cra-audit 0.1.0 → 1.0.0

package/src/core/lockfile-parser.js

@@ -1,33 +1,50 @@
 'use strict';
 
+const fs = require('node:fs');
 const path = require('node:path');
 const { readJson, exists } = require('../utils/fs');
+const { parseYaml } = require('../utils/yaml');
 
 /**
- * Parses an npm lockfile (package-lock.json v2/v3 or npm-shrinkwrap.json)
- * into a normalized list of components. CRA / TR-03183 require traceability
- * of every direct and transitive dependency, including integrity hashes.
+ * Detection order: npm lockfiles take precedence (they carry the richest
+ * metadata and let `npm audit` run natively), followed by Yarn (classic v1
+ * and Berry v2+) and pnpm.
+ */
+const LOCKFILES = [
+  { name: 'package-lock.json', manager: 'npm' },
+  { name: 'npm-shrinkwrap.json', manager: 'npm' },
+  { name: 'yarn.lock', manager: 'yarn' },
+  { name: 'pnpm-lock.yaml', manager: 'pnpm' },
+];
+
+/**
+ * Parses the project lockfile (npm `package-lock.json`/`npm-shrinkwrap.json`,
+ * Yarn `yarn.lock` classic or Berry, or pnpm `pnpm-lock.yaml`) into a
+ * normalized list of components. CRA / TR-03183 require traceability of every
+ * direct and transitive dependency, including integrity hashes.
  *
  * @param {string} projectRoot
  * @returns {{
  *   ok: boolean,
+ *   manager: 'npm'|'yarn'|'pnpm'|null,
  *   lockfileName: string|null,
- *   lockfileVersion: number|null,
+ *   lockfileVersion: number|string|null,
  *   root: { name: string, version: string },
  *   components: Array<object>,
  *   error?: string
  * }}
  */
 function parseLockfile(projectRoot) {
-  const candidates = ['package-lock.json', 'npm-shrinkwrap.json'];
   let lockPath = null;
   let lockfileName = null;
+  let manager = null;
 
-  for (const candidate of candidates) {
-    const full = path.join(projectRoot, candidate);
+  for (const candidate of LOCKFILES) {
+    const full = path.join(projectRoot, candidate.name);
     if (exists(full)) {
       lockPath = full;
-      lockfileName = candidate;
+      lockfileName = candidate.name;
+      manager = candidate.manager;
       break;
     }
   }
@@ -42,16 +59,39 @@ function parseLockfile(projectRoot) {
   if (!lockPath) {
     return {
       ok: false,
+      manager: null,
       lockfileName: null,
       lockfileVersion: null,
       root,
       components: [],
       error:
-        'No se encontró package-lock.json ni npm-shrinkwrap.json. ' +
-        'El CRA exige trazabilidad determinista de dependencias: ejecuta `npm install` para generar el lockfile.',
+        'No lockfile found (package-lock.json, npm-shrinkwrap.json, ' +
+        'yarn.lock or pnpm-lock.yaml). The CRA requires deterministic dependency ' +
+        'traceability: run `npm install` (or `yarn` / `pnpm install`) to generate the lockfile.',
+    };
+  }
+
+  try {
+    if (manager === 'npm') return parseNpmLock(lockPath, lockfileName, root);
+    if (manager === 'yarn') return parseYarnLock(lockPath, lockfileName, root);
+    if (manager === 'pnpm') return parsePnpmLock(lockPath, lockfileName, root);
+  } catch (err) {
+    return {
+      ok: false,
+      manager,
+      lockfileName,
+      lockfileVersion: null,
+      root,
+      components: [],
+      error: `Could not parse ${lockfileName}: ${err.message}`,
     };
   }
 
+  return { ok: true, manager, lockfileName, lockfileVersion: null, root, components: [] };
+}
+
+/** npm: package-lock.json (v1/v2/v3) or npm-shrinkwrap.json. */
+function parseNpmLock(lockPath, lockfileName, root) {
   const lock = readJson(lockPath);
   const lockfileVersion = lock.lockfileVersion || 1;
 
