cra-audit 1.1.0 → 2.0.0

package/CHANGELOG.md

@@ -0,0 +1,61 @@
+# Changelog
+
+All notable changes to this project are documented here. The format follows
+[Keep a Changelog](https://keepachangelog.com/) and the project uses
+[Semantic Versioning](https://semver.org/).
+
+Releases are automated: pushing a `vX.Y.Z` tag publishes the package to npm
+(with provenance) and creates the GitHub Release from the matching section
+below, so add the section before running `npm version`.
+
+## [2.0.0] — OSV.dev, CISA KEV & malicious package detection
+
+### Highlights
+
+**Known, actively exploited and malicious dependencies — in one check**
+
+- **OSV.dev** is now the default vulnerability source: every dependency is checked at the exact version pinned in the lockfile (npm, Yarn, pnpm), with severity, CVE aliases and the version that fixes it. `npm` is no longer required.
+- **Malicious packages**: compromised releases from the OpenSSF malicious-packages feed (`MAL-*`, e.g. the Shai-Hulud worm versions) always fail the audit and cannot be allowlisted.
+- **CISA KEV**: vulnerabilities with evidence of active exploitation fail the audit by default and print the **CRA Art. 14 reporting clock** (24 h / 72 h / 14 days). Use `--no-fail-on-kev` to report them as a warning.
+- `--production` now follows the dependency graph, so it works for Yarn and pnpm projects too.
+- The allowlist accepts GHSA and CVE identifiers.
+
+### New options
+
+- `--vuln-source osv|npm` / policy `vulnerabilitySource` (default `osv`)
+- `--no-fail-on-kev` / policy `failOnKev` (default `true`)
+
+### ⚠️ Breaking changes
+
+- **CLI / CI usage is unchanged** (`npx cra-audit`), but the audit is stricter: malicious packages and actively exploited (KEV) vulnerabilities now fail it.
+- **Programmatic API**: `runAudit()` and `scanVulnerabilities()` are now async — add `await`.
+- Requires network access to `api.osv.dev` and `cisa.gov`. If OSV.dev is unreachable, the audit falls back to `npm audit` and says so.
+
+## [1.1.0] — TR-03183-2 v2.1 SBOM
+
+### Highlights
+
+**CycloneDX 1.6 SBOM conforming to BSI TR-03183-2 v2.1.0**
+
+- Full dependency graph from npm (v1–v3), Yarn classic/Berry and pnpm (v5–v9) lockfiles, with completeness declared in `compositions`
+- SBOM creator (`--creator` flag or `sbomCreator` policy, defaulting to package.json) and component creators read from installed packages
+- `bsi:component:filename` / `executable` / `archive` / `structured` properties, SHA-512 on the distribution reference, declared/concluded licenses, source code URI
+- `sbom check` validates every TR-03183-2 v2.1 required field
+
+### Fixes
+
+- Licenses of Yarn/pnpm projects now reach the SBOM
+- Yarn Berry workspace entries are no longer listed as third-party components
+- pnpm v5 lockfile keys with peer suffixes are parsed correctly
+- Malformed integrity digests no longer produce schema-invalid hashes
+
+### ⚠️ Stricter validation
+
+- CycloneDX < 1.6 and SPDX < 3.0.1 are flagged (use the default CycloneDX output)
+- Yarn Berry projects fail the SHA-512 check (the lockfile doesn't store the npm tarball hash)
+- Run it after installing dependencies: component creators and licenses are read from `node_modules`
+
+## [1.0.0]
+
+- Yarn (classic and Berry) and pnpm lockfile support
+- CRA audit for npm projects: SBOM (CycloneDX/SPDX), `npm audit` vulnerabilities, licenses and an interactive HTML maintenance report

package/README.md

@@ -47,11 +47,29 @@ Known limits: Yarn Berry lockfiles only store Yarn's own cache checksum, not the
 
 > CRA Annex I · TR-03183 Part 2 — *"Transparency through SBOM"*.
 
-### 2. "Zero known vulnerabilities" audit
+### 2. Known, actively exploited and malicious dependencies
 
-Scans **direct and transitive** dependencies (from the lockfile) with `npm audit` and blocks the audit if there are exploitable vulnerabilities above the configured threshold. For Yarn/pnpm projects (which have no npm lockfile), `cra-audit` synthesizes a temporary `package-lock.json` from the exact versions pinned in `yarn.lock` / `pnpm-lock.yaml` and runs `npm audit --package-lock-only` against it, so the scanned versions match what the package manager actually resolved.
+Checks every **direct and transitive** dependency, at the exact version pinned in the lockfile, against:
 
-> CRA Art. 13 — *products must be placed on the market without known exploitable vulnerabilities*.
+| Source | What it finds | Effect on the audit |
+| --- | --- | --- |
+| [OSV.dev](https://osv.dev) — GitHub Advisory Database | Known vulnerabilities, with severity, CVE aliases and the version that fixes them | Fails at or above `--fail-on` (default `high`) |
+| OSV.dev — [OpenSSF malicious packages](https://github.com/ossf/malicious-packages) | Compromised releases (`MAL-*`), e.g. the Shai-Hulud worm versions | **Always fails**; cannot be allowlisted |
+| [CISA KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) | Vulnerabilities with evidence of **active exploitation** | Fails by default (`--no-fail-on-kev` to only warn) and prints the CRA Art. 14 reporting clock |
+
+```text
+  HIGH     [KEV] vite@6.2.3  (fix: vite@6.4.3)
+    GHSA-4r4m-qw57-chr8 / CVE-2025-31125 Vite has a `server.fs.deny` bypassed … [KEV since 2026-01-22]
+
+⚠ CRA Art. 14 — actively exploited vulnerability in a dependency
+    • Early warning ........ within 24 hours of becoming aware
+    • Notification ......... within 72 hours
+    • Final report ......... within 14 days after a corrective measure is available
+```
+
+Only package names and versions are sent to `api.osv.dev`; the KEV catalogue is downloaded from cisa.gov (or CISA's GitHub mirror). If KEV cannot be reached the report says so instead of silently passing, and if OSV.dev is unreachable the audit falls back to `npm audit`. `--vuln-source npm` uses `npm audit` directly.
+
+> CRA Annex I Part I (2)(a) — *placed on the market without known exploitable vulnerabilities*. Art. 14 — *actively exploited vulnerabilities must be reported within 24 hours*.
 
