cra-audit 1.0.0 → 2.0.0

package/CHANGELOG.md

@@ -0,0 +1,61 @@
+# Changelog
+
+All notable changes to this project are documented here. The format follows
+[Keep a Changelog](https://keepachangelog.com/) and the project uses
+[Semantic Versioning](https://semver.org/).
+
+Releases are automated: pushing a `vX.Y.Z` tag publishes the package to npm
+(with provenance) and creates the GitHub Release from the matching section
+below, so add the section before running `npm version`.
+
+## [2.0.0] — OSV.dev, CISA KEV & malicious package detection
+
+### Highlights
+
+**Known, actively exploited and malicious dependencies — in one check**
+
+- **OSV.dev** is now the default vulnerability source: every dependency is checked at the exact version pinned in the lockfile (npm, Yarn, pnpm), with severity, CVE aliases and the version that fixes it. `npm` is no longer required.
+- **Malicious packages**: compromised releases from the OpenSSF malicious-packages feed (`MAL-*`, e.g. the Shai-Hulud worm versions) always fail the audit and cannot be allowlisted.
+- **CISA KEV**: vulnerabilities with evidence of active exploitation fail the audit by default and print the **CRA Art. 14 reporting clock** (24 h / 72 h / 14 days). Use `--no-fail-on-kev` to report them as a warning.
+- `--production` now follows the dependency graph, so it works for Yarn and pnpm projects too.
+- The allowlist accepts GHSA and CVE identifiers.
+
+### New options
+
+- `--vuln-source osv|npm` / policy `vulnerabilitySource` (default `osv`)
+- `--no-fail-on-kev` / policy `failOnKev` (default `true`)
+
+### ⚠️ Breaking changes
+
+- **CLI / CI usage is unchanged** (`npx cra-audit`), but the audit is stricter: malicious packages and actively exploited (KEV) vulnerabilities now fail it.
+- **Programmatic API**: `runAudit()` and `scanVulnerabilities()` are now async — add `await`.
+- Requires network access to `api.osv.dev` and `cisa.gov`. If OSV.dev is unreachable, the audit falls back to `npm audit` and says so.
+
+## [1.1.0] — TR-03183-2 v2.1 SBOM
+
+### Highlights
+
+**CycloneDX 1.6 SBOM conforming to BSI TR-03183-2 v2.1.0**
+
+- Full dependency graph from npm (v1–v3), Yarn classic/Berry and pnpm (v5–v9) lockfiles, with completeness declared in `compositions`
+- SBOM creator (`--creator` flag or `sbomCreator` policy, defaulting to package.json) and component creators read from installed packages
+- `bsi:component:filename` / `executable` / `archive` / `structured` properties, SHA-512 on the distribution reference, declared/concluded licenses, source code URI
+- `sbom check` validates every TR-03183-2 v2.1 required field
+
+### Fixes
+
+- Licenses of Yarn/pnpm projects now reach the SBOM
+- Yarn Berry workspace entries are no longer listed as third-party components
+- pnpm v5 lockfile keys with peer suffixes are parsed correctly
+- Malformed integrity digests no longer produce schema-invalid hashes
+
+### ⚠️ Stricter validation
+
+- CycloneDX < 1.6 and SPDX < 3.0.1 are flagged (use the default CycloneDX output)
+- Yarn Berry projects fail the SHA-512 check (the lockfile doesn't store the npm tarball hash)
+- Run it after installing dependencies: component creators and licenses are read from `node_modules`
+
+## [1.0.0]
+
+- Yarn (classic and Berry) and pnpm lockfile support
+- CRA audit for npm projects: SBOM (CycloneDX/SPDX), `npm audit` vulnerabilities, licenses and an interactive HTML maintenance report

package/README.md

@@ -1,5 +1,7 @@
 # cra-audit
 
+[![npm](https://img.shields.io/npm/v/cra-audit)](https://www.npmjs.com/package/cra-audit) [![CI](https://github.com/migohe14/cra-audit/actions/workflows/ci.yml/badge.svg)](https://github.com/migohe14/cra-audit/actions/workflows/ci.yml) [![license](https://img.shields.io/npm/l/cra-audit)](LICENSE)
+
 > Compliance audit for the **Cyber Resilience Act** (Regulation EU 2024/2847) and the **BSI TR-03183** technical guideline, for npm projects.
 
