cra-audit 0.1.0

package/src/core/vuln-scanner.js

@@ -0,0 +1,148 @@
+'use strict';
+
+const { runJson } = require('../utils/exec');
+
+const SEVERITY_ORDER = ['info', 'low', 'moderate', 'high', 'critical'];
+
+/**
+ * Scans direct and transitive dependencies for known vulnerabilities using
+ * `npm audit --json`. The CRA requires products to ship "without known
+ * exploitable vulnerabilities", so this is the core gate of the audit.
+ *
+ * @param {string} projectRoot
+ * @param {{ production?: boolean }} [options]
+ */
+function scanVulnerabilities(projectRoot, { production = false } = {}) {
+  const args = ['audit', '--json'];
+  if (production) args.push('--omit=dev');
+
+  const result = runJson('npm', args, { cwd: projectRoot });
+
+  if (!result.data) {
+    return {
+      ok: false,
+      error:
+        'No se pudo ejecutar `npm audit`. Asegúrate de tener npm instalado y un ' +
+        'package-lock.json presente. ' +
+        (result.stderr ? `Detalle: ${result.stderr.trim()}` : ''),
+      counts: emptyCounts(),
+      vulnerabilities: [],
+    };
+  }
+
+  // npm v7+ returns the modern audit report shape.
+  if (result.data.vulnerabilities || result.data.metadata) {
+    return parseModernReport(result.data);
+  }
+  // npm v6 (legacy) shape.
+  if (result.data.advisories) {
+    return parseLegacyReport(result.data);
+  }
+
+  return {
+    ok: true,
+    counts: emptyCounts(),
+    vulnerabilities: [],
+  };
+}
+
+function parseModernReport(data) {
+  const counts = emptyCounts();
+  const vulnerabilities = [];
+
+  const meta = data.metadata && data.metadata.vulnerabilities;
+  if (meta) {
+    for (const sev of SEVERITY_ORDER) {
+      if (typeof meta[sev] === 'number') counts[sev] = meta[sev];
+    }
+    counts.total = meta.total || sumCounts(counts);
+  }
+
+  for (const [name, info] of Object.entries(data.vulnerabilities || {})) {
+    const via = Array.isArray(info.via) ? info.via : [];
+    const advisories = via.filter((v) => typeof v === 'object');
+    const sources = advisories.length
+      ? advisories.map((adv) => ({
+          title: adv.title || 'Vulnerabilidad conocida',
+          url: adv.url || null,
+          cwe: adv.cwe || [],
+          cvss: adv.cvss ? adv.cvss.score : null,
+          source: adv.source || null,
+          range: adv.range || null,
+        }))
+      : [{ title: `Dependencia vulnerable a través de ${via.join(', ')}`, url: null, cwe: [], cvss: null }];
+
+    vulnerabilities.push({
+      name,
+      severity: info.severity || 'unknown',
+      direct: Boolean(info.isDirect),
+      range: info.range || null,
+      fixAvailable: normalizeFix(info.fixAvailable),
+      sources,
+    });
+  }
+
+  if (!meta) {
+    for (const v of vulnerabilities) {
+      if (counts[v.severity] !== undefined) counts[v.severity]++;
+    }
+    counts.total = sumCounts(counts);
+  }
+
+  return { ok: true, counts, vulnerabilities: sortBySeverity(vulnerabilities) };
+}
+
+function parseLegacyReport(data) {
+  const counts = emptyCounts();
+  const vulnerabilities = [];
+
+  for (const adv of Object.values(data.advisories)) {
+    const severity = adv.severity || 'unknown';
+    if (counts[severity] !== undefined) counts[severity]++;
+    vulnerabilities.push({
+      name: adv.module_name,
+      severity,
+      direct: false,
+      range: adv.vulnerable_versions || null,
+      fixAvailable: Boolean(adv.patched_versions && adv.patched_versions !== '<0.0.0'),
+      sources: [{
+        title: adv.title,
+        url: adv.url || null,
+        cwe: adv.cwe ? [adv.cwe] : [],
+        cvss: adv.cvss_score || null,
+      }],
+    });
+  }
+  counts.total = sumCounts(counts);
+  return { ok: true, counts, vulnerabilities: sortBySeverity(vulnerabilities) };
+}
+
+function normalizeFix(fixAvailable) {
+  if (fixAvailable === true) return true;
+  if (fixAvailable === false || fixAvailable === undefined) return false;
+  if (typeof fixAvailable === 'object') {
+    return {
+      name: fixAvailable.name,
+      version: fixAvailable.version,
+      breaking: Boolean(fixAvailable.isSemVerMajor),
+    };
+  }
+  return false;
+}
+
+function emptyCounts() {
+  return { info: 0, low: 0, moderate: 0, high: 0, critical: 0, total: 0 };
+}
+
+function sumCounts(counts) {
+  return SEVERITY_ORDER.reduce((acc, sev) => acc + (counts[sev] || 0), 0);
+}
+
+function sortBySeverity(list) {
+  return list.sort(
+    (a, b) => SEVERITY_ORDER.indexOf(b.severity) - SEVERITY_ORDER.indexOf(a.severity) ||
+      a.name.localeCompare(b.name)
+  );
+}
+
+module.exports = { scanVulnerabilities, SEVERITY_ORDER };

package/src/index.js

@@ -0,0 +1,33 @@
+'use strict';
+
+/**
+ * Programmatic API for cra-audit.