 ### 3. Third-party component check
 
@@ -138,6 +156,8 @@ cra-audit --help
 | `--format <fmt>` | SBOM format: `cyclonedx` (default) or `spdx`. |
 | `--creator <contact>` | Email or URL of the SBOM creator (TR-03183-2 §5.2.1). Defaults to the project's `package.json` `author` / `homepage` / `repository`. |
 | `--fail-on <sev>` | Minimum severity that fails the audit: `info`, `low`, `moderate`, `high`, `critical`. |
+| `--vuln-source <src>` | `osv` (default: OSV.dev + CISA KEV) or `npm` (`npm audit`). |
+| `--no-fail-on-kev` | Report actively exploited (CISA KEV) vulnerabilities as a warning instead of failing. |
 | `--production`, `--prod` | Audit production dependencies only. |
 | `--no-sbom` | Do not require an SBOM in the full audit. |
 | `--json` | Machine-readable JSON output. |
@@ -190,6 +210,8 @@ Create a `.cra-audit.json` file at the project root to customize the rules (ther
 ```json
 {
   "failOn": "high",
+  "failOnKev": true,
+  "vulnerabilitySource": "osv",
   "requireSbom": true,
   "sbomFormat": "cyclonedx",
   "sbomCreator": "security@example.com",
@@ -206,11 +228,13 @@ Create a `.cra-audit.json` file at the project root to customize the rules (ther
 ```
 
 - `failOn`: minimum severity that blocks the audit.
+- `failOnKev`: fail when a dependency has an actively exploited vulnerability (CISA KEV). Default `true`.
+- `vulnerabilitySource`: `osv` (OSV.dev + CISA KEV) or `npm` (`npm audit`).
 - `requireSbom`: require the SBOM to meet the TR-03183-2 required data fields.
 - `sbomFormat`: `cyclonedx` or `spdx`.
 - `sbomCreator`: email or URL of the entity that creates the SBOM (usually the manufacturer).
 - `productionOnly`: audit production dependencies only.
-- `vulnerabilities.allowlist`: advisory/CVE identifiers accepted with documented justification.
+- `vulnerabilities.allowlist`: package names or advisory ids (GHSA, CVE) accepted with documented justification, e.g. when the vulnerable code is not reachable in your product. Malicious packages (`MAL-*`) cannot be allowlisted.
 - `licenses.allow` / `licenses.deny`: allowed / denied lists (SPDX id).
 - `licenses.failOnMissing`: treat undocumented licenses as a failure.
 
@@ -245,7 +269,7 @@ const {
 } = require('cra-audit');
 
 const { policy, source } = loadPolicy(process.cwd());
-const report = runAudit(process.cwd(), policy, source);
+const report = await runAudit(process.cwd(), policy, source);
 console.log(report.gate.passed ? 'OK' : 'FAILED');
 
 // Maintenance data + custom HTML report
@@ -258,9 +282,13 @@ const signals = await enrichComponents(components, { network: true, github: true
 ## Requirements
 
 - Node.js >= 18 (uses native `fetch` and `node --test`).
-- `npm` available on the `PATH` (for `npm audit`).
+- Network access to `api.osv.dev` and `cisa.gov` (or `raw.githubusercontent.com` for the KEV mirror). `npm` on the `PATH` is only needed for `--vuln-source npm` or the offline fallback.
 - A lockfile present: `package-lock.json` / `npm-shrinkwrap.json` (npm), `yarn.lock` (Yarn classic or Berry) or `pnpm-lock.yaml` (pnpm). Run `npm install` / `yarn` / `pnpm install` if missing.
 
+## See also
+
+- [hulud-party-scanner](https://www.npmjs.com/package/hulud-party-scanner) — incident response for a machine that may have installed a compromised package: lifecycle-hook analysis, malicious code patterns and Shai-Hulud artifacts in the home directory.
+
 ## Legal notice
 
 `cra-audit` is a technical support tool. It helps verify controls associated with the CRA and TR-03183, but it **does not constitute legal advice** nor does it guarantee regulatory compliance on its own.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cra-audit",
-  "version": "1.1.0",
+  "version": "2.0.0",
   "description": "Audits npm, yarn, and pnpm projects for compliance with the European Cyber Resilience Act (CRA, EU Regulation 2024/2847) and BSI TR-03183: SBOM (CycloneDX/SPDX), known vulnerabilities, third-party components, and licenses.",
   "homepage": "https://github.com/migohe14/cra-audit#readme",
   "repository": {
@@ -43,6 +43,7 @@
     "bin",
     "src",
     "README.md",
+    "CHANGELOG.md",
     "LICENSE"
   ],
   "scripts": {

package/src/cli.js

@@ -20,6 +20,7 @@ const BOOLEAN_FLAGS = new Set([
   '--help', '--version', '--json', '--sbom', '--no-sbom',
   '--production', '--prod', '--no-color',
   '--visualize', '--offline', '--github', '--no-open',
+  '--fail-on-kev', '--no-fail-on-kev',
 ]);
 
 /**
@@ -152,6 +153,9 @@ function setFlag(flags, name, value) {
     case '--fail-on': flags.failOn = String(value).toLowerCase(); break;
     case '--cwd': flags.cwd = value; break;
     case '--creator': flags.creator = value; break;
+    case '--vuln-source': flags.vulnSource = String(value).toLowerCase(); break;
+    case '--fail-on-kev': flags.failOnKev = value; break;
+    case '--no-fail-on-kev': flags.noFailOnKev = value; break;
     default:
       // Unknown flag stored under its raw name for forward compatibility.
       flags[name.replace(/^--/, '')] = value;
@@ -172,7 +176,7 @@ ${c.bold('COMMANDS')}
   ${c.cyan('visualize')}             Generate an interactive HTML report (SBOM, licenses, versions and maintenance).
   ${c.cyan('sbom generate')}         Generate an SBOM (CycloneDX or SPDX) and print or save it.
   ${c.cyan('sbom check')}            Validate the SBOM against the TR-03183-2 v2.1 data fields.
-  ${c.cyan('vulnerabilities')}       Analyze known vulnerabilities only (alias: vuln).
+  ${c.cyan('vulnerabilities')}       Known, actively exploited (KEV) and malicious packages only (alias: vuln).
   ${c.cyan('licenses')}              Analyze dependency licenses only.
   ${c.cyan('help')}                  Show this help.
 
