFEST_VERSION,
+    manifestType: "crypto-agility",
+    generatedAt: opts.generatedAt,
+    generator: { name: "qScan", version: result.toolVersion || VERSION },
+    subject: {
+      root: result.root,
+      repository: opts.repository ?? null,
+      commit: opts.commit ?? null,
+    },
+    posture: {
+      readinessScore: inv.readinessScore,
+      hybridKexInUse: opts.hybridKexInUse ?? null,
+      quantumVulnerable: {
+        total: result.findings.length,
+        bySeverity,
+      },
+      hndlExposedCount: inv.hndlCount,
+    },
+    cbomSummary: {
+      serialNumber: cbom.serialNumber,
+      assetCount: cbom.components.length,
+      algorithmFamilies,
+    },
+    ...(opts.attestationUrl ? { attestation: { url: opts.attestationUrl } } : {}),
+    policy,
+  };
+  return manifest;
+}
+
+/** Outcome of {@link validateCryptoAgilityManifest}. */
+export interface ManifestValidation {
+  /** True when the value satisfies the manifest schema. */
+  valid: boolean;
+  /** One human-readable message per problem found (empty when `valid`). */
+  errors: string[];
+}
+
+/** True for a plain (non-array, non-null) object. */
+function isObject(v: unknown): v is Record<string, unknown> {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+
+/**
+ * Validate an untrusted value against the crypto-agility manifest schema.
+ *
+ * Checks structure, required fields, types, and the schema version. Purely local:
+ * it parses an already-in-memory value and NEVER performs I/O or network fetches;
+ * a fetch-and-validate of a remote manifest is a website-side concern, deliberately
+ * kept out of this offline-boundary tool. Returns every problem it finds rather than
+ * throwing on the first, so a caller can report them all at once.
+ */
+export function validateCryptoAgilityManifest(value: unknown): ManifestValidation {
+  const errors: string[] = [];
+  const err = (m: string): void => void errors.push(m);
+
+  if (!isObject(value)) {
+    return { valid: false, errors: ["manifest must be a JSON object"] };
+  }
+
+  // version
+  if (value.version === undefined) {
+    err("missing required field: version");
+  } else if (typeof value.version !== "number" || !Number.isInteger(value.version)) {
+    err("version must be an integer");
+  } else if (value.version !== CRYPTO_AGILITY_MANIFEST_VERSION) {
+    err(
+      `unsupported version ${value.version} (this validator understands version ${CRYPTO_AGILITY_MANIFEST_VERSION})`,
+    );
+  }
+
+  // manifestType
+  if (value.manifestType === undefined) {
+    err("missing required field: manifestType");
+  } else if (value.manifestType !== "crypto-agility") {
+    err('manifestType must be the string "crypto-agility"');
+  }
+
+  // generatedAt
+  if (value.generatedAt === undefined) {
+    err("missing required field: generatedAt");
+  } else if (typeof value.generatedAt !== "string" || value.generatedAt.length === 0) {
+    err("generatedAt must be a non-empty ISO 8601 string");
+  } else if (Number.isNaN(Date.parse(value.generatedAt))) {
+    err("generatedAt must be a parseable ISO 8601 timestamp");
+  }
+
+  // generator
+  if (value.generator === undefined) {
+    err("missing required field: generator");
+  } else if (!isObject(value.generator)) {
+    err("generator must be an object");
+  } else {
+    if (typeof value.generator.name !== "string") err("generator.name must be a string");
+    if (typeof value.generator.version !== "string") err("generator.version must be a string");
+  }
+
+  // subject
+  if (value.subject === undefined) {
+    err("missing required field: subject");
+  } else if (!isObject(value.subject)) {
+    err("subject must be an object");
+  } else {
+    if (typeof value.subject.root !== "string") err("subject.root must be a string");
+    if (value.subject.repository !== null && typeof value.subject.repository !== "string") {
+      err("subject.repository must be a string or null");
+    }
+    if (value.subject.commit !== null && typeof value.subject.commit !== "string") {
+      err("subject.commit must be a string or null");
+    }
+  }
+
+  // posture