+ *
+ * Example:
+ *   const { runAudit, loadPolicy } = require('cra-audit');
+ *   const { policy, source } = loadPolicy(process.cwd());
+ *   const report = runAudit(process.cwd(), policy, source);
+ */
+
+const { runAudit } = require('./core/auditor');
+const { loadPolicy, DEFAULT_POLICY } = require('./core/policy');
+const { generateSbom } = require('./core/sbom-generator');
+const { validateSbom } = require('./core/sbom-validator');
+const { scanVulnerabilities } = require('./core/vuln-scanner');
+const { checkLicenses } = require('./core/license-checker');
+const { parseLockfile } = require('./core/lockfile-parser');
+const { enrichComponents } = require('./core/enrich');
+const { buildHtml } = require('./reporters/html');
+
+module.exports = {
+  runAudit,
+  loadPolicy,
+  DEFAULT_POLICY,
+  generateSbom,
+  validateSbom,
+  scanVulnerabilities,
+  checkLicenses,
+  parseLockfile,
+  enrichComponents,
+  buildHtml,
+};

package/src/reporters/console.js

@@ -0,0 +1,137 @@
+'use strict';
+
+const { logger, color } = require('../utils/logger');
+
+const SEVERITY_COLORS = {
+  critical: color.red,
+  high: color.red,
+  moderate: color.yellow,
+  low: color.yellow,
+  info: color.gray,
+  unknown: color.gray,
+};
+
+/**
+ * Renders a full audit report to the terminal.
+ * @param {import('../core/auditor').AuditResult} report
+ */
+function reportConsole(report) {
+  logger.heading('  CRA Audit — Cyber Resilience Act (UE 2024/2847) · BSI TR-03183');
+  logger.detail(`Proyecto: ${report.project.name}@${report.project.version}`);
+  if (report.policySource) {
+    logger.detail(`Política: ${report.policySource}`);
+  }
+
+  if (report.sections.vulnerabilities) renderVulnerabilities(report.sections.vulnerabilities);
+  if (report.sections.sbom) renderSbom(report.sections.sbom);
+  if (report.sections.licenses) renderLicenses(report.sections.licenses);
+
+  renderSummary(report);
+}
+
+function renderVulnerabilities(section) {
+  logger.heading('1) Vulnerabilidades conocidas (Art. 13 CRA)');
+  if (!section.ok) {
+    logger.error(section.error);
+    return;
+  }
+
+  const c = section.counts;
+  if (c.total === 0) {
+    logger.success('Sin vulnerabilidades conocidas. Cumple el requisito de "cero vulnerabilidades explotables".');
+    return;
+  }
+
+  logger.log(
+    `  ${color.red(`${c.critical} críticas`)} · ${color.red(`${c.high} altas`)} · ` +
+    `${color.yellow(`${c.moderate} moderadas`)} · ${color.yellow(`${c.low} bajas`)} · ${color.gray(`${c.info} info`)}`
+  );
+
+  const top = section.vulnerabilities.slice(0, 15);
+  for (const vuln of top) {
+    const sev = (SEVERITY_COLORS[vuln.severity] || color.gray)(vuln.severity.toUpperCase().padEnd(8));
+    const fix = describeFix(vuln.fixAvailable);
+    logger.log(`  ${sev} ${color.bold(vuln.name)} ${color.gray(vuln.range || '')} ${fix}`);
+    const adv = vuln.sources[0];
+    if (adv && adv.title) logger.detail(`${adv.title}${adv.url ? ' — ' + adv.url : ''}`);
+  }
+  if (section.vulnerabilities.length > top.length) {
+    logger.detail(`… y ${section.vulnerabilities.length - top.length} más.`);
+  }
+}
+
+function describeFix(fix) {
