cra-audit 1.0.0 → 2.0.0

package/src/core/sbom-validator.js

@@ -1,124 +1,228 @@
-'use strict';
-
-/**
- * Validates an SBOM document against the minimum elements required by
- * CRA Annex I (2)(1) and BSI TR-03183 Part 2. It auto-detects whether the
- * document is CycloneDX or SPDX.
- *
- * Minimum required elements (TR-03183 §6 "minimum elements"):
- *  - SBOM format declared (CycloneDX or SPDX)
- *  - Author / creator of the SBOM
- *  - Timestamp of creation
- *  - For each component: name, version, supplier/author, unique identifier,
- *    cryptographic hash, license and dependency relationship.
- */
-function validateSbom(document) {
-  if (!document || typeof document !== 'object') {
-    return invalid('The SBOM is not a valid JSON object.');
-  }
-
-  if (document.bomFormat === 'CycloneDX' || document.specVersion) {
-    return validateCycloneDx(document);
-  }
-  if (document.spdxVersion || document.SPDXID === 'SPDXRef-DOCUMENT') {
-    return validateSpdx(document);
-  }
-
-  return invalid('Unrecognized SBOM format (neither CycloneDX nor SPDX).');
-}
-
-function validateCycloneDx(doc) {
-  const issues = [];
-  const checks = [];
-
-  pushCheck(checks, 'format', 'Format declared (CycloneDX)', doc.bomFormat === 'CycloneDX');
-  pushCheck(checks, 'specVersion', 'Specification version present', Boolean(doc.specVersion));
-  pushCheck(checks, 'serialNumber', 'Unique document identifier (serialNumber)', Boolean(doc.serialNumber));
-  pushCheck(checks, 'timestamp', 'Creation timestamp', Boolean(doc.metadata && doc.metadata.timestamp));
-  pushCheck(checks, 'author', 'Author / generating tool declared',
-    Boolean(doc.metadata && (doc.metadata.tools || doc.metadata.authors)));
-  pushCheck(checks, 'rootComponent', 'Root component (product) identified',
-    Boolean(doc.metadata && doc.metadata.component && doc.metadata.component.name));
-
-  const components = Array.isArray(doc.components) ? doc.components : [];
-  pushCheck(checks, 'components', 'Contains at least one component', components.length > 0);
-
-  const stats = { total: components.length, missingVersion: 0, missingHash: 0, missingLicense: 0, missingPurl: 0 };
-  for (const comp of components) {
-    const label = comp.name || comp['bom-ref'] || 'unknown';
-    if (!comp.version) { stats.missingVersion++; issues.push(`Component without a version: ${label}`); }
-    if (!hasCdxHash(comp)) { stats.missingHash++; issues.push(`Component without a cryptographic hash: ${label}`); }
-    if (!hasCdxLicense(comp)) { stats.missingLicense++; issues.push(`Component without a license: ${label}`); }
-    if (!comp.purl && !comp['bom-ref']) { stats.missingPurl++; issues.push(`Component without a unique identifier (purl): ${label}`); }
-  }
-
-  pushCheck(checks, 'componentVersions', 'All components have a version', stats.missingVersion === 0);
-  pushCheck(checks, 'componentHashes', 'All components have a cryptographic hash', stats.missingHash === 0);
-  pushCheck(checks, 'componentLicenses', 'All components have a license', stats.missingLicense === 0);
-  pushCheck(checks, 'componentIdentifiers', 'All components have a unique identifier', stats.missingPurl === 0);
