cra-audit 0.1.0 → 1.0.0

package/README.md

@@ -3,7 +3,7 @@
 > Compliance audit for the **Cyber Resilience Act** (Regulation EU 2024/2847) and the **BSI TR-03183** technical guideline, for npm projects.
 
 `cra-audit` audits the installed dependencies of an npm project and checks the key requirements that the CRA imposes on "products with digital elements". It runs directly with `npx`, **without installation**, and has **no production dependencies** to minimize its own supply-chain surface.
-
+It reads the project lockfile natively, so it works with **npm** (`package-lock.json` / `npm-shrinkwrap.json`), **Yarn** (classic v1 and Berry v2+ `yarn.lock`) and **pnpm** (`pnpm-lock.yaml`) — auditing the exact versions each package manager pinned.
 ```bash
 # Run ALL the law's checks (Vulnerabilities + Licenses + SBOM)
 npx cra-audit
@@ -24,13 +24,13 @@ Under the hood, the package runs the checks derived from the CRA legal obligatio
 
 ### 1. Automatic SBOM validation
 
-Generates and validates a **Software Bill of Materials (SBOM)** in a machine-readable format —**CycloneDX 1.5** or **SPDX 2.3**— from the `package-lock.json` / `npm-shrinkwrap.json`. It verifies the **minimum elements** required by TR-03183 §6 for every component: name, version, unique identifier (`purl`), cryptographic integrity hash and license.
+Generates and validates a **Software Bill of Materials (SBOM)** in a machine-readable format —**CycloneDX 1.5** or **SPDX 2.3**— from the `package-lock.json` / `npm-shrinkwrap.json`, `yarn.lock` or `pnpm-lock.yaml`. It verifies the **minimum elements** required by TR-03183 §6 for every component: name, version, unique identifier (`purl`), cryptographic integrity hash and license.
 
 > CRA Annex I · TR-03183 Part 2 — *"Transparency through SBOM"*.
 
 ### 2. "Zero known vulnerabilities" audit
 
-Scans **direct and transitive** dependencies (from the lockfile) with `npm audit` and blocks the audit if there are exploitable vulnerabilities above the configured threshold.
+Scans **direct and transitive** dependencies (from the lockfile) with `npm audit` and blocks the audit if there are exploitable vulnerabilities above the configured threshold. For Yarn/pnpm projects (which have no npm lockfile), `cra-audit` synthesizes a temporary `package-lock.json` from the exact versions pinned in `yarn.lock` / `pnpm-lock.yaml` and runs `npm audit --package-lock-only` against it, so the scanned versions match what the package manager actually resolved.
 
 > CRA Art. 13 — *products must be placed on the market without known exploitable vulnerabilities*.
 
@@ -237,7 +237,7 @@ const signals = await enrichComponents(components, { network: true, github: true
 
 - Node.js >= 18 (uses native `fetch` and `node --test`).
 - `npm` available on the `PATH` (for `npm audit`).
-- A `package-lock.json` or `npm-shrinkwrap.json` present (run `npm install` if missing).
+- A lockfile present: `package-lock.json` / `npm-shrinkwrap.json` (npm), `yarn.lock` (Yarn classic or Berry) or `pnpm-lock.yaml` (pnpm). Run `npm install` / `yarn` / `pnpm install` if missing.