 `cra-audit` audits the installed dependencies of an npm project and checks the key requirements that the CRA imposes on "products with digital elements". It runs directly with `npx`, **without installation**, and has **no production dependencies** to minimize its own supply-chain surface.
@@ -24,15 +26,50 @@ Under the hood, the package runs the checks derived from the CRA legal obligatio
 
 ### 1. Automatic SBOM validation
 
-Generates and validates a **Software Bill of Materials (SBOM)** in a machine-readable format —**CycloneDX 1.5** or **SPDX 2.3**— from the `package-lock.json` / `npm-shrinkwrap.json`, `yarn.lock` or `pnpm-lock.yaml`. It verifies the **minimum elements** required by TR-03183 §6 for every component: name, version, unique identifier (`purl`), cryptographic integrity hash and license.
+Generates and validates a **Software Bill of Materials (SBOM)** in a machine-readable format —**CycloneDX 1.6** (default) or **SPDX 2.3**— from the `package-lock.json` / `npm-shrinkwrap.json`, `yarn.lock` or `pnpm-lock.yaml`, following the field mapping of **BSI TR-03183-2 v2.1.0**:
+
+| TR-03183-2 data field | Where it comes from | CycloneDX 1.6 field |
+| --- | --- | --- |
+| Creator of the SBOM (email or URL) | `--creator`, `sbomCreator` policy, or the project's `author` / `homepage` / `repository` | `metadata.manufacturer` |
+| Timestamp | generation time (UTC) | `metadata.timestamp` |
+| Component creator (email or URL) | installed `package.json`: `author`, `maintainers`, `homepage`, `repository` | `components[].manufacturer` |
+| Name, version, purl | lockfile | `name`, `version`, `purl` |
+| Filename | tarball name (`left-pad-1.3.0.tgz`) | property `bsi:component:filename` |
+| SHA-512 of the deployable component | lockfile `integrity` | `externalReferences[distribution].hashes` |
+| Executable / archive / structured | npm tarball: `non-executable`, `archive`, `structured` | properties `bsi:component:*` |
+| Dependencies + completeness | lockfile dependency graph (npm v1–v3, Yarn classic/Berry, pnpm v5–v9) | `dependencies`, `compositions[].aggregate` |
+| Distribution / original licences | lockfile or installed `package.json` | `licenses[]` with `acknowledgement` `concluded` / `declared` |
+| Source code URI | `repository` | `externalReferences[source-distribution]` |
+
+`sbom check` verifies every one of those fields for every component. Licenses (for Yarn/pnpm) and component creators are read from `node_modules`, so **run it after installing dependencies** (e.g. after `npm ci` in CI).
+
+Known limits: Yarn Berry lockfiles only store Yarn's own cache checksum, not the npm tarball SHA-512, so Berry projects fail the hash check. TR-03183-2 v2.1 requires **SPDX ≥ 3.0.1**; the SPDX output is still 2.3, so use CycloneDX for a conforming SBOM.
 
 > CRA Annex I · TR-03183 Part 2 — *"Transparency through SBOM"*.
 
-### 2. "Zero known vulnerabilities" audit
+### 2. Known, actively exploited and malicious dependencies
+
+Checks every **direct and transitive** dependency, at the exact version pinned in the lockfile, against:
 