@@ -64,13 +104,7 @@ function parseLockfile(projectRoot) {
     components = [];
   }
 
-  return {
-    ok: true,
-    lockfileName,
-    lockfileVersion,
-    root,
-    components,
-  };
+  return { ok: true, manager: 'npm', lockfileName, lockfileVersion, root, components };
 }
 
 /** Lockfile v2/v3 store everything under the `packages` map keyed by path. */
@@ -126,6 +160,164 @@ function nameFromPath(pkgPath) {
   return pkgPath.slice(idx + 'node_modules/'.length);
 }
 
+// --- Yarn ------------------------------------------------------------------
+
+/** Yarn: dispatches between the classic v1 text format and Berry's YAML. */
+function parseYarnLock(lockPath, lockfileName, root) {
+  const content = fs.readFileSync(lockPath, 'utf8');
+  const isBerry = /^__metadata:/m.test(content) || /\n {2}resolution:/.test(content);
+  const components = isBerry ? parseYarnBerry(content) : parseYarnClassic(content);
+  return {
+    ok: true,
+    manager: 'yarn',
+    lockfileName,
+    lockfileVersion: isBerry ? 'berry' : 1,
+    root,
+    components: dedupe(components),
+  };
+}
+
+/**
+ * Yarn classic (v1) lockfiles use a custom, non-YAML text format: a block per
+ * resolved entry whose header lists one or more `name@range` descriptors.
+ */
+function parseYarnClassic(content) {
+  const components = [];
+  const blocks = content.split(/\r?\n(?=\S)/);
+
+  for (const block of blocks) {
+    const lines = block.split(/\r?\n/);
+    const header = lines[0];
+    if (!header || header.startsWith('#') || !header.trim().endsWith(':')) continue;
+
+    const descriptors = header.replace(/:\s*$/, '').split(',').map((d) => stripQuotes(d.trim()));
+    const name = packageNameFromDescriptor(descriptors[0]);
+    if (!name) continue;
+
+    let version = null;
+    let resolved = null;
+    let integrity = null;
+    for (const raw of lines.slice(1)) {
+      const line = raw.trim();
+      if (line.startsWith('version ')) version = stripQuotes(line.slice('version '.length).trim());
+      else if (line.startsWith('resolved ')) resolved = stripQuotes(line.slice('resolved '.length).trim());
+      else if (line.startsWith('integrity ')) integrity = stripQuotes(line.slice('integrity '.length).trim());
+    }
+    if (!version) continue;
+
+    components.push(normalizeComponent({ name, version, resolved, integrity, path: `node_modules/${name}` }));
+  }
+  return components;
+}
+
+/** Yarn Berry (v2+) lockfiles are YAML keyed by descriptor lists. */
+function parseYarnBerry(content) {
+  const doc = parseYaml(content) || {};
+  const components = [];
+
+  for (const [key, info] of Object.entries(doc)) {
+    if (key === '__metadata' || !info || typeof info !== 'object') continue;
+    if (!info.version) continue;
+
+    const resolution = typeof info.resolution === 'string' ? info.resolution : '';
+    const name = packageNameFromDescriptor(resolution || String(key).split(',')[0].trim());
+    if (!name) continue;
+
+    components.push(normalizeComponent({
+      name,
+      version: info.version,
+      // Berry's `checksum` is a cache key, not an npm SRI hash, so we omit it.
+      integrity: null,
+      path: `node_modules/${name}`,
+    }));
+  }
+  return components;
+}
+
+// --- pnpm ------------------------------------------------------------------
+
+/** pnpm: `pnpm-lock.yaml` (lockfileVersion 5.x / 6.x / 9.x). */
+function parsePnpmLock(lockPath, lockfileName, root) {
+  const doc = parseYaml(fs.readFileSync(lockPath, 'utf8')) || {};
+  const packages = doc.packages && typeof doc.packages === 'object' ? doc.packages : {};
+  const components = [];
+
+  for (const [key, info] of Object.entries(packages)) {
+    const parsed = packageKeyToNameVersion(key);
+    if (!parsed) continue;
+    const resolution = info && typeof info === 'object' ? info.resolution : null;
+    const integrity = resolution && typeof resolution === 'object' ? resolution.integrity || null : null;
+    components.push(normalizeComponent({
+      name: parsed.name,
+      version: parsed.version,
+      integrity,
+      path: `node_modules/${parsed.name}`,
+    }));
+  }
+
+  return {
+    ok: true,
+    manager: 'pnpm',
+    lockfileName,
+    lockfileVersion: doc.lockfileVersion || null,
+    root,
+    components: dedupe(components),
+  };
+}
+
+/**
+ * Extracts a package name from a Yarn/pnpm descriptor or resolution string,
+ * e.g. `lodash@^4.17.21`, `@babel/core@npm:7.0.0`, `left-pad@1.3.0`.
+ */
+function packageNameFromDescriptor(descriptor) {
+  if (!descriptor) return null;
+  let d = stripQuotes(String(descriptor).trim());
+  // Drop a protocol/range part: take everything before the version separator.
+  const scoped = d.startsWith('@');
+  const at = d.indexOf('@', scoped ? 1 : 0);
+  return at === -1 ? d : d.slice(0, at);
+}
+
+/**
+ * Splits a pnpm package map key into { name, version }. Handles the historical
+ * variants: `/lodash/4.17.21`, `/lodash@4.17.21`, `lodash@4.17.21` and peer
+ * suffixes like `@babel/core@7.0.0(react@18.0.0)`.
+ */
+function packageKeyToNameVersion(key) {
+  let k = stripQuotes(String(key).trim());
+  if (!k) return null;
+  // Strip peer-dependency suffix: name@version(peer@x)(...).
+  const peerIdx = k.indexOf('(');
+  if (peerIdx !== -1) k = k.slice(0, peerIdx);
+
+  if (k.startsWith('/')) {
+    k = k.slice(1);
+    // v5 uses `/` as separator: name/version (scoped: @scope/name/version).
+    if (!k.includes('@', k.startsWith('@') ? 1 : 0) && k.includes('/')) {
+      const idx = k.lastIndexOf('/');
+      return { name: k.slice(0, idx), version: k.slice(idx + 1) };
+    }
+  }
+
+  const scoped = k.startsWith('@');
+  const at = k.lastIndexOf('@');
+  if (at <= 0) return null;
+  if (scoped && at === 0) return null;
+  const name = k.slice(0, at);
+  const version = k.slice(at + 1);
+  if (!name || !version) return null;
+  return { name, version };
+}
+
+function stripQuotes(value) {
+  if (typeof value !== 'string') return value;
+  const t = value.trim();
+  if (t.length >= 2 && ((t[0] === '"' && t[t.length - 1] === '"') || (t[0] === "'" && t[t.length - 1] === "'"))) {
+    return t.slice(1, -1);
+  }
+  return t;
+}
+
 function normalizeComponent(raw) {
   const { algorithm, hash } = parseIntegrity(raw.integrity);
   return {
@@ -138,8 +330,8 @@ function normalizeComponent(raw) {
     hashValue: hash,
     license: raw.license || null,
     scope: raw.dev ? 'optional' : 'required',
-    dev: raw.dev,
-    optional: raw.optional,
+    dev: Boolean(raw.dev),
+    optional: Boolean(raw.optional),
     path: raw.path,
   };
 }
@@ -195,4 +387,53 @@ function dedupe(components) {
   );
 }
 
