cra-audit 2.4.0 → 2.4.1

package/CHANGELOG.md

@@ -8,6 +8,13 @@ Releases are automated: pushing a `vX.Y.Z` tag publishes the package to npm
 (with provenance) and creates the GitHub Release from the matching section
 below, so add the section before running `npm version`.
 
+## [2.4.1] — Clearer CRA Art. 14 notice
+
+### Changed
+
+- The Art. 14 notice is now headed **"dependency with a known exploited vulnerability (CISA KEV)"** instead of "actively exploited vulnerability in a dependency". A KEV match means the vulnerability has been exploited somewhere; the reporting duty applies once you are aware that it is exploitable in your product (CRA Art. 3(42) and Art. 14(1)). The 24 h / 72 h / 14 days deadlines run from that awareness, not from the KEV listing.
+- README and the Spanish INCIBE-CERT guide describe KEV matches as a trigger to assess and document with VEX, not as a started reporting clock.
+
 ## [2.4.0] — Report to your country's CSIRT (INCIBE-CERT for Spain)
 
 ### Highlights

package/README.md

@@ -55,13 +55,13 @@ Checks every **direct and transitive** dependency, at the exact version pinned i
 | --- | --- | --- |
 | [OSV.dev](https://osv.dev) — GitHub Advisory Database | Known vulnerabilities, with severity, CVE aliases and the version that fixes them | Fails at or above `--fail-on` (default `high`) |
 | OSV.dev — [OpenSSF malicious packages](https://github.com/ossf/malicious-packages) | Compromised releases (`MAL-*`), e.g. the Shai-Hulud worm versions | **Always fails**; cannot be allowlisted |
-| [CISA KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) | Vulnerabilities with evidence of **active exploitation** | Fails by default (`--no-fail-on-kev` to only warn) and prints the CRA Art. 14 reporting clock |
+| [CISA KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) | Vulnerabilities with evidence of **active exploitation** | Fails by default (`--no-fail-on-kev` to only warn) and shows the CRA Art. 14 deadlines that apply if it affects your product |
 
 ```text
   HIGH     [KEV] vite@6.2.3  (fix: vite@6.4.3)
     GHSA-4r4m-qw57-chr8 / CVE-2025-31125 Vite has a `server.fs.deny` bypassed … [KEV since 2026-01-22]
 
-⚠ CRA Art. 14 — actively exploited vulnerability in a dependency
+⚠ CRA Art. 14 — dependency with a known exploited vulnerability (CISA KEV)
     • Early warning ........ within 24 hours of becoming aware
     • Notification ......... within 72 hours
     • Final report ......... within 14 days after a corrective measure is available
@@ -69,7 +69,7 @@ Checks every **direct and transitive** dependency, at the exact version pinned i
 
 Only package names and versions are sent to `api.osv.dev`; the KEV catalogue is downloaded from cisa.gov (or CISA's GitHub mirror). If KEV cannot be reached the report says so instead of silently passing, and if OSV.dev is unreachable the audit falls back to `npm audit`. `--vuln-source npm` uses `npm audit` directly.
 
-> CRA Annex I Part I (2)(a) — *placed on the market without known exploitable vulnerabilities*. Art. 14 — *actively exploited vulnerabilities must be reported within 24 hours*.
+> CRA Annex I Part I (2)(a) — *placed on the market without known exploitable vulnerabilities*. Art. 14 — *any actively exploited vulnerability contained in the product* must be notified, with an early warning within 24 hours of becoming aware. A KEV match means the vulnerability has been exploited somewhere: assess whether it is exploitable in your product and record the decision with VEX.
 
 ### 3. Third-party component check
 
@@ -171,7 +171,7 @@ Findings point at the exact line of the manifest (in the console and in SARIF).
 
 **Input SBOM (`-i`), any language:**
 
-`audit`, `vuln`, `licenses` and `vex` accept an existing **CycloneDX JSON**, **SPDX 2.x JSON** or **SPDX 3.0 JSON-LD** SBOM instead of the npm lockfile. Every component is looked up in OSV.dev by its **Package URL**, so you get the same checks — known vulnerabilities, **malicious packages**, **CISA KEV** with the Art. 14 clock, licenses, VEX and SARIF — for any ecosystem OSV covers (Maven, PyPI, Go, crates.io, NuGet, Packagist, RubyGems, Hex, Pub, npm…).
+`audit`, `vuln`, `licenses` and `vex` accept an existing **CycloneDX JSON**, **SPDX 2.x JSON** or **SPDX 3.0 JSON-LD** SBOM instead of the npm lockfile. Every component is looked up in OSV.dev by its **Package URL**, so you get the same checks — known vulnerabilities, **malicious packages**, **CISA KEV** with the Art. 14 deadlines, licenses, VEX and SARIF — for any ecosystem OSV covers (Maven, PyPI, Go, crates.io, NuGet, Packagist, RubyGems, Hex, Pub, npm…).
 
 ```bash
 # Generate the SBOM with the tool of your ecosystem…

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cra-audit",
-  "version": "2.4.0",
+  "version": "2.4.1",
   "description": "Audits npm, yarn, and pnpm projects for compliance with the European Cyber Resilience Act (CRA, EU Regulation 2024/2847) and BSI TR-03183: SBOM (CycloneDX/SPDX), known vulnerabilities, third-party components, and licenses.",
   "homepage": "https://github.com/migohe14/cra-audit#readme",
   "repository": {

package/src/core/kev.js

@@ -6,7 +6,9 @@ const { fetchJson } = require('../utils/http');
  * CISA Known Exploited Vulnerabilities catalogue: the most complete public
  * list of vulnerabilities with evidence of active exploitation. Under CRA
  * Art. 14 (applicable since 11 September 2026) manufacturers must report
- * actively exploited vulnerabilities in their products within 24 hours.
+ * actively exploited vulnerabilities contained in their products within 24
+ * hours of becoming aware. A KEV match is a signal to assess, not a report
+ * by itself: the vulnerability must be exploitable in the product.
  *
  * The GitHub mirror maintained by CISA is used when the primary feed fails.
  */

package/src/core/policy.js

@@ -20,8 +20,8 @@ const DEFAULT_POLICY = {
   sbomCreator: null,
   // Vulnerability source: `osv` (OSV.dev + CISA KEV) or `npm` (npm audit).
   vulnerabilitySource: 'osv',
-  // Fail when a dependency has an actively exploited vulnerability (CISA KEV),
-  // the trigger of the CRA Art. 14 reporting obligation.
+  // Fail when a dependency has an actively exploited vulnerability (CISA KEV):
+  // if it is exploitable in the product, CRA Art. 14 reporting applies.
   failOnKev: true,
   // ISO 3166-1 alpha-2 country of the manufacturer's main establishment: it
   // decides the CSIRT that receives CRA Art. 14 notifications (e.g. "ES").

package/src/reporters/console.js

@@ -100,7 +100,7 @@ function describeSources(section) {
 function renderArticle14Notice(reporting) {
   const local = reporting && reporting.local;
   logger.log('');
-  logger.warn(color.bold('CRA Art. 14 — actively exploited vulnerability in a dependency'));
+  logger.warn(color.bold('CRA Art. 14 — dependency with a known exploited vulnerability (CISA KEV)'));
   logger.detail('If it affects a product with digital elements you place on the EU market, notify');
   logger.detail(`${local ? `${local.csirt} and ENISA` : 'the coordinating CSIRT and ENISA'} through the Single Reporting Platform (SRP):`);
   logger.detail('  • Early warning ........ within 24 hours of becoming aware');