 
 ## Legal notice
 

package/package.json

@@ -1,8 +1,7 @@
 {
   "name": "cra-audit",
-  "version": "0.1.0",
-  "description": "Audits npm projects for compliance with the European Cyber Resilience Act (CRA, EU Regulation 2024/2847) and the BSI TR-03183 technical guideline: SBOM (CycloneDX/SPDX), known vulnerabilities, third-party components, and licenses.",
-  "author": "Miguel Gonzalez Herrera",
+  "version": "1.0.0",
+  "description": "Audits npm, yarn, and pnpm projects for compliance with the European Cyber Resilience Act (CRA, EU Regulation 2024/2847) and BSI TR-03183: SBOM (CycloneDX/SPDX), known vulnerabilities, third-party components, and licenses.",
   "keywords": [
     "cra",
     "cyber-resilience-act",

package/src/cli.js

@@ -79,8 +79,8 @@ async function main(argv) {
       return 0;
 
     default:
-      logger.error(`Comando desconocido: "${command}".`);
-      logger.log(`Ejecuta ${color.cyan('cra-audit --help')} para ver los comandos disponibles.`);
+      logger.error(`Unknown command: "${command}".`);
+      logger.log(`Run ${color.cyan('cra-audit --help')} to see the available commands.`);
       return 1;
   }
 }
@@ -160,56 +160,56 @@ function setFlag(flags, name, value) {
 function printHelp() {
   const c = color;
   logger.log(`
-${c.bold('cra-audit')} — Auditoría de cumplimiento del Cyber Resilience Act (UE 2024/2847)
-            y la directriz técnica BSI TR-03183 para proyectos npm.
-
-${c.bold('USO')}
-  npx cra-audit [comando] [opciones]
-
-${c.bold('COMANDOS')}
-  ${c.cyan('audit')}                 Ejecuta TODAS las comprobaciones (vulnerabilidades + SBOM + licencias). Por defecto.
-  ${c.cyan('visualize')}             Genera un informe HTML interactivo (SBOM, licencias, versiones y mantenimiento).
-  ${c.cyan('sbom generate')}         Genera un SBOM (CycloneDX o SPDX) y lo imprime o guarda.
-  ${c.cyan('sbom check')}            Valida que el SBOM cumple los elementos mínimos de TR-03183.
-  ${c.cyan('vulnerabilities')}       Analiza solo vulnerabilidades conocidas (alias: vuln).
-  ${c.cyan('licenses')}              Analiza solo las licencias de las dependencias.
-  ${c.cyan('help')}                  Muestra esta ayuda.
-
-${c.bold('OPCIONES')}
-  ${c.cyan('--visualize, -V')}       Atajo para generar y abrir el informe HTML interactivo.
-  ${c.cyan('--github')}              Enriquece el informe visual con datos de GitHub (último commit, contribuidores, stars).
-  ${c.cyan('--offline')}             No consulta la red al visualizar (omite metadatos de mantenimiento).
-  ${c.cyan('--no-open')}             No abre el informe HTML en el navegador automáticamente.
-  ${c.cyan('--sbom')}                Atajo equivalente a "sbom check".
-  ${c.cyan('--format <fmt>')}        Formato del SBOM: cyclonedx (def.) | spdx.
-  ${c.cyan('--fail-on <sev>')}       Severidad mínima que hace fallar la auditoría: info|low|moderate|high|critical.
-  ${c.cyan('--production, --prod')}  Audita solo dependencias de producción (omite devDependencies).
-  ${c.cyan('--no-sbom')}             No exige SBOM en la auditoría completa.
-  ${c.cyan('--json')}                Salida en JSON legible por máquina.
-  ${c.cyan('--output, -o <ruta>')}   Escribe el resultado/SBOM/HTML en un archivo.
-  ${c.cyan('--input, -i <ruta>')}    SBOM existente a validar (para "sbom check").
-  ${c.cyan('--config, -c <ruta>')}   Ruta a la política de seguridad (.cra-audit.json).
-  ${c.cyan('--cwd <ruta>')}          Directorio del proyecto a auditar.
-  ${c.cyan('--no-color')}            Desactiva los colores.
-  ${c.cyan('--version, -v')}         Muestra la versión.
-  ${c.cyan('--help, -h')}            Muestra esta ayuda.
-
-${c.bold('EJEMPLOS')}
-  ${c.gray('# Auditoría completa de cumplimiento CRA')}
+${c.bold('cra-audit')} — Cyber Resilience Act (EU 2024/2847) compliance audit
+            and the BSI TR-03183 technical guideline, for npm projects.
