@shubhambattoo/look-see 0.2.0 → 0.2.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shubhambattoo/look-see",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Look-See scans locked project dependencies for known vulnerabilities",
   "author": "shubhambattoo",
   "type": "module",

package/src/advisories/nvd.js

@@ -4,6 +4,7 @@ const NVD_URL = 'https://services.nvd.nist.gov/rest/json/cves/2.0';
 const CACHE_TTL = 7 * 24 * 60 * 60 * 1000;
 const NVD_API_KEY = process.env.NVD_API_KEY;
 const MIN_INTERVAL_MS = NVD_API_KEY ? 700 : 6_100;
+const MAX_CVES_PER_REQUEST = 100;
 
 function cveIdsFrom(vulnerabilities) {
   const ids = new Set();
@@ -16,15 +17,17 @@ function cveIdsFrom(vulnerabilities) {
   return [...ids].sort();
 }
 
-async function fetchCve(cveId) {
+async function fetchCves(cveIds) {
   const url = new URL(NVD_URL);
-  url.searchParams.set('cveId', cveId);
+  url.searchParams.set('cveIds', cveIds.join(','));
   const headers = { accept: 'application/json' };
   if (NVD_API_KEY) headers.apiKey = NVD_API_KEY;
   const response = await fetch(url, { headers, signal: AbortSignal.timeout(30_000) });
   if (!response.ok) throw new Error(`NVD returned HTTP ${response.status}`);
   const body = await response.json();
-  return body.vulnerabilities?.[0]?.cve ?? null;
+  return new Map((body.vulnerabilities ?? [])
+    .map(({ cve }) => [cve?.id, cve])
+    .filter(([id]) => id));
 }
 
 export async function queryNvd(vulnerabilities, { onProgress } = {}) {
@@ -33,6 +36,7 @@ export async function queryNvd(vulnerabilities, { onProgress } = {}) {
   const errors = [];
   let lastRequestAt = 0;
   let completed = 0;
+  const missing = [];
   onProgress?.({ stage: 'nvd', completed, total: ids.length });
   for (const cveId of ids) {
     const cacheKey = `nvd:${cveId}`;
@@ -41,21 +45,29 @@ export async function queryNvd(vulnerabilities, { onProgress } = {}) {
       byCve.set(cveId, cached && Object.hasOwn(cached, 'cve') ? cached.cve : cached);
       completed += 1;
       onProgress?.({ stage: 'nvd', completed, total: ids.length });
-      continue;
-    }
+    } else missing.push(cveId);
+  }
+
+  for (let offset = 0; offset < missing.length; offset += MAX_CVES_PER_REQUEST) {
+    const batch = missing.slice(offset, offset + MAX_CVES_PER_REQUEST);
     const waitMs = Math.max(0, MIN_INTERVAL_MS - (Date.now() - lastRequestAt));
     if (waitMs) await new Promise((resolve) => setTimeout(resolve, waitMs));
     try {
-      const cve = await fetchCve(cveId);
+      const cves = await fetchCves(batch);
       lastRequestAt = Date.now();
-      byCve.set(cveId, cve);
-      await setCached(cacheKey, { cve });
-      completed += 1;
+      await Promise.all(batch.map(async (cveId) => {
+        const cve = cves.get(cveId) ?? null;
+        byCve.set(cveId, cve);
+        await setCached(`nvd:${cveId}`, { cve });
+      }));
+      completed += batch.length;
       onProgress?.({ stage: 'nvd', completed, total: ids.length });
     } catch (error) {
       lastRequestAt = Date.now();
-      errors.push({ source: 'NVD', cveId, message: error.message });
-      completed += 1;
+      for (const cveId of batch) {
+        errors.push({ source: 'NVD', cveId, message: error.message });
+      }
+      completed += batch.length;
       onProgress?.({ stage: 'nvd', completed, total: ids.length });
       if (/HTTP 403|HTTP 429/.test(error.message)) {
         errors.push({ source: 'NVD', message: 'Stopped further NVD lookups after a rate-limit response.' });

package/src/cli.js

@@ -26,7 +26,7 @@ Environment:
   NVD_API_KEY           Optional NVD API key for higher request limits
   LOOK_SEE_CACHE_DIR    Override the local advisory cache directory`;
 
-const VERSION = '0.1.0';
+const VERSION = '0.2.1';
 const SEVERITY_RANK = { UNKNOWN: 0, LOW: 1, MEDIUM: 2, HIGH: 3, CRITICAL: 4 };
 
 function parseArgs(args) {