+  validatePosture(value.posture, err);
+
+  // cbomSummary
+  validateCbomSummary(value.cbomSummary, err);
+
+  // attestation (optional)
+  if (value.attestation !== undefined) {
+    if (!isObject(value.attestation)) {
+      err("attestation must be an object when present");
+    } else if (typeof value.attestation.url !== "string" || value.attestation.url.length === 0) {
+      err("attestation.url must be a non-empty string");
+    }
+  }
+
+  // policy
+  validatePolicy(value.policy, err);
+
+  return { valid: errors.length === 0, errors };
+}
+
+/** Validate the `posture` block. */
+function validatePosture(posture: unknown, err: (m: string) => void): void {
+  if (posture === undefined) {
+    err("missing required field: posture");
+    return;
+  }
+  if (!isObject(posture)) {
+    err("posture must be an object");
+    return;
+  }
+  if (
+    typeof posture.readinessScore !== "number" ||
+    posture.readinessScore < 0 ||
+    posture.readinessScore > 100
+  ) {
+    err("posture.readinessScore must be a number between 0 and 100");
+  }
+  if (posture.hybridKexInUse !== null && typeof posture.hybridKexInUse !== "boolean") {
+    err("posture.hybridKexInUse must be a boolean or null");
+  }
+  if (typeof posture.hndlExposedCount !== "number" || posture.hndlExposedCount < 0) {
+    err("posture.hndlExposedCount must be a non-negative number");
+  }
+  const qv = posture.quantumVulnerable;
+  if (!isObject(qv)) {
+    err("posture.quantumVulnerable must be an object");
+    return;
+  }
+  if (typeof qv.total !== "number" || qv.total < 0) {
+    err("posture.quantumVulnerable.total must be a non-negative number");
+  }
+  if (!isObject(qv.bySeverity)) {
+    err("posture.quantumVulnerable.bySeverity must be an object");
+  } else {
+    for (const sev of SEVERITY_ORDER) {
+      if (typeof qv.bySeverity[sev] !== "number") {
+        err(`posture.quantumVulnerable.bySeverity.${sev} must be a number`);
+      }
+    }
+  }
+}
+
+/** Validate the `cbomSummary` block. */
+function validateCbomSummary(summary: unknown, err: (m: string) => void): void {
+  if (summary === undefined) {
+    err("missing required field: cbomSummary");
+    return;
+  }
+  if (!isObject(summary)) {
+    err("cbomSummary must be an object");
+    return;
+  }
+  if (typeof summary.serialNumber !== "string") err("cbomSummary.serialNumber must be a string");
+  if (typeof summary.assetCount !== "number" || summary.assetCount < 0) {
+    err("cbomSummary.assetCount must be a non-negative number");
+  }
+  if (!Array.isArray(summary.algorithmFamilies)) {
+    err("cbomSummary.algorithmFamilies must be an array");
+    return;
+  }
+  summary.algorithmFamilies.forEach((fam, i) => {
+    if (!isObject(fam)) {
+      err(`cbomSummary.algorithmFamilies[${i}] must be an object`);
+      return;
+    }
+    if (typeof fam.family !== "string")
+      err(`cbomSummary.algorithmFamilies[${i}].family must be a string`);
+    if (typeof fam.count !== "number" || fam.count < 0) {
+      err(`cbomSummary.algorithmFamilies[${i}].count must be a non-negative number`);
+    }
+    if (typeof fam.quantumVulnerable !== "boolean") {
+      err(`cbomSummary.algorithmFamilies[${i}].quantumVulnerable must be a boolean`);
+    }
+  });
+}
+
+/** Validate the `policy` block. */
+function validatePolicy(policy: unknown, err: (m: string) => void): void {
+  if (policy === undefined) {
+    err("missing required field: policy");
+    return;
+  }
+  if (!isObject(policy)) {
+    err("policy must be an object");
+    return;
+  }
+  if (typeof policy.source !== "string") err("policy.source must be a string");
+  if (typeof policy.deprecateClassicalAfter !== "number") {
+    err("policy.deprecateClassicalAfter must be a number (year)");
+  }
+  if (typeof policy.disallowClassicalAfter !== "number") {
+    err("policy.disallowClassicalAfter must be a number (year)");
+  }
+  if (policy.transitionDeadline !== null && typeof policy.transitionDeadline !== "string") {
+    err("policy.transitionDeadline must be a string or null");
+  }
+  if (typeof policy.citation !== "string") err("policy.citation must be a string");
+}