-Scans **direct and transitive** dependencies (from the lockfile) with `npm audit` and blocks the audit if there are exploitable vulnerabilities above the configured threshold. For Yarn/pnpm projects (which have no npm lockfile), `cra-audit` synthesizes a temporary `package-lock.json` from the exact versions pinned in `yarn.lock` / `pnpm-lock.yaml` and runs `npm audit --package-lock-only` against it, so the scanned versions match what the package manager actually resolved.
+| Source | What it finds | Effect on the audit |
+| --- | --- | --- |
+| [OSV.dev](https://osv.dev) — GitHub Advisory Database | Known vulnerabilities, with severity, CVE aliases and the version that fixes them | Fails at or above `--fail-on` (default `high`) |
+| OSV.dev — [OpenSSF malicious packages](https://github.com/ossf/malicious-packages) | Compromised releases (`MAL-*`), e.g. the Shai-Hulud worm versions | **Always fails**; cannot be allowlisted |
+| [CISA KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) | Vulnerabilities with evidence of **active exploitation** | Fails by default (`--no-fail-on-kev` to only warn) and prints the CRA Art. 14 reporting clock |
 
-> CRA Art. 13 — *products must be placed on the market without known exploitable vulnerabilities*.
+```text
+  HIGH     [KEV] vite@6.2.3  (fix: vite@6.4.3)
+    GHSA-4r4m-qw57-chr8 / CVE-2025-31125 Vite has a `server.fs.deny` bypassed … [KEV since 2026-01-22]
+
+⚠ CRA Art. 14 — actively exploited vulnerability in a dependency
+    • Early warning ........ within 24 hours of becoming aware
+    • Notification ......... within 72 hours
+    • Final report ......... within 14 days after a corrective measure is available
+```
+
+Only package names and versions are sent to `api.osv.dev`; the KEV catalogue is downloaded from cisa.gov (or CISA's GitHub mirror). If KEV cannot be reached the report says so instead of silently passing, and if OSV.dev is unreachable the audit falls back to `npm audit`. `--vuln-source npm` uses `npm audit` directly.
+
+> CRA Annex I Part I (2)(a) — *placed on the market without known exploitable vulnerabilities*. Art. 14 — *actively exploited vulnerabilities must be reported within 24 hours*.
 
 ### 3. Third-party component check
 
@@ -44,7 +81,7 @@ Identifies every third-party open-source library present in the dependency tree
 
 Verifies that **all** dependencies have their license documented and compliant with the policy (allowlist / denylist), and that they carry unique identifiers (`purl`) and integrity hashes (SHA-512/384/256) as recommended by TR-03183.
 
-> TR-03183 §6 — license governance and hash integrity.
+> TR-03183-2 §5.2 — license governance and hash integrity.
 
 ### 5. Visualization (`--visualize`)
 
@@ -102,7 +139,7 @@ cra-audit --help
 | `cra-audit` / `cra-audit audit` | Full CRA compliance audit (vulnerabilities + SBOM + licenses). **Default.** |
 | `cra-audit visualize` (aliases `view`, `report`) | Interactive HTML report with SBOM, licenses, versions and maintenance. |
 | `cra-audit sbom generate` | Generate an SBOM (CycloneDX/SPDX). |
-| `cra-audit sbom check` | Validate the SBOM against the TR-03183 minimum elements. |
+| `cra-audit sbom check` | Validate the SBOM against the TR-03183-2 v2.1 data fields. |
 | `cra-audit vulnerabilities` (alias `vuln`) | Vulnerability analysis only. |
 | `cra-audit licenses` | License analysis only. |
 | `cra-audit help` | Show help. |
@@ -117,7 +154,10 @@ cra-audit --help
 | `--no-open` | Do not open the HTML report in the browser automatically. |
 | `--sbom` | Shortcut equivalent to `sbom check`. |
 | `--format <fmt>` | SBOM format: `cyclonedx` (default) or `spdx`. |
+| `--creator <contact>` | Email or URL of the SBOM creator (TR-03183-2 §5.2.1). Defaults to the project's `package.json` `author` / `homepage` / `repository`. |
 | `--fail-on <sev>` | Minimum severity that fails the audit: `info`, `low`, `moderate`, `high`, `critical`. |
+| `--vuln-source <src>` | `osv` (default: OSV.dev + CISA KEV) or `npm` (`npm audit`). |
+| `--no-fail-on-kev` | Report actively exploited (CISA KEV) vulnerabilities as a warning instead of failing. |
 | `--production`, `--prod` | Audit production dependencies only. |
 | `--no-sbom` | Do not require an SBOM in the full audit. |
 | `--json` | Machine-readable JSON output. |
@@ -170,8 +210,11 @@ Create a `.cra-audit.json` file at the project root to customize the rules (ther
 ```json
 {
   "failOn": "high",
+  "failOnKev": true,
+  "vulnerabilitySource": "osv",
   "requireSbom": true,
   "sbomFormat": "cyclonedx",
+  "sbomCreator": "security@example.com",
   "productionOnly": false,
   "vulnerabilities": {
     "allowlist": []
@@ -185,10 +228,13 @@ Create a `.cra-audit.json` file at the project root to customize the rules (ther
 ```
 