-module.exports = { parseLockfile, buildPurl, parseIntegrity };
+/**
+ * Builds a synthetic npm `package-lock.json` (v3) and matching `package.json`
+ * from a parsed lockfile, so that `npm audit --package-lock-only` can scan a
+ * Yarn/pnpm project without an npm lockfile. The exact versions resolved by
+ * Yarn/pnpm are preserved; duplicate versions of a package are nested so each
+ * is present in the tree the auditor inspects.
+ *
+ * @param {{ root: {name:string, version:string}, components: Array<object> }} parsed
+ * @returns {{ packageJson: object, packageLock: object }}
+ */
+function toNpmLockfile(parsed) {
+  const packages = { '': { name: parsed.root.name, version: parsed.root.version } };
+  const rootDeps = {};
+  const placed = new Map();
+
+  for (const c of parsed.components) {
+    if (!c.name || !c.version) continue;
+    const count = placed.get(c.name) || 0;
+    placed.set(c.name, count + 1);
+
+    let key;
+    if (count === 0) {
+      key = `node_modules/${c.name}`;
+      rootDeps[c.name] = c.version;
+    } else {
+      key = `node_modules/${c.name}` + `/node_modules/${c.name}`.repeat(count);
+    }
+
+    const entry = { version: c.version };
+    if (c.resolved) entry.resolved = c.resolved;
+    if (c.integrity) entry.integrity = c.integrity;
+    if (c.license) entry.license = c.license;
+    packages[key] = entry;
+  }
+
+  packages[''].dependencies = rootDeps;
+
+  return {
+    packageJson: { name: parsed.root.name, version: parsed.root.version, dependencies: rootDeps },
+    packageLock: {
+      name: parsed.root.name,
+      version: parsed.root.version,
+      lockfileVersion: 3,
+      requires: true,
+      packages,
+    },
+  };
+}
+
+module.exports = { parseLockfile, buildPurl, parseIntegrity, toNpmLockfile };