+
+${c.bold('USAGE')}
+  npx cra-audit [command] [options]
+
+${c.bold('COMMANDS')}
+  ${c.cyan('audit')}                 Run ALL the checks (vulnerabilities + SBOM + licenses). Default.
+  ${c.cyan('visualize')}             Generate an interactive HTML report (SBOM, licenses, versions and maintenance).
+  ${c.cyan('sbom generate')}         Generate an SBOM (CycloneDX or SPDX) and print or save it.
+  ${c.cyan('sbom check')}            Validate that the SBOM meets the TR-03183 minimum elements.
+  ${c.cyan('vulnerabilities')}       Analyze known vulnerabilities only (alias: vuln).
+  ${c.cyan('licenses')}              Analyze dependency licenses only.
+  ${c.cyan('help')}                  Show this help.
+
+${c.bold('OPTIONS')}
+  ${c.cyan('--visualize, -V')}       Shortcut to generate and open the interactive HTML report.
+  ${c.cyan('--github')}              Enrich the visual report with GitHub data (last commit, contributors, stars).
+  ${c.cyan('--offline')}             Do not query the network when visualizing (skips maintenance metadata).
+  ${c.cyan('--no-open')}             Do not open the HTML report in the browser automatically.
+  ${c.cyan('--sbom')}                Shortcut equivalent to "sbom check".
+  ${c.cyan('--format <fmt>')}        SBOM format: cyclonedx (default) | spdx.
+  ${c.cyan('--fail-on <sev>')}       Minimum severity that fails the audit: info|low|moderate|high|critical.
+  ${c.cyan('--production, --prod')}  Audit production dependencies only (skips devDependencies).
+  ${c.cyan('--no-sbom')}             Do not require an SBOM in the full audit.
+  ${c.cyan('--json')}                Machine-readable JSON output.
+  ${c.cyan('--output, -o <path>')}   Write the result/SBOM/HTML to a file.
+  ${c.cyan('--input, -i <path>')}    Existing SBOM to validate (for "sbom check").
+  ${c.cyan('--config, -c <path>')}   Path to the security policy (.cra-audit.json).
+  ${c.cyan('--cwd <path>')}          Project directory to audit.
+  ${c.cyan('--no-color')}            Disable colors.
+  ${c.cyan('--version, -v')}         Show the version.
+  ${c.cyan('--help, -h')}            Show this help.
+
+${c.bold('EXAMPLES')}
+  ${c.gray('# Full CRA compliance audit')}
   npx cra-audit
 
-  ${c.gray('# Informe visual interactivo (HTML) con datos de mantenimiento')}
+  ${c.gray('# Interactive visual report (HTML) with maintenance data')}
   npx cra-audit --visualize
   npx cra-audit visualize --github
 
-  ${c.gray('# Solo la parte del SBOM')}
+  ${c.gray('# Just the SBOM part')}
   npx cra-audit --sbom
   npx cra-audit sbom check
 
-  ${c.gray('# Generar un SBOM CycloneDX en disco')}
+  ${c.gray('# Generate a CycloneDX SBOM on disk')}
   npx cra-audit sbom generate -o sbom.cdx.json
 
-  ${c.gray('# Fallar solo ante vulnerabilidades críticas, en CI')}
+  ${c.gray('# Fail only on critical vulnerabilities, in CI')}
   npx cra-audit --fail-on critical --production --json -o cra-report.json
 `);
 }

package/src/commands/audit.js

@@ -43,7 +43,7 @@ function resolveRoot(flags) {
   const start = flags.cwd || process.cwd();
   const root = findProjectRoot(start);
   if (!root) {
-    logger.error('No se encontró ningún package.json. Ejecuta el comando dentro de un proyecto npm.');
+    logger.error('No package.json found. Run the command inside an npm project.');
     return null;
   }
   return root;

package/src/commands/sbom.js

@@ -16,7 +16,7 @@ const { validateSbom } = require('../core/sbom-validator');
 function sbomCommand(subcommand, flags) {