package/src/dependencies.ts

@@ -401,6 +401,14 @@ export const vulnerableDependencies: VulnerableDependency[] = [
     algorithms: ["X25519", "EdDSA"],
     severity: "low",
   },
+  {
+    name: "tink",
+    ecosystem: "pypi",
+    reason:
+      "Google Tink (Python) — classical RSA/ECDSA/Ed25519 signatures and ECIES hybrid encryption.",
+    algorithms: ["RSA", "ECDSA", "EdDSA", "ECIES"],
+    severity: "high",
+  },
 
   // --- crates.io (Rust) ---
   {
@@ -513,6 +521,21 @@ export const vulnerableDependencies: VulnerableDependency[] = [
     algorithms: ["ECDSA", "ECDH"],
     severity: "medium",
   },
+  {
+    name: "github.com/tink-crypto/tink-go/v2",
+    ecosystem: "go",
+    reason:
+      "Google Tink (Go) — classical RSA/ECDSA/Ed25519 signatures and ECIES hybrid encryption.",
+    algorithms: ["RSA", "ECDSA", "EdDSA", "ECIES"],
+    severity: "high",
+  },
+  {
+    name: "github.com/google/tink/go",
+    ecosystem: "go",
+    reason: "Google Tink (legacy Go module) — classical RSA/ECDSA/Ed25519 and ECIES hybrid.",
+    algorithms: ["RSA", "ECDSA", "EdDSA", "ECIES"],
+    severity: "high",
+  },
 
   // --- Maven (Java) ---
   {
@@ -559,6 +582,14 @@ export const vulnerableDependencies: VulnerableDependency[] = [
     severity: "medium",
     hndl: false,
   },
+  {
+    name: "tink",
+    ecosystem: "maven",
+    reason:
+      "Google Tink (com.google.crypto.tink) — classical RSA/ECDSA/Ed25519 signatures and ECIES hybrid encryption.",
+    algorithms: ["RSA", "ECDSA", "EdDSA", "ECIES"],
+    severity: "high",
+  },
 
   // --- RubyGems ---
   {
@@ -623,14 +654,83 @@ export const vulnerableDependencies: VulnerableDependency[] = [
     severity: "medium",
     hndl: false,
   },
+
+  // --- Composer (PHP) ---
+  {
+    name: "phpseclib/phpseclib",
+    ecosystem: "composer",
+    reason: "Pure-PHP RSA / DSA / ECDSA / Diffie-Hellman public-key crypto and X.509.",
+    algorithms: ["RSA", "DSA", "ECDSA", "DH"],
+    severity: "high",
+  },
+  {
+    name: "paragonie/sodium_compat",
+    ecosystem: "composer",
+    reason: "Pure-PHP libsodium polyfill: X25519 key agreement and Ed25519 signatures.",
+    algorithms: ["X25519", "EdDSA"],
+    severity: "low",
+  },
+  {
+    name: "paragonie/halite",
+    ecosystem: "composer",
+    reason: "libsodium wrapper: X25519 key agreement and Ed25519 signatures.",
+    algorithms: ["X25519", "EdDSA"],
+    severity: "low",
+  },
+  {
+    name: "paragonie/paseto",
+    ecosystem: "composer",
+    reason: "PASETO public tokens signed with classical Ed25519 (v2/v4) or RSA.",
+    algorithms: ["EdDSA", "RSA"],
+    severity: "medium",
+    hndl: false,
+  },
+  {
+    name: "firebase/php-jwt",
+    ecosystem: "composer",
+    reason: "PHP JWT signing/verification with classical RS*/ES* algorithms.",
+    algorithms: ["RSA", "ECDSA"],
+    severity: "medium",
+    hndl: false,
+  },
+  {
+    name: "lcobucci/jwt",
+    ecosystem: "composer",
+    reason: "PHP JWT with classical RSA/ECDSA signature algorithms.",
+    algorithms: ["RSA", "ECDSA"],
+    severity: "medium",
+    hndl: false,
+  },
+  {
+    name: "web-token/jwt-framework",
+    ecosystem: "composer",
+    reason: "JOSE (JWS/JWE) framework: classical RSA/ECDSA signatures and ECDH-ES key agreement.",
+    algorithms: ["RSA", "ECDSA", "ECDH"],
+    severity: "medium",
+  },
+  {
+    name: "mdanter/ecc",
+    ecosystem: "composer",
+    reason: "Pure-PHP elliptic-curve ECDSA signatures and ECDH key agreement.",
+    algorithms: ["ECDSA", "ECDH"],
+    severity: "high",
+  },
+  {
+    name: "simplito/elliptic-php",
+    ecosystem: "composer",
+    reason: "secp256k1 / NIST-curve ECDSA and ECDH in pure PHP (blockchain keys).",
+    algorithms: ["ECDSA", "ECDH"],
+    severity: "high",
+  },
 ];
 
