cra-audit 1.1.0 → 2.1.0

package/src/core/vex.js

@@ -0,0 +1,264 @@
+'use strict';
+
+const crypto = require('node:crypto');
+const { buildPurl } = require('./lockfile-parser');
+
+const TOOL_NAME = 'cra-audit';
+const TOOL_VERSION = require('../../package.json').version;
+
+/**
+ * VEX (Vulnerability Exploitability eXchange) states the exploitability of
+ * each known vulnerability in the product. TR-03183-2 keeps vulnerability data
+ * out of the SBOM and points to VEX for it, and the CRA asks manufacturers to
+ * document how each vulnerability was assessed.
+ *
+ * The assessments come from the policy allowlist
+ * (`vulnerabilities.allowlist` in .cra-audit.json). Entries can be plain ids
+ * or package names (legacy), or objects:
+ *
+ *   { "id": "CVE-2021-23337", "package": "lodash",
+ *     "status": "not_affected", "justification": "code_not_reachable",
+ *     "detail": "We never call _.template with user input." }
+ */
+
+/** Statuses, as written in the policy, and whether they accept the finding. */
+const STATUSES = {
+  not_affected: { accepts: true, cdx: 'not_affected', openvex: 'not_affected' },
+  false_positive: { accepts: true, cdx: 'false_positive', openvex: 'not_affected' },
+  affected: { accepts: false, cdx: 'exploitable', openvex: 'affected' },
+  under_investigation: { accepts: false, cdx: 'in_triage', openvex: 'under_investigation' },
+};
+
+/**
+ * Justifications accepted in the policy (CycloneDX or OpenVEX vocabulary) and
+ * their equivalent in the other format.
+ */
+const JUSTIFICATIONS = {
+  code_not_present: { cdx: 'code_not_present', openvex: 'vulnerable_code_not_present' },
+  code_not_reachable: { cdx: 'code_not_reachable', openvex: 'vulnerable_code_not_in_execute_path' },
+  requires_configuration: { cdx: 'requires_configuration', openvex: 'vulnerable_code_cannot_be_controlled_by_adversary' },
+  requires_dependency: { cdx: 'requires_dependency', openvex: 'vulnerable_code_not_in_execute_path' },
+  requires_environment: { cdx: 'requires_environment', openvex: 'vulnerable_code_cannot_be_controlled_by_adversary' },
+  protected_by_compiler: { cdx: 'protected_by_compiler', openvex: 'inline_mitigations_already_exist' },
+  protected_at_runtime: { cdx: 'protected_at_runtime', openvex: 'inline_mitigations_already_exist' },
+  protected_at_perimeter: { cdx: 'protected_at_perimeter', openvex: 'inline_mitigations_already_exist' },
+  protected_by_mitigating_control: { cdx: 'protected_by_mitigating_control', openvex: 'inline_mitigations_already_exist' },
+  component_not_present: { cdx: 'code_not_present', openvex: 'component_not_present' },
+  vulnerable_code_not_present: { cdx: 'code_not_present', openvex: 'vulnerable_code_not_present' },
+  vulnerable_code_not_in_execute_path: { cdx: 'code_not_reachable', openvex: 'vulnerable_code_not_in_execute_path' },
+  vulnerable_code_cannot_be_controlled_by_adversary: { cdx: 'requires_environment', openvex: 'vulnerable_code_cannot_be_controlled_by_adversary' },
+  inline_mitigations_already_exist: { cdx: 'protected_by_mitigating_control', openvex: 'inline_mitigations_already_exist' },
+};
+
+/**
+ * Normalizes the policy allowlist into assessment objects.
+ * @returns {Array<{ id: string|null, package: string|null, status: string, justification: string|null, detail: string|null }>}
+ */
+function normalizeAllowlist(policy) {
+  const list = (policy && policy.vulnerabilities && policy.vulnerabilities.allowlist) || [];
+  return list.map((entry) => {
+    if (typeof entry === 'string') {
+      // Legacy form: a package name, an advisory id/alias or an advisory URL fragment.
+      return { id: entry, package: null, status: 'not_affected', justification: null, detail: null, legacy: true };
+    }
+    const status = STATUSES[entry.status] ? entry.status : 'not_affected';
+    return {
+      id: entry.id || null,
+      package: entry.package || null,
+      status,
+      justification: JUSTIFICATIONS[entry.justification] ? entry.justification : null,
+      detail: entry.detail || null,
+    };
+  });
+}
+
+/** Does an assessment apply to one advisory of a finding? */
+function entryMatches(entry, finding, source) {
+  if (entry.legacy && entry.id === finding.name) return true;