   const projectRoot = findProjectRoot(flags.cwd || process.cwd());
   if (!projectRoot) {
-    logger.error('No se encontró ningún package.json. Ejecuta el comando dentro de un proyecto npm.');
+    logger.error('No package.json found. Run the command inside an npm project.');
     return 1;
   }
 
@@ -30,7 +30,7 @@ function sbomCommand(subcommand, flags) {
     return sbomGenerate(projectRoot, format, flags);
   }
 
-  logger.error(`Subcomando de SBOM desconocido: "${action}". Usa "generate" o "check".`);
+  logger.error(`Unknown SBOM subcommand: "${action}". Use "generate" or "check".`);
   return 1;
 }
 
@@ -44,7 +44,7 @@ function sbomGenerate(projectRoot, format, flags) {
   if (flags.output) {
     const outPath = path.isAbsolute(flags.output) ? flags.output : path.join(projectRoot, flags.output);
     writeJson(outPath, result.document);
-    logger.success(`SBOM (${result.format}) con ${result.componentCount} componentes escrito en: ${outPath}`);
+    logger.success(`SBOM (${result.format}) with ${result.componentCount} components written to: ${outPath}`);
   } else {
     process.stdout.write(JSON.stringify(result.document, null, 2) + '\n');
   }
@@ -58,7 +58,7 @@ function sbomCheck(projectRoot, format, flags) {
   if (flags.input) {
     const inPath = path.isAbsolute(flags.input) ? flags.input : path.join(projectRoot, flags.input);
     if (!exists(inPath)) {
-      logger.error(`No se encontró el SBOM indicado: ${flags.input}`);
+      logger.error(`The specified SBOM was not found: ${flags.input}`);
       return 1;
     }
     document = readJson(inPath);
@@ -82,18 +82,18 @@ function sbomCheck(projectRoot, format, flags) {
     return validation.valid ? 0 : 1;
   }
 
-  logger.heading('Validación de SBOM · BSI TR-03183 §6 (elementos mínimos)');
-  logger.detail(`Formato detectado: ${validation.format} · Componentes: ${validation.stats.total}`);
+  logger.heading('SBOM validation · BSI TR-03183 §6 (minimum elements)');
+  logger.detail(`Detected format: ${validation.format} · Components: ${validation.stats.total}`);
   for (const check of validation.checks) {
     const mark = check.passed ? color.green('✔') : color.red('✖');
     logger.log(`  ${mark} ${check.label}`);
   }
   logger.log('');
   if (validation.valid) {
-    logger.success(color.bold('SBOM VÁLIDO — cumple los elementos mínimos exigidos por el CRA.'));
+    logger.success(color.bold('SBOM VALID — meets the minimum elements required by the CRA.'));
     return 0;
   }
-  logger.error(color.bold(`SBOM INVÁLIDO — ${validation.failedChecks.length} requisito(s) sin cumplir.`));
+  logger.error(color.bold(`SBOM INVALID — ${validation.failedChecks.length} requirement(s) not met.`));
   return 1;
 }
 

package/src/commands/visualize.js

@@ -25,7 +25,7 @@ const { buildHtml } = require('../reporters/html');
 async function visualizeCommand(flags) {
   const projectRoot = findProjectRoot(flags.cwd || process.cwd());
   if (!projectRoot) {
-    logger.error('No se encontró ningún package.json. Ejecuta el comando dentro de un proyecto npm.');
+    logger.error('No package.json found. Run the command inside an npm project.');
     return 1;
   }
 
@@ -42,7 +42,7 @@ async function visualizeCommand(flags) {
     policy = {};
   }
 
-  logger.info(`Analizando ${parsed.components.length} componentes de ${parsed.root.name}@${parsed.root.version}…`);
+  logger.info(`Analyzing ${parsed.components.length} components from ${parsed.root.name}@${parsed.root.version}…`);
 
   // Vulnerabilities + licenses run locally (no network).