package/src/core/policy.js

@@ -44,7 +44,7 @@ function loadPolicy(projectRoot, explicitPath) {
       ? explicitPath
       : path.join(projectRoot, explicitPath);
     if (!exists(configPath)) {
-      throw new Error(`No se encontró el archivo de configuración: ${explicitPath}`);
+      throw new Error(`Configuration file not found: ${explicitPath}`);
     }
   } else {
     for (const name of CONFIG_FILENAMES) {

package/src/core/sbom-generator.js

@@ -24,7 +24,7 @@ function generateSbom(projectRoot, { format = 'cyclonedx' } = {}) {
   } else if (normalizedFormat === 'cyclonedx' || normalizedFormat === 'cdx') {
     document = buildCycloneDx(parsed);
   } else {
-    return { ok: false, error: `Formato de SBOM no soportado: "${format}". Usa "cyclonedx" o "spdx".` };
+    return { ok: false, error: `Unsupported SBOM format: "${format}". Use "cyclonedx" or "spdx".` };
   }
 
   return {

package/src/core/sbom-validator.js

@@ -14,7 +14,7 @@
  */
 function validateSbom(document) {
   if (!document || typeof document !== 'object') {
-    return invalid('El SBOM no es un objeto JSON válido.');
+    return invalid('The SBOM is not a valid JSON object.');
   }
 
   if (document.bomFormat === 'CycloneDX' || document.specVersion) {
@@ -24,38 +24,38 @@ function validateSbom(document) {
     return validateSpdx(document);
   }
 
-  return invalid('Formato de SBOM no reconocido (no es CycloneDX ni SPDX).');
+  return invalid('Unrecognized SBOM format (neither CycloneDX nor SPDX).');
 }
 
 function validateCycloneDx(doc) {
   const issues = [];
   const checks = [];
 
-  pushCheck(checks, 'format', 'Formato declarado (CycloneDX)', doc.bomFormat === 'CycloneDX');
-  pushCheck(checks, 'specVersion', 'Versión de especificación presente', Boolean(doc.specVersion));
-  pushCheck(checks, 'serialNumber', 'Identificador único del documento (serialNumber)', Boolean(doc.serialNumber));
-  pushCheck(checks, 'timestamp', 'Marca temporal de creación', Boolean(doc.metadata && doc.metadata.timestamp));
-  pushCheck(checks, 'author', 'Autor / herramienta generadora declarada',
+  pushCheck(checks, 'format', 'Format declared (CycloneDX)', doc.bomFormat === 'CycloneDX');
+  pushCheck(checks, 'specVersion', 'Specification version present', Boolean(doc.specVersion));
+  pushCheck(checks, 'serialNumber', 'Unique document identifier (serialNumber)', Boolean(doc.serialNumber));
+  pushCheck(checks, 'timestamp', 'Creation timestamp', Boolean(doc.metadata && doc.metadata.timestamp));
+  pushCheck(checks, 'author', 'Author / generating tool declared',
     Boolean(doc.metadata && (doc.metadata.tools || doc.metadata.authors)));
-  pushCheck(checks, 'rootComponent', 'Componente raíz (producto) identificado',
+  pushCheck(checks, 'rootComponent', 'Root component (product) identified',
     Boolean(doc.metadata && doc.metadata.component && doc.metadata.component.name));
 
