cra-audit 2.1.1 → 2.2.0

package/CHANGELOG.md

@@ -8,6 +8,20 @@ Releases are automated: pushing a `vX.Y.Z` tag publishes the package to npm
 (with provenance) and creates the GitHub Release from the matching section
 below, so add the section before running `npm version`.
 
+## [2.2.0] — Any language through its SBOM
+
+### Highlights
+
+- **Input SBOM** (`-i/--input` for `audit`, `vuln`, `licenses` and `vex`; `sbom-input` in the GitHub Action): audit a CycloneDX JSON, SPDX 2.x JSON or SPDX 3.0 JSON-LD SBOM from Syft, cdxgen, Trivy or the CycloneDX build plugins instead of the npm lockfile. Components are looked up in OSV.dev by Package URL, so **Python, Java, Go, Rust, .NET, PHP, Ruby…** projects get known vulnerabilities, malicious packages, CISA KEV with the Art. 14 clock, licenses, VEX and SARIF. No package.json needed.
+- SARIF alerts point at the purl's line in the SBOM; VEX statements use the components' real purls and the product's purl (or `pkg:generic`).
+- The input SBOM's TR-03183-2 gaps are reported as a warning in the audit (`sbom check -i` still fails on them).
+- `readiness` works in any repository (stops at the nearest package.json or .git) and accepts a committed SBOM file for non-npm projects.
+
+### Fixes
+
+- The SPDX validator no longer counts the described product as a component and accepts `CONTAINS` / `DEPENDENCY_OF` edges (as written by Syft).
+- Fixed versions resolve with each ecosystem's naming (Maven `group:artifact`, PyPI normalisation) and Go `v`-prefixed versions.
+
 ## [2.1.1] — GitHub Marketplace
 
 - The GitHub Action is published in the Marketplace as **CRA Compliance Audit** (the name "CRA Audit" is taken by a GitHub organization). Usage is unchanged: `uses: migohe14/cra-audit@v2`.

package/README.md

@@ -2,10 +2,10 @@
 
 [![npm](https://img.shields.io/npm/v/cra-audit)](https://www.npmjs.com/package/cra-audit) [![CI](https://github.com/migohe14/cra-audit/actions/workflows/ci.yml/badge.svg)](https://github.com/migohe14/cra-audit/actions/workflows/ci.yml) [![license](https://img.shields.io/npm/l/cra-audit)](LICENSE)
 
-> Compliance audit for the **Cyber Resilience Act** (Regulation EU 2024/2847) and the **BSI TR-03183** technical guideline, for npm projects.
+> Compliance audit for the **Cyber Resilience Act** (Regulation EU 2024/2847) and the **BSI TR-03183** technical guideline — native for npm, Yarn and pnpm, and for **any language** through its SBOM.
 
 `cra-audit` audits the installed dependencies of an npm project and checks the key requirements that the CRA imposes on "products with digital elements". It runs directly with `npx`, **without installation**, and has **no production dependencies** to minimize its own supply-chain surface.
-It reads the project lockfile natively, so it works with **npm** (`package-lock.json` / `npm-shrinkwrap.json`), **Yarn** (classic v1 and Berry v2+ `yarn.lock`) and **pnpm** (`pnpm-lock.yaml`) — auditing the exact versions each package manager pinned.
+It reads the project lockfile natively, so it works with **npm** (`package-lock.json` / `npm-shrinkwrap.json`), **Yarn** (classic v1 and Berry v2+ `yarn.lock`) and **pnpm** (`pnpm-lock.yaml`) — auditing the exact versions each package manager pinned. For **Python, Java, Go, Rust, .NET, PHP, Ruby…** pass the SBOM produced by your usual tooling with `-i` ([details](#8-any-language-input-sbom--i)).
 ```bash
 # Run ALL the law's checks (Vulnerabilities + Licenses + SBOM)
 npx cra-audit
@@ -151,6 +151,37 @@ npx cra-audit readiness --init   # creates SECURITY.md and .well-known/security.
 
 `--init` prefills the templates from `package.json` (GitHub private vulnerability reporting link, supported major version, a coordinated disclosure process and the Art. 14 24 h / 72 h / 14 days reporting commitments); fill in the `TODO` placeholders and run it again.
 
+### 8. Any language: input SBOM (`-i`)
+
+`audit`, `vuln`, `licenses` and `vex` accept an existing **CycloneDX JSON**, **SPDX 2.x JSON** or **SPDX 3.0 JSON-LD** SBOM instead of the npm lockfile. Every component is looked up in OSV.dev by its **Package URL**, so you get the same checks — known vulnerabilities, **malicious packages**, **CISA KEV** with the Art. 14 clock, licenses, VEX and SARIF — for any ecosystem OSV covers (Maven, PyPI, Go, crates.io, NuGet, Packagist, RubyGems, Hex, Pub, npm…).
+
+```bash
+# Generate the SBOM with the tool of your ecosystem…
+syft dir:. -o cyclonedx-json=sbom.cdx.json          # any language / container images
+cdxgen -o sbom.cdx.json .                            # multi-language
+mvn org.cyclonedx:cyclonedx-maven-plugin:makeAggregateBom   # Maven → target/bom.json
+cyclonedx-py environment -o sbom.cdx.json            # Python
+
+# …and audit it (no package.json needed)
+npx cra-audit -i sbom.cdx.json
+npx cra-audit vex -i sbom.cdx.json -o vex.cdx.json
+npx cra-audit -i sbom.cdx.json --sarif cra-audit.sarif
+```
+
+```text
+  Sources: OSV.dev … · CISA KEV (1721 entries) · 5 components from sbom.spdx.json (cargo, golang, maven, nuget) · 1 without purl skipped
+  CRITICAL [KEV] org.apache.logging.log4j:log4j-core@2.14.1  (fix: org.apache.logging.log4j:log4j-core@2.25.4)
+    GHSA-jfh8-c2jp-5v3q / CVE-2021-44228 Remote code injection in Log4j [KEV since 2021-12-10]
+  CRITICAL smallvec@1.6.0  (fix: smallvec@1.6.1)
+  HIGH     Newtonsoft.Json@12.0.1  (fix: Newtonsoft.Json@13.0.1, breaking)
+```
+
+Notes:
+- Components without a purl are skipped and counted in the output. Operating-system packages (deb/rpm/apk) are not looked up.
+- `--production` skips components with CycloneDX scope `optional`/`excluded` (or SPDX `DEV_DEPENDENCY_OF`).
+- The input SBOM is also checked against TR-03183-2; since third-party generators rarely include the manufacturer fields, gaps are reported as a **warning** in the audit (`cra-audit sbom check -i` shows the details and fails on them). For npm projects, `cra-audit sbom generate` produces a conforming SBOM.
+- SARIF alerts point at the line of the component's purl in the SBOM file.
+
 ---
 
 ## Usage
@@ -222,7 +253,7 @@ cra-audit --help
 | `--sarif <path>` | Also write the audit as SARIF 2.1.0 for GitHub code scanning. |
 | `--init` | With `readiness`: create SECURITY.md and security.txt templates. |
 | `--output`, `-o <path>` | Write the result / SBOM / HTML to a file. |
-| `--input`, `-i <path>` | Existing SBOM to validate (for `sbom check`). |
+| `--input`, `-i <path>` | Existing CycloneDX/SPDX JSON SBOM: validated by `sbom check`, or audited instead of the npm lockfile by `audit`, `vuln`, `licenses` and `vex` (any language). |
 | `--config`, `-c <path>` | Path to the security policy. |
 | `--cwd <path>` | Project directory to audit. |
 | `--no-color` | Disable colors. |
@@ -315,6 +346,17 @@ Suitable for CI/CD: a non-`0` code blocks the pipeline.
 
 Available in the GitHub Marketplace as [CRA Compliance Audit](https://github.com/marketplace/actions/cra-compliance-audit).
 
+For a Python, Java, Go… project, generate the SBOM first and pass it with `sbom-input`:
+
+```yaml
+      - uses: anchore/sbom-action@v0          # Syft
+        with: { format: cyclonedx-json, output-file: sbom.cdx.json, upload-artifact: false }
+      - uses: migohe14/cra-audit@v2
+        with:
+          sbom-input: sbom.cdx.json
+          vex: vex.cdx.json
+```
+
 ```yaml
 name: CRA audit
 on: [push, pull_request]
@@ -357,6 +399,7 @@ Every finding shows up in **Security → Code scanning**, pointing at the exact
 | `sarif` | `cra-audit.sarif` | SARIF path (empty to skip). |
 | `upload-sarif` | `true` | Upload to code scanning (needs `security-events: write`; private repos need GitHub Advanced Security). |
 | `sbom` / `vex` | — | Also write the SBOM / VEX to these paths. |
+| `sbom-input` | — | Audit this CycloneDX/SPDX SBOM instead of the npm lockfile (any language). |
 | `args` | — | Extra `cra-audit audit` arguments. |
 