 /**
  * Normalise a package name for matching within its ecosystem. PyPI is
  * case-insensitive and folds runs of `-_.` to a single `-` (PEP 503); cargo /
- * maven / rubygems / nuget are effectively lower-case (NuGet ids are matched
- * case-insensitively); npm and go module paths are matched verbatim (npm scopes
- * and go paths are case-sensitive).
+ * maven / rubygems / nuget / composer are effectively lower-case (NuGet ids are
+ * matched case-insensitively; Composer `vendor/package` names are lower-cased by
+ * Packagist); npm and go module paths are matched verbatim (npm scopes and go
+ * paths are case-sensitive).
  */
 function normalizeName(ecosystem: DependencyEcosystem, name: string): string {
   const n = name.trim();
@@ -718,6 +818,7 @@ export function manifestEcosystem(file: string): DependencyEcosystem | null {
   if (base === "gemfile" || base.endsWith(".gemspec")) return "rubygems";
   if (base === "packages.config" || base === "directory.packages.props" || base.endsWith(".csproj"))
     return "nuget";
+  if (base === "composer.json" || base === "composer.lock") return "composer";
   return null;
 }
 
@@ -797,6 +898,20 @@ function candidateNames(ecosystem: DependencyEcosystem, content: string): string
       }
       break;
     }
+    case "composer": {
+      // composer.json `require`/`require-dev` maps are keyed by "vendor/package";
+      // composer.lock lists `{"name": "vendor/package", …}`. Both are JSON, so
+      // grab every quoted `vendor/package` token (a lower-case vendor + package
+      // separated by a single `/`). PHP platform requirements ("php", "ext-*")
+      // carry no slash and so are naturally excluded; the curated DB filters the
+      // rest, so over-capture is safe.
+      for (const m of content.matchAll(
+        /["']([a-z0-9](?:[a-z0-9._-]*[a-z0-9])?\/[a-z0-9](?:[a-z0-9._-]*[a-z0-9])?)["']/gi,
+      )) {
+        names.push(m[1]);
+      }
+      break;
+    }
     case "npm":
       break; // npm uses the JSON path, not this extractor.
   }
@@ -893,10 +1008,33 @@ export function scanManifest(file: string, content: string): Finding[] {
   return sortByTitle(findings);
 }
 