   const components = Array.isArray(doc.components) ? doc.components : [];
-  pushCheck(checks, 'components', 'Contiene al menos un componente', components.length > 0);
+  pushCheck(checks, 'components', 'Contains at least one component', components.length > 0);
 
   const stats = { total: components.length, missingVersion: 0, missingHash: 0, missingLicense: 0, missingPurl: 0 };
   for (const comp of components) {
-    const label = comp.name || comp['bom-ref'] || 'desconocido';
-    if (!comp.version) { stats.missingVersion++; issues.push(`Componente sin versión: ${label}`); }
-    if (!hasCdxHash(comp)) { stats.missingHash++; issues.push(`Componente sin hash criptográfico: ${label}`); }
-    if (!hasCdxLicense(comp)) { stats.missingLicense++; issues.push(`Componente sin licencia: ${label}`); }
-    if (!comp.purl && !comp['bom-ref']) { stats.missingPurl++; issues.push(`Componente sin identificador único (purl): ${label}`); }
+    const label = comp.name || comp['bom-ref'] || 'unknown';
+    if (!comp.version) { stats.missingVersion++; issues.push(`Component without a version: ${label}`); }
+    if (!hasCdxHash(comp)) { stats.missingHash++; issues.push(`Component without a cryptographic hash: ${label}`); }
+    if (!hasCdxLicense(comp)) { stats.missingLicense++; issues.push(`Component without a license: ${label}`); }
+    if (!comp.purl && !comp['bom-ref']) { stats.missingPurl++; issues.push(`Component without a unique identifier (purl): ${label}`); }
   }
 
-  pushCheck(checks, 'componentVersions', 'Todos los componentes tienen versión', stats.missingVersion === 0);
-  pushCheck(checks, 'componentHashes', 'Todos los componentes tienen hash criptográfico', stats.missingHash === 0);
-  pushCheck(checks, 'componentLicenses', 'Todos los componentes tienen licencia', stats.missingLicense === 0);
-  pushCheck(checks, 'componentIdentifiers', 'Todos los componentes tienen identificador único', stats.missingPurl === 0);
+  pushCheck(checks, 'componentVersions', 'All components have a version', stats.missingVersion === 0);
+  pushCheck(checks, 'componentHashes', 'All components have a cryptographic hash', stats.missingHash === 0);
+  pushCheck(checks, 'componentLicenses', 'All components have a license', stats.missingLicense === 0);
+  pushCheck(checks, 'componentIdentifiers', 'All components have a unique identifier', stats.missingPurl === 0);
 
   return summarize('cyclonedx', checks, issues, stats);
 }
@@ -64,30 +64,30 @@ function validateSpdx(doc) {
   const issues = [];
   const checks = [];
 
-  pushCheck(checks, 'format', 'Formato declarado (SPDX)', Boolean(doc.spdxVersion));
-  pushCheck(checks, 'dataLicense', 'Licencia de los datos declarada', Boolean(doc.dataLicense));
-  pushCheck(checks, 'serialNumber', 'Namespace único del documento', Boolean(doc.documentNamespace));
-  pushCheck(checks, 'timestamp', 'Marca temporal de creación', Boolean(doc.creationInfo && doc.creationInfo.created));
-  pushCheck(checks, 'author', 'Autor / creador declarado',
+  pushCheck(checks, 'format', 'Format declared (SPDX)', Boolean(doc.spdxVersion));
+  pushCheck(checks, 'dataLicense', 'Data license declared', Boolean(doc.dataLicense));
+  pushCheck(checks, 'serialNumber', 'Unique document namespace', Boolean(doc.documentNamespace));
+  pushCheck(checks, 'timestamp', 'Creation timestamp', Boolean(doc.creationInfo && doc.creationInfo.created));
+  pushCheck(checks, 'author', 'Author / creator declared',
     Boolean(doc.creationInfo && Array.isArray(doc.creationInfo.creators) && doc.creationInfo.creators.length));
 