 Outputs: `exit-code`, `sarif`, `sbom`, `vex`. Without the action, `npx cra-audit --sarif cra-audit.sarif` does the same in any CI.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cra-audit",
-  "version": "2.1.1",
+  "version": "2.2.0",
   "description": "Audits npm, yarn, and pnpm projects for compliance with the European Cyber Resilience Act (CRA, EU Regulation 2024/2847) and BSI TR-03183: SBOM (CycloneDX/SPDX), known vulnerabilities, third-party components, and licenses.",
   "homepage": "https://github.com/migohe14/cra-audit#readme",
   "repository": {

package/src/cli.js

@@ -211,7 +211,8 @@ ${c.bold('OPTIONS')}
   ${c.cyan('--json')}                Machine-readable JSON output.
   ${c.cyan('--sarif <path>')}        Also write the audit as SARIF 2.1.0 (GitHub code scanning).
   ${c.cyan('--output, -o <path>')}   Write the result/SBOM/HTML to a file.
-  ${c.cyan('--input, -i <path>')}    Existing SBOM to validate (for "sbom check").
+  ${c.cyan('--input, -i <path>')}    Existing CycloneDX/SPDX JSON SBOM: validate it (sbom check) or audit it
+                        instead of the npm lockfile — any ecosystem (audit, vuln, licenses, vex).
   ${c.cyan('--config, -c <path>')}   Path to the security policy (.cra-audit.json).
   ${c.cyan('--cwd <path>')}          Project directory to audit.
   ${c.cyan('--no-color')}            Disable colors.
@@ -233,6 +234,9 @@ ${c.bold('EXAMPLES')}
   ${c.gray('# Generate a CycloneDX SBOM on disk')}
   npx cra-audit sbom generate -o sbom.cdx.json
 
+  ${c.gray('# Any language: audit an SBOM from Syft, cdxgen, Trivy, CycloneDX plugins…')}
+  npx cra-audit -i sbom.cdx.json
+
   ${c.gray('# VEX with the exploitability assessments recorded in .cra-audit.json')}
   npx cra-audit vex -o vex.cdx.json
 

package/src/commands/audit.js

@@ -1,69 +1,81 @@
-'use strict';
-
-const { findProjectRoot } = require('../utils/fs');
-const { logger } = require('../utils/logger');
-const { loadPolicy } = require('../core/policy');
-const { runAudit } = require('../core/auditor');
-const { reportConsole } = require('../reporters/console');
-const { reportJson } = require('../reporters/json');
-const { reportSarif } = require('../reporters/sarif');
-
-/**
- * `cra-audit [audit]` — runs the full compliance audit (vulnerabilities + SBOM
- * + licenses) or a single section via `only`.
- *
- * @param {object} flags Parsed CLI flags.
- * @param {'vulnerabilities'|'sbom'|'licenses'} [only]
- * @returns {Promise<number>} Process exit code.
- */
-async function auditCommand(flags, only) {
-  const projectRoot = resolveRoot(flags);
-  if (!projectRoot) return 1;
-
-  let policyResult;
-  try {
-    policyResult = loadPolicy(projectRoot, flags.config);
-  } catch (err) {
-    logger.error(err.message);
-    return 1;
-  }
-
-  const policy = applyFlagOverrides(policyResult.policy, flags);
-  const report = await runAudit(projectRoot, policy, policyResult.source, { only });
-
-  if (flags.json) {
-    reportJson(report, { outputPath: flags.output });
-  } else {
-    reportConsole(report);
-  }
-  if (typeof flags.sarif === 'string') {
-    reportSarif(report, projectRoot, flags.sarif, { quiet: flags.json && !flags.output, policy });
-  }
-
-  return report.gate.passed ? 0 : 1;
-}
-
-function resolveRoot(flags) {
-  const start = flags.cwd || process.cwd();
-  const root = findProjectRoot(start);
-  if (!root) {
-    logger.error('No package.json found. Run the command inside an npm project.');
-    return null;
-  }
-  return root;
-}
-
-/** CLI flags take precedence over the file-based policy. */
-function applyFlagOverrides(policy, flags) {
-  const merged = { ...policy };
-  if (flags.failOn) merged.failOn = flags.failOn;
-  if (flags.production) merged.productionOnly = true;
-  if (flags.format) merged.sbomFormat = flags.format;
-  if (flags.noSbom) merged.requireSbom = false;
-  if (flags.vulnSource) merged.vulnerabilitySource = flags.vulnSource;
-  if (flags.failOnKev) merged.failOnKev = true;
-  if (flags.noFailOnKev) merged.failOnKev = false;
-  return merged;
-}
-
-module.exports = { auditCommand };
+'use strict';
+
+const path = require('node:path');
+const { findProjectRoot } = require('../utils/fs');
+const { logger } = require('../utils/logger');
+const { loadPolicy } = require('../core/policy');
+const { runAudit } = require('../core/auditor');
+const { reportConsole } = require('../reporters/console');
+const { reportJson } = require('../reporters/json');
+const { reportSarif } = require('../reporters/sarif');
+
+/**
+ * `cra-audit [audit]` — runs the full compliance audit (vulnerabilities + SBOM
+ * + licenses) or a single section via `only`.
+ *
+ * @param {object} flags Parsed CLI flags.
+ * @param {'vulnerabilities'|'sbom'|'licenses'} [only]
+ * @returns {Promise<number>} Process exit code.
+ */
+async function auditCommand(flags, only) {
+  const projectRoot = resolveRoot(flags);
+  if (!projectRoot) return 1;
+
+  let policyResult;
+  try {
+    policyResult = loadPolicy(projectRoot, flags.config);
+  } catch (err) {
+    logger.error(err.message);
+    return 1;
+  }
+
+  const policy = applyFlagOverrides(policyResult.policy, flags);
+  const report = await runAudit(projectRoot, policy, policyResult.source, { only, input: inputPath(flags) });
+
+  if (flags.json) {
+    reportJson(report, { outputPath: flags.output });
+  } else {
+    reportConsole(report);
+  }
+  if (typeof flags.sarif === 'string') {
+    reportSarif(report, projectRoot, flags.sarif, { quiet: flags.json && !flags.output, policy });
+  }
+
+  return report.gate.passed ? 0 : 1;
+}
+
+/**
+ * Project root: the nearest package.json, or with `-i <sbom>` the working
+ * directory (any ecosystem, no package.json needed).
+ */
+function resolveRoot(flags) {
+  const start = flags.cwd || process.cwd();
+  if (inputPath(flags)) return path.resolve(start);
+  const root = findProjectRoot(start);
+  if (!root) {
+    logger.error('No package.json found. Run the command inside an npm project.');
+    return null;
+  }
+  return root;
+}
+
+/** `-i/--input <sbom>` resolved against the working directory. */
+function inputPath(flags) {
+  if (typeof flags.input !== 'string') return null;
+  return path.resolve(flags.cwd || process.cwd(), flags.input);
+}
+
+/** CLI flags take precedence over the file-based policy. */
+function applyFlagOverrides(policy, flags) {
+  const merged = { ...policy };
+  if (flags.failOn) merged.failOn = flags.failOn;
+  if (flags.production) merged.productionOnly = true;
+  if (flags.format) merged.sbomFormat = flags.format;
+  if (flags.noSbom) merged.requireSbom = false;
+  if (flags.vulnSource) merged.vulnerabilitySource = flags.vulnSource;
+  if (flags.failOnKev) merged.failOnKev = true;
+  if (flags.noFailOnKev) merged.failOnKev = false;
+  return merged;
+}
+
+module.exports = { auditCommand, inputPath };