+  if (fix === true) return color.green('(fix disponible)');
+  if (fix && typeof fix === 'object') {
+    return color.green(`(fix: ${fix.name}@${fix.version}${fix.breaking ? ', breaking' : ''})`);
+  }
+  return color.gray('(sin fix)');
+}
+
+function renderSbom(section) {
+  logger.heading('2) Lista de Materiales de Software · SBOM (Anexo I CRA)');
+  if (!section.ok) {
+    logger.error(section.error);
+    return;
+  }
+  logger.detail(`Formato: ${section.format} · Componentes: ${section.componentCount}`);
+
+  if (section.validation) {
+    const v = section.validation;
+    for (const check of v.checks) {
+      const mark = check.passed ? color.green('✔') : color.red('✖');
+      logger.log(`  ${mark} ${check.label}`);
+    }
+    if (v.valid) {
+      logger.success('El SBOM cumple los elementos mínimos de TR-03183 §6.');
+    } else {
+      logger.warn(`El SBOM no cumple ${v.failedChecks.length} requisito(s) mínimo(s).`);
+    }
+  }
+  if (section.outputPath) {
+    logger.detail(`SBOM escrito en: ${section.outputPath}`);
+  }
+}
+
+function renderLicenses(section) {
+  logger.heading('3) Licencias de componentes de terceros (TR-03183 §6)');
+  if (!section.ok) {
+    logger.error(section.error);
+    return;
+  }
+  const s = section.summary;
+  logger.detail(`Documentadas: ${s.documented}/${s.total}`);
+
+  if (s.missing.length) {
+    logger.warn(`${s.missing.length} componente(s) sin licencia documentada:`);
+    for (const c of s.missing.slice(0, 10)) logger.log(`    ${color.gray('•')} ${c.name}@${c.version}`);
+  }
+  if (s.denied.length) {
+    logger.error(`${s.denied.length} componente(s) con licencia prohibida por la política:`);
+    for (const c of s.denied) logger.log(`    ${color.red('•')} ${c.name}@${c.version} (${c.license})`);
+  }
+  if (s.notAllowed.length) {
+    logger.warn(`${s.notAllowed.length} componente(s) con licencia fuera de la allowlist:`);
+    for (const c of s.notAllowed.slice(0, 10)) logger.log(`    ${color.yellow('•')} ${c.name}@${c.version} (${c.license})`);
+  }
+  if (!s.missing.length && !s.denied.length && !s.notAllowed.length) {
+    logger.success('Todas las licencias están documentadas y permitidas.');
+  }
+}
+
+function renderSummary(report) {
+  logger.heading('Resultado');
+  for (const item of report.gate.reasons) {
+    const mark = item.passed ? color.green('✔') : color.red('✖');
+    logger.log(`  ${mark} ${item.label}`);
+  }
+  logger.log('');
+  if (report.gate.passed) {
+    logger.success(color.bold('AUDITORÍA SUPERADA — el proyecto cumple la política CRA configurada.'));
+  } else {
+    logger.error(color.bold('AUDITORÍA FALLIDA — se han detectado incumplimientos del CRA.'));
+  }
+  logger.log('');
+}
+
+module.exports = { reportConsole };

package/src/reporters/html.js

@@ -0,0 +1,267 @@
+'use strict';
+
+/**
+ * Builds a self-contained, dependency-free HTML report. All data is embedded
+ * as JSON and rendered client-side with vanilla JS (no external CDNs, so it
+ * works offline and adds no third-party script supply-chain risk).
+ */
+
+/**
+ * @param {object} model The view model produced by the visualize command.
+ * @returns {string} Full HTML document.