   const packages = Array.isArray(doc.packages) ? doc.packages : [];
-  pushCheck(checks, 'components', 'Contiene al menos un paquete', packages.length > 0);
+  pushCheck(checks, 'components', 'Contains at least one package', packages.length > 0);
 
   const stats = { total: packages.length, missingVersion: 0, missingHash: 0, missingLicense: 0, missingPurl: 0 };
   for (const pkg of packages) {
-    const label = pkg.name || pkg.SPDXID || 'desconocido';
+    const label = pkg.name || pkg.SPDXID || 'unknown';
     if (pkg.SPDXID === 'SPDXRef-Package-root') continue;
-    if (!pkg.versionInfo || pkg.versionInfo === 'NOASSERTION') { stats.missingVersion++; issues.push(`Paquete sin versión: ${label}`); }
-    if (!Array.isArray(pkg.checksums) || pkg.checksums.length === 0) { stats.missingHash++; issues.push(`Paquete sin checksum: ${label}`); }
-    if (!pkg.licenseConcluded || pkg.licenseConcluded === 'NOASSERTION') { stats.missingLicense++; issues.push(`Paquete sin licencia: ${label}`); }
-    if (!Array.isArray(pkg.externalRefs) || !pkg.externalRefs.some((r) => r.referenceType === 'purl')) { stats.missingPurl++; issues.push(`Paquete sin purl: ${label}`); }
+    if (!pkg.versionInfo || pkg.versionInfo === 'NOASSERTION') { stats.missingVersion++; issues.push(`Package without a version: ${label}`); }
+    if (!Array.isArray(pkg.checksums) || pkg.checksums.length === 0) { stats.missingHash++; issues.push(`Package without a checksum: ${label}`); }
+    if (!pkg.licenseConcluded || pkg.licenseConcluded === 'NOASSERTION') { stats.missingLicense++; issues.push(`Package without a license: ${label}`); }
+    if (!Array.isArray(pkg.externalRefs) || !pkg.externalRefs.some((r) => r.referenceType === 'purl')) { stats.missingPurl++; issues.push(`Package without a purl: ${label}`); }
   }
 
-  pushCheck(checks, 'componentVersions', 'Todos los paquetes tienen versión', stats.missingVersion === 0);
-  pushCheck(checks, 'componentHashes', 'Todos los paquetes tienen checksum', stats.missingHash === 0);
-  pushCheck(checks, 'componentLicenses', 'Todos los paquetes tienen licencia', stats.missingLicense === 0);
-  pushCheck(checks, 'componentIdentifiers', 'Todos los paquetes tienen purl', stats.missingPurl === 0);
+  pushCheck(checks, 'componentVersions', 'All packages have a version', stats.missingVersion === 0);
+  pushCheck(checks, 'componentHashes', 'All packages have a checksum', stats.missingHash === 0);
+  pushCheck(checks, 'componentLicenses', 'All packages have a license', stats.missingLicense === 0);
+  pushCheck(checks, 'componentIdentifiers', 'All packages have a purl', stats.missingPurl === 0);
 
   return summarize('spdx', checks, issues, stats);
 }

package/src/core/vuln-scanner.js

@@ -1,6 +1,11 @@
 'use strict';
 
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
 const { runJson } = require('../utils/exec');
+const { exists } = require('../utils/fs');
+const { parseLockfile, toNpmLockfile } = require('./lockfile-parser');
 
 const SEVERITY_ORDER = ['info', 'low', 'moderate', 'high', 'critical'];
 