package/src/commands/readiness.js

@@ -1,6 +1,7 @@
 'use strict';
 
-const { findProjectRoot } = require('../utils/fs');
+const fs = require('node:fs');
+const path = require('node:path');
 const { logger, color } = require('../utils/logger');
 const { checkReadiness, writeTemplates } = require('../core/readiness');
 
@@ -13,11 +14,7 @@ const { checkReadiness, writeTemplates } = require('../core/readiness');
  * @returns {number} exit code: 1 when a required check fails.
  */
 function readinessCommand(flags) {
-  const projectRoot = findProjectRoot(flags.cwd || process.cwd());
-  if (!projectRoot) {
-    logger.error('No package.json found. Run the command inside an npm project.');
-    return 1;
-  }
+  const projectRoot = findRepositoryRoot(flags.cwd || process.cwd());
 
   if (flags.init) {
     for (const { file, created } of writeTemplates(projectRoot)) {
@@ -56,4 +53,18 @@ function readinessCommand(flags) {
   return result.passed ? 0 : 1;
 }
 
+/**
+ * The nearest folder with a package.json or a .git entry: readiness applies to
+ * any repository, not only npm projects. Falls back to the start folder.
+ */
+function findRepositoryRoot(start) {
+  let dir = path.resolve(start);
+  for (;;) {
+    if (fs.existsSync(path.join(dir, 'package.json')) || fs.existsSync(path.join(dir, '.git'))) return dir;
+    const parent = path.dirname(dir);
+    if (parent === dir) return path.resolve(start);
+    dir = parent;
+  }
+}
+
 module.exports = { readinessCommand };

package/src/commands/vex.js

@@ -7,6 +7,8 @@ const { loadPolicy } = require('../core/policy');
 const { scanVulnerabilities } = require('../core/vuln-scanner');
 const { buildVex } = require('../core/vex');
 const { creatorFromManifest } = require('../core/installed-metadata');
+const { readSbom } = require('../core/sbom-reader');
+const { inputPath } = require('./audit');
 
 /**
  * `cra-audit vex` — writes a VEX document (CycloneDX 1.6 or OpenVEX 0.2.0)
@@ -16,7 +18,9 @@ const { creatorFromManifest } = require('../core/installed-metadata');
  * @returns {Promise<number>} exit code
  */
 async function vexCommand(flags) {
-  const projectRoot = findProjectRoot(flags.cwd || process.cwd());
+  const input = inputPath(flags);
+  const start = flags.cwd || process.cwd();
+  const projectRoot = input ? path.resolve(start) : findProjectRoot(start);
   if (!projectRoot) {
     logger.error('No package.json found. Run the command inside an npm project.');
     return 1;
@@ -36,9 +40,15 @@ async function vexCommand(flags) {
     return 1;
   }
 
+  const parsed = input ? readSbom(input) : null;
+  if (parsed && !parsed.ok) {
+    logger.error(parsed.error);
+    return 1;
+  }
   const vulns = await scanVulnerabilities(projectRoot, {
     production: flags.production || policy.productionOnly,
     source: flags.vulnSource || policy.vulnerabilitySource,
+    parsed,
   });
   if (!vulns.ok) {
     logger.error(vulns.error);
@@ -53,7 +63,9 @@ async function vexCommand(flags) {
   const pkg = readJson(path.join(projectRoot, 'package.json')) || {};
   const creator = creatorFromManifest(pkg);
   const author = policy.sbomCreator || (creator && (creator.email || creator.url)) || null;
-  const product = { name: pkg.name || path.basename(projectRoot), version: pkg.version || '0.0.0' };
+  const product = parsed
+    ? { name: parsed.root.name, version: parsed.root.version, purl: parsed.root.purl }
+    : { name: pkg.name || path.basename(projectRoot), version: pkg.version || '0.0.0' };
   const document = buildVex(product, vulns, policy, { format, author });
 
   const count = format === 'openvex' ? document.statements.length : document.vulnerabilities.length;

package/src/core/auditor.js

@@ -5,6 +5,7 @@ const { generateSbom } = require('./sbom-generator');
 const { validateSbom } = require('./sbom-validator');
 const { checkLicenses } = require('./license-checker');
 const { acceptance } = require('./vex');
+const { readSbom } = require('./sbom-reader');
 
 /**
  * @typedef {object} AuditResult
@@ -21,19 +22,24 @@ const { acceptance } = require('./vex');
  * @param {string} projectRoot
  * @param {object} policy
  * @param {string|null} policySource
- * @param {{ only?: 'vulnerabilities'|'sbom'|'licenses' }} [options]
+ * With `input` (path to a CycloneDX/SPDX JSON SBOM) the audit runs on that
+ * SBOM instead of the npm lockfile, so it covers any ecosystem.
+ *
+ * @param {{ only?: 'vulnerabilities'|'sbom'|'licenses', input?: string }} [options]
  * @returns {Promise<AuditResult>}
  */
 async function runAudit(projectRoot, policy, policySource, options = {}) {
-  const { only } = options;
+  const { only, input } = options;
   const sections = {};
   const reasons = [];
+  const parsed = input ? readSbom(input) : null;
 
   // --- 1. Vulnerabilities -------------------------------------------------
   if (!only || only === 'vulnerabilities') {
     const vulns = await scanVulnerabilities(projectRoot, {
       production: policy.productionOnly,
       source: policy.vulnerabilitySource,
+      parsed,
     });
     sections.vulnerabilities = vulns;
 
@@ -56,7 +62,25 @@ async function runAudit(projectRoot, policy, policySource, options = {}) {
   }
 