+ */
+function buildHtml(model) {
+  const json = safeJson(model);
+  return `<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>CRA Audit — ${escapeHtml(model.project.name)}@${escapeHtml(model.project.version)}</title>
+<style>${CSS}</style>
+</head>
+<body>
+<header class="hdr">
+  <div>
+    <h1>CRA Audit</h1>
+    <p class="sub">Cyber Resilience Act (EU 2024/2847) · BSI TR-03183</p>
+  </div>
+  <div class="proj">
+    <span class="proj-name">${escapeHtml(model.project.name)}</span>
+    <span class="proj-ver">v${escapeHtml(model.project.version)}</span>
+    <span class="ts">${escapeHtml(model.generatedAt)}</span>
+  </div>
+</header>
+
+<section class="cards" id="cards"></section>
+
+<section class="panel">
+  <div class="toolbar">
+    <input id="search" type="search" placeholder="Filter by name, license or status…" autocomplete="off">
+    <div class="filters" id="filters"></div>
+  </div>
+  <div class="table-wrap">
+    <table id="grid">
+      <thead>
+        <tr>
+          <th data-sort="name">Package</th>
+          <th data-sort="version">Version</th>
+          <th data-sort="latest">Latest</th>
+          <th data-sort="license">License</th>
+          <th data-sort="severity">Vulnerability</th>
+          <th data-sort="lastActivity">Last activity</th>
+          <th data-sort="maintainers">Maint.</th>
+          <th data-sort="contributors">Contrib.</th>
+          <th data-sort="maintenanceScore">Maintenance</th>
+          <th>Repo</th>
+        </tr>
+      </thead>
+      <tbody id="rows"></tbody>
+    </table>
+  </div>
+  <p class="empty" id="empty" hidden>No results for the current filter.</p>
+</section>
+
+<footer class="ftr">
+  Generated by <strong>cra-audit</strong> · Technical support tool; not legal advice.
+</footer>
+
+<script id="data" type="application/json">${json}</script>
+<script>${SCRIPT}</script>
+</body>
+</html>`;
+}
+
+/** Escapes a string for safe insertion into HTML text/attributes. */
+function escapeHtml(value) {
+  return String(value == null ? '' : value)
+    .replace(/&/g, '&amp;')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;')
+    .replace(/'/g, '&#39;');
+}
+
+/** Serializes JSON safely for embedding inside a <script> element. */
+function safeJson(data) {
+  return JSON.stringify(data)
+    .replace(/</g, '\\u003c')
+    .replace(/>/g, '\\u003e')
+    .replace(/&/g, '\\u0026')
+    .replace(/\u2028/g, '\\u2028')
+    .replace(/\u2029/g, '\\u2029');
+}
+
+const CSS = `
+:root{--bg:#0f1117;--panel:#171a23;--panel2:#1d2130;--line:#2a2f3e;--txt:#e6e8ee;--mut:#9aa3b2;
+--ok:#3fb950;--warn:#d29922;--bad:#f85149;--info:#58a6ff;--accent:#7c8cff}
+*{box-sizing:border-box}
+body{margin:0;background:var(--bg);color:var(--txt);font:14px/1.5 system-ui,Segoe UI,Roboto,Helvetica,Arial,sans-serif}
+a{color:var(--info);text-decoration:none}a:hover{text-decoration:underline}
+.hdr{display:flex;justify-content:space-between;align-items:center;padding:20px 28px;border-bottom:1px solid var(--line);background:linear-gradient(180deg,#141821,#0f1117)}
+.hdr h1{margin:0;font-size:20px;letter-spacing:.3px}
+.sub{margin:2px 0 0;color:var(--mut);font-size:12px}
+.proj{text-align:right;display:flex;flex-direction:column;gap:2px}
+.proj-name{font-weight:600}.proj-ver{color:var(--accent);font-size:12px}.ts{color:var(--mut);font-size:11px}
+.cards{display:grid;grid-template-columns:repeat(auto-fit,minmax(170px,1fr));gap:14px;padding:22px 28px}
+.card{background:var(--panel);border:1px solid var(--line);border-radius:12px;padding:16px}
+.card .k{color:var(--mut);font-size:12px;text-transform:uppercase;letter-spacing:.5px}