+  if (entry.package && entry.package !== finding.name) return false;
+  if (!entry.id) return Boolean(entry.package);
+  const ids = [source.id, ...(source.aliases || [])].filter(Boolean);
+  return ids.includes(entry.id) || Boolean(source.url && source.url.includes(entry.id));
+}
+
+/** The assessment recorded for one advisory of a finding, if any. */
+function assessmentFor(finding, source, entries) {
+  return entries.find((e) => entryMatches(e, finding, source)) || null;
+}
+
+/**
+ * A finding is accepted when every advisory on it has an accepting assessment
+ * (not_affected / false_positive). Malicious packages are never accepted.
+ *
+ * @returns {{ accepted: boolean, unjustified: number }}
+ */
+function acceptance(finding, policy) {
+  const entries = normalizeAllowlist(policy);
+  if (!entries.length || finding.malicious) return { accepted: false, unjustified: 0 };
+  const assessments = finding.sources.map((s) => assessmentFor(finding, s, entries));
+  const accepted = assessments.every((a) => a && STATUSES[a.status].accepts);
+  const unjustified = accepted ? assessments.filter((a) => !a.justification && !a.detail).length : 0;
+  return { accepted, unjustified };
+}
+
+// --- Documents -------------------------------------------------------------
+
+/**
+ * Builds a VEX document for the vulnerability findings of an audit.
+ *
+ * @param {{ name: string, version: string }} product
+ * @param {object} vulnSection Result of scanVulnerabilities().
+ * @param {object} policy
+ * @param {{ format?: 'cyclonedx'|'openvex', author?: string|null }} [options]
+ */
+function buildVex(product, vulnSection, policy, { format = 'cyclonedx', author = null } = {}) {
+  const entries = normalizeAllowlist(policy);
+  const productPurl = buildPurl(product.name, product.version);
+  const statements = [];
+
+  for (const finding of vulnSection.vulnerabilities || []) {
+    const purl = buildPurl(finding.name, finding.version);
+    for (const source of finding.sources) {
+      const assessment = finding.malicious ? null : assessmentFor(finding, source, entries);
+      statements.push({ finding, source, purl, assessment });
+    }
+  }
+
+  return format === 'openvex'
+    ? buildOpenVex(productPurl, statements, author)
+    : buildCycloneDxVex(product, productPurl, statements);
+}
+
+function buildCycloneDxVex(product, productPurl, statements) {
+  const vulnerabilities = statements.map(({ finding, source, purl, assessment }) => {
+    const { primary, others } = identifiers(source);
+    const analysis = { state: cdxState(finding, assessment) };
+    if (assessment && assessment.justification) analysis.justification = JUSTIFICATIONS[assessment.justification].cdx;
+    const detail = analysisDetail(finding, source, assessment);
+    if (detail) analysis.detail = detail;
+    if (analysis.state === 'exploitable' || analysis.state === 'in_triage') {
+      analysis.response = finding.malicious ? ['update'] : finding.fixAvailable ? ['update'] : ['can_not_fix'];
+    }
+
+    const vuln = {
+      'bom-ref': `${primary}@${purl}`,
+      id: primary,
+      source: { name: 'OSV', url: `https://osv.dev/vulnerability/${source.id}` },
+      references: others.map((id) => ({ id, source: { name: sourceName(id), url: advisoryUrl(id) } })),
+      ratings: [{
+        source: { name: 'OSV' },
+        severity: cdxSeverity(source.severity),
+        ...(source.cvss !== null && source.cvss !== undefined ? { score: source.cvss, method: 'CVSSv31' } : {}),
+      }],
+      cwes: (source.cwe || []).map((c) => parseInt(String(c).replace(/^CWE-/i, ''), 10)).filter(Number.isFinite),
+      description: source.title || undefined,
+      advisories: source.url ? [{ url: source.url }] : undefined,
+      affects: [{ ref: purl }],
+      analysis,
+    };
+    if (source.kev) {
+      vuln.properties = [
+        { name: 'cra-audit:kev', value: 'true' },
+        { name: 'cra-audit:kev:dateAdded', value: String(source.kev.dateAdded) },
+      ];
+    }
+    if (!vuln.references.length) delete vuln.references;
+    if (!vuln.cwes.length) delete vuln.cwes;
+    return vuln;
+  });
+
+  return {
+    bomFormat: 'CycloneDX',