   // --- 2. SBOM ------------------------------------------------------------
-  if (!only || only === 'sbom') {
+  if ((!only || only === 'sbom') && parsed) {
+    // An input SBOM comes from third-party tooling that rarely carries the
+    // manufacturer fields TR-03183 requires: report gaps without blocking.
+    const sbom = parsed.ok
+      ? { ok: true, input: parsed.sourceFile, format: parsed.format, componentCount: parsed.components.length, validation: validateSbom(parsed.document) }
+      : { ok: false, input: parsed.sourceFile, error: parsed.error };
+    sections.sbom = sbom;
+    if (!sbom.ok) {
+      reasons.push({ label: `The input SBOM could not be read: ${sbom.error}`, passed: false });
+    } else if (policy.requireSbom) {
+      reasons.push({
+        label: sbom.validation.valid
+          ? 'Input SBOM valid against the TR-03183-2 required data fields'
+          : `Input SBOM misses ${sbom.validation.failedChecks.length} TR-03183-2 requirement(s) (see \`cra-audit sbom check -i\`)`,
+        passed: true,
+        warning: !sbom.validation.valid,
+      });
+    }
+  } else if (!only || only === 'sbom') {
     const sbom = generateSbom(projectRoot, { format: policy.sbomFormat, creator: policy.sbomCreator });
     if (sbom.ok) {
       sbom.validation = validateSbom(sbom.document);
@@ -79,7 +103,7 @@ async function runAudit(projectRoot, policy, policySource, options = {}) {
 
   // --- 3. Licenses --------------------------------------------------------
   if (!only || only === 'licenses') {
-    const licenses = checkLicenses(projectRoot, policy.licenses);
+    const licenses = checkLicenses(projectRoot, policy.licenses, { parsed });
     sections.licenses = licenses;
 
     if (!licenses.ok) {
@@ -98,7 +122,9 @@ async function runAudit(projectRoot, policy, policySource, options = {}) {
   }
 
   return {
-    project: getProject(projectRoot, sections),
+    project: parsed && parsed.ok
+      ? { name: parsed.root.name, version: parsed.root.version, sbom: parsed.sourceFile }
+      : getProject(projectRoot, sections),
     policySource,
     generatedAt: new Date().toISOString(),
     sections,

package/src/core/license-checker.js

@@ -7,11 +7,16 @@ const { readInstalledManifest, licenseFromManifest } = require('./installed-meta
  * Resolves and evaluates the license of every third-party component.
  * CRA / TR-03183 require every component's license to be documented.
  *
+ * Pass `parsed` (from readSbom()) to check the licenses declared in an input
+ * SBOM instead of the lockfile and node_modules.
+ *
  * @param {string} projectRoot
  * @param {{ allow?: string[], deny?: string[] }} [policy]
+ * @param {{ parsed?: object }} [options]
  */
-function checkLicenses(projectRoot, policy = {}) {
-  const parsed = parseLockfile(projectRoot);
+function checkLicenses(projectRoot, policy = {}, { parsed: given } = {}) {
+  const parsed = given || parseLockfile(projectRoot);
+  const fromSbom = parsed.manager === 'sbom';
   if (!parsed.ok) {
     return { ok: false, error: parsed.error, components: [], summary: emptySummary() };
   }
@@ -20,12 +25,13 @@ function checkLicenses(projectRoot, policy = {}) {
   const deny = normalizeList(policy.deny);
 
   const components = parsed.components.map((c) => {
-    const license = c.license || licenseFromManifest(readInstalledManifest(projectRoot, c));
+    const license = c.license || (fromSbom ? null : licenseFromManifest(readInstalledManifest(projectRoot, c)));
     const normalized = license ? String(license) : null;
     const status = classify(normalized, allow, deny);
     return {
       name: c.name,
       version: c.version,
+      purl: c.purl || null,
       license: normalized,
       status, // 'ok' | 'missing' | 'denied' | 'not-allowed'
     };

package/src/core/osv.js

@@ -7,25 +7,32 @@ const BATCH_SIZE = 1000; // OSV querybatch limit
 
 /**
  * Queries OSV.dev (https://osv.dev) for the advisories affecting each exact
- * `name@version`. OSV aggregates the GitHub Advisory Database (GHSA) and the
- * OpenSSF malicious-packages feed (MAL-*), which lists compromised releases
- * such as the ones published by the Shai-Hulud worm.
+ * component version. OSV aggregates the GitHub Advisory Database (GHSA), the
+ * ecosystem databases (PyPA, RustSec, Go…) and the OpenSSF malicious-packages
+ * feed (MAL-*), which lists compromised releases such as the ones published by
+ * the Shai-Hulud worm.
  *
- * Only package names and versions leave the machine.
+ * Components with a Package URL (from an input SBOM, any ecosystem) are
+ * queried by purl; lockfile components by npm name and version. Only package
+ * identifiers and versions leave the machine.
  *
- * @param {Array<{ name: string, version: string }>} components
+ * @param {Array<{ name: string, version: string, purl?: string, key?: string }>} components
  * @param {{ timeout?: number, concurrency?: number }} [options]
  * @returns {Promise<{ ok: true, byComponent: Map<string, object[]> } | { ok: false, error: string }>}
- *   `byComponent` is keyed by `name@version` and holds full OSV records.
+ *   `byComponent` is keyed by the component key and holds full OSV records.
  */
 async function queryOsv(components, { timeout = 30000, concurrency = 8 } = {}) {
   const idsByKey = new Map();
+  const queryFor = (c) => (c.ecosystem && c.purl
+    ? { package: { purl: c.purl } } // the version is part of the purl
+    : { package: { name: c.name, ecosystem: 'npm' }, version: c.version });
+  const keyFor = (c) => c.key || `${c.name}@${c.version}`;
 
   for (let i = 0; i < components.length; i += BATCH_SIZE) {
     const chunk = components.slice(i, i + BATCH_SIZE);
     const res = await fetchJson(`${OSV_API}/querybatch`, {
       timeout,
-      body: { queries: chunk.map((c) => ({ package: { name: c.name, ecosystem: 'npm' }, version: c.version })) },
+      body: { queries: chunk.map(queryFor) },
     });
     if (!res || !res.ok || !res.json || !Array.isArray(res.json.results)) {
       return { ok: false, error: `OSV.dev query failed${res ? ` (HTTP ${res.status})` : ' (network unreachable)'}` };
@@ -39,13 +46,13 @@ async function queryOsv(components, { timeout = 30000, concurrency = 8 } = {}) {
       while (pageToken) {
         const page = await fetchJson(`${OSV_API}/query`, {
           timeout,
-          body: { package: { name: chunk[j].name, ecosystem: 'npm' }, version: chunk[j].version, page_token: pageToken },
+          body: { ...queryFor(chunk[j]), page_token: pageToken },
         });
         if (!page || !page.ok || !page.json) break;
         ids.push(...(page.json.vulns || []).map((v) => v.id));
         pageToken = page.json.next_page_token;
       }
-      if (ids.length) idsByKey.set(`${chunk[j].name}@${chunk[j].version}`, ids);
+      if (ids.length) idsByKey.set(keyFor(chunk[j]), ids);
     }
   }
 
@@ -123,7 +130,7 @@ function isMalicious(record) {
 function fixedVersion(record, name, version) {
   let best = null;
   for (const affected of record.affected || []) {
-    if (!affected.package || affected.package.name !== name) continue;
+    if (!affected.package || normalizeName(affected.package.name) !== normalizeName(name)) continue;
     for (const range of affected.ranges || []) {
       if (range.type !== 'SEMVER' && range.type !== 'ECOSYSTEM') continue;
       let introduced = null;
@@ -140,17 +147,26 @@ function fixedVersion(record, name, version) {
 }
 