   const vulns = scanVulnerabilities(projectRoot, { production: policy.productionOnly });
@@ -53,23 +53,18 @@ async function visualizeCommand(flags) {
   const github = Boolean(flags.github);
   if (network) {
     logger.info(
-      `Consultando metadatos de mantenimiento (npm${github ? ' + GitHub' : ''})…` +
-      (github && !process.env.GITHUB_TOKEN ? color.gray(' (sin GITHUB_TOKEN: límite de 60 req/h)') : '')
+      `Fetching maintenance metadata (npm${github ? ' + GitHub' : ''})…` +
+      (github && !process.env.GITHUB_TOKEN ? color.gray(' (no GITHUB_TOKEN: limited to 60 req/h)') : '')
     );
   } else {
-    logger.info('Modo offline: se omiten metadatos de mantenimiento.');
+    logger.info('Offline mode: maintenance metadata skipped.');
   }
 
-  let lastPct = -1;
   const enrichment = await enrichComponents(parsed.components, {
     network,
     github,
     onProgress: (done, total) => {
-      const pct = Math.floor((done / total) * 100);
-      if (pct !== lastPct && pct % 20 === 0) {
-        logger.detail(`metadatos npm: ${pct}%`);
-        lastPct = pct;
-      }
+      logger.progress('npm metadata', done, total);
     },
   });
 
@@ -78,13 +73,13 @@ async function visualizeCommand(flags) {
 
   const outPath = resolveOutputPath(projectRoot, flags.output);
   fs.writeFileSync(outPath, html, 'utf8');
-  logger.success(`Informe visual escrito en: ${outPath}`);
+  logger.success(`Visual report written to: ${outPath}`);
 
   if (!flags.noOpen) {
     openInBrowser(outPath);
-    logger.detail('Abriendo en el navegador…');
+    logger.detail('Opening in the browser…');
   } else {
-    logger.detail(`Ábrelo en tu navegador: file://${outPath.replace(/\\/g, '/')}`);
+    logger.detail(`Open it in your browser: file://${outPath.replace(/\\/g, '/')}`);
   }
 
   return 0;
@@ -107,11 +102,16 @@ function buildModel(parsed, vulns, licenses, enrichment) {
     const lic = licByKey.get(key) || null;
     const enr = enrichment.get(key) || {};
 
+    const license = (lic && lic.license) || c.license || enr.license || null;
+    const licenseStatus = (lic && lic.license)
+      ? lic.status
+      : (license ? 'ok' : 'missing');
+
     return {
       name: c.name,
       version: c.version,
-      license: (lic && lic.license) || c.license || null,
-      licenseStatus: lic ? lic.status : (c.license ? 'ok' : 'missing'),
+      license,
+      licenseStatus,
       severity: vuln ? vuln.severity : 'none',
       fixAvailable: vuln ? Boolean(vuln.fixAvailable) : false,
       latest: enr.latest || null,

package/src/core/auditor.js

@@ -34,13 +34,13 @@ function runAudit(projectRoot, policy, policySource, options = {}) {
     sections.vulnerabilities = vulns;
 
     if (!vulns.ok) {
-      reasons.push({ label: `No se pudieron analizar vulnerabilidades: ${vulns.error}`, passed: false });
+      reasons.push({ label: `Vulnerabilities could not be analyzed: ${vulns.error}`, passed: false });
     } else {
       const blocking = countBlocking(vulns, policy);
       reasons.push({
         label: blocking === 0
-          ? `Sin vulnerabilidades de severidad >= ${policy.failOn}`
-          : `${blocking} vulnerabilidad(es) de severidad >= ${policy.failOn}`,
+          ? `No vulnerabilities of severity >= ${policy.failOn}`
+          : `${blocking} vulnerability(ies) of severity >= ${policy.failOn}`,
         passed: blocking === 0,
       });
     }
@@ -56,12 +56,12 @@ function runAudit(projectRoot, policy, policySource, options = {}) {
 