-
-  return summarize('cyclonedx', checks, issues, stats);
-}
-
-function validateSpdx(doc) {
-  const issues = [];
-  const checks = [];
-
-  pushCheck(checks, 'format', 'Format declared (SPDX)', Boolean(doc.spdxVersion));
-  pushCheck(checks, 'dataLicense', 'Data license declared', Boolean(doc.dataLicense));
-  pushCheck(checks, 'serialNumber', 'Unique document namespace', Boolean(doc.documentNamespace));
-  pushCheck(checks, 'timestamp', 'Creation timestamp', Boolean(doc.creationInfo && doc.creationInfo.created));
-  pushCheck(checks, 'author', 'Author / creator declared',
-    Boolean(doc.creationInfo && Array.isArray(doc.creationInfo.creators) && doc.creationInfo.creators.length));
-
-  const packages = Array.isArray(doc.packages) ? doc.packages : [];
-  pushCheck(checks, 'components', 'Contains at least one package', packages.length > 0);
-
-  const stats = { total: packages.length, missingVersion: 0, missingHash: 0, missingLicense: 0, missingPurl: 0 };
-  for (const pkg of packages) {
-    const label = pkg.name || pkg.SPDXID || 'unknown';
-    if (pkg.SPDXID === 'SPDXRef-Package-root') continue;
-    if (!pkg.versionInfo || pkg.versionInfo === 'NOASSERTION') { stats.missingVersion++; issues.push(`Package without a version: ${label}`); }
-    if (!Array.isArray(pkg.checksums) || pkg.checksums.length === 0) { stats.missingHash++; issues.push(`Package without a checksum: ${label}`); }
-    if (!pkg.licenseConcluded || pkg.licenseConcluded === 'NOASSERTION') { stats.missingLicense++; issues.push(`Package without a license: ${label}`); }
-    if (!Array.isArray(pkg.externalRefs) || !pkg.externalRefs.some((r) => r.referenceType === 'purl')) { stats.missingPurl++; issues.push(`Package without a purl: ${label}`); }
-  }
-
-  pushCheck(checks, 'componentVersions', 'All packages have a version', stats.missingVersion === 0);
-  pushCheck(checks, 'componentHashes', 'All packages have a checksum', stats.missingHash === 0);
-  pushCheck(checks, 'componentLicenses', 'All packages have a license', stats.missingLicense === 0);
-  pushCheck(checks, 'componentIdentifiers', 'All packages have a purl', stats.missingPurl === 0);
-
-  return summarize('spdx', checks, issues, stats);
-}
-
-function hasCdxHash(comp) {
-  return Array.isArray(comp.hashes) && comp.hashes.length > 0;
-}
-
-function hasCdxLicense(comp) {
-  return Array.isArray(comp.licenses) && comp.licenses.length > 0;
-}
-
-function pushCheck(checks, id, label, passed) {
-  checks.push({ id, label, passed: Boolean(passed) });
-}
-
-function summarize(format, checks, issues, stats) {
-  const failed = checks.filter((c) => !c.passed);
-  return {
-    ok: true,
-    format,
-    valid: failed.length === 0,
-    checks,
-    failedChecks: failed,
-    issues,
-    stats,
-  };
-}
-
-function invalid(message) {
-  return { ok: false, valid: false, error: message, checks: [], issues: [message] };
-}
-
-module.exports = { validateSbom };
+'use strict';
+
+/**
+ * Validates an SBOM document against the requirements of CRA Annex I and
+ * BSI TR-03183-2 v2.1.0. It auto-detects whether the document is CycloneDX
+ * or SPDX.