+    specVersion: '1.6',
+    serialNumber: `urn:uuid:${crypto.randomUUID()}`,
+    version: 1,
+    metadata: {
+      timestamp: new Date().toISOString(),
+      tools: { components: [{ type: 'application', name: TOOL_NAME, version: TOOL_VERSION }] },
+      component: { type: 'application', 'bom-ref': productPurl, name: product.name, version: product.version, purl: productPurl },
+    },
+    vulnerabilities,
+  };
+}
+
+function buildOpenVex(productPurl, statements, author) {
+  return {
+    '@context': 'https://openvex.dev/ns/v0.2.0',
+    '@id': `https://openvex.dev/docs/public/cra-audit-${crypto.randomUUID()}`,
+    author: author || TOOL_NAME,
+    timestamp: new Date().toISOString(),
+    version: 1,
+    tooling: `${TOOL_NAME}/${TOOL_VERSION}`,
+    statements: statements.map(({ finding, source, purl, assessment }) => {
+      const { primary, others } = identifiers(source);
+      const status = finding.malicious ? 'affected' : assessment ? STATUSES[assessment.status].openvex : 'under_investigation';
+      const statement = {
+        vulnerability: { name: primary, ...(others.length ? { aliases: others } : {}) },
+        products: [{ '@id': productPurl, subcomponents: [{ '@id': purl }] }],
+        status,
+      };
+      const detail = analysisDetail(finding, source, assessment);
+      if (status === 'not_affected') {
+        if (assessment.justification) statement.justification = JUSTIFICATIONS[assessment.justification].openvex;
+        // OpenVEX requires a justification or an impact statement.
+        statement.impact_statement = detail || 'Assessed as not affected; justification not recorded in the cra-audit policy.';
+      } else if (status === 'affected') {
+        statement.action_statement = actionStatement(finding);
+      } else if (detail) {
+        statement.status_notes = detail;
+      }
+      return statement;
+    }),
+  };
+}
+
+function cdxState(finding, assessment) {
+  if (finding.malicious) return 'exploitable';
+  return assessment ? STATUSES[assessment.status].cdx : 'in_triage';
+}
+
+function analysisDetail(finding, source, assessment) {
+  const parts = [];
+  if (finding.malicious) parts.push('Malicious package (OpenSSF malicious-packages): remove it and rotate exposed credentials.');
+  if (source.kev) parts.push(`Listed in CISA KEV (actively exploited) since ${source.kev.dateAdded}.`);
+  if (assessment && assessment.detail) parts.push(assessment.detail);
+  if (assessment && !assessment.detail && !assessment.justification && STATUSES[assessment.status].accepts) {
+    parts.push('Accepted in the cra-audit policy without a recorded justification.');
+  }
+  return parts.join(' ') || undefined;
+}
+
+function actionStatement(finding) {
+  if (finding.malicious) return `Remove ${finding.name}@${finding.version}, reinstall from a clean lockfile and rotate exposed credentials.`;
+  if (finding.fixAvailable && typeof finding.fixAvailable === 'object') {
+    return `Update ${finding.name} to ${finding.fixAvailable.version} or later.`;
+  }
+  return `No fixed version of ${finding.name} is available: remove or replace the dependency, or mitigate.`;
+}
+
+/** Prefer the CVE as the VEX id; keep the rest as references/aliases. */
+function identifiers(source) {
+  const all = [source.id, ...(source.aliases || [])].filter(Boolean);
+  const primary = all.find((id) => /^CVE-/i.test(id)) || all[0] || 'UNKNOWN';
+  return { primary, others: all.filter((id) => id !== primary) };
+}
+
+function sourceName(id) {
+  if (/^CVE-/i.test(id)) return 'NVD';
+  if (/^GHSA-/i.test(id)) return 'GitHub';
+  return 'OSV';
+}
+
+function advisoryUrl(id) {
+  if (/^CVE-/i.test(id)) return `https://nvd.nist.gov/vuln/detail/${id}`;
+  if (/^GHSA-/i.test(id)) return `https://github.com/advisories/${id}`;
+  return `https://osv.dev/vulnerability/${id}`;
+}
+
+/** CycloneDX uses "medium" where npm/GHSA say "moderate". */
+function cdxSeverity(severity) {
+  if (severity === 'moderate') return 'medium';
+  return ['critical', 'high', 'medium', 'low', 'info', 'none'].includes(severity) ? severity : 'unknown';
+}
+
+module.exports = { buildVex, normalizeAllowlist, assessmentFor, acceptance, STATUSES, JUSTIFICATIONS };