     if (policy.requireSbom) {
       if (!sbom.ok) {
-        reasons.push({ label: `No se pudo generar el SBOM: ${sbom.error}`, passed: false });
+        reasons.push({ label: `The SBOM could not be generated: ${sbom.error}`, passed: false });
       } else {
         reasons.push({
           label: sbom.validation.valid
-            ? 'SBOM válido según los elementos mínimos de TR-03183'
-            : 'SBOM incompleto respecto a TR-03183',
+            ? 'SBOM valid against the TR-03183 minimum elements'
+            : 'SBOM incomplete with respect to TR-03183',
           passed: sbom.validation.valid,
         });
       }
@@ -74,15 +74,15 @@ function runAudit(projectRoot, policy, policySource, options = {}) {
     sections.licenses = licenses;
 
     if (!licenses.ok) {
-      reasons.push({ label: `No se pudieron analizar licencias: ${licenses.error}`, passed: false });
+      reasons.push({ label: `Licenses could not be analyzed: ${licenses.error}`, passed: false });
     } else {
       const s = licenses.summary;
       const missingFails = policy.licenses.failOnMissing && s.missing.length > 0;
       const licensesPassed = s.denied.length === 0 && s.notAllowed.length === 0 && !missingFails;
       reasons.push({
         label: licensesPassed
-          ? 'Licencias documentadas y conformes con la política'
-          : 'Problemas de licencias detectados (prohibidas, no permitidas o sin documentar)',
+          ? 'Licenses documented and compliant with the policy'
+          : 'License issues detected (denied, not allowed or undocumented)',
         passed: licensesPassed,
       });
     }

package/src/core/enrich.js

@@ -103,9 +103,35 @@ async function fetchNpmMeta(name, timeout) {
     repo,
     deprecated,
     homepage: doc.homepage || null,
+    licenseByVersion: licensesByVersion(doc),
   };
 }
 
+/**
+ * Builds a compact `{ version: licenseId }` map from a registry document so the
+ * report can document a license even when it is absent from the lockfile or
+ * not installed on disk (common with pnpm/Yarn).
+ */
+function licensesByVersion(doc) {
+  const map = {};
+  const versions = doc.versions && typeof doc.versions === 'object' ? doc.versions : {};
+  for (const [version, vDoc] of Object.entries(versions)) {
+    const license = normalizeRegistryLicense(vDoc);
+    if (license) map[version] = license;
+  }
+  return map;
+}
+
+function normalizeRegistryLicense(vDoc) {
+  if (!vDoc) return null;
+  if (typeof vDoc.license === 'string') return vDoc.license;
+  if (vDoc.license && typeof vDoc.license.type === 'string') return vDoc.license.type;
+  if (Array.isArray(vDoc.licenses) && vDoc.licenses.length) {
+    return vDoc.licenses.map((l) => (typeof l === 'string' ? l : l && l.type)).filter(Boolean).join(' OR ') || null;
+  }
+  return null;
+}
+
 async function fetchGithubRepo(owner, name, timeout, token) {
   const headers = { 'User-Agent': 'cra-audit', Accept: 'application/vnd.github+json' };
   if (token) headers.Authorization = `Bearer ${token}`;
@@ -163,7 +189,7 @@ function buildSignals(comp, npm, gh) {
   const signals = {
     name: comp.name,
     version: comp.version,
-    license: comp.license || null,
+    license: comp.license || (npm && npm.licenseByVersion && npm.licenseByVersion[comp.version]) || null,
     latest: npm ? npm.latest : null,
     outdated: Boolean(npm && npm.latest && comp.version && npm.latest !== comp.version),
     lastPublish: npm ? npm.lastPublish : null,