 - `failOn`: minimum severity that blocks the audit.
-- `requireSbom`: require the SBOM to meet the TR-03183 minimum elements.
+- `failOnKev`: fail when a dependency has an actively exploited vulnerability (CISA KEV). Default `true`.
+- `vulnerabilitySource`: `osv` (OSV.dev + CISA KEV) or `npm` (`npm audit`).
+- `requireSbom`: require the SBOM to meet the TR-03183-2 required data fields.
 - `sbomFormat`: `cyclonedx` or `spdx`.
+- `sbomCreator`: email or URL of the entity that creates the SBOM (usually the manufacturer).
 - `productionOnly`: audit production dependencies only.
-- `vulnerabilities.allowlist`: advisory/CVE identifiers accepted with documented justification.
+- `vulnerabilities.allowlist`: package names or advisory ids (GHSA, CVE) accepted with documented justification, e.g. when the vulnerable code is not reachable in your product. Malicious packages (`MAL-*`) cannot be allowlisted.
 - `licenses.allow` / `licenses.deny`: allowed / denied lists (SPDX id).
 - `licenses.failOnMissing`: treat undocumented licenses as a failure.
 
@@ -223,7 +269,7 @@ const {
 } = require('cra-audit');
 
 const { policy, source } = loadPolicy(process.cwd());
-const report = runAudit(process.cwd(), policy, source);
+const report = await runAudit(process.cwd(), policy, source);
 console.log(report.gate.passed ? 'OK' : 'FAILED');
 
 // Maintenance data + custom HTML report
@@ -236,9 +282,13 @@ const signals = await enrichComponents(components, { network: true, github: true
 ## Requirements
 
 - Node.js >= 18 (uses native `fetch` and `node --test`).
-- `npm` available on the `PATH` (for `npm audit`).
+- Network access to `api.osv.dev` and `cisa.gov` (or `raw.githubusercontent.com` for the KEV mirror). `npm` on the `PATH` is only needed for `--vuln-source npm` or the offline fallback.
 - A lockfile present: `package-lock.json` / `npm-shrinkwrap.json` (npm), `yarn.lock` (Yarn classic or Berry) or `pnpm-lock.yaml` (pnpm). Run `npm install` / `yarn` / `pnpm install` if missing.
 
+## See also
+
+- [hulud-party-scanner](https://www.npmjs.com/package/hulud-party-scanner) — incident response for a machine that may have installed a compromised package: lifecycle-hook analysis, malicious code patterns and Shai-Hulud artifacts in the home directory.
+
 ## Legal notice
 
 `cra-audit` is a technical support tool. It helps verify controls associated with the CRA and TR-03183, but it **does not constitute legal advice** nor does it guarantee regulatory compliance on its own.