package/src/core/vuln-scanner.js

@@ -4,24 +4,174 @@ const fs = require('node:fs');
 const os = require('node:os');
 const path = require('node:path');
 const { runJson } = require('../utils/exec');
-const { exists } = require('../utils/fs');
-const { parseLockfile, toNpmLockfile } = require('./lockfile-parser');
+const { exists, readJson } = require('../utils/fs');
+const { parseLockfile, toNpmLockfile, componentKey } = require('./lockfile-parser');
+const {
+  queryOsv, osvSeverity, cvssScore, isMalicious, fixedVersion, compareSemver,
+} = require('./osv');
+const { loadKev } = require('./kev');
 
 const SEVERITY_ORDER = ['info', 'low', 'moderate', 'high', 'critical'];
 
 /**
- * Scans direct and transitive dependencies for known vulnerabilities using
- * `npm audit --json`. The CRA requires products to ship "without known
- * exploitable vulnerabilities", so this is the core gate of the audit.
+ * Scans direct and transitive dependencies for known vulnerabilities. The CRA
+ * requires products to ship "without known exploitable vulnerabilities"
+ * (Annex I) and, since 11 September 2026, the reporting of actively exploited
+ * ones (Art. 14), so this is the core gate of the audit.
  *
- * npm projects are audited in place. Yarn/pnpm projects (which have no npm
- * lockfile) are audited against a synthetic `package-lock.json` generated from
- * their lockfile, preserving the exact installed versions.
+ * Sources:
+ *  - `osv` (default): every exact `name@version` from the lockfile is checked
+ *    against OSV.dev (GitHub advisories + OpenSSF malicious packages), and the
+ *    CVEs found are cross-checked with the CISA KEV catalogue.
+ *  - `npm`: `npm audit`. Also the fallback when OSV.dev is unreachable.
  *
  * @param {string} projectRoot
- * @param {{ production?: boolean }} [options]
+ * @param {{ production?: boolean, source?: 'osv'|'npm', kev?: boolean }} [options]
+ * @returns {Promise<object>}
  */
-function scanVulnerabilities(projectRoot, { production = false } = {}) {
+async function scanVulnerabilities(projectRoot, { production = false, source = 'osv', kev = true } = {}) {
+  if (source === 'npm') return npmAuditSection(projectRoot, { production });
+
+  const parsed = parseLockfile(projectRoot);
+  if (!parsed.ok) {
+    return { ok: false, error: parsed.error, counts: emptyCounts(), vulnerabilities: [] };
+  }
+
+  const rootPkg = readJson(path.join(projectRoot, 'package.json')) || {};
+  const components = production ? productionComponents(parsed, rootPkg) : parsed.components;
+  const scannable = components.filter((c) => c.name && c.version);
+
+  const [osv, catalogue] = await Promise.all([
+    queryOsv(scannable),
+    kev ? loadKev() : Promise.resolve(null),
+  ]);
+
+  if (!osv.ok) {
+    const fallback = npmAuditSection(projectRoot, { production });
+    fallback.warnings = [`${osv.error}; fell back to \`npm audit\` (no malicious-package or KEV check).`];
+    return fallback;
+  }
+
+  const direct = new Set(parsed.root.dependsOn);
+  const vulnerabilities = [];
+  for (const c of scannable) {
+    const key = componentKey(c.name, c.version);
+    const records = osv.byComponent.get(key);
+    if (!records || !records.length) continue;
+    vulnerabilities.push(toFinding(c, records, direct.has(key), catalogue));
+  }
+
+  const counts = emptyCounts();
+  for (const v of vulnerabilities) {
+    counts[v.severity] = (counts[v.severity] || 0) + 1;
+    if (v.malicious) counts.malicious++;
+    if (v.kev) counts.kev++;
+  }
+  counts.total = vulnerabilities.length;
+
+  return {
+    ok: true,
+    source: 'osv',
+    scanned: scannable.length,
+    kev: catalogue
+      ? (catalogue.ok
+        ? { checked: true, catalogVersion: catalogue.catalogVersion, entries: catalogue.count }