+ *
+ * TR-03183-2 v2.1.0 requirements checked:
+ *  - §4:     format CycloneDX >= 1.6 or SPDX >= 3.0.1
+ *  - §5.2.1: creator of the SBOM (email or URL) and timestamp
+ *  - §5.2.2: for each component: creator (email or URL), name, version,
+ *            filename, dependencies (and completeness of that enumeration),
+ *            licence, SHA-512 hash of the deployable component and the
+ *            executable / archive / structured properties
+ *  - §5.2.4: unique identifier (purl, CPE, SWID)
+ */
+function validateSbom(document) {
+  if (!document || typeof document !== 'object') {
+    return invalid('The SBOM is not a valid JSON object.');
+  }
+
+  if (document.bomFormat === 'CycloneDX' || document.specVersion) {
+    return validateCycloneDx(document);
+  }
+  if (document.spdxVersion || document.SPDXID === 'SPDXRef-DOCUMENT') {
+    return validateSpdx(document);
+  }
+
+  return invalid('Unrecognized SBOM format (neither CycloneDX nor SPDX).');
+}
+
+const BSI_PROPERTIES = ['bsi:component:executable', 'bsi:component:archive', 'bsi:component:structured'];
+
+function validateCycloneDx(doc) {
+  const issues = [];
+  const checks = [];
+  const metadata = doc.metadata || {};
+
+  pushCheck(checks, 'format', 'Format declared (CycloneDX)', doc.bomFormat === 'CycloneDX');
+  pushCheck(checks, 'specVersion', 'Specification version CycloneDX >= 1.6 (TR-03183-2 §4)',
+    compareVersions(doc.specVersion, '1.6') >= 0);
+  pushCheck(checks, 'serialNumber', 'Unique document identifier (serialNumber)', Boolean(doc.serialNumber));
+  pushCheck(checks, 'timestamp', 'Creation timestamp', Boolean(metadata.timestamp));
+  pushCheck(checks, 'author', 'Creator of the SBOM (email or URL)',
+    hasCdxContact(metadata.manufacturer) || toArray(metadata.authors).some((a) => a && a.email));
+  pushCheck(checks, 'rootComponent', 'Root component (product) identified',
+    Boolean(metadata.component && metadata.component.name));
+
+  const components = toArray(doc.components);
+  pushCheck(checks, 'components', 'Contains at least one component', components.length > 0);
+
+  const graphRefs = new Set(toArray(doc.dependencies).map((d) => d && d.ref));
+  const stats = {
+    total: components.length,
+    missingVersion: 0,
+    missingCreator: 0,
+    missingFilename: 0,
+    missingHash: 0,
+    missingLicense: 0,
+    missingPurl: 0,
+    missingProperties: 0,
+    missingDependencies: 0,
+  };
+
+  for (const comp of components) {
+    const label = comp.name || comp['bom-ref'] || 'unknown';
+    const props = new Map(toArray(comp.properties).map((p) => [p && p.name, p && p.value]));
+
+    if (!comp.version) { stats.missingVersion++; issues.push(`Component without a version: ${label}`); }
+    if (!hasCdxContact(comp.manufacturer) && !hasCdxContact(comp.supplier) && !hasEmail(comp.authors)) {
+      stats.missingCreator++; issues.push(`Component without a creator (email or URL): ${label}`);
+    }
+    if (!props.get('bsi:component:filename')) { stats.missingFilename++; issues.push(`Component without a filename: ${label}`); }
+    if (!hasCdxSha512(comp)) { stats.missingHash++; issues.push(`Component without a SHA-512 hash: ${label}`); }
+    if (!hasCdxLicense(comp)) { stats.missingLicense++; issues.push(`Component without a license: ${label}`); }
+    if (!comp.purl && !comp.cpe && !comp.swid && !comp['bom-ref']) {
+      stats.missingPurl++; issues.push(`Component without a unique identifier (purl): ${label}`);
+    }
+    if (BSI_PROPERTIES.some((name) => !props.get(name))) {
+      stats.missingProperties++; issues.push(`Component without the executable/archive/structured properties: ${label}`);
+    }
+    if (!graphRefs.has(comp['bom-ref'])) {
+      stats.missingDependencies++; issues.push(`Component missing from the dependency graph: ${label}`);