package/package.json

@@ -1,7 +1,16 @@
 {
   "name": "cra-audit",
-  "version": "1.0.0",
+  "version": "2.0.0",
   "description": "Audits npm, yarn, and pnpm projects for compliance with the European Cyber Resilience Act (CRA, EU Regulation 2024/2847) and BSI TR-03183: SBOM (CycloneDX/SPDX), known vulnerabilities, third-party components, and licenses.",
+  "homepage": "https://github.com/migohe14/cra-audit#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/migohe14/cra-audit.git"
+  },
+  "bugs": {
+    "url": "https://github.com/migohe14/cra-audit/issues"
+  },
+  "author": "Miguel Gonzalez (https://github.com/migohe14)",
   "keywords": [
     "cra",
     "cyber-resilience-act",
@@ -15,7 +24,11 @@
     "compliance",
     "vulnerabilities",
     "licenses",
-    "supply-chain"
+    "supply-chain",
+    "yarn",
+    "pnpm",
+    "eu",
+    "sbom-validation"
   ],
   "license": "MIT",
   "type": "commonjs",
@@ -30,6 +43,7 @@
     "bin",
     "src",
     "README.md",
+    "CHANGELOG.md",
     "LICENSE"
   ],
   "scripts": {

package/src/cli.js

@@ -20,6 +20,7 @@ const BOOLEAN_FLAGS = new Set([
   '--help', '--version', '--json', '--sbom', '--no-sbom',
   '--production', '--prod', '--no-color',
   '--visualize', '--offline', '--github', '--no-open',
+  '--fail-on-kev', '--no-fail-on-kev',
 ]);
 
 /**
@@ -151,6 +152,10 @@ function setFlag(flags, name, value) {
     case '--format': flags.format = String(value).toLowerCase(); break;
     case '--fail-on': flags.failOn = String(value).toLowerCase(); break;
     case '--cwd': flags.cwd = value; break;
+    case '--creator': flags.creator = value; break;
+    case '--vuln-source': flags.vulnSource = String(value).toLowerCase(); break;
+    case '--fail-on-kev': flags.failOnKev = value; break;
+    case '--no-fail-on-kev': flags.noFailOnKev = value; break;
     default:
       // Unknown flag stored under its raw name for forward compatibility.
       flags[name.replace(/^--/, '')] = value;
@@ -170,8 +175,8 @@ ${c.bold('COMMANDS')}
   ${c.cyan('audit')}                 Run ALL the checks (vulnerabilities + SBOM + licenses). Default.
   ${c.cyan('visualize')}             Generate an interactive HTML report (SBOM, licenses, versions and maintenance).
   ${c.cyan('sbom generate')}         Generate an SBOM (CycloneDX or SPDX) and print or save it.
-  ${c.cyan('sbom check')}            Validate that the SBOM meets the TR-03183 minimum elements.
-  ${c.cyan('vulnerabilities')}       Analyze known vulnerabilities only (alias: vuln).
+  ${c.cyan('sbom check')}            Validate the SBOM against the TR-03183-2 v2.1 data fields.
+  ${c.cyan('vulnerabilities')}       Known, actively exploited (KEV) and malicious packages only (alias: vuln).
   ${c.cyan('licenses')}              Analyze dependency licenses only.
   ${c.cyan('help')}                  Show this help.
 
@@ -182,7 +187,10 @@ ${c.bold('OPTIONS')}
   ${c.cyan('--no-open')}             Do not open the HTML report in the browser automatically.
   ${c.cyan('--sbom')}                Shortcut equivalent to "sbom check".
   ${c.cyan('--format <fmt>')}        SBOM format: cyclonedx (default) | spdx.
+  ${c.cyan('--creator <contact>')}   Email or URL of the SBOM creator (default: package.json author/homepage).
   ${c.cyan('--fail-on <sev>')}       Minimum severity that fails the audit: info|low|moderate|high|critical.
+  ${c.cyan('--vuln-source <src>')}   Vulnerability source: osv (default: OSV.dev + CISA KEV) | npm (npm audit).
+  ${c.cyan('--no-fail-on-kev')}      Report actively exploited (CISA KEV) vulnerabilities without failing.
   ${c.cyan('--production, --prod')}  Audit production dependencies only (skips devDependencies).
   ${c.cyan('--no-sbom')}             Do not require an SBOM in the full audit.
   ${c.cyan('--json')}                Machine-readable JSON output.