@@ -185,6 +189,8 @@ ${c.bold('OPTIONS')}
   ${c.cyan('--format <fmt>')}        SBOM format: cyclonedx (default) | spdx.
   ${c.cyan('--creator <contact>')}   Email or URL of the SBOM creator (default: package.json author/homepage).
   ${c.cyan('--fail-on <sev>')}       Minimum severity that fails the audit: info|low|moderate|high|critical.
+  ${c.cyan('--vuln-source <src>')}   Vulnerability source: osv (default: OSV.dev + CISA KEV) | npm (npm audit).
+  ${c.cyan('--no-fail-on-kev')}      Report actively exploited (CISA KEV) vulnerabilities without failing.
   ${c.cyan('--production, --prod')}  Audit production dependencies only (skips devDependencies).
   ${c.cyan('--no-sbom')}             Do not require an SBOM in the full audit.
   ${c.cyan('--json')}                Machine-readable JSON output.

package/src/commands/audit.js

@@ -13,9 +13,9 @@ const { reportJson } = require('../reporters/json');
  *
  * @param {object} flags Parsed CLI flags.
  * @param {'vulnerabilities'|'sbom'|'licenses'} [only]
- * @returns {number} Process exit code.
+ * @returns {Promise<number>} Process exit code.
  */
-function auditCommand(flags, only) {
+async function auditCommand(flags, only) {
   const projectRoot = resolveRoot(flags);
   if (!projectRoot) return 1;
 
@@ -28,7 +28,7 @@ function auditCommand(flags, only) {
   }
 
   const policy = applyFlagOverrides(policyResult.policy, flags);
-  const report = runAudit(projectRoot, policy, policyResult.source, { only });
+  const report = await runAudit(projectRoot, policy, policyResult.source, { only });
 
   if (flags.json) {
     reportJson(report, { outputPath: flags.output });
@@ -56,6 +56,9 @@ function applyFlagOverrides(policy, flags) {
   if (flags.production) merged.productionOnly = true;
   if (flags.format) merged.sbomFormat = flags.format;
   if (flags.noSbom) merged.requireSbom = false;
+  if (flags.vulnSource) merged.vulnerabilitySource = flags.vulnSource;
+  if (flags.failOnKev) merged.failOnKev = true;
+  if (flags.noFailOnKev) merged.failOnKev = false;
   return merged;
 }
 

package/src/commands/visualize.js

@@ -44,8 +44,11 @@ async function visualizeCommand(flags) {
 
   logger.info(`Analyzing ${parsed.components.length} components from ${parsed.root.name}@${parsed.root.version}…`);
 
-  // Vulnerabilities + licenses run locally (no network).
-  const vulns = scanVulnerabilities(projectRoot, { production: policy.productionOnly });
+  // --offline keeps the previous behaviour: npm audit instead of OSV.dev/KEV.
+  const vulns = await scanVulnerabilities(projectRoot, {
+    production: policy.productionOnly,
+    source: flags.offline ? 'npm' : policy.vulnerabilitySource,
+  });
   const licenses = checkLicenses(projectRoot, policy.licenses || {});
 
   // Maintenance enrichment over the network (opt-out with --offline).
@@ -87,9 +90,10 @@ async function visualizeCommand(flags) {
 
 /** Merges all data sources into the view model consumed by the HTML reporter. */
 function buildModel(parsed, vulns, licenses, enrichment) {
+  // OSV findings are per name@version; npm audit findings only per name.
   const vulnByName = new Map();
   if (vulns.ok) {
-    for (const v of vulns.vulnerabilities) vulnByName.set(v.name, v);
+    for (const v of vulns.vulnerabilities) vulnByName.set(v.version ? `${v.name}@${v.version}` : v.name, v);
   }
   const licByKey = new Map();
   if (licenses.ok) {
@@ -98,7 +102,7 @@ function buildModel(parsed, vulns, licenses, enrichment) {
 
   const components = parsed.components.map((c) => {
     const key = `${c.name}@${c.version}`;
-    const vuln = vulnByName.get(c.name) || null;
+    const vuln = vulnByName.get(key) || vulnByName.get(c.name) || null;
     const lic = licByKey.get(key) || null;
     const enr = enrichment.get(key) || {};
 

package/src/core/auditor.js

@@ -21,21 +21,28 @@ const { checkLicenses } = require('./license-checker');
  * @param {object} policy
  * @param {string|null} policySource
  * @param {{ only?: 'vulnerabilities'|'sbom'|'licenses' }} [options]
- * @returns {AuditResult}
+ * @returns {Promise<AuditResult>}
  */
-function runAudit(projectRoot, policy, policySource, options = {}) {
+async function runAudit(projectRoot, policy, policySource, options = {}) {
   const { only } = options;
   const sections = {};
   const reasons = [];
 
   // --- 1. Vulnerabilities -------------------------------------------------
   if (!only || only === 'vulnerabilities') {
-    const vulns = scanVulnerabilities(projectRoot, { production: policy.productionOnly });
+    const vulns = await scanVulnerabilities(projectRoot, {
+      production: policy.productionOnly,
+      source: policy.vulnerabilitySource,
+    });
     sections.vulnerabilities = vulns;
 
     if (!vulns.ok) {
       reasons.push({ label: `Vulnerabilities could not be analyzed: ${vulns.error}`, passed: false });
     } else {
+      for (const warning of vulns.warnings || []) {
+        reasons.push({ label: warning, passed: true, warning: true });
+      }
+      reasons.push(...exploitationReasons(vulns, policy));
       const blocking = countBlocking(vulns, policy);
       reasons.push({
         label: blocking === 0
@@ -97,22 +104,68 @@ function runAudit(projectRoot, policy, policySource, options = {}) {
   };
 }
 