 /**
- * Compares two semver strings (major.minor.patch[-prerelease]).
- * Build metadata is ignored.
+ * OSV package names compare case-insensitively, and PyPI treats `-`, `_` and
+ * `.` as equivalent (PEP 503).
+ */
+function normalizeName(name) {
+  return String(name || '').toLowerCase().replace(/[-_.]+/g, '-');
+}
+
+/**
+ * Compares two semver strings (major.minor.patch[-prerelease]). Also used,
+ * approximately, for other ecosystems: a leading `v` (Go) is ignored and any
+ * number of numeric parts is compared. Build metadata is ignored.
  */
 function compareSemver(a, b) {
   const parse = (v) => {
-    const [core, pre] = String(v).split('+')[0].split(/-(.*)/s);
+    const [core, pre] = String(v).replace(/^v/i, '').split('+')[0].split(/-(.*)/s);
     return { nums: core.split('.').map((n) => parseInt(n, 10) || 0), pre: pre ? pre.split('.') : [] };
   };
   const pa = parse(a);
   const pb = parse(b);
-  for (let i = 0; i < 3; i++) {
+  for (let i = 0; i < Math.max(pa.nums.length, pb.nums.length, 3); i++) {
     const diff = (pa.nums[i] || 0) - (pb.nums[i] || 0);
     if (diff) return diff;
   }

package/src/core/readiness.js

@@ -102,9 +102,14 @@ function checkReadiness(projectRoot, { now = new Date() } = {}) {
   }
 
   // --- SBOM ---------------------------------------------------------------------
+  // npm projects: a lockfile cra-audit builds the SBOM from. Other ecosystems:
+  // an SBOM produced by their own tooling (Syft, cdxgen…) kept in the repo.
   const parsed = parseLockfile(projectRoot);
-  add('sbom', 'A lockfile to generate the SBOM from', 'required', parsed.ok,
-    parsed.ok ? `${parsed.lockfileName} (${parsed.components.length} components)` : parsed.error, 'CRA Annex I Part II (1)');
+  const sbomFile = parsed.ok ? null : findSbomFile(projectRoot);
+  add('sbom', 'SBOM available (npm lockfile or an SBOM file)', 'required', parsed.ok || sbomFile,
+    parsed.ok ? `${parsed.lockfileName} (${parsed.components.length} components)`
+      : sbomFile ? `Found ${sbomFile}` : `${parsed.error} For other ecosystems, commit an SBOM (e.g. sbom.cdx.json).`,
+    'CRA Annex I Part II (1)');
 
   add('package-repository', 'package.json links the source repository', 'recommended', Boolean(repositoryUrl(pkg.repository)),
     repositoryUrl(pkg.repository) || 'No "repository" field', 'TR-03183-2 §5.2.4');
@@ -216,6 +221,21 @@ function securityTxtTemplate({ advisories, repo, expires }) {
   return lines.join('\n');
 }
 
+/** An SBOM file at the root or in sbom/: *.cdx.json, *.spdx.json, bom.json… */
+function findSbomFile(root) {
+  for (const dir of ['', 'sbom']) {
+    let names = [];
+    try {
+      names = fs.readdirSync(path.join(root, dir));
+    } catch {
+      continue;
+    }
+    const match = names.find((n) => /(\.cdx\.json|\.spdx\.json|^bom\.json|^sbom\.json)$/i.test(n));
+    if (match) return dir ? `${dir}/${match}` : match;
+  }
+  return null;
+}
+
 function firstExisting(root, candidates) {
   return candidates.find((rel) => fs.existsSync(path.join(root, rel))) || null;
 }