package/src/commands/audit.js

@@ -13,9 +13,9 @@ const { reportJson } = require('../reporters/json');
  *
  * @param {object} flags Parsed CLI flags.
  * @param {'vulnerabilities'|'sbom'|'licenses'} [only]
- * @returns {number} Process exit code.
+ * @returns {Promise<number>} Process exit code.
  */
-function auditCommand(flags, only) {
+async function auditCommand(flags, only) {
   const projectRoot = resolveRoot(flags);
   if (!projectRoot) return 1;
 
@@ -28,7 +28,7 @@ function auditCommand(flags, only) {
   }
 
   const policy = applyFlagOverrides(policyResult.policy, flags);
-  const report = runAudit(projectRoot, policy, policyResult.source, { only });
+  const report = await runAudit(projectRoot, policy, policyResult.source, { only });
 
   if (flags.json) {
     reportJson(report, { outputPath: flags.output });
@@ -56,6 +56,9 @@ function applyFlagOverrides(policy, flags) {
   if (flags.production) merged.productionOnly = true;
   if (flags.format) merged.sbomFormat = flags.format;
   if (flags.noSbom) merged.requireSbom = false;
+  if (flags.vulnSource) merged.vulnerabilitySource = flags.vulnSource;
+  if (flags.failOnKev) merged.failOnKev = true;
+  if (flags.noFailOnKev) merged.failOnKev = false;
   return merged;
 }
 

package/src/commands/sbom.js

@@ -5,13 +5,14 @@ const { findProjectRoot, readJson, writeJson, exists } = require('../utils/fs');
 const { logger, color } = require('../utils/logger');
 const { generateSbom } = require('../core/sbom-generator');
 const { validateSbom } = require('../core/sbom-validator');
+const { loadPolicy } = require('../core/policy');
 
 /**
  * `cra-audit sbom <generate|check>` and the `--sbom` shortcut.
  *
  * - generate: builds a CycloneDX/SPDX SBOM and prints it or writes it to disk.
- * - check:    generates (or reads) an SBOM and validates the minimum elements
- *             required by BSI TR-03183 §6.
+ * - check:    generates (or reads) an SBOM and validates the data fields
+ *             required by BSI TR-03183-2 v2.1.0 §5.2.
  */
 function sbomCommand(subcommand, flags) {
   const projectRoot = findProjectRoot(flags.cwd || process.cwd());
@@ -35,7 +36,7 @@ function sbomCommand(subcommand, flags) {
 }
 
 function sbomGenerate(projectRoot, format, flags) {
-  const result = generateSbom(projectRoot, { format });
+  const result = generateSbom(projectRoot, { format, creator: sbomCreator(projectRoot, flags) });
   if (!result.ok) {
     logger.error(result.error);
     return 1;
@@ -63,7 +64,7 @@ function sbomCheck(projectRoot, format, flags) {
     }
     document = readJson(inPath);
   } else {
-    const result = generateSbom(projectRoot, { format });
+    const result = generateSbom(projectRoot, { format, creator: sbomCreator(projectRoot, flags) });
     if (!result.ok) {
       logger.error(result.error);
       return 1;
@@ -82,7 +83,7 @@ function sbomCheck(projectRoot, format, flags) {
     return validation.valid ? 0 : 1;
   }
 
-  logger.heading('SBOM validation · BSI TR-03183 §6 (minimum elements)');
+  logger.heading('SBOM validation · BSI TR-03183-2 v2.1.0 (required data fields)');
   logger.detail(`Detected format: ${validation.format} · Components: ${validation.stats.total}`);
   for (const check of validation.checks) {
     const mark = check.passed ? color.green('✔') : color.red('✖');
@@ -90,11 +91,21 @@ function sbomCheck(projectRoot, format, flags) {
   }
   logger.log('');
   if (validation.valid) {
-    logger.success(color.bold('SBOM VALID — meets the minimum elements required by the CRA.'));
+    logger.success(color.bold('SBOM VALID — meets the TR-03183-2 data fields required by the CRA.'));
     return 0;
   }
   logger.error(color.bold(`SBOM INVALID — ${validation.failedChecks.length} requirement(s) not met.`));
   return 1;
 }
 