+/**
+ * Gate reasons for the OSV source: malicious packages always block (they are
+ * compromised releases, not bugs, so the allowlist cannot accept them), and
+ * actively exploited vulnerabilities (CISA KEV) block unless `failOnKev` is off.
+ */
+function exploitationReasons(vulns, policy) {
+  if (vulns.source !== 'osv') return [];
+  const reasons = [];
+
+  const malicious = vulns.vulnerabilities.filter((v) => v.malicious);
+  reasons.push({
+    label: malicious.length === 0
+      ? 'No malicious packages (OpenSSF malicious-packages via OSV.dev)'
+      : `${malicious.length} malicious package(s): ${malicious.map((v) => `${v.name}@${v.version}`).join(', ')}`,
+    passed: malicious.length === 0,
+  });
+
+  if (!vulns.kev || !vulns.kev.checked) {
+    reasons.push({
+      label: `Actively exploited vulnerabilities not checked: ${(vulns.kev && vulns.kev.error) || 'CISA KEV unavailable'}`,
+      passed: true,
+      warning: true,
+    });
+    return reasons;
+  }
+
+  const exploited = vulns.vulnerabilities.filter((v) => v.kev && !isAllowlisted(v, policy));
+  reasons.push({
+    label: exploited.length === 0
+      ? 'No actively exploited vulnerabilities (CISA KEV)'
+      : `${exploited.length} component(s) with actively exploited vulnerabilities (CISA KEV) — CRA Art. 14 reporting may apply`,
+    passed: exploited.length === 0 || policy.failOnKev === false,
+    warning: exploited.length > 0 && policy.failOnKev === false,
+  });
+  return reasons;
+}
+
 function countBlocking(vulns, policy) {
   const threshold = SEVERITY_ORDER.indexOf(policy.failOn);
   if (threshold === -1) return 0;
-  const allowlist = new Set((policy.vulnerabilities && policy.vulnerabilities.allowlist) || []);
 
   let count = 0;
   for (const vuln of vulns.vulnerabilities) {
     if (SEVERITY_ORDER.indexOf(vuln.severity) < threshold) continue;
-    const isAllowlisted = vuln.sources.some(
-      (src) => src.url && [...allowlist].some((id) => src.url.includes(id))
-    ) || allowlist.has(vuln.name);
-    if (!isAllowlisted) count++;
+    if (!vuln.malicious && isAllowlisted(vuln, policy)) continue;
+    count++;
   }
   return count;
 }
 
+/**
+ * A finding is accepted when the policy allowlist names the package, or every
+ * advisory on it by id/alias (GHSA, CVE) or advisory URL.
+ */
+function isAllowlisted(vuln, policy) {
+  const allowlist = (policy.vulnerabilities && policy.vulnerabilities.allowlist) || [];
+  if (!allowlist.length) return false;
+  if (allowlist.includes(vuln.name)) return true;
+  return vuln.sources.every((src) => allowlist.some((id) =>
+    [src.id, ...(src.aliases || [])].includes(id) || (src.url && src.url.includes(id))));
+}
+
 function getProject(projectRoot, sections) {
   // Derive project identity from any section that parsed the lockfile/root.
   if (sections.sbom && sections.sbom.ok && sections.sbom.document) {

package/src/core/kev.js

@@ -0,0 +1,44 @@
+'use strict';
+
+const { fetchJson } = require('../utils/http');
+
+/**
+ * CISA Known Exploited Vulnerabilities catalogue: the most complete public
+ * list of vulnerabilities with evidence of active exploitation. Under CRA
+ * Art. 14 (applicable since 11 September 2026) manufacturers must report
+ * actively exploited vulnerabilities in their products within 24 hours.
+ *
+ * The GitHub mirror maintained by CISA is used when the primary feed fails.
+ */
+const KEV_SOURCES = [
+  'https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json',
+  'https://raw.githubusercontent.com/cisagov/kev-data/develop/known_exploited_vulnerabilities.json',
+];
+
+/**
+ * @returns {Promise<{ ok: true, catalogVersion: string|null, count: number, byCve: Map<string, object> }
+ *   | { ok: false, error: string }>}
+ */
+async function loadKev({ timeout = 20000 } = {}) {
+  for (const url of KEV_SOURCES) {
+    const res = await fetchJson(url, { timeout });
+    const list = res && res.ok && res.json && res.json.vulnerabilities;
+    if (!Array.isArray(list)) continue;
+
+    const byCve = new Map();
+    for (const entry of list) {
+      if (!entry || !entry.cveID) continue;
+      byCve.set(entry.cveID.toUpperCase(), {
+        cve: entry.cveID,
+        name: entry.vulnerabilityName || null,
+        dateAdded: entry.dateAdded || null,
+        dueDate: entry.dueDate || null,
+        knownRansomwareCampaignUse: entry.knownRansomwareCampaignUse || null,
+      });
+    }
+    return { ok: true, catalogVersion: res.json.catalogVersion || null, count: byCve.size, byCve };
+  }
+  return { ok: false, error: 'CISA KEV catalogue unreachable' };
+}
+
+module.exports = { loadKev };