+    }
+  }
+
+  const completeness = toArray(doc.compositions).some((c) => c && c.aggregate);
+
+  pushCheck(checks, 'componentVersions', 'All components have a version', stats.missingVersion === 0);
+  pushCheck(checks, 'componentCreators', 'All components have a creator (email or URL)', stats.missingCreator === 0);
+  pushCheck(checks, 'componentFilenames', 'All components have a filename', stats.missingFilename === 0);
+  pushCheck(checks, 'componentHashes', 'All components have a SHA-512 hash', stats.missingHash === 0);
+  pushCheck(checks, 'componentLicenses', 'All components have a license', stats.missingLicense === 0);
+  pushCheck(checks, 'componentIdentifiers', 'All components have a unique identifier', stats.missingPurl === 0);
+  pushCheck(checks, 'componentProperties', 'All components declare executable/archive/structured', stats.missingProperties === 0);
+  pushCheck(checks, 'dependencyGraph', 'Dependency graph covers every component', stats.missingDependencies === 0);
+  pushCheck(checks, 'dependencyCompleteness', 'Completeness of the dependency graph declared (compositions)', completeness);
+
+  return summarize('cyclonedx', checks, issues, stats);
+}
+
+function validateSpdx(doc) {
+  const issues = [];
+  const checks = [];
+  const creators = toArray(doc.creationInfo && doc.creationInfo.creators);
+
+  pushCheck(checks, 'format', 'Format declared (SPDX)', Boolean(doc.spdxVersion));
+  const spdxVersion = String(doc.spdxVersion || '').replace(/^SPDX-/, '');
+  pushCheck(checks, 'specVersion', 'Specification version SPDX >= 3.0.1 (TR-03183-2 §4; use CycloneDX)',
+    compareVersions(spdxVersion, '3.0.1') >= 0);
+  pushCheck(checks, 'dataLicense', 'Data license declared', Boolean(doc.dataLicense));
+  pushCheck(checks, 'serialNumber', 'Unique document namespace', Boolean(doc.documentNamespace));
+  pushCheck(checks, 'timestamp', 'Creation timestamp', Boolean(doc.creationInfo && doc.creationInfo.created));
+  pushCheck(checks, 'author', 'Creator of the SBOM (organization or person)',
+    creators.some((c) => /^(Organization|Person):/.test(String(c))));
+
+  const packages = toArray(doc.packages);
+  pushCheck(checks, 'components', 'Contains at least one package', packages.length > 0);
+
+  const relationships = toArray(doc.relationships);
+  const inGraph = new Set();
+  for (const r of relationships) {
+    if (r && r.relationshipType === 'DEPENDS_ON') {
+      inGraph.add(r.spdxElementId);
+      inGraph.add(r.relatedSpdxElement);
+    }
+  }
+
+  const stats = {
+    total: packages.length,
+    missingVersion: 0,
+    missingCreator: 0,
+    missingFilename: 0,
+    missingHash: 0,
+    missingLicense: 0,
+    missingPurl: 0,
+    missingDependencies: 0,
+  };
+  for (const pkg of packages) {
+    const label = pkg.name || pkg.SPDXID || 'unknown';
+    if (pkg.SPDXID === 'SPDXRef-Package-root') continue;
+    if (!pkg.versionInfo || pkg.versionInfo === 'NOASSERTION') { stats.missingVersion++; issues.push(`Package without a version: ${label}`); }
+    if (!isAssertion(pkg.originator) && !isAssertion(pkg.supplier)) { stats.missingCreator++; issues.push(`Package without an originator: ${label}`); }
+    if (!pkg.packageFileName) { stats.missingFilename++; issues.push(`Package without a filename: ${label}`); }
+    if (!toArray(pkg.checksums).some((c) => /^SHA-?512$/i.test(String(c && c.algorithm)))) {
+      stats.missingHash++; issues.push(`Package without a SHA-512 checksum: ${label}`);
+    }
+    if (!isAssertion(pkg.licenseConcluded)) { stats.missingLicense++; issues.push(`Package without a license: ${label}`); }
+    if (!toArray(pkg.externalRefs).some((r) => r.referenceType === 'purl')) { stats.missingPurl++; issues.push(`Package without a purl: ${label}`); }