+        : { checked: false, error: catalogue.error })
+      : { checked: false, error: 'KEV check disabled' },
+    counts,
+    vulnerabilities: sortBySeverity(vulnerabilities),
+  };
+}
+
+/** One finding per vulnerable component, aggregating its OSV records. */
+function toFinding(component, records, isDirect, catalogue) {
+  const sources = records.map((record) => {
+    const aliases = record.aliases || [];
+    const cves = [record.id, ...aliases].filter((id) => /^CVE-/i.test(id));
+    const kevEntry = catalogue && catalogue.ok
+      ? cves.map((cve) => catalogue.byCve.get(cve.toUpperCase())).find(Boolean) || null
+      : null;
+    return {
+      id: record.id,
+      aliases,
+      title: record.summary || (isMalicious(record) ? 'Malicious package' : record.id),
+      url: `https://osv.dev/vulnerability/${record.id}`,
+      severity: osvSeverity(record),
+      cvss: cvssScore(record),
+      cwe: (record.database_specific && record.database_specific.cwe_ids) || [],
+      malicious: isMalicious(record),
+      fixed: fixedVersion(record, component.name, component.version),
+      kev: kevEntry,
+    };
+  });
+
+  const severity = sources.map((s) => s.severity)
+    .reduce((max, s) => (severityRank(s) > severityRank(max) ? s : max), 'unknown');
+  const fixes = sources.map((s) => s.fixed);
+  // Only claim a fix when every advisory has one; suggest the highest of them.
+  const fix = fixes.every(Boolean)
+    ? fixes.reduce((a, b) => (compareSemver(a, b) >= 0 ? a : b))
+    : null;
+
+  return {
+    name: component.name,
+    version: component.version,
+    severity,
+    direct: isDirect,
+    range: null,
+    malicious: sources.some((s) => s.malicious),
+    kev: sources.some((s) => s.kev),
+    fixAvailable: fix
+      ? { name: component.name, version: fix, breaking: major(fix) !== major(component.version) }
+      : false,
+    // Malicious and actively exploited advisories first, then by severity.
+    sources: sources.sort((a, b) => Number(b.malicious) - Number(a.malicious) ||
+      Number(Boolean(b.kev)) - Number(Boolean(a.kev)) ||
+      severityRank(b.severity) - severityRank(a.severity)),
+  };
+}
+
+/**
+ * Components reachable from the production dependencies declared in
+ * package.json (`dependencies` + `optionalDependencies`), following the graph.
+ */
+function productionComponents(parsed, rootPkg) {
+  const prodNames = new Set([
+    ...Object.keys(rootPkg.dependencies || {}),
+    ...Object.keys(rootPkg.optionalDependencies || {}),
+  ]);
+  const byKey = new Map(parsed.components.map((c) => [componentKey(c.name, c.version), c]));
+  const queue = parsed.root.dependsOn.filter((key) => prodNames.has(byKey.has(key) ? byKey.get(key).name : null));
+  const seen = new Set(queue);
+  while (queue.length) {
+    const comp = byKey.get(queue.shift());
+    if (!comp) continue;
+    for (const dep of comp.dependsOn) {
+      if (!seen.has(dep)) { seen.add(dep); queue.push(dep); }
+    }
+  }
+  return parsed.components.filter((c) => seen.has(componentKey(c.name, c.version)));
+}
+
+function severityRank(severity) {
+  return SEVERITY_ORDER.indexOf(severity);
+}
+
+function major(version) {
+  return parseInt(String(version).split('.')[0], 10);
+}
+
+/** `npm audit` source, used on request or as the OSV fallback. */
+function npmAuditSection(projectRoot, { production }) {
+  const result = npmAudit(projectRoot, { production });
+  return {
+    ...result,
+    source: 'npm-audit',
+    kev: { checked: false, error: 'npm audit reports no CVE identifiers' },
+  };
+}
+
+function npmAudit(projectRoot, { production = false } = {}) {
   if (hasNpmLockfile(projectRoot)) {
     return runNpmAudit(projectRoot, { production });
   }
@@ -187,7 +337,7 @@ function normalizeFix(fixAvailable) {
 }
 