package/src/core/osv.js

@@ -0,0 +1,211 @@
+'use strict';
+
+const { fetchJson, mapLimit } = require('../utils/http');
+
+const OSV_API = 'https://api.osv.dev/v1';
+const BATCH_SIZE = 1000; // OSV querybatch limit
+
+/**
+ * Queries OSV.dev (https://osv.dev) for the advisories affecting each exact
+ * `name@version`. OSV aggregates the GitHub Advisory Database (GHSA) and the
+ * OpenSSF malicious-packages feed (MAL-*), which lists compromised releases
+ * such as the ones published by the Shai-Hulud worm.
+ *
+ * Only package names and versions leave the machine.
+ *
+ * @param {Array<{ name: string, version: string }>} components
+ * @param {{ timeout?: number, concurrency?: number }} [options]
+ * @returns {Promise<{ ok: true, byComponent: Map<string, object[]> } | { ok: false, error: string }>}
+ *   `byComponent` is keyed by `name@version` and holds full OSV records.
+ */
+async function queryOsv(components, { timeout = 30000, concurrency = 8 } = {}) {
+  const idsByKey = new Map();
+
+  for (let i = 0; i < components.length; i += BATCH_SIZE) {
+    const chunk = components.slice(i, i + BATCH_SIZE);
+    const res = await fetchJson(`${OSV_API}/querybatch`, {
+      timeout,
+      body: { queries: chunk.map((c) => ({ package: { name: c.name, ecosystem: 'npm' }, version: c.version })) },
+    });
+    if (!res || !res.ok || !res.json || !Array.isArray(res.json.results)) {
+      return { ok: false, error: `OSV.dev query failed${res ? ` (HTTP ${res.status})` : ' (network unreachable)'}` };
+    }
+
+    for (let j = 0; j < chunk.length; j++) {
+      const result = res.json.results[j] || {};
+      const ids = (result.vulns || []).map((v) => v.id);
+      // A package with many advisories is paginated: follow the token.
+      let pageToken = result.next_page_token;
+      while (pageToken) {
+        const page = await fetchJson(`${OSV_API}/query`, {
+          timeout,
+          body: { package: { name: chunk[j].name, ecosystem: 'npm' }, version: chunk[j].version, page_token: pageToken },
+        });
+        if (!page || !page.ok || !page.json) break;
+        ids.push(...(page.json.vulns || []).map((v) => v.id));
+        pageToken = page.json.next_page_token;
+      }
+      if (ids.length) idsByKey.set(`${chunk[j].name}@${chunk[j].version}`, ids);
+    }
+  }
+
+  // querybatch only returns ids: fetch each distinct record once.
+  const uniqueIds = [...new Set([].concat(...idsByKey.values()))];
+  const records = new Map();
+  let failed = 0;
+  await mapLimit(uniqueIds, async (id) => {
+    const res = await fetchJson(`${OSV_API}/vulns/${encodeURIComponent(id)}`, { timeout });
+    if (res && res.ok && res.json) records.set(id, res.json);
+    else failed++;
+  }, concurrency);
+  if (failed) {
+    return { ok: false, error: `Could not download ${failed} advisory record(s) from OSV.dev` };
+  }
+
+  const byComponent = new Map();
+  for (const [key, ids] of idsByKey) {
+    const list = ids.map((id) => records.get(id)).filter((r) => r && !r.withdrawn);
+    // The same advisory can appear under two ids (e.g. GHSA and its CVE).
+    const seen = new Set();
+    const unique = [];
+    for (const record of list) {
+      if (seen.has(record.id)) continue;
+      [record.id, ...(record.aliases || [])].forEach((a) => seen.add(a));
+      unique.push(record);
+    }
+    byComponent.set(key, unique);
+  }
+  return { ok: true, byComponent };
+}
+
+/**
+ * Severity of an OSV record in npm-audit terms. Malicious packages are always
+ * critical; GHSA records carry a reviewed rating; otherwise the CVSS v3 base
+ * score is computed from the vector.
+ *
+ * @returns {'low'|'moderate'|'high'|'critical'|'unknown'}
+ */
+function osvSeverity(record) {
+  if (isMalicious(record)) return 'critical';
+
+  const rated = record.database_specific && record.database_specific.severity;
+  if (typeof rated === 'string') {
+    const s = rated.toLowerCase();
+    if (s === 'medium') return 'moderate';
+    if (['low', 'moderate', 'high', 'critical'].includes(s)) return s;
+  }
+
+  const score = cvssScore(record);
+  if (score === null) return 'unknown';
+  if (score >= 9) return 'critical';
+  if (score >= 7) return 'high';
+  if (score >= 4) return 'moderate';
+  return 'low';
+}
+
+/** CVSS v3 base score of the record, or null when it has no v3 vector. */
+function cvssScore(record) {
+  const v3 = (record.severity || []).find((s) => s.type === 'CVSS_V3');
+  return v3 ? cvss3BaseScore(v3.score) : null;
+}
+
+/** OpenSSF malicious-packages advisories use the MAL- prefix. */
+function isMalicious(record) {
+  return typeof record.id === 'string' && record.id.startsWith('MAL-');
+}
+
+/**
+ * Lowest version that fixes the advisory for the installed version, taken from
+ * the OSV `affected[].ranges[].events` of this package.
+ *
+ * @returns {string|null}
+ */
+function fixedVersion(record, name, version) {
+  let best = null;
+  for (const affected of record.affected || []) {
+    if (!affected.package || affected.package.name !== name) continue;
+    for (const range of affected.ranges || []) {
+      if (range.type !== 'SEMVER' && range.type !== 'ECOSYSTEM') continue;
+      let introduced = null;
+      for (const event of range.events || []) {
+        if (event.introduced !== undefined) introduced = event.introduced;
+        if (event.fixed === undefined) continue;
+        const inRange = (introduced === '0' || introduced === null || compareSemver(version, introduced) >= 0) &&
+          compareSemver(version, event.fixed) < 0;
+        if (inRange && (!best || compareSemver(event.fixed, best) < 0)) best = event.fixed;
+      }
+    }
+  }
+  return best;
+}
+
+/**
+ * Compares two semver strings (major.minor.patch[-prerelease]).
+ * Build metadata is ignored.
+ */
+function compareSemver(a, b) {
+  const parse = (v) => {
+    const [core, pre] = String(v).split('+')[0].split(/-(.*)/s);
+    return { nums: core.split('.').map((n) => parseInt(n, 10) || 0), pre: pre ? pre.split('.') : [] };
+  };
+  const pa = parse(a);
+  const pb = parse(b);
+  for (let i = 0; i < 3; i++) {
+    const diff = (pa.nums[i] || 0) - (pb.nums[i] || 0);
+    if (diff) return diff;
+  }
+  // A version without prerelease is greater than one with it.
+  if (!pa.pre.length || !pb.pre.length) return pb.pre.length - pa.pre.length;
+  for (let i = 0; i < Math.max(pa.pre.length, pb.pre.length); i++) {
+    const x = pa.pre[i];
+    const y = pb.pre[i];
+    if (x === undefined) return -1;
+    if (y === undefined) return 1;
+    const nx = /^\d+$/.test(x);
+    const ny = /^\d+$/.test(y);
+    if (nx && ny && Number(x) !== Number(y)) return Number(x) - Number(y);
+    if (nx !== ny) return nx ? -1 : 1;
+    if (x !== y) return x < y ? -1 : 1;
+  }
+  return 0;
+}
+
+const CVSS3_WEIGHTS = {
+  AV: { N: 0.85, A: 0.62, L: 0.55, P: 0.2 },
+  AC: { L: 0.77, H: 0.44 },
+  UI: { N: 0.85, R: 0.62 },
+  C: { H: 0.56, L: 0.22, N: 0 },
+  I: { H: 0.56, L: 0.22, N: 0 },
+  A: { H: 0.56, L: 0.22, N: 0 },
+};
+
+/** CVSS v3.0/v3.1 base score from a vector string (FIRST specification). */
+function cvss3BaseScore(vector) {
+  const m = {};
+  for (const part of String(vector).split('/')) {
+    const [k, v] = part.split(':');
+    m[k] = v;
+  }
+  const scopeChanged = m.S === 'C';
+  const pr = { N: 0.85, L: scopeChanged ? 0.68 : 0.62, H: scopeChanged ? 0.5 : 0.27 }[m.PR];
+  const w = CVSS3_WEIGHTS;
+  const values = [w.AV[m.AV], w.AC[m.AC], pr, w.UI[m.UI], w.C[m.C], w.I[m.I], w.A[m.A]];
+  if (values.some((x) => x === undefined)) return null;
+  const [av, ac, , ui, c, i, a] = values;
+
+  const iss = 1 - (1 - c) * (1 - i) * (1 - a);
+  const impact = scopeChanged ? 7.52 * (iss - 0.029) - 3.25 * Math.pow(iss - 0.02, 15) : 6.42 * iss;
+  if (impact <= 0) return 0;
+  const exploitability = 8.22 * av * ac * pr * ui;
+  const raw = scopeChanged ? Math.min(1.08 * (impact + exploitability), 10) : Math.min(impact + exploitability, 10);
+  return roundUp(raw);
+}
+
+function roundUp(value) {
+  const int = Math.round(value * 100000);
+  return int % 10000 === 0 ? int / 100000 : (Math.floor(int / 10000) + 1) / 10;
+}
+
+module.exports = {
+  queryOsv, osvSeverity, cvssScore, isMalicious, fixedVersion, compareSemver, cvss3BaseScore,
+};