+.card .v{font-size:26px;font-weight:700;margin-top:6px}
+.card.ok .v{color:var(--ok)}.card.warn .v{color:var(--warn)}.card.bad .v{color:var(--bad)}.card.info .v{color:var(--info)}
+.card .d{color:var(--mut);font-size:12px;margin-top:4px}
+.panel{margin:0 28px 28px;background:var(--panel);border:1px solid var(--line);border-radius:12px;overflow:hidden}
+.toolbar{display:flex;gap:14px;align-items:center;flex-wrap:wrap;padding:14px 16px;border-bottom:1px solid var(--line)}
+#search{flex:1;min-width:220px;background:var(--panel2);border:1px solid var(--line);color:var(--txt);
+border-radius:8px;padding:9px 12px;font-size:13px}
+.filters{display:flex;gap:8px;flex-wrap:wrap}
+.chip{background:var(--panel2);border:1px solid var(--line);color:var(--mut);border-radius:999px;
+padding:6px 12px;font-size:12px;cursor:pointer;user-select:none}
+.chip.active{color:#fff;border-color:var(--accent);background:#262c44}
+.table-wrap{overflow:auto;max-height:70vh}
+table{width:100%;border-collapse:collapse;font-size:13px}
+thead th{position:sticky;top:0;background:var(--panel2);text-align:left;padding:11px 14px;
+border-bottom:1px solid var(--line);cursor:pointer;white-space:nowrap;color:var(--mut);font-weight:600}
+thead th:hover{color:var(--txt)}
+tbody td{padding:10px 14px;border-bottom:1px solid var(--line);white-space:nowrap}
+tbody tr:hover{background:#1b1f2c}
+.pkg{font-weight:600}
+.badge{display:inline-block;padding:2px 9px;border-radius:999px;font-size:11px;font-weight:600;border:1px solid transparent}
+.b-ok{color:var(--ok);background:rgba(63,185,80,.12);border-color:rgba(63,185,80,.3)}
+.b-warn{color:var(--warn);background:rgba(210,153,34,.12);border-color:rgba(210,153,34,.3)}
+.b-bad{color:var(--bad);background:rgba(248,81,73,.12);border-color:rgba(248,81,73,.3)}
+.b-mut{color:var(--mut);background:rgba(154,163,178,.1);border-color:rgba(154,163,178,.25)}
+.b-info{color:var(--info);background:rgba(88,166,255,.12);border-color:rgba(88,166,255,.3)}
+.bar{display:inline-flex;align-items:center;gap:8px}
+.bar .track{width:74px;height:7px;border-radius:4px;background:var(--panel2);overflow:hidden}
+.bar .fill{height:100%}
+.mut{color:var(--mut)}
+.empty{padding:26px;text-align:center;color:var(--mut)}
+.ftr{padding:18px 28px;color:var(--mut);font-size:12px;border-top:1px solid var(--line)}
+`;
+
+const SCRIPT = `
+(function(){
+  var MODEL = JSON.parse(document.getElementById('data').textContent);
+  var rows = MODEL.components.slice();
+  var sortKey = 'maintenanceScore', sortDir = 1, activeFilter = 'all', term = '';
+
+  var SEV_RANK = {critical:5,high:4,moderate:3,low:2,info:1,none:0};
+
+  function fmtDate(d){ if(!d) return '—'; var t=new Date(d); if(isNaN(t)) return '—';
+    return t.toISOString().slice(0,10); }
+  function ago(d){ if(!d) return ''; var days=Math.floor((Date.now()-new Date(d).getTime())/86400000);
+    if(days<0) return ''; if(days<31) return days+'d'; if(days<365) return Math.floor(days/30)+'mo';
+    return Math.floor(days/365)+'y'; }
+  function esc(s){ var e=document.createElement('div'); e.textContent=(s==null?'':s); return e.innerHTML; }
+
+  function sevBadge(r){
+    var s=r.severity||'none';
+    if(s==='none') return '<span class="badge b-ok">clean</span>';
+    var cls = (s==='critical'||s==='high')?'b-bad':(s==='moderate'||s==='low')?'b-warn':'b-mut';
+    return '<span class="badge '+cls+'">'+esc(s)+'</span>';
+  }
+  function licBadge(r){
+    if(!r.license) return '<span class="badge b-bad">no license</span>';
+    var cls = r.licenseStatus==='denied'?'b-bad':r.licenseStatus==='not-allowed'?'b-warn':'b-mut';