package/src/core/sbom-reader.js

@@ -0,0 +1,296 @@
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+/**
+ * Reads an existing SBOM (CycloneDX JSON, SPDX 2.x JSON or SPDX 3.0 JSON-LD)
+ * into the same shape parseLockfile() returns, so the vulnerability scan, the
+ * license check, the VEX and the SARIF work for any ecosystem: Python, Java,
+ * Go, Rust, .NET, PHP, Ruby… Each component is identified by its Package URL
+ * (purl), which OSV.dev resolves directly.
+ *
+ * Generate the SBOM with the ecosystem's tooling (Syft, cdxgen, Trivy,
+ * cyclonedx-py, the CycloneDX Maven/Gradle plugins…) and pass it with `-i`.
+ *
+ * @param {string} file
+ * @returns {{
+ *   ok: boolean, error?: string, manager: 'sbom', format: 'cyclonedx'|'spdx',
+ *   lockfileName: string, sourceFile: string, document: object,
+ *   root: { name: string, version: string, dependsOn: string[] },
+ *   components: Array<object>, unidentified: number, dependencyGraphComplete: boolean
+ * }}
+ */
+function readSbom(file) {
+  let document;
+  try {
+    document = JSON.parse(fs.readFileSync(file, 'utf8'));
+  } catch (err) {
+    return fail(file, `Could not read the SBOM ${file}: ${err.code === 'ENOENT' ? 'file not found' : err.message}`);
+  }
+
+  let result;
+  if (document && (document.bomFormat === 'CycloneDX' || Array.isArray(document.components))) {
+    result = fromCycloneDx(document);
+  } else if (document && document.spdxVersion) {
+    result = fromSpdx2(document);
+  } else if (document && Array.isArray(document['@graph'])) {
+    result = fromSpdx3(document);
+  } else {
+    return fail(file, `${file} is not a CycloneDX or SPDX JSON document.`);
+  }
+
+  // Only components with a purl can be looked up; keep the count visible.
+  const identified = result.components.filter((c) => c.purl);
+  return {
+    ok: true,
+    manager: 'sbom',
+    format: result.format,
+    lockfileName: path.basename(file),
+    sourceFile: file,
+    document,
+    root: result.root,
+    components: dedupe(identified),
+    unidentified: result.components.length - identified.length,
+    dependencyGraphComplete: result.complete,
+  };
+}
+
+// --- CycloneDX ---------------------------------------------------------------
+
+function fromCycloneDx(doc) {
+  const byRef = new Map();
+  const components = [];
+  const visit = (list) => {
+    for (const c of list || []) {
+      if (!c || typeof c !== 'object') continue;
+      if (c.type !== 'file' && c.type !== 'operating-system') {
+        const comp = component({
+          purl: c.purl,
+          name: c.group ? `${c.group}/${c.name}` : c.name,
+          version: c.version,
+          license: cdxLicense(c.licenses),
+          optional: c.scope === 'optional' || c.scope === 'excluded',
+        });
+        components.push(comp);
+        if (c['bom-ref']) byRef.set(c['bom-ref'], comp);
+      }
+      visit(c.components); // nested components (assemblies)
+    }
+  };
+  visit(doc.components);
+
+  const meta = (doc.metadata && doc.metadata.component) || {};
+  const root = rootInfo(meta.name, meta.version, meta.purl);
+  const rootRef = meta['bom-ref'];
+
+  let complete = Array.isArray(doc.dependencies) && doc.dependencies.length > 0;
+  for (const dep of doc.dependencies || []) {
+    const targets = (dep.dependsOn || []).map((ref) => byRef.get(ref)).filter(Boolean).map((c) => c.key);
+    if (dep.ref === rootRef) root.dependsOn.push(...targets);
+    const from = byRef.get(dep.ref);
+    if (from) from.dependsOn.push(...targets);
+  }
+  if ((doc.compositions || []).some((c) => c && c.aggregate && c.aggregate !== 'complete')) complete = false;
+  return { format: 'cyclonedx', components, root, complete };
+}
+
+function cdxLicense(licenses) {
+  if (!Array.isArray(licenses) || !licenses.length) return null;
+  const ids = licenses.map((l) => l.expression || (l.license && (l.license.id || l.license.name))).filter(Boolean);
+  return ids.length ? [...new Set(ids)].join(' AND ') : null;
+}
+
+// --- SPDX 2.x ----------------------------------------------------------------
+
+function fromSpdx2(doc) {
+  const byId = new Map();
+  const components = [];
+  const described = new Set(doc.documentDescribes || []);
+  for (const r of doc.relationships || []) {
+    if (r.relationshipType === 'DESCRIBES' && r.spdxElementId === 'SPDXRef-DOCUMENT') described.add(r.relatedSpdxElement);
+  }
+
+  let rootPkg = null;
+  for (const pkg of doc.packages || []) {
+    const ref = (pkg.externalRefs || []).find((r) => r.referenceType === 'purl');
+    if (described.has(pkg.SPDXID) && !rootPkg) {
+      rootPkg = pkg;
+      continue;
+    }
+    const comp = component({
+      purl: ref && ref.referenceLocator,
+      name: pkg.name,
+      version: pkg.versionInfo,
+      license: spdxLicense(pkg.licenseConcluded) || spdxLicense(pkg.licenseDeclared),
+    });
+    components.push(comp);
+    byId.set(pkg.SPDXID, comp);
+  }
+
+  const rootRef = rootPkg && (rootPkg.externalRefs || []).find((r) => r.referenceType === 'purl');
+  const root = rootInfo((rootPkg && rootPkg.name) || doc.name, rootPkg && rootPkg.versionInfo, rootRef && rootRef.referenceLocator);
+  const rootId = rootPkg && rootPkg.SPDXID;
+
+  let edges = 0;
+  for (const r of doc.relationships || []) {
+    // A DEPENDS_ON B; B DEPENDENCY_OF A; A CONTAINS B.
+    let from = r.spdxElementId;
+    let to = r.relatedSpdxElement;
+    if (r.relationshipType === 'DEPENDENCY_OF') [from, to] = [to, from];
+    else if (!['DEPENDS_ON', 'CONTAINS', 'RUNTIME_DEPENDENCY_OF', 'DEV_DEPENDENCY_OF'].includes(r.relationshipType)) continue;
+    if (r.relationshipType.endsWith('_DEPENDENCY_OF')) [from, to] = [to, from];
+    const target = byId.get(to);
+    if (!target) continue;
+    edges++;
+    if (from === rootId) root.dependsOn.push(target.key);
+    else if (byId.has(from)) byId.get(from).dependsOn.push(target.key);
+    if (r.relationshipType === 'DEV_DEPENDENCY_OF') target.optional = true;
+  }
+  return { format: 'spdx', components, root, complete: edges > 0 };
+}
+
+function spdxLicense(value) {
+  return value && value !== 'NOASSERTION' && value !== 'NONE' ? value : null;
+}
+
+// --- SPDX 3.0 (JSON-LD) ----------------------------------------------------------
+
+function fromSpdx3(doc) {
+  const byId = new Map();
+  const components = [];
+  let rootId = null;
+
+  for (const el of doc['@graph']) {
+    if (el.type === 'SpdxDocument' && Array.isArray(el.rootElement)) rootId = rootId || el.rootElement[0];
+  }
+  let root = rootInfo(doc.name);
+
+  for (const el of doc['@graph']) {
+    if (el.type !== 'software_Package') continue;
+    const id = el.spdxId || el['@id'];
+    if (id && id === rootId) {
+      root = rootInfo(el.name || root.name, el.software_packageVersion, el.software_packageUrl);
+      continue;
+    }
+    const comp = component({
+      purl: el.software_packageUrl,
+      name: el.name,
+      version: el.software_packageVersion,
+      license: null,
+    });
+    components.push(comp);
+    if (id) byId.set(id, comp);
+  }
+
+  let edges = 0;
+  for (const el of doc['@graph']) {
+    if (el.type !== 'Relationship' || !['dependsOn', 'contains'].includes(el.relationshipType)) continue;
+    for (const to of el.to || []) {
+      const target = byId.get(to);
+      if (!target) continue;
+      edges++;
+      if (el.from === rootId) root.dependsOn.push(target.key);
+      else if (byId.has(el.from)) byId.get(el.from).dependsOn.push(target.key);
+    }
+  }
+  return { format: 'spdx', components, root, complete: edges > 0 };
+}
+
+/**
+ * The product the SBOM describes. Without a purl in the SBOM it gets a
+ * `pkg:generic` one, so VEX statements still name the product unambiguously.
+ */
+function rootInfo(name, version, purl) {
+  const n = name || 'unknown';
+  const v = version || '0.0.0';
+  const parsed = parsePurl(purl);
+  return { name: n, version: v, purl: parsed ? parsed.canonical : `pkg:generic/${encodeURIComponent(n)}@${encodeURIComponent(v)}`, dependsOn: [] };
+}
+
+// --- Components -------------------------------------------------------------------
+
+/**
+ * Normalizes an SBOM component. The name and version come from the purl when
+ * there is one (it is what OSV understands), else from the SBOM fields.
+ */
+function component({ purl, name, version, license, optional = false }) {
+  const parsed = parsePurl(purl);
+  const clean = parsed ? parsed.canonical : null;
+  const displayName = parsed ? parsed.displayName : name || 'unknown';
+  const ver = (parsed && parsed.version) || version || null;
+  return {
+    key: clean || `${displayName}@${ver}`,
+    name: displayName,
+    version: ver,
+    purl: clean,
+    ecosystem: parsed ? parsed.type : null,
+    osvName: parsed ? parsed.osvName : displayName,
+    license: license || null,
+    scope: optional ? 'optional' : 'required',
+    dev: optional,
+    optional,
+    dependsOn: [],
+  };
+}
+
+/**
+ * Minimal Package URL parser (https://github.com/package-url/purl-spec).
+ * Returns the canonical purl without qualifiers/subpath and the name in the
+ * form each ecosystem uses (OSV naming): Maven `group:artifact`, npm
+ * `@scope/name`, Go/Composer `namespace/name`.
+ */
+function parsePurl(purl) {
+  if (typeof purl !== 'string' || !purl.startsWith('pkg:')) return null;
+  let rest = purl.slice(4).split('#')[0].split('?')[0];
+  // The version separator is the last `@` after the last `/` (an unencoded
+  // npm scope, `pkg:npm/@scope/name`, is not a version).
+  const at = rest.lastIndexOf('@');
+  let version = null;
+  let rawVersion = '';
+  if (at > rest.lastIndexOf('/')) {
+    rawVersion = rest.slice(at + 1);
+    version = decodeURIComponent(rawVersion);
+    rest = rest.slice(0, at);
+  }
+  const parts = rest.split('/');
+  const type = parts.shift().toLowerCase();
+  if (!type || !parts.length) return null;
+  const name = decodeURIComponent(parts.pop());
+  const namespace = parts.map(decodeURIComponent).join('/');
+
+  let osvName = name;
+  if (type === 'maven') osvName = namespace ? `${namespace}:${name}` : name;
+  else if (namespace) osvName = `${namespace}/${name}`;
+
+  return {
+    type,
+    namespace,
+    name,
+    version,
+    osvName,
+    displayName: osvName,
+    canonical: `pkg:${rest}${rawVersion ? `@${rawVersion}` : ''}`,
+  };
+}
+
+function dedupe(components) {
+  const seen = new Map();
+  for (const c of components) {
+    const existing = seen.get(c.key);
+    if (!existing) seen.set(c.key, c);
+    else existing.dependsOn.push(...c.dependsOn);
+  }
+  for (const c of seen.values()) c.dependsOn = [...new Set(c.dependsOn)].sort();
+  return [...seen.values()].sort((a, b) => a.key.localeCompare(b.key));
+}
+
+function fail(file, error) {
+  return {
+    ok: false, error, manager: 'sbom', format: null, lockfileName: path.basename(file), sourceFile: file,
+    document: null, root: rootInfo(), components: [], unidentified: 0,
+    dependencyGraphComplete: false,
+  };
+}
+
+module.exports = { readSbom, parsePurl };