@@ -9,22 +14,47 @@ const SEVERITY_ORDER = ['info', 'low', 'moderate', 'high', 'critical'];
  * `npm audit --json`. The CRA requires products to ship "without known
  * exploitable vulnerabilities", so this is the core gate of the audit.
  *
+ * npm projects are audited in place. Yarn/pnpm projects (which have no npm
+ * lockfile) are audited against a synthetic `package-lock.json` generated from
+ * their lockfile, preserving the exact installed versions.
+ *
  * @param {string} projectRoot
  * @param {{ production?: boolean }} [options]
  */
 function scanVulnerabilities(projectRoot, { production = false } = {}) {
+  if (hasNpmLockfile(projectRoot)) {
+    return runNpmAudit(projectRoot, { production });
+  }
+
+  const parsed = parseLockfile(projectRoot);
+  if (parsed.ok && parsed.components.length > 0) {
+    return auditSynthesized(parsed, { production });
+  }
+
+  // No usable lockfile: run npm audit in place so the user gets npm's own error.
+  return runNpmAudit(projectRoot, { production });
+}
+
+function hasNpmLockfile(projectRoot) {
+  return exists(path.join(projectRoot, 'package-lock.json')) ||
+    exists(path.join(projectRoot, 'npm-shrinkwrap.json'));
+}
+
+/** Runs `npm audit --json` in the given directory. */
+function runNpmAudit(cwd, { production = false, packageLockOnly = false } = {}) {
   const args = ['audit', '--json'];
   if (production) args.push('--omit=dev');
+  if (packageLockOnly) args.push('--package-lock-only');
 
-  const result = runJson('npm', args, { cwd: projectRoot });
+  const result = runJson('npm', args, { cwd });
 
   if (!result.data) {
     return {
       ok: false,
       error:
-        'No se pudo ejecutar `npm audit`. Asegúrate de tener npm instalado y un ' +
-        'package-lock.json presente. ' +
-        (result.stderr ? `Detalle: ${result.stderr.trim()}` : ''),
+        'Could not run `npm audit`. Make sure npm is installed and a ' +
+        'lockfile is present. ' +
+        (result.stderr ? `Detail: ${result.stderr.trim()}` : ''),
       counts: emptyCounts(),
       vulnerabilities: [],
     };
@@ -46,6 +76,32 @@ function scanVulnerabilities(projectRoot, { production = false } = {}) {
   };
 }
 
+/**
+ * Audits a Yarn/pnpm project by materializing a synthetic npm lockfile in a
+ * temporary directory and running `npm audit --package-lock-only` there.
+ */
+function auditSynthesized(parsed, { production = false } = {}) {
+  const { packageJson, packageLock } = toNpmLockfile(parsed);
+  let tmpDir;
+  try {
+    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'cra-audit-'));
+    fs.writeFileSync(path.join(tmpDir, 'package.json'), JSON.stringify(packageJson, null, 2));
+    fs.writeFileSync(path.join(tmpDir, 'package-lock.json'), JSON.stringify(packageLock, null, 2));
+    return runNpmAudit(tmpDir, { production, packageLockOnly: true });
+  } catch (err) {
+    return {
+      ok: false,
+      error: `Could not analyze vulnerabilities from lockfile ${parsed.lockfileName || ''}: ${err.message}`.trim(),
+      counts: emptyCounts(),
+      vulnerabilities: [],
+    };
+  } finally {
+    if (tmpDir) {
+      try { fs.rmSync(tmpDir, { recursive: true, force: true }); } catch { /* best effort */ }
+    }
+  }
+}
+
 function parseModernReport(data) {
   const counts = emptyCounts();
   const vulnerabilities = [];
@@ -63,14 +119,14 @@ function parseModernReport(data) {
     const advisories = via.filter((v) => typeof v === 'object');
     const sources = advisories.length
       ? advisories.map((adv) => ({
-          title: adv.title || 'Vulnerabilidad conocida',
+          title: adv.title || 'Known vulnerability',
           url: adv.url || null,
           cwe: adv.cwe || [],
           cvss: adv.cvss ? adv.cvss.score : null,
           source: adv.source || null,
           range: adv.range || null,
         }))
-      : [{ title: `Dependencia vulnerable a través de ${via.join(', ')}`, url: null, cwe: [], cvss: null }];
+      : [{ title: `Dependency vulnerable through ${via.join(', ')}`, url: null, cwe: [], cvss: null }];
 
     vulnerabilities.push({
       name,