 function emptyCounts() {
-  return { info: 0, low: 0, moderate: 0, high: 0, critical: 0, total: 0 };
+  return { info: 0, low: 0, moderate: 0, high: 0, critical: 0, unknown: 0, malicious: 0, kev: 0, total: 0 };
 }
 
 function sumCounts(counts) {

package/src/index.js

@@ -6,7 +6,7 @@
  * Example:
  *   const { runAudit, loadPolicy } = require('cra-audit');
  *   const { policy, source } = loadPolicy(process.cwd());
- *   const report = runAudit(process.cwd(), policy, source);
+ *   const report = await runAudit(process.cwd(), policy, source);
  */
 
 const { runAudit } = require('./core/auditor');
@@ -18,6 +18,9 @@ const { checkLicenses } = require('./core/license-checker');
 const { parseLockfile } = require('./core/lockfile-parser');
 const { enrichComponents } = require('./core/enrich');
 const { buildHtml } = require('./reporters/html');
+const { buildSarif } = require('./reporters/sarif');
+const { buildVex } = require('./core/vex');
+const { checkReadiness } = require('./core/readiness');
 
 module.exports = {
   runAudit,
@@ -30,4 +33,7 @@ module.exports = {
   parseLockfile,
   enrichComponents,
   buildHtml,
+  buildSarif,
+  buildVex,
+  checkReadiness,
 };

package/src/reporters/console.js

@@ -30,36 +30,78 @@ function reportConsole(report) {
 }
 
 function renderVulnerabilities(section) {
-  logger.heading('1) Known vulnerabilities (CRA Art. 13)');
+  logger.heading('1) Known vulnerabilities (CRA Annex I · Art. 14)');
   if (!section.ok) {
     logger.error(section.error);
     return;
   }
+  logger.detail(describeSources(section));
+  for (const warning of section.warnings || []) logger.warn(warning);
 
   const c = section.counts;
   if (c.total === 0) {
-    logger.success('No known vulnerabilities. Meets the "zero exploitable vulnerabilities" requirement.');
+    logger.success('No known vulnerabilities. Meets the "no known exploitable vulnerabilities" requirement.');
     return;
   }
 
   logger.log(
     `  ${color.red(`${c.critical} critical`)} · ${color.red(`${c.high} high`)} · ` +
-    `${color.yellow(`${c.moderate} moderate`)} · ${color.yellow(`${c.low} low`)} · ${color.gray(`${c.info} info`)}`
+    `${color.yellow(`${c.moderate} moderate`)} · ${color.yellow(`${c.low} low`)} · ${color.gray(`${c.info} info`)}` +
+    (c.unknown ? color.gray(` · ${c.unknown} unrated`) : '') +
+    (c.kev ? ` · ${color.red(color.bold(`${c.kev} actively exploited (KEV)`))}` : '') +
+    (c.malicious ? ` · ${color.red(color.bold(`${c.malicious} MALICIOUS`))}` : '')
   );
 