package/src/core/policy.js

@@ -18,6 +18,11 @@ const DEFAULT_POLICY = {
   // Email or URL of the SBOM creator (TR-03183-2 §5.2.1). Defaults to the
   // project's package.json author, homepage or repository.
   sbomCreator: null,
+  // Vulnerability source: `osv` (OSV.dev + CISA KEV) or `npm` (npm audit).
+  vulnerabilitySource: 'osv',
+  // Fail when a dependency has an actively exploited vulnerability (CISA KEV),
+  // the trigger of the CRA Art. 14 reporting obligation.
+  failOnKev: true,
   // Audit only production dependencies (recommended for shipped products).
   productionOnly: false,
   vulnerabilities: {

package/src/core/vuln-scanner.js

@@ -4,24 +4,174 @@ const fs = require('node:fs');
 const os = require('node:os');
 const path = require('node:path');
 const { runJson } = require('../utils/exec');
-const { exists } = require('../utils/fs');
-const { parseLockfile, toNpmLockfile } = require('./lockfile-parser');
+const { exists, readJson } = require('../utils/fs');
+const { parseLockfile, toNpmLockfile, componentKey } = require('./lockfile-parser');
+const {
+  queryOsv, osvSeverity, cvssScore, isMalicious, fixedVersion, compareSemver,
+} = require('./osv');
+const { loadKev } = require('./kev');
 
 const SEVERITY_ORDER = ['info', 'low', 'moderate', 'high', 'critical'];
 