+/** SBOM creator from --creator, else from the project policy (`sbomCreator`). */
+function sbomCreator(projectRoot, flags) {
+  if (typeof flags.creator === 'string') return flags.creator;
+  try {
+    return loadPolicy(projectRoot, flags.config).policy.sbomCreator;
+  } catch {
+    return undefined; // A broken policy file must not block SBOM generation.
+  }
+}
+
 module.exports = { sbomCommand };

package/src/commands/visualize.js

@@ -44,8 +44,11 @@ async function visualizeCommand(flags) {
 
   logger.info(`Analyzing ${parsed.components.length} components from ${parsed.root.name}@${parsed.root.version}…`);
 
-  // Vulnerabilities + licenses run locally (no network).
-  const vulns = scanVulnerabilities(projectRoot, { production: policy.productionOnly });
+  // --offline keeps the previous behaviour: npm audit instead of OSV.dev/KEV.
+  const vulns = await scanVulnerabilities(projectRoot, {
+    production: policy.productionOnly,
+    source: flags.offline ? 'npm' : policy.vulnerabilitySource,
+  });
   const licenses = checkLicenses(projectRoot, policy.licenses || {});
 
   // Maintenance enrichment over the network (opt-out with --offline).
@@ -87,9 +90,10 @@ async function visualizeCommand(flags) {
 
 /** Merges all data sources into the view model consumed by the HTML reporter. */
 function buildModel(parsed, vulns, licenses, enrichment) {
+  // OSV findings are per name@version; npm audit findings only per name.
   const vulnByName = new Map();
   if (vulns.ok) {
-    for (const v of vulns.vulnerabilities) vulnByName.set(v.name, v);
+    for (const v of vulns.vulnerabilities) vulnByName.set(v.version ? `${v.name}@${v.version}` : v.name, v);
   }
   const licByKey = new Map();
   if (licenses.ok) {
@@ -98,7 +102,7 @@ function buildModel(parsed, vulns, licenses, enrichment) {
 
   const components = parsed.components.map((c) => {
     const key = `${c.name}@${c.version}`;
-    const vuln = vulnByName.get(c.name) || null;
+    const vuln = vulnByName.get(key) || vulnByName.get(c.name) || null;
     const lic = licByKey.get(key) || null;
     const enr = enrichment.get(key) || {};
 

package/src/core/auditor.js

@@ -21,21 +21,28 @@ const { checkLicenses } = require('./license-checker');
  * @param {object} policy
  * @param {string|null} policySource
  * @param {{ only?: 'vulnerabilities'|'sbom'|'licenses' }} [options]
- * @returns {AuditResult}
+ * @returns {Promise<AuditResult>}
  */
-function runAudit(projectRoot, policy, policySource, options = {}) {
+async function runAudit(projectRoot, policy, policySource, options = {}) {
   const { only } = options;
   const sections = {};
   const reasons = [];
 
   // --- 1. Vulnerabilities -------------------------------------------------
   if (!only || only === 'vulnerabilities') {
-    const vulns = scanVulnerabilities(projectRoot, { production: policy.productionOnly });
+    const vulns = await scanVulnerabilities(projectRoot, {
+      production: policy.productionOnly,
+      source: policy.vulnerabilitySource,
+    });
     sections.vulnerabilities = vulns;
 
     if (!vulns.ok) {
       reasons.push({ label: `Vulnerabilities could not be analyzed: ${vulns.error}`, passed: false });
     } else {
+      for (const warning of vulns.warnings || []) {
+        reasons.push({ label: warning, passed: true, warning: true });
+      }
+      reasons.push(...exploitationReasons(vulns, policy));
       const blocking = countBlocking(vulns, policy);
       reasons.push({
         label: blocking === 0
@@ -48,7 +55,7 @@ function runAudit(projectRoot, policy, policySource, options = {}) {
 