+/**
+ * Resolve an npm `npm:` alias spec to the real package it installs, or null when
+ * the spec is not an alias. An aliased dependency records the alias as the map
+ * KEY and `npm:<real-name>@<range>` as the VALUE (in package.json and in a
+ * lockfile entry's `version`), so the vulnerable package hides behind a benign
+ * alias name. Keeps a leading scope `@` (only a version `@` past index 0 is a
+ * separator): `npm:node-forge@^1` → `node-forge`, `npm:@scope/pkg@1` → `@scope/pkg`.
+ */
+function npmAliasTarget(spec: string): string | null {
+  if (!spec.startsWith("npm:")) return null;
+  const rest = spec.slice(4);
+  const at = rest.lastIndexOf("@");
+  const name = at > 0 ? rest.slice(0, at) : rest;
+  return name || null;
+}
+
+/** Guard against a pathological / hostile lockfile nesting the walk unbounded. */
+const NPM_TREE_MAX_DEPTH = 64;
+
 /**
  * npm manifest scan.
- * - `package.json`: dependencies / devDependencies / peerDependencies / optionalDependencies.
- * - `package-lock.json` (v2/v3): the `packages` map keys (node_modules/<name>).
+ * - `package.json`: dependencies / devDependencies / peerDependencies / optionalDependencies,
+ *   including `npm:`-aliased entries (the alias key hides the real package name).
+ * - `package-lock.json` v1: the NESTED `dependencies` tree, where each entry may carry
+ *   its own `dependencies` (transitive deps) and an `npm:` alias in `version`.
+ * - `package-lock.json` v2/v3: the flat `packages` map keys (node_modules/<name>),
+ *   plus each entry's own `name` field (set for aliased installs).
  */
 function scanNpmManifest(
   content: string,
@@ -914,26 +1052,54 @@ function scanNpmManifest(
   const found = new Set<string>();
   const obj = json as Record<string, unknown>;
 
-  const collectFromRecord = (rec: unknown): void => {
-    if (rec === null || typeof rec !== "object") return;
-    for (const key of Object.keys(rec as Record<string, unknown>)) {
-      if (db.has(key)) found.add(key);
+  const add = (name: string): void => {
+    if (db.has(name)) found.add(name);
+  };
+
+  /**
+   * Walk a dependency map that may be either a flat package.json map
+   * (name → version-range string) or a legacy package-lock v1 tree (name →
+   * `{ version, requires, dependencies }`, arbitrarily nested). Matches keys,
+   * resolves `npm:` aliases from string values and entry `version` fields, and
+   * recurses into a nested `dependencies` sub-tree.
+   */
+  const walkDepTree = (deps: unknown, depth: number): void => {
+    if (depth > NPM_TREE_MAX_DEPTH || deps === null || typeof deps !== "object") return;
+    for (const [name, node] of Object.entries(deps as Record<string, unknown>)) {
+      add(name);
+      if (typeof node === "string") {
+        // package.json form: the value is a range, possibly `npm:<real>@<range>`.
+        const aliased = npmAliasTarget(node);
+        if (aliased) add(aliased);
+      } else if (node !== null && typeof node === "object") {
+        const rec = node as Record<string, unknown>;
+        if (typeof rec.version === "string") {
+          const aliased = npmAliasTarget(rec.version);
+          if (aliased) add(aliased);
+        }
+        walkDepTree(rec.dependencies, depth + 1); // v1 nests transitive deps here
+      }
     }
   };
 
-  collectFromRecord(obj.dependencies);
-  collectFromRecord(obj.devDependencies);
-  collectFromRecord(obj.peerDependencies);
-  collectFromRecord(obj.optionalDependencies);
+  walkDepTree(obj.dependencies, 0);
+  walkDepTree(obj.devDependencies, 0);
+  walkDepTree(obj.peerDependencies, 0);
+  walkDepTree(obj.optionalDependencies, 0);
 
   const packages = obj.packages;
   if (packages !== null && typeof packages === "object") {
-    for (const key of Object.keys(packages as Record<string, unknown>)) {
+    for (const [key, entry] of Object.entries(packages as Record<string, unknown>)) {
       if (!key) continue; // root package entry
       const marker = "node_modules/";
       const idx = key.lastIndexOf(marker);
-      const name = idx >= 0 ? key.slice(idx + marker.length) : key;
-      if (db.has(name)) found.add(name);
+      add(idx >= 0 ? key.slice(idx + marker.length) : key);
+      // Aliased install: the entry's own `name` field is the real package, which
+      // differs from the alias embedded in the node_modules/<alias> key.
+      if (entry !== null && typeof entry === "object") {
+        const realName = (entry as Record<string, unknown>).name;
+        if (typeof realName === "string") add(realName);
+      }
     }
   }