 /**
- * Scans direct and transitive dependencies for known vulnerabilities using
- * `npm audit --json`. The CRA requires products to ship "without known
- * exploitable vulnerabilities", so this is the core gate of the audit.
+ * Scans direct and transitive dependencies for known vulnerabilities. The CRA
+ * requires products to ship "without known exploitable vulnerabilities"
+ * (Annex I) and, since 11 September 2026, the reporting of actively exploited
+ * ones (Art. 14), so this is the core gate of the audit.
  *
- * npm projects are audited in place. Yarn/pnpm projects (which have no npm
- * lockfile) are audited against a synthetic `package-lock.json` generated from
- * their lockfile, preserving the exact installed versions.
+ * Sources:
+ *  - `osv` (default): every exact `name@version` from the lockfile is checked
+ *    against OSV.dev (GitHub advisories + OpenSSF malicious packages), and the
+ *    CVEs found are cross-checked with the CISA KEV catalogue.
+ *  - `npm`: `npm audit`. Also the fallback when OSV.dev is unreachable.
  *
  * @param {string} projectRoot
- * @param {{ production?: boolean }} [options]
+ * @param {{ production?: boolean, source?: 'osv'|'npm', kev?: boolean }} [options]
+ * @returns {Promise<object>}
  */
-function scanVulnerabilities(projectRoot, { production = false } = {}) {
+async function scanVulnerabilities(projectRoot, { production = false, source = 'osv', kev = true } = {}) {
+  if (source === 'npm') return npmAuditSection(projectRoot, { production });
+
+  const parsed = parseLockfile(projectRoot);
+  if (!parsed.ok) {
+    return { ok: false, error: parsed.error, counts: emptyCounts(), vulnerabilities: [] };
+  }
+
+  const rootPkg = readJson(path.join(projectRoot, 'package.json')) || {};
+  const components = production ? productionComponents(parsed, rootPkg) : parsed.components;
+  const scannable = components.filter((c) => c.name && c.version);
+
+  const [osv, catalogue] = await Promise.all([
+    queryOsv(scannable),
+    kev ? loadKev() : Promise.resolve(null),
+  ]);
+
+  if (!osv.ok) {
+    const fallback = npmAuditSection(projectRoot, { production });
+    fallback.warnings = [`${osv.error}; fell back to \`npm audit\` (no malicious-package or KEV check).`];
+    return fallback;
+  }
+
+  const direct = new Set(parsed.root.dependsOn);
+  const vulnerabilities = [];
+  for (const c of scannable) {
+    const key = componentKey(c.name, c.version);
+    const records = osv.byComponent.get(key);
+    if (!records || !records.length) continue;
+    vulnerabilities.push(toFinding(c, records, direct.has(key), catalogue));
+  }
+
+  const counts = emptyCounts();
+  for (const v of vulnerabilities) {
+    counts[v.severity] = (counts[v.severity] || 0) + 1;
+    if (v.malicious) counts.malicious++;
+    if (v.kev) counts.kev++;
+  }
+  counts.total = vulnerabilities.length;
+
+  return {
+    ok: true,
+    source: 'osv',
+    scanned: scannable.length,
+    kev: catalogue
+      ? (catalogue.ok
+        ? { checked: true, catalogVersion: catalogue.catalogVersion, entries: catalogue.count }
+        : { checked: false, error: catalogue.error })
+      : { checked: false, error: 'KEV check disabled' },
+    counts,
+    vulnerabilities: sortBySeverity(vulnerabilities),
+  };
+}
+
+/** One finding per vulnerable component, aggregating its OSV records. */
+function toFinding(component, records, isDirect, catalogue) {
+  const sources = records.map((record) => {
+    const aliases = record.aliases || [];
+    const cves = [record.id, ...aliases].filter((id) => /^CVE-/i.test(id));
+    const kevEntry = catalogue && catalogue.ok
+      ? cves.map((cve) => catalogue.byCve.get(cve.toUpperCase())).find(Boolean) || null
+      : null;
+    return {
+      id: record.id,
+      aliases,
+      title: record.summary || (isMalicious(record) ? 'Malicious package' : record.id),
+      url: `https://osv.dev/vulnerability/${record.id}`,
+      severity: osvSeverity(record),
+      cvss: cvssScore(record),
+      cwe: (record.database_specific && record.database_specific.cwe_ids) || [],
+      malicious: isMalicious(record),
+      fixed: fixedVersion(record, component.name, component.version),
+      kev: kevEntry,
+    };
+  });
+
+  const severity = sources.map((s) => s.severity)
+    .reduce((max, s) => (severityRank(s) > severityRank(max) ? s : max), 'unknown');
+  const fixes = sources.map((s) => s.fixed);
+  // Only claim a fix when every advisory has one; suggest the highest of them.
+  const fix = fixes.every(Boolean)
+    ? fixes.reduce((a, b) => (compareSemver(a, b) >= 0 ? a : b))
+    : null;
+
+  return {
+    name: component.name,
+    version: component.version,
+    severity,
+    direct: isDirect,
+    range: null,
+    malicious: sources.some((s) => s.malicious),
+    kev: sources.some((s) => s.kev),
+    fixAvailable: fix
+      ? { name: component.name, version: fix, breaking: major(fix) !== major(component.version) }
+      : false,
+    // Malicious and actively exploited advisories first, then by severity.
+    sources: sources.sort((a, b) => Number(b.malicious) - Number(a.malicious) ||
+      Number(Boolean(b.kev)) - Number(Boolean(a.kev)) ||
+      severityRank(b.severity) - severityRank(a.severity)),
+  };
+}
+
+/**
+ * Components reachable from the production dependencies declared in
+ * package.json (`dependencies` + `optionalDependencies`), following the graph.
+ */
+function productionComponents(parsed, rootPkg) {
+  const prodNames = new Set([
+    ...Object.keys(rootPkg.dependencies || {}),
+    ...Object.keys(rootPkg.optionalDependencies || {}),
+  ]);
+  const byKey = new Map(parsed.components.map((c) => [componentKey(c.name, c.version), c]));
+  const queue = parsed.root.dependsOn.filter((key) => prodNames.has(byKey.has(key) ? byKey.get(key).name : null));
+  const seen = new Set(queue);
+  while (queue.length) {
+    const comp = byKey.get(queue.shift());
+    if (!comp) continue;
+    for (const dep of comp.dependsOn) {
+      if (!seen.has(dep)) { seen.add(dep); queue.push(dep); }
+    }
+  }
+  return parsed.components.filter((c) => seen.has(componentKey(c.name, c.version)));
+}
+
+function severityRank(severity) {
+  return SEVERITY_ORDER.indexOf(severity);
+}
+
+function major(version) {
+  return parseInt(String(version).split('.')[0], 10);
+}
+
+/** `npm audit` source, used on request or as the OSV fallback. */
+function npmAuditSection(projectRoot, { production }) {
+  const result = npmAudit(projectRoot, { production });
+  return {
+    ...result,
+    source: 'npm-audit',
+    kev: { checked: false, error: 'npm audit reports no CVE identifiers' },
+  };
+}
+
+function npmAudit(projectRoot, { production = false } = {}) {
   if (hasNpmLockfile(projectRoot)) {
     return runNpmAudit(projectRoot, { production });
   }
@@ -187,7 +337,7 @@ function normalizeFix(fixAvailable) {
 }
 
 function emptyCounts() {
-  return { info: 0, low: 0, moderate: 0, high: 0, critical: 0, total: 0 };
+  return { info: 0, low: 0, moderate: 0, high: 0, critical: 0, unknown: 0, malicious: 0, kev: 0, total: 0 };
 }
 
 function sumCounts(counts) {

package/src/index.js

@@ -6,7 +6,7 @@
  * Example:
  *   const { runAudit, loadPolicy } = require('cra-audit');
  *   const { policy, source } = loadPolicy(process.cwd());
- *   const report = runAudit(process.cwd(), policy, source);
+ *   const report = await runAudit(process.cwd(), policy, source);
  */
 
 const { runAudit } = require('./core/auditor');

package/src/reporters/console.js

@@ -30,36 +30,78 @@ function reportConsole(report) {
 }
 
 function renderVulnerabilities(section) {
-  logger.heading('1) Known vulnerabilities (CRA Art. 13)');
+  logger.heading('1) Known vulnerabilities (CRA Annex I · Art. 14)');
   if (!section.ok) {
     logger.error(section.error);
     return;
   }
+  logger.detail(describeSources(section));
+  for (const warning of section.warnings || []) logger.warn(warning);
 
   const c = section.counts;
   if (c.total === 0) {
-    logger.success('No known vulnerabilities. Meets the "zero exploitable vulnerabilities" requirement.');
+    logger.success('No known vulnerabilities. Meets the "no known exploitable vulnerabilities" requirement.');
     return;
   }
 
   logger.log(
     `  ${color.red(`${c.critical} critical`)} · ${color.red(`${c.high} high`)} · ` +
-    `${color.yellow(`${c.moderate} moderate`)} · ${color.yellow(`${c.low} low`)} · ${color.gray(`${c.info} info`)}`
+    `${color.yellow(`${c.moderate} moderate`)} · ${color.yellow(`${c.low} low`)} · ${color.gray(`${c.info} info`)}` +
+    (c.unknown ? color.gray(` · ${c.unknown} unrated`) : '') +
+    (c.kev ? ` · ${color.red(color.bold(`${c.kev} actively exploited (KEV)`))}` : '') +
+    (c.malicious ? ` · ${color.red(color.bold(`${c.malicious} MALICIOUS`))}` : '')
   );
 
