cra-audit 2.4.0 → 2.4.2

package/CHANGELOG.md

@@ -8,6 +8,20 @@ Releases are automated: pushing a `vX.Y.Z` tag publishes the package to npm
 (with provenance) and creates the GitHub Release from the matching section
 below, so add the section before running `npm version`.
 
+## [2.4.2] — Art. 14 notice: assess exploitability first
+
+### Changed
+
+- The Art. 14 notice now reads **"applies if this known exploited (CISA KEV) vulnerability is exploitable in your product"** and leads with the assessment: not exploitable → record a `not_affected` VEX statement; exploitable → notify the coordinating CSIRT and ENISA within 24 h / 72 h / 14 days of becoming aware.
+- The audit check label and the SARIF message say "CRA Art. 14 reporting applies if exploitable in your product" instead of "may apply".
+
+## [2.4.1] — Clearer CRA Art. 14 notice
+
+### Changed
+
+- The Art. 14 notice is now headed **"dependency with a known exploited vulnerability (CISA KEV)"** instead of "actively exploited vulnerability in a dependency". A KEV match means the vulnerability has been exploited somewhere; the reporting duty applies once you are aware that it is exploitable in your product (CRA Art. 3(42) and Art. 14(1)). The 24 h / 72 h / 14 days deadlines run from that awareness, not from the KEV listing.
+- README and the Spanish INCIBE-CERT guide describe KEV matches as a trigger to assess and document with VEX, not as a started reporting clock.
+
 ## [2.4.0] — Report to your country's CSIRT (INCIBE-CERT for Spain)
 
 ### Highlights

package/README.md

@@ -55,21 +55,24 @@ Checks every **direct and transitive** dependency, at the exact version pinned i
 | --- | --- | --- |
 | [OSV.dev](https://osv.dev) — GitHub Advisory Database | Known vulnerabilities, with severity, CVE aliases and the version that fixes them | Fails at or above `--fail-on` (default `high`) |
 | OSV.dev — [OpenSSF malicious packages](https://github.com/ossf/malicious-packages) | Compromised releases (`MAL-*`), e.g. the Shai-Hulud worm versions | **Always fails**; cannot be allowlisted |
-| [CISA KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) | Vulnerabilities with evidence of **active exploitation** | Fails by default (`--no-fail-on-kev` to only warn) and prints the CRA Art. 14 reporting clock |
+| [CISA KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) | Vulnerabilities with evidence of **active exploitation** | Fails by default (`--no-fail-on-kev` to only warn) and shows the CRA Art. 14 deadlines that apply if it is exploitable in your product |
 
 ```text
   HIGH     [KEV] vite@6.2.3  (fix: vite@6.4.3)
     GHSA-4r4m-qw57-chr8 / CVE-2025-31125 Vite has a `server.fs.deny` bypassed … [KEV since 2026-01-22]
 
-⚠ CRA Art. 14 — actively exploited vulnerability in a dependency
-    • Early warning ........ within 24 hours of becoming aware
-    • Notification ......... within 72 hours
-    • Final report ......... within 14 days after a corrective measure is available
+⚠ CRA Art. 14 — applies if this known exploited (CISA KEV) vulnerability is exploitable in your product
+    Assess first: is the vulnerable code shipped and exploitable in your product?
+      • Not exploitable ...... record it as not_affected with VEX (cra-audit vex)
+      • Exploitable .......... notify the coordinating CSIRT and ENISA through the Single Reporting Platform (SRP):
+          Early warning ...... within 24 hours of becoming aware
+          Notification ....... within 72 hours
+          Final report ....... within 14 days after a corrective measure is available
 ```
 
 Only package names and versions are sent to `api.osv.dev`; the KEV catalogue is downloaded from cisa.gov (or CISA's GitHub mirror). If KEV cannot be reached the report says so instead of silently passing, and if OSV.dev is unreachable the audit falls back to `npm audit`. `--vuln-source npm` uses `npm audit` directly.
 
-> CRA Annex I Part I (2)(a) — *placed on the market without known exploitable vulnerabilities*. Art. 14 — *actively exploited vulnerabilities must be reported within 24 hours*.
+> CRA Annex I Part I (2)(a) — *placed on the market without known exploitable vulnerabilities*. Art. 14 — *any actively exploited vulnerability contained in the product* must be notified, with an early warning within 24 hours of becoming aware. A KEV match means the vulnerability has been exploited somewhere: assess whether it is exploitable in your product and record the decision with VEX.
 
 ### 3. Third-party component check
 
@@ -171,7 +174,7 @@ Findings point at the exact line of the manifest (in the console and in SARIF).
 