   // --- 2. SBOM ------------------------------------------------------------
   if (!only || only === 'sbom') {
-    const sbom = generateSbom(projectRoot, { format: policy.sbomFormat });
+    const sbom = generateSbom(projectRoot, { format: policy.sbomFormat, creator: policy.sbomCreator });
     if (sbom.ok) {
       sbom.validation = validateSbom(sbom.document);
     }
@@ -60,7 +67,7 @@ function runAudit(projectRoot, policy, policySource, options = {}) {
       } else {
         reasons.push({
           label: sbom.validation.valid
-            ? 'SBOM valid against the TR-03183 minimum elements'
+            ? 'SBOM valid against the TR-03183-2 required data fields'
             : 'SBOM incomplete with respect to TR-03183',
           passed: sbom.validation.valid,
         });
@@ -97,22 +104,68 @@ function runAudit(projectRoot, policy, policySource, options = {}) {
   };
 }
 
+/**
+ * Gate reasons for the OSV source: malicious packages always block (they are
+ * compromised releases, not bugs, so the allowlist cannot accept them), and
+ * actively exploited vulnerabilities (CISA KEV) block unless `failOnKev` is off.
+ */
+function exploitationReasons(vulns, policy) {
+  if (vulns.source !== 'osv') return [];
+  const reasons = [];
+
+  const malicious = vulns.vulnerabilities.filter((v) => v.malicious);
+  reasons.push({
+    label: malicious.length === 0
+      ? 'No malicious packages (OpenSSF malicious-packages via OSV.dev)'
+      : `${malicious.length} malicious package(s): ${malicious.map((v) => `${v.name}@${v.version}`).join(', ')}`,
+    passed: malicious.length === 0,
+  });
+
+  if (!vulns.kev || !vulns.kev.checked) {
+    reasons.push({
+      label: `Actively exploited vulnerabilities not checked: ${(vulns.kev && vulns.kev.error) || 'CISA KEV unavailable'}`,
+      passed: true,
+      warning: true,
+    });
+    return reasons;
+  }
+
+  const exploited = vulns.vulnerabilities.filter((v) => v.kev && !isAllowlisted(v, policy));
+  reasons.push({
+    label: exploited.length === 0
+      ? 'No actively exploited vulnerabilities (CISA KEV)'
+      : `${exploited.length} component(s) with actively exploited vulnerabilities (CISA KEV) — CRA Art. 14 reporting may apply`,
+    passed: exploited.length === 0 || policy.failOnKev === false,
+    warning: exploited.length > 0 && policy.failOnKev === false,
+  });
+  return reasons;
+}
+
 function countBlocking(vulns, policy) {
   const threshold = SEVERITY_ORDER.indexOf(policy.failOn);
   if (threshold === -1) return 0;
-  const allowlist = new Set((policy.vulnerabilities && policy.vulnerabilities.allowlist) || []);
 
   let count = 0;
   for (const vuln of vulns.vulnerabilities) {
     if (SEVERITY_ORDER.indexOf(vuln.severity) < threshold) continue;
-    const isAllowlisted = vuln.sources.some(
-      (src) => src.url && [...allowlist].some((id) => src.url.includes(id))
-    ) || allowlist.has(vuln.name);
-    if (!isAllowlisted) count++;
+    if (!vuln.malicious && isAllowlisted(vuln, policy)) continue;
+    count++;
   }
   return count;
 }
 
+/**
+ * A finding is accepted when the policy allowlist names the package, or every
+ * advisory on it by id/alias (GHSA, CVE) or advisory URL.
+ */
+function isAllowlisted(vuln, policy) {
+  const allowlist = (policy.vulnerabilities && policy.vulnerabilities.allowlist) || [];
+  if (!allowlist.length) return false;
+  if (allowlist.includes(vuln.name)) return true;
+  return vuln.sources.every((src) => allowlist.some((id) =>
+    [src.id, ...(src.aliases || [])].includes(id) || (src.url && src.url.includes(id))));
+}
+
 function getProject(projectRoot, sections) {
   // Derive project identity from any section that parsed the lockfile/root.
   if (sections.sbom && sections.sbom.ok && sections.sbom.document) {