-  const top = section.vulnerabilities.slice(0, 15);
+  // Malicious and exploited findings first: they are the urgent ones.
+  const urgency = (v) => (v.malicious ? 2 : v.kev ? 1 : 0);
+  const ordered = [...section.vulnerabilities].sort((a, b) => urgency(b) - urgency(a));
+  const top = ordered.slice(0, 15);
   for (const vuln of top) {
     const sev = (SEVERITY_COLORS[vuln.severity] || color.gray)(vuln.severity.toUpperCase().padEnd(8));
-    const fix = describeFix(vuln.fixAvailable);
-    logger.log(`  ${sev} ${color.bold(vuln.name)} ${color.gray(vuln.range || '')} ${fix}`);
-    const adv = vuln.sources[0];
-    if (adv && adv.title) logger.detail(`${adv.title}${adv.url ? ' — ' + adv.url : ''}`);
+    const tags = (vuln.malicious ? color.red(color.bold('[MALICIOUS] ')) : '') + (vuln.kev ? color.red(color.bold('[KEV] ')) : '');
+    const label = vuln.version ? `${vuln.name}@${vuln.version}` : vuln.name;
+    const fix = vuln.malicious ? color.red('(remove it and rotate any exposed credentials)') : describeFix(vuln.fixAvailable);
+    logger.log(`  ${sev} ${tags}${color.bold(label)} ${color.gray(vuln.range || '')} ${fix}`);
+    for (const adv of vuln.sources.slice(0, 3)) {
+      const kev = adv.kev ? color.red(` [KEV since ${adv.kev.dateAdded}]`) : '';
+      const id = adv.id ? `${adv.id}${(adv.aliases || []).filter((a) => a.startsWith('CVE-')).map((a) => ` / ${a}`).join('')} ` : '';
+      logger.detail(`${id}${adv.title || ''}${kev}${adv.url ? ' — ' + adv.url : ''}`);
+    }
+    if (vuln.sources.length > 3) logger.detail(`… and ${vuln.sources.length - 3} more advisories.`);
+  }
+  if (ordered.length > top.length) {
+    logger.detail(`… and ${ordered.length - top.length} more.`);
   }
-  if (section.vulnerabilities.length > top.length) {
-    logger.detail(`… and ${section.vulnerabilities.length - top.length} more.`);
+
+  if (c.kev) renderArticle14Notice();
+  if (c.malicious) {
+    logger.log('');
+    logger.error(color.bold('Malicious package(s) detected: treat this as a security incident.'));
+    logger.detail('Remove the package, reinstall from a clean lockfile, and rotate every credential');
+    logger.detail('available to machines that installed it (npm/GitHub tokens, cloud keys, CI secrets).');
   }
 }
 
+function describeSources(section) {
+  if (section.source !== 'osv') return 'Source: npm audit';
+  const kev = section.kev && section.kev.checked
+    ? `CISA KEV ${section.kev.catalogVersion || ''} (${section.kev.entries} entries)`.replace('  ', ' ')
+    : `CISA KEV not checked (${(section.kev && section.kev.error) || 'unavailable'})`;
+  return `Sources: OSV.dev (GitHub advisories + OpenSSF malicious packages) · ${kev} · ${section.scanned} components`;
+}
+
+/** CRA Art. 14 reporting clock, shown when a KEV-listed vulnerability is found. */
+function renderArticle14Notice() {
+  logger.log('');
+  logger.warn(color.bold('CRA Art. 14 — actively exploited vulnerability in a dependency'));
+  logger.detail('If it affects a product with digital elements you place on the EU market, notify');
+  logger.detail('the coordinating CSIRT and ENISA through the Single Reporting Platform:');
+  logger.detail('  • Early warning ........ within 24 hours of becoming aware');
+  logger.detail('  • Notification ......... within 72 hours');
+  logger.detail('  • Final report ......... within 14 days after a corrective measure is available');
+  logger.detail('Assess exploitability in your product first; document the decision either way.');
+}
+
 function describeFix(fix) {
   if (fix === true) return color.green('(fix available)');
   if (fix && typeof fix === 'object') {
@@ -122,7 +164,7 @@ function renderLicenses(section) {
 function renderSummary(report) {
   logger.heading('Result');
   for (const item of report.gate.reasons) {
-    const mark = item.passed ? color.green('✔') : color.red('✖');
+    const mark = !item.passed ? color.red('✖') : item.warning ? color.yellow('!') : color.green('✔');
     logger.log(`  ${mark} ${item.label}`);
   }
   logger.log('');

package/src/reporters/json.js

@@ -11,7 +11,7 @@ const { writeJson } = require('../utils/fs');
 function reportJson(report, { outputPath } = {}) {
   if (outputPath) {
     writeJson(outputPath, report);
-    logger.success(`Informe JSON escrito en: ${outputPath}`);
+    logger.success(`JSON report written to: ${outputPath}`);
   } else {
     process.stdout.write(JSON.stringify(report, null, 2) + '\n');
   }

package/src/utils/http.js

@@ -8,21 +8,28 @@
 
 /**
  * @param {string} url
- * @param {{ timeout?: number, headers?: object }} [options]
+ * @param {{ timeout?: number, headers?: object, body?: any }} [options]
+ *   `body`: sent as a JSON POST when present.
  * @returns {Promise<{ ok: boolean, status: number, json: any, headers: Headers }|null>}
  */
-async function fetchJson(url, { timeout = 8000, headers = {} } = {}) {
+async function fetchJson(url, { timeout = 8000, headers = {}, body } = {}) {
   if (typeof fetch !== 'function') return null;
 
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), timeout);
 
   try {
-    const res = await fetch(url, {
+    const init = {
       headers: { Accept: 'application/json', ...headers },
       signal: controller.signal,
       redirect: 'follow',
-    });
+    };
+    if (body !== undefined) {
+      init.method = 'POST';
+      init.headers['Content-Type'] = 'application/json';
+      init.body = JSON.stringify(body);
+    }
+    const res = await fetch(url, init);
     let json = null;
     try {
       json = await res.json();