+    return '<span class="badge '+cls+'">'+esc(r.license)+'</span>';
+  }
+  function maint(r){
+    if(r.maintenanceScore==null) return '<span class="mut">unknown</span>';
+    var col = r.maintenanceLabel==='well-maintained'?'var(--ok)':r.maintenanceLabel==='moderate'?'var(--warn)':'var(--bad)';
+    return '<span class="bar"><span class="track"><span class="fill" style="width:'+r.maintenanceScore+'%;background:'+col+'"></span></span>'+
+      '<span class="mut">'+r.maintenanceScore+'</span></span>';
+  }
+  function repoCell(r){
+    if(!r.repoUrl) return '<span class="mut">—</span>';
+    var host=r.repoUrl.replace(/^https?:\\/\\//,'').replace(/\\/$/,'');
+    return '<a href="'+esc(r.repoUrl)+'" target="_blank" rel="noopener">'+esc(host.length>26?host.slice(0,26)+'…':host)+'</a>';
+  }
+  function verCell(r){
+    if(!r.latest) return esc(r.version)+' <span class="mut">/ ?</span>';
+    if(r.outdated) return esc(r.version)+' <span class="badge b-warn" title="Latest: '+esc(r.latest)+'">→ '+esc(r.latest)+'</span>';
+    return esc(r.version)+' <span class="badge b-ok">up to date</span>';
+  }
+  function lastActivity(r){
+    var d=r.lastCommit||r.lastPublish;
+    var label=r.lastCommit?'commit':'publish';
+    if(!d) return '<span class="mut">—</span>';
+    return fmtDate(d)+' <span class="mut">('+label+' '+ago(d)+')</span>';
+  }
+
+  function passFilter(r){
+    if(activeFilter==='vuln') return (r.severity&&r.severity!=='none');
+    if(activeFilter==='outdated') return r.outdated;
+    if(activeFilter==='lic') return (!r.license||r.licenseStatus==='denied'||r.licenseStatus==='not-allowed');
+    if(activeFilter==='risk') return r.maintenanceLabel==='at-risk';
+    return true;
+  }
+  function passTerm(r){
+    if(!term) return true;
+    var hay=(r.name+' '+(r.license||'')+' '+(r.maintenanceLabel||'')+' '+(r.severity||'')).toLowerCase();
+    return hay.indexOf(term)>=0;
+  }
+  function sortVal(r){
+    if(sortKey==='severity') return SEV_RANK[r.severity||'none']||0;
+    if(sortKey==='lastActivity') return new Date(r.lastCommit||r.lastPublish||0).getTime();
+    var v=r[sortKey];
+    return (typeof v==='string')?v.toLowerCase():(v==null?-1:v);
+  }
+
+  function render(){
+    var list=rows.filter(function(r){return passFilter(r)&&passTerm(r);});
+    list.sort(function(a,b){var x=sortVal(a),y=sortVal(b);return x<y?-1*sortDir:x>y?1*sortDir:0;});
+    var tb=document.getElementById('rows'); tb.innerHTML='';
+    list.forEach(function(r){
+      var tr=document.createElement('tr');
+      tr.innerHTML='<td class="pkg">'+esc(r.name)+(r.deprecated?' <span class="badge b-bad">deprecated</span>':'')+(r.archived?' <span class="badge b-bad">archived</span>':'')+'</td>'+
+        '<td>'+verCell(r)+'</td>'+
+        '<td class="mut">'+esc(r.latest||'—')+'</td>'+
+        '<td>'+licBadge(r)+'</td>'+
+        '<td>'+sevBadge(r)+'</td>'+
+        '<td>'+lastActivity(r)+'</td>'+
+        '<td class="mut">'+(r.maintainers==null?'—':r.maintainers)+'</td>'+
+        '<td class="mut">'+(r.contributors==null?'—':r.contributors)+'</td>'+
+        '<td>'+maint(r)+'</td>'+
+        '<td>'+repoCell(r)+'</td>';
+      tb.appendChild(tr);
+    });
+    document.getElementById('empty').hidden = list.length>0;
+  }
+
+  function renderCards(){
+    var s=MODEL.summary, c=document.getElementById('cards');
+    function card(cls,k,v,d){return '<div class="card '+cls+'"><div class="k">'+k+'</div><div class="v">'+v+'</div><div class="d">'+(d||'')+'</div></div>';}
+    c.innerHTML =