+    if (packages.length > 2 && !inGraph.has(pkg.SPDXID)) {
+      stats.missingDependencies++; issues.push(`Package missing from the dependency graph: ${label}`);
+    }
+  }
+
+  pushCheck(checks, 'componentVersions', 'All packages have a version', stats.missingVersion === 0);
+  pushCheck(checks, 'componentCreators', 'All packages have an originator', stats.missingCreator === 0);
+  pushCheck(checks, 'componentFilenames', 'All packages have a filename', stats.missingFilename === 0);
+  pushCheck(checks, 'componentHashes', 'All packages have a SHA-512 checksum', stats.missingHash === 0);
+  pushCheck(checks, 'componentLicenses', 'All packages have a license', stats.missingLicense === 0);
+  pushCheck(checks, 'componentIdentifiers', 'All packages have a purl', stats.missingPurl === 0);
+  pushCheck(checks, 'dependencyGraph', 'Dependency relationships (DEPENDS_ON) declared', stats.missingDependencies === 0);
+
+  return summarize('spdx', checks, issues, stats);
+}
+
+/** CycloneDX organizational entity with an email contact or a URL. */
+function hasCdxContact(entity) {
+  if (!entity || typeof entity !== 'object') return false;
+  return toArray(entity.url).length > 0 || hasEmail(entity.contact);
+}
+
+function hasEmail(people) {
+  return toArray(people).some((p) => p && p.email);
+}
+
+/** SHA-512 in `hashes` or on the `distribution` reference (TR-03183 mapping). */
+function hasCdxSha512(comp) {
+  const isSha512 = (h) => h && h.alg === 'SHA-512' && h.content;
+  if (toArray(comp.hashes).some(isSha512)) return true;
+  return toArray(comp.externalReferences).some((ref) => ref && toArray(ref.hashes).some(isSha512));
+}
+
+function hasCdxLicense(comp) {
+  return toArray(comp.licenses).length > 0;
+}
+
+function isAssertion(value) {
+  return Boolean(value) && value !== 'NOASSERTION' && value !== 'NONE';
+}
+
+/** Compares dotted numeric versions ("1.6" vs "1.5"); missing parts are 0. */
+function compareVersions(a, b) {
+  if (!a) return -1;
+  const pa = String(a).split('.').map((n) => parseInt(n, 10) || 0);
+  const pb = String(b).split('.').map((n) => parseInt(n, 10) || 0);
+  for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+    const diff = (pa[i] || 0) - (pb[i] || 0);
+    if (diff !== 0) return diff;
+  }
+  return 0;
+}
+
+function toArray(value) {
+  return Array.isArray(value) ? value : [];
+}
+
+function pushCheck(checks, id, label, passed) {
+  checks.push({ id, label, passed: Boolean(passed) });
+}
+
+function summarize(format, checks, issues, stats) {
+  const failed = checks.filter((c) => !c.passed);
+  return {
+    ok: true,
+    format,
+    valid: failed.length === 0,
+    checks,
+    failedChecks: failed,
+    issues,
+    stats,
+  };
+}
+
+function invalid(message) {
+  return { ok: false, valid: false, error: message, checks: [], issues: [message] };
+}
+
+module.exports = { validateSbom };

package/src/core/vuln-scanner.js

@@ -4,24 +4,174 @@ const fs = require('node:fs');
 const os = require('node:os');
 const path = require('node:path');
 const { runJson } = require('../utils/exec');
-const { exists } = require('../utils/fs');
-const { parseLockfile, toNpmLockfile } = require('./lockfile-parser');
+const { exists, readJson } = require('../utils/fs');
+const { parseLockfile, toNpmLockfile, componentKey } = require('./lockfile-parser');
+const {
+  queryOsv, osvSeverity, cvssScore, isMalicious, fixedVersion, compareSemver,
+} = require('./osv');
+const { loadKev } = require('./kev');
 
 const SEVERITY_ORDER = ['info', 'low', 'moderate', 'high', 'critical'];
 
 /**
- * Scans direct and transitive dependencies for known vulnerabilities using
- * `npm audit --json`. The CRA requires products to ship "without known
- * exploitable vulnerabilities", so this is the core gate of the audit.