-  const top = section.vulnerabilities.slice(0, 15);
+  // Malicious and exploited findings first: they are the urgent ones.
+  const urgency = (v) => (v.malicious ? 2 : v.kev ? 1 : 0);
+  const ordered = [...section.vulnerabilities].sort((a, b) => urgency(b) - urgency(a));
+  const top = ordered.slice(0, 15);
   for (const vuln of top) {
     const sev = (SEVERITY_COLORS[vuln.severity] || color.gray)(vuln.severity.toUpperCase().padEnd(8));
-    const fix = describeFix(vuln.fixAvailable);
-    logger.log(`  ${sev} ${color.bold(vuln.name)} ${color.gray(vuln.range || '')} ${fix}`);
-    const adv = vuln.sources[0];
-    if (adv && adv.title) logger.detail(`${adv.title}${adv.url ? ' — ' + adv.url : ''}`);
+    const tags = (vuln.malicious ? color.red(color.bold('[MALICIOUS] ')) : '') + (vuln.kev ? color.red(color.bold('[KEV] ')) : '');
+    const label = vuln.version ? `${vuln.name}@${vuln.version}` : vuln.name;
+    const fix = vuln.malicious ? color.red('(remove it and rotate any exposed credentials)') : describeFix(vuln.fixAvailable);
+    logger.log(`  ${sev} ${tags}${color.bold(label)} ${color.gray(vuln.range || '')} ${fix}`);
+    for (const adv of vuln.sources.slice(0, 3)) {
+      const kev = adv.kev ? color.red(` [KEV since ${adv.kev.dateAdded}]`) : '';
+      const id = adv.id ? `${adv.id}${(adv.aliases || []).filter((a) => a.startsWith('CVE-')).map((a) => ` / ${a}`).join('')} ` : '';
+      logger.detail(`${id}${adv.title || ''}${kev}${adv.url ? ' — ' + adv.url : ''}`);
+    }
+    if (vuln.sources.length > 3) logger.detail(`… and ${vuln.sources.length - 3} more advisories.`);
+  }
+  if (ordered.length > top.length) {
+    logger.detail(`… and ${ordered.length - top.length} more.`);
   }
-  if (section.vulnerabilities.length > top.length) {
-    logger.detail(`… and ${section.vulnerabilities.length - top.length} more.`);
+
+  if (c.kev) renderArticle14Notice();
+  if (c.malicious) {
+    logger.log('');
+    logger.error(color.bold('Malicious package(s) detected: treat this as a security incident.'));
+    logger.detail('Remove the package, reinstall from a clean lockfile, and rotate every credential');
+    logger.detail('available to machines that installed it (npm/GitHub tokens, cloud keys, CI secrets).');
   }
 }
 
+function describeSources(section) {
+  if (section.source !== 'osv') return 'Source: npm audit';
+  const kev = section.kev && section.kev.checked
+    ? `CISA KEV ${section.kev.catalogVersion || ''} (${section.kev.entries} entries)`.replace('  ', ' ')
+    : `CISA KEV not checked (${(section.kev && section.kev.error) || 'unavailable'})`;
+  return `Sources: OSV.dev (GitHub advisories + OpenSSF malicious packages) · ${kev} · ${section.scanned} components`;
+}
+
+/** CRA Art. 14 reporting clock, shown when a KEV-listed vulnerability is found. */
+function renderArticle14Notice() {
+  logger.log('');
+  logger.warn(color.bold('CRA Art. 14 — actively exploited vulnerability in a dependency'));
+  logger.detail('If it affects a product with digital elements you place on the EU market, notify');
+  logger.detail('the coordinating CSIRT and ENISA through the Single Reporting Platform:');
+  logger.detail('  • Early warning ........ within 24 hours of becoming aware');
+  logger.detail('  • Notification ......... within 72 hours');
+  logger.detail('  • Final report ......... within 14 days after a corrective measure is available');
+  logger.detail('Assess exploitability in your product first; document the decision either way.');
+}
+
 function describeFix(fix) {
   if (fix === true) return color.green('(fix available)');
   if (fix && typeof fix === 'object') {
@@ -122,7 +164,7 @@ function renderLicenses(section) {
 function renderSummary(report) {
   logger.heading('Result');
   for (const item of report.gate.reasons) {
-    const mark = item.passed ? color.green('✔') : color.red('✖');
+    const mark = !item.passed ? color.red('✖') : item.warning ? color.yellow('!') : color.green('✔');
     logger.log(`  ${mark} ${item.label}`);
   }
   logger.log('');

package/src/reporters/json.js

@@ -11,7 +11,7 @@ const { writeJson } = require('../utils/fs');
 function reportJson(report, { outputPath } = {}) {
   if (outputPath) {
     writeJson(outputPath, report);
-    logger.success(`Informe JSON escrito en: ${outputPath}`);
+    logger.success(`JSON report written to: ${outputPath}`);
   } else {
     process.stdout.write(JSON.stringify(report, null, 2) + '\n');
   }