package/src/core/sbom-validator.js

@@ -118,9 +118,15 @@ function validateSpdx(doc) {
   pushCheck(checks, 'components', 'Contains at least one package', packages.length > 0);
 
   const relationships = toArray(doc.relationships);
+  // Dependency edges as written by SPDX tools (Syft uses CONTAINS and
+  // DEPENDENCY_OF); the described package is the product, not a component.
+  const graphTypes = /^(DEPENDS_ON|CONTAINS|DEPENDENCY_OF|[A-Z_]+_DEPENDENCY_OF)$/;
+  const described = new Set(toArray(doc.documentDescribes));
   const inGraph = new Set();
   for (const r of relationships) {
-    if (r && r.relationshipType === 'DEPENDS_ON') {
+    if (!r) continue;
+    if (r.relationshipType === 'DESCRIBES' && r.spdxElementId === 'SPDXRef-DOCUMENT') described.add(r.relatedSpdxElement);
+    if (graphTypes.test(r.relationshipType)) {
       inGraph.add(r.spdxElementId);
       inGraph.add(r.relatedSpdxElement);
     }
@@ -138,7 +144,7 @@ function validateSpdx(doc) {
   };
   for (const pkg of packages) {
     const label = pkg.name || pkg.SPDXID || 'unknown';
-    if (pkg.SPDXID === 'SPDXRef-Package-root') continue;
+    if (pkg.SPDXID === 'SPDXRef-Package-root' || described.has(pkg.SPDXID)) continue;
     if (!pkg.versionInfo || pkg.versionInfo === 'NOASSERTION') { stats.missingVersion++; issues.push(`Package without a version: ${label}`); }
     if (!isAssertion(pkg.originator) && !isAssertion(pkg.supplier)) { stats.missingCreator++; issues.push(`Package without an originator: ${label}`); }
     if (!pkg.packageFileName) { stats.missingFilename++; issues.push(`Package without a filename: ${label}`); }
@@ -158,7 +164,7 @@ function validateSpdx(doc) {
   pushCheck(checks, 'componentHashes', 'All packages have a SHA-512 checksum', stats.missingHash === 0);
   pushCheck(checks, 'componentLicenses', 'All packages have a license', stats.missingLicense === 0);
   pushCheck(checks, 'componentIdentifiers', 'All packages have a purl', stats.missingPurl === 0);
-  pushCheck(checks, 'dependencyGraph', 'Dependency relationships (DEPENDS_ON) declared', stats.missingDependencies === 0);
+  pushCheck(checks, 'dependencyGraph', 'Dependency relationships declared for every package', stats.missingDependencies === 0);
 
   return summarize('spdx', checks, issues, stats);
 }

package/src/core/vex.js

@@ -106,18 +106,18 @@ function acceptance(finding, policy) {
 /**
  * Builds a VEX document for the vulnerability findings of an audit.
  *
- * @param {{ name: string, version: string }} product
+ * @param {{ name: string, version: string, purl?: string }} product
  * @param {object} vulnSection Result of scanVulnerabilities().
  * @param {object} policy
  * @param {{ format?: 'cyclonedx'|'openvex', author?: string|null }} [options]
  */
 function buildVex(product, vulnSection, policy, { format = 'cyclonedx', author = null } = {}) {
   const entries = normalizeAllowlist(policy);
-  const productPurl = buildPurl(product.name, product.version);
+  const productPurl = product.purl || buildPurl(product.name, product.version);
   const statements = [];
 
   for (const finding of vulnSection.vulnerabilities || []) {
-    const purl = buildPurl(finding.name, finding.version);
+    const purl = finding.purl || buildPurl(finding.name, finding.version);
     for (const source of finding.sources) {
       const assessment = finding.malicious ? null : assessmentFor(finding, source, entries);
       statements.push({ finding, source, purl, assessment });

package/src/core/vuln-scanner.js

@@ -5,7 +5,7 @@ const os = require('node:os');
 const path = require('node:path');
 const { runJson } = require('../utils/exec');
 const { exists, readJson } = require('../utils/fs');
-const { parseLockfile, toNpmLockfile, componentKey } = require('./lockfile-parser');
+const { parseLockfile, toNpmLockfile, componentKey, buildPurl } = require('./lockfile-parser');
 const {
   queryOsv, osvSeverity, cvssScore, isMalicious, fixedVersion, compareSemver,
 } = require('./osv');
@@ -25,20 +25,34 @@ const SEVERITY_ORDER = ['info', 'low', 'moderate', 'high', 'critical'];
  *    CVEs found are cross-checked with the CISA KEV catalogue.
  *  - `npm`: `npm audit`. Also the fallback when OSV.dev is unreachable.
  *
+ * An existing SBOM of any ecosystem can be scanned instead of the lockfile by
+ * passing the result of readSbom() as `parsed`; its components are looked up
+ * in OSV.dev by Package URL.
+ *
  * @param {string} projectRoot
- * @param {{ production?: boolean, source?: 'osv'|'npm', kev?: boolean }} [options]
+ * @param {{ production?: boolean, source?: 'osv'|'npm', kev?: boolean, parsed?: object }} [options]
  * @returns {Promise<object>}
  */
-async function scanVulnerabilities(projectRoot, { production = false, source = 'osv', kev = true } = {}) {
-  if (source === 'npm') return npmAuditSection(projectRoot, { production });
+async function scanVulnerabilities(projectRoot, { production = false, source = 'osv', kev = true, parsed: given } = {}) {
+  const fromSbom = Boolean(given && given.manager === 'sbom');
+  if (source === 'npm') {
+    if (fromSbom) {
+      return { ok: false, error: '`npm audit` cannot scan an input SBOM; use the default OSV source.', counts: emptyCounts(), vulnerabilities: [] };
+    }
+    return npmAuditSection(projectRoot, { production });
+  }
 
-  const parsed = parseLockfile(projectRoot);
+  const parsed = given || parseLockfile(projectRoot);
   if (!parsed.ok) {
     return { ok: false, error: parsed.error, counts: emptyCounts(), vulnerabilities: [] };
   }
 
-  const rootPkg = readJson(path.join(projectRoot, 'package.json')) || {};
-  const components = production ? productionComponents(parsed, rootPkg) : parsed.components;
+  let components = parsed.components;
+  if (production) {
+    components = fromSbom
+      ? components.filter((c) => !c.optional)
+      : productionComponents(parsed, readJson(path.join(projectRoot, 'package.json')) || {});
+  }
   const scannable = components.filter((c) => c.name && c.version);
 
   const [osv, catalogue] = await Promise.all([
@@ -47,6 +61,7 @@ async function scanVulnerabilities(projectRoot, { production = false, source = '
   ]);
 