+ * Scans direct and transitive dependencies for known vulnerabilities. The CRA
+ * requires products to ship "without known exploitable vulnerabilities"
+ * (Annex I) and, since 11 September 2026, the reporting of actively exploited
+ * ones (Art. 14), so this is the core gate of the audit.
  *
- * npm projects are audited in place. Yarn/pnpm projects (which have no npm
- * lockfile) are audited against a synthetic `package-lock.json` generated from
- * their lockfile, preserving the exact installed versions.
+ * Sources:
+ *  - `osv` (default): every exact `name@version` from the lockfile is checked
+ *    against OSV.dev (GitHub advisories + OpenSSF malicious packages), and the
+ *    CVEs found are cross-checked with the CISA KEV catalogue.
+ *  - `npm`: `npm audit`. Also the fallback when OSV.dev is unreachable.
  *
  * @param {string} projectRoot
- * @param {{ production?: boolean }} [options]
+ * @param {{ production?: boolean, source?: 'osv'|'npm', kev?: boolean }} [options]
+ * @returns {Promise<object>}
  */
-function scanVulnerabilities(projectRoot, { production = false } = {}) {
+async function scanVulnerabilities(projectRoot, { production = false, source = 'osv', kev = true } = {}) {
+  if (source === 'npm') return npmAuditSection(projectRoot, { production });
+
+  const parsed = parseLockfile(projectRoot);
+  if (!parsed.ok) {
+    return { ok: false, error: parsed.error, counts: emptyCounts(), vulnerabilities: [] };
+  }
+
+  const rootPkg = readJson(path.join(projectRoot, 'package.json')) || {};
+  const components = production ? productionComponents(parsed, rootPkg) : parsed.components;
+  const scannable = components.filter((c) => c.name && c.version);
+
+  const [osv, catalogue] = await Promise.all([
+    queryOsv(scannable),
+    kev ? loadKev() : Promise.resolve(null),
+  ]);
+
+  if (!osv.ok) {
+    const fallback = npmAuditSection(projectRoot, { production });
+    fallback.warnings = [`${osv.error}; fell back to \`npm audit\` (no malicious-package or KEV check).`];
+    return fallback;
+  }
+
+  const direct = new Set(parsed.root.dependsOn);
+  const vulnerabilities = [];
+  for (const c of scannable) {
+    const key = componentKey(c.name, c.version);
+    const records = osv.byComponent.get(key);
+    if (!records || !records.length) continue;
+    vulnerabilities.push(toFinding(c, records, direct.has(key), catalogue));
+  }
+
+  const counts = emptyCounts();
+  for (const v of vulnerabilities) {
+    counts[v.severity] = (counts[v.severity] || 0) + 1;
+    if (v.malicious) counts.malicious++;
+    if (v.kev) counts.kev++;
+  }
+  counts.total = vulnerabilities.length;
+
+  return {
+    ok: true,
+    source: 'osv',
+    scanned: scannable.length,
+    kev: catalogue
+      ? (catalogue.ok
+        ? { checked: true, catalogVersion: catalogue.catalogVersion, entries: catalogue.count }
+        : { checked: false, error: catalogue.error })
+      : { checked: false, error: 'KEV check disabled' },
+    counts,
+    vulnerabilities: sortBySeverity(vulnerabilities),
+  };
+}
+
+/** One finding per vulnerable component, aggregating its OSV records. */
+function toFinding(component, records, isDirect, catalogue) {
+  const sources = records.map((record) => {
+    const aliases = record.aliases || [];
+    const cves = [record.id, ...aliases].filter((id) => /^CVE-/i.test(id));
+    const kevEntry = catalogue && catalogue.ok
+      ? cves.map((cve) => catalogue.byCve.get(cve.toUpperCase())).find(Boolean) || null
+      : null;
+    return {
+      id: record.id,
+      aliases,
+      title: record.summary || (isMalicious(record) ? 'Malicious package' : record.id),
+      url: `https://osv.dev/vulnerability/${record.id}`,
+      severity: osvSeverity(record),
+      cvss: cvssScore(record),
+      cwe: (record.database_specific && record.database_specific.cwe_ids) || [],
+      malicious: isMalicious(record),
+      fixed: fixedVersion(record, component.name, component.version),
+      kev: kevEntry,
+    };
+  });
+
+  const severity = sources.map((s) => s.severity)
+    .reduce((max, s) => (severityRank(s) > severityRank(max) ? s : max), 'unknown');
+  const fixes = sources.map((s) => s.fixed);
+  // Only claim a fix when every advisory has one; suggest the highest of them.