+      card('info','Components', s.total, 'audited dependencies')+
+      card(s.vulnerable>0?'bad':'ok','Vulnerable', s.vulnerable, s.critical+' critical · '+s.high+' high')+
+      card(s.licenseIssues>0?'warn':'ok','Licenses', s.licenseIssues, 'undocumented or not allowed')+
+      card(s.outdated>0?'warn':'ok','Outdated', s.outdated, 'a newer version exists')+
+      card(s.atRisk>0?'bad':'ok','At risk', s.atRisk, 'questionable maintenance');
+  }
+
+  function renderFilters(){
+    var defs=[['all','All'],['vuln','Vulnerable'],['outdated','Outdated'],['lic','Licenses'],['risk','At risk']];
+    var f=document.getElementById('filters');
+    f.innerHTML=defs.map(function(d){return '<span class="chip'+(d[0]==='all'?' active':'')+'" data-f="'+d[0]+'">'+d[1]+'</span>';}).join('');
+    f.addEventListener('click',function(e){
+      var chip=e.target.closest('.chip'); if(!chip) return;
+      activeFilter=chip.getAttribute('data-f');
+      [].forEach.call(f.querySelectorAll('.chip'),function(x){x.classList.toggle('active',x===chip);});
+      render();
+    });
+  }
+
+  document.querySelectorAll('th[data-sort]').forEach(function(th){
+    th.addEventListener('click',function(){
+      var k=th.getAttribute('data-sort');
+      if(sortKey===k) sortDir*=-1; else {sortKey=k; sortDir=1;}
+      render();
+    });
+  });
+  document.getElementById('search').addEventListener('input',function(e){term=e.target.value.toLowerCase().trim();render();});
+
+  renderCards(); renderFilters(); render();
+})();
+`;
+
+module.exports = { buildHtml };

package/src/reporters/json.js

@@ -0,0 +1,20 @@
+'use strict';
+
+const { logger } = require('../utils/logger');
+const { writeJson } = require('../utils/fs');
+
+/**
+ * Emits the audit report as machine-readable JSON, either to stdout or to a file.
+ * @param {object} report
+ * @param {{ outputPath?: string }} [options]
+ */
+function reportJson(report, { outputPath } = {}) {
+  if (outputPath) {
+    writeJson(outputPath, report);
+    logger.success(`Informe JSON escrito en: ${outputPath}`);
+  } else {
+    process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+  }
+}
+
+module.exports = { reportJson };

package/src/utils/exec.js

@@ -0,0 +1,57 @@
+'use strict';
+
+const { spawnSync } = require('node:child_process');
+
+/**
+ * Runs a command synchronously and returns its stdout/stderr/status
+ * without throwing. Used to invoke `npm` safely.
+ *
+ * @param {string} command
+ * @param {string[]} args
+ * @param {object} [options]
+ * @returns {{ status: number|null, stdout: string, stderr: string, error: Error|undefined }}
+ */
+function run(command, args = [], options = {}) {
+  const result = spawnSync(command, args, {
+    encoding: 'utf8',
+    maxBuffer: 64 * 1024 * 1024,
+    shell: process.platform === 'win32',
+    ...options,
+  });
+
+  return {
+    status: result.status,
+    stdout: result.stdout || '',
+    stderr: result.stderr || '',
+    error: result.error,
+  };
+}
+
+/**
+ * Runs a command and attempts to parse its stdout as JSON.
+ * Returns { ok, data, raw, status }.
+ */
+function runJson(command, args = [], options = {}) {
+  const result = run(command, args, options);
+  let data = null;
+  let parseError = null;
+
+  if (result.stdout) {
+    try {
+      data = JSON.parse(result.stdout);
+    } catch (err) {
+      parseError = err;
+    }
+  }
+
+  return {
+    ok: !result.error && data !== null,
+    data,
+    raw: result.stdout,
+    status: result.status,
+    stderr: result.stderr,
+    error: result.error || parseError,
+  };
+}
+
+module.exports = { run, runJson };