   if (!osv.ok) {
+    if (fromSbom) return { ok: false, error: osv.error, counts: emptyCounts(), vulnerabilities: [] };
     const fallback = npmAuditSection(projectRoot, { production });
     fallback.warnings = [`${osv.error}; fell back to \`npm audit\` (no malicious-package or KEV check).`];
     return fallback;
@@ -55,7 +70,7 @@ async function scanVulnerabilities(projectRoot, { production = false, source = '
   const direct = new Set(parsed.root.dependsOn);
   const vulnerabilities = [];
   for (const c of scannable) {
-    const key = componentKey(c.name, c.version);
+    const key = c.key || componentKey(c.name, c.version);
     const records = osv.byComponent.get(key);
     if (!records || !records.length) continue;
     vulnerabilities.push(toFinding(c, records, direct.has(key), catalogue));
@@ -73,6 +88,8 @@ async function scanVulnerabilities(projectRoot, { production = false, source = '
     ok: true,
     source: 'osv',
     scanned: scannable.length,
+    input: fromSbom ? { file: parsed.sourceFile, format: parsed.format, unidentified: parsed.unidentified } : null,
+    ecosystems: [...new Set(scannable.map((c) => c.ecosystem || 'npm'))].sort(),
     kev: catalogue
       ? (catalogue.ok
         ? { checked: true, catalogVersion: catalogue.catalogVersion, entries: catalogue.count }
@@ -100,7 +117,7 @@ function toFinding(component, records, isDirect, catalogue) {
       cvss: cvssScore(record),
       cwe: (record.database_specific && record.database_specific.cwe_ids) || [],
       malicious: isMalicious(record),
-      fixed: fixedVersion(record, component.name, component.version),
+      fixed: fixedVersion(record, component.osvName || component.name, component.version),
       kev: kevEntry,
     };
   });
@@ -116,6 +133,8 @@ function toFinding(component, records, isDirect, catalogue) {
   return {
     name: component.name,
     version: component.version,
+    purl: component.purl || buildPurl(component.name, component.version),
+    ecosystem: component.ecosystem || 'npm',
     severity,
     direct: isDirect,
     range: null,
@@ -158,7 +177,7 @@ function severityRank(severity) {
 }
 
 function major(version) {
-  return parseInt(String(version).split('.')[0], 10);
+  return parseInt(String(version).replace(/^v/i, '').split('.')[0], 10);
 }
 
 /** `npm audit` source, used on request or as the OSV fallback. */

package/src/reporters/console.js

@@ -1,5 +1,6 @@
 'use strict';
 
+const path = require('node:path');
 const { logger, color } = require('../utils/logger');
 
 const SEVERITY_COLORS = {
@@ -87,7 +88,11 @@ function describeSources(section) {
   const kev = section.kev && section.kev.checked
     ? `CISA KEV ${section.kev.catalogVersion || ''} (${section.kev.entries} entries)`.replace('  ', ' ')
     : `CISA KEV not checked (${(section.kev && section.kev.error) || 'unavailable'})`;
-  return `Sources: OSV.dev (GitHub advisories + OpenSSF malicious packages) · ${kev} · ${section.scanned} components`;
+  const scope = section.input
+    ? `${section.scanned} components from ${shortPath(section.input.file)} (${(section.ecosystems || []).join(', ')})` +
+      (section.input.unidentified ? ` · ${section.input.unidentified} without purl skipped` : '')
+    : `${section.scanned} components`;
+  return `Sources: OSV.dev (GitHub advisories + OpenSSF malicious packages) · ${kev} · ${scope}`;
 }
 
 /** CRA Art. 14 reporting clock, shown when a KEV-listed vulnerability is found. */
@@ -116,7 +121,7 @@ function renderSbom(section) {
     logger.error(section.error);
     return;
   }
-  logger.detail(`Format: ${section.format} · Components: ${section.componentCount}`);
+  logger.detail(`${section.input ? `Input SBOM: ${shortPath(section.input)} · ` : ''}Format: ${section.format} · Components: ${section.componentCount}`);
 
   if (section.validation) {
     const v = section.validation;
@@ -176,4 +181,10 @@ function renderSummary(report) {
   logger.log('');
 }
 
+/** A path relative to the working directory when it is inside it. */
+function shortPath(file) {
+  const rel = path.relative(process.cwd(), file);
+  return rel && !rel.startsWith('..') && !path.isAbsolute(rel) ? rel : file;
+}
+
 module.exports = { reportConsole };

package/src/reporters/sarif.js

@@ -29,10 +29,11 @@ const SECURITY_SEVERITY = { critical: 9.5, high: 8.0, moderate: 5.5, low: 2.0, i
 function buildSarif(report, projectRoot, policy = {}) {
   const rules = new Map();
   const results = [];
-  const lock = lockfileLocator(projectRoot);
+  const vulns = report.sections.vulnerabilities;
+  const inputFile = vulns && vulns.input ? vulns.input.file : null;
+  const lock = lockfileLocator(projectRoot, inputFile);
   const assessments = normalizeAllowlist(policy);
 
-  const vulns = report.sections.vulnerabilities;
   if (vulns && vulns.ok) {
     for (const finding of vulns.vulnerabilities) {
       for (const source of finding.sources) {
@@ -46,7 +47,7 @@ function buildSarif(report, projectRoot, policy = {}) {
             : finding.malicious || source.kev || ['critical', 'high'].includes(source.severity || finding.severity) ? 'error'
               : (source.severity || finding.severity) === 'moderate' ? 'warning' : 'note',
           message: { text: vulnerabilityMessage(finding, source) },
-          locations: [lock.locate(finding.name, finding.version)],
+          locations: [lock.locate(finding.name, finding.version, finding.purl)],
           partialFingerprints: { 'craAudit/v1': `${ruleId}:${finding.name}@${finding.version || ''}` },
         };
         if (accepted) {
@@ -77,7 +78,7 @@ function buildSarif(report, projectRoot, policy = {}) {
           ruleId,
           level,
           message: { text: text(c) },
-          locations: [lock.locate(c.name, c.version)],
+          locations: [lock.locate(c.name, c.version, c.purl)],
           partialFingerprints: { 'craAudit/v1': `${ruleId}:${c.name}@${c.version}` },
         });
       }
@@ -163,13 +164,18 @@ function licenseRule(ruleId) {
 }
 
 /**
- * Finds the line of `name@version` in the project lockfile so each alert
- * points at the exact entry. Falls back to package.json line 1.
+ * Finds the line of `name@version` in the project lockfile (or of the purl in
+ * an input SBOM) so each alert points at the exact entry. Falls back to line 1.
  */
-function lockfileLocator(projectRoot) {
+function lockfileLocator(projectRoot, inputFile = null) {
   const repoRoot = findRepoRoot(projectRoot);
-  const parsed = parseLockfile(projectRoot);
-  const file = parsed.lockfileName ? path.join(projectRoot, parsed.lockfileName) : path.join(projectRoot, 'package.json');
+  let file;
+  if (inputFile) {
+    file = path.resolve(inputFile);
+  } else {
+    const parsed = parseLockfile(projectRoot);
+    file = parsed.lockfileName ? path.join(projectRoot, parsed.lockfileName) : path.join(projectRoot, 'package.json');
+  }
   let lines = [];
   try {
     lines = fs.readFileSync(file, 'utf8').split(/\r?\n/);
@@ -178,8 +184,8 @@ function lockfileLocator(projectRoot) {
   }
   const uri = path.relative(repoRoot, file).split(path.sep).join('/');
 
-  const locate = (name, version) => {
-    const line = findEntryLine(lines, name, version);
+  const locate = (name, version, purl) => {
+    const line = inputFile ? findPurlLine(lines, purl) : findEntryLine(lines, name, version);
     return {
       physicalLocation: {
         artifactLocation: { uri, uriBaseId: '%SRCROOT%' },
@@ -209,6 +215,15 @@ function findEntryLine(lines, name, version) {
   return 1;
 }
 
+/** Line of an SBOM that holds the purl (qualifiers may follow it). */
+function findPurlLine(lines, purl) {
+  if (!purl) return 1;
+  const escaped = purl.replace(/[.*+?^${}()|[\]\\/]/g, '\\$&');
+  const exact = new RegExp(`${escaped}(?![\\w.+-])`);
+  const index = lines.findIndex((line) => exact.test(line));
+  return index === -1 ? 1 : index + 1;
+}
+
 /** Nearest folder with a .git entry: SARIF paths must be repository-relative. */
 function findRepoRoot(start) {
   let dir = path.resolve(start);