+  const fix = fixes.every(Boolean)
+    ? fixes.reduce((a, b) => (compareSemver(a, b) >= 0 ? a : b))
+    : null;
+
+  return {
+    name: component.name,
+    version: component.version,
+    severity,
+    direct: isDirect,
+    range: null,
+    malicious: sources.some((s) => s.malicious),
+    kev: sources.some((s) => s.kev),
+    fixAvailable: fix
+      ? { name: component.name, version: fix, breaking: major(fix) !== major(component.version) }
+      : false,
+    // Malicious and actively exploited advisories first, then by severity.
+    sources: sources.sort((a, b) => Number(b.malicious) - Number(a.malicious) ||
+      Number(Boolean(b.kev)) - Number(Boolean(a.kev)) ||
+      severityRank(b.severity) - severityRank(a.severity)),
+  };
+}
+
+/**
+ * Components reachable from the production dependencies declared in
+ * package.json (`dependencies` + `optionalDependencies`), following the graph.
+ */
+function productionComponents(parsed, rootPkg) {
+  const prodNames = new Set([
+    ...Object.keys(rootPkg.dependencies || {}),
+    ...Object.keys(rootPkg.optionalDependencies || {}),
+  ]);
+  const byKey = new Map(parsed.components.map((c) => [componentKey(c.name, c.version), c]));
+  const queue = parsed.root.dependsOn.filter((key) => prodNames.has(byKey.has(key) ? byKey.get(key).name : null));
+  const seen = new Set(queue);
+  while (queue.length) {
+    const comp = byKey.get(queue.shift());
+    if (!comp) continue;
+    for (const dep of comp.dependsOn) {
+      if (!seen.has(dep)) { seen.add(dep); queue.push(dep); }
+    }
+  }
+  return parsed.components.filter((c) => seen.has(componentKey(c.name, c.version)));
+}
+
+function severityRank(severity) {
+  return SEVERITY_ORDER.indexOf(severity);
+}
+
+function major(version) {
+  return parseInt(String(version).split('.')[0], 10);
+}
+
+/** `npm audit` source, used on request or as the OSV fallback. */
+function npmAuditSection(projectRoot, { production }) {
+  const result = npmAudit(projectRoot, { production });
+  return {
+    ...result,
+    source: 'npm-audit',
+    kev: { checked: false, error: 'npm audit reports no CVE identifiers' },
+  };
+}
+
+function npmAudit(projectRoot, { production = false } = {}) {
   if (hasNpmLockfile(projectRoot)) {
     return runNpmAudit(projectRoot, { production });
   }
@@ -187,7 +337,7 @@ function normalizeFix(fixAvailable) {
 }
 
 function emptyCounts() {
-  return { info: 0, low: 0, moderate: 0, high: 0, critical: 0, total: 0 };
+  return { info: 0, low: 0, moderate: 0, high: 0, critical: 0, unknown: 0, malicious: 0, kev: 0, total: 0 };
 }
 
 function sumCounts(counts) {

package/src/index.js

@@ -6,7 +6,7 @@
  * Example:
  *   const { runAudit, loadPolicy } = require('cra-audit');
  *   const { policy, source } = loadPolicy(process.cwd());
- *   const report = runAudit(process.cwd(), policy, source);
+ *   const report = await runAudit(process.cwd(), policy, source);
  */
 
 const { runAudit } = require('./core/auditor');