 **Input SBOM (`-i`), any language:**
 
-`audit`, `vuln`, `licenses` and `vex` accept an existing **CycloneDX JSON**, **SPDX 2.x JSON** or **SPDX 3.0 JSON-LD** SBOM instead of the npm lockfile. Every component is looked up in OSV.dev by its **Package URL**, so you get the same checks — known vulnerabilities, **malicious packages**, **CISA KEV** with the Art. 14 clock, licenses, VEX and SARIF — for any ecosystem OSV covers (Maven, PyPI, Go, crates.io, NuGet, Packagist, RubyGems, Hex, Pub, npm…).
+`audit`, `vuln`, `licenses` and `vex` accept an existing **CycloneDX JSON**, **SPDX 2.x JSON** or **SPDX 3.0 JSON-LD** SBOM instead of the npm lockfile. Every component is looked up in OSV.dev by its **Package URL**, so you get the same checks — known vulnerabilities, **malicious packages**, **CISA KEV** with the Art. 14 deadlines, licenses, VEX and SARIF — for any ecosystem OSV covers (Maven, PyPI, Go, crates.io, NuGet, Packagist, RubyGems, Hex, Pub, npm…).
 
 ```bash
 # Generate the SBOM with the tool of your ecosystem…

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cra-audit",
-  "version": "2.4.0",
+  "version": "2.4.2",
   "description": "Audits npm, yarn, and pnpm projects for compliance with the European Cyber Resilience Act (CRA, EU Regulation 2024/2847) and BSI TR-03183: SBOM (CycloneDX/SPDX), known vulnerabilities, third-party components, and licenses.",
   "homepage": "https://github.com/migohe14/cra-audit#readme",
   "repository": {

package/src/core/auditor.js

@@ -189,7 +189,7 @@ function exploitationReasons(vulns, policy) {
   reasons.push({
     label: exploited.length === 0
       ? 'No actively exploited vulnerabilities (CISA KEV)'
-      : `${exploited.length} component(s) with actively exploited vulnerabilities (CISA KEV) — CRA Art. 14 reporting may apply`,
+      : `${exploited.length} component(s) with actively exploited vulnerabilities (CISA KEV) — CRA Art. 14 reporting applies if exploitable in your product`,
     passed: exploited.length === 0 || policy.failOnKev === false,
     warning: exploited.length > 0 && policy.failOnKev === false,
   });

package/src/core/kev.js

@@ -6,7 +6,9 @@ const { fetchJson } = require('../utils/http');
  * CISA Known Exploited Vulnerabilities catalogue: the most complete public
  * list of vulnerabilities with evidence of active exploitation. Under CRA
  * Art. 14 (applicable since 11 September 2026) manufacturers must report
- * actively exploited vulnerabilities in their products within 24 hours.
+ * actively exploited vulnerabilities contained in their products within 24
+ * hours of becoming aware. A KEV match is a signal to assess, not a report
+ * by itself: the vulnerability must be exploitable in the product.
  *
  * The GitHub mirror maintained by CISA is used when the primary feed fails.
  */

package/src/core/policy.js

@@ -20,8 +20,8 @@ const DEFAULT_POLICY = {
   sbomCreator: null,
   // Vulnerability source: `osv` (OSV.dev + CISA KEV) or `npm` (npm audit).
   vulnerabilitySource: 'osv',
-  // Fail when a dependency has an actively exploited vulnerability (CISA KEV),
-  // the trigger of the CRA Art. 14 reporting obligation.
+  // Fail when a dependency has an actively exploited vulnerability (CISA KEV):
+  // if it is exploitable in the product, CRA Art. 14 reporting applies.
   failOnKev: true,
   // ISO 3166-1 alpha-2 country of the manufacturer's main establishment: it
   // decides the CSIRT that receives CRA Art. 14 notifications (e.g. "ES").

package/src/reporters/console.js

@@ -100,13 +100,13 @@ function describeSources(section) {
 function renderArticle14Notice(reporting) {
   const local = reporting && reporting.local;
   logger.log('');
-  logger.warn(color.bold('CRA Art. 14 — actively exploited vulnerability in a dependency'));
-  logger.detail('If it affects a product with digital elements you place on the EU market, notify');
-  logger.detail(`${local ? `${local.csirt} and ENISA` : 'the coordinating CSIRT and ENISA'} through the Single Reporting Platform (SRP):`);
-  logger.detail('  • Early warning ........ within 24 hours of becoming aware');
-  logger.detail('  • Notification ......... within 72 hours');
-  logger.detail('  • Final report ......... within 14 days after a corrective measure is available');
-  logger.detail('Assess exploitability in your product first; document the decision either way.');
+  logger.warn(color.bold('CRA Art. 14 — applies if this known exploited (CISA KEV) vulnerability is exploitable in your product'));
+  logger.detail('Assess first: is the vulnerable code shipped and exploitable in your product?');
+  logger.detail('  • Not exploitable ...... record it as not_affected with VEX (cra-audit vex)');
+  logger.detail(`  • Exploitable .......... notify ${local ? `${local.csirt} and ENISA` : 'the coordinating CSIRT and ENISA'} through the Single Reporting Platform (SRP):`);
+  logger.detail('      Early warning ...... within 24 hours of becoming aware');
+  logger.detail('      Notification ....... within 72 hours');
+  logger.detail('      Final report ....... within 14 days after a corrective measure is available');
   if (local) {
     logger.log('');
     logger.detail(color.bold(`${local.csirt} (${local.country}) — access to the SRP:`));

package/src/reporters/sarif.js

@@ -142,7 +142,7 @@ function vulnerabilityMessage(finding, source) {
     return `[MALICIOUS] ${pkg} is a known compromised release (${source.id}). Remove it and rotate exposed credentials.`;
   }
   const parts = [];
-  if (source.kev) parts.push(`[ACTIVELY EXPLOITED — CISA KEV since ${source.kev.dateAdded}; CRA Art. 14 reporting may apply]`);
+  if (source.kev) parts.push(`[ACTIVELY EXPLOITED — CISA KEV since ${source.kev.dateAdded}; CRA Art. 14 reporting applies if exploitable in your product]`);
   parts.push(`${pkg}: ${source.title || source.id}`);
   const cves = (source.aliases || []).filter((a) => /^CVE-/i.test(a));
   if (cves.length) parts.push(`(${cves.join(', ')})`);