cra-audit 2.4.1 → 2.4.2

package/CHANGELOG.md

@@ -8,6 +8,13 @@ Releases are automated: pushing a `vX.Y.Z` tag publishes the package to npm
 (with provenance) and creates the GitHub Release from the matching section
 below, so add the section before running `npm version`.
 
+## [2.4.2] — Art. 14 notice: assess exploitability first
+
+### Changed
+
+- The Art. 14 notice now reads **"applies if this known exploited (CISA KEV) vulnerability is exploitable in your product"** and leads with the assessment: not exploitable → record a `not_affected` VEX statement; exploitable → notify the coordinating CSIRT and ENISA within 24 h / 72 h / 14 days of becoming aware.
+- The audit check label and the SARIF message say "CRA Art. 14 reporting applies if exploitable in your product" instead of "may apply".
+
 ## [2.4.1] — Clearer CRA Art. 14 notice
 
 ### Changed

package/README.md

@@ -55,16 +55,19 @@ Checks every **direct and transitive** dependency, at the exact version pinned i
 | --- | --- | --- |
 | [OSV.dev](https://osv.dev) — GitHub Advisory Database | Known vulnerabilities, with severity, CVE aliases and the version that fixes them | Fails at or above `--fail-on` (default `high`) |
 | OSV.dev — [OpenSSF malicious packages](https://github.com/ossf/malicious-packages) | Compromised releases (`MAL-*`), e.g. the Shai-Hulud worm versions | **Always fails**; cannot be allowlisted |
-| [CISA KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) | Vulnerabilities with evidence of **active exploitation** | Fails by default (`--no-fail-on-kev` to only warn) and shows the CRA Art. 14 deadlines that apply if it affects your product |
+| [CISA KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) | Vulnerabilities with evidence of **active exploitation** | Fails by default (`--no-fail-on-kev` to only warn) and shows the CRA Art. 14 deadlines that apply if it is exploitable in your product |
 
 ```text
   HIGH     [KEV] vite@6.2.3  (fix: vite@6.4.3)
     GHSA-4r4m-qw57-chr8 / CVE-2025-31125 Vite has a `server.fs.deny` bypassed … [KEV since 2026-01-22]
 
-⚠ CRA Art. 14 — dependency with a known exploited vulnerability (CISA KEV)
-    • Early warning ........ within 24 hours of becoming aware
-    • Notification ......... within 72 hours
-    • Final report ......... within 14 days after a corrective measure is available
+⚠ CRA Art. 14 — applies if this known exploited (CISA KEV) vulnerability is exploitable in your product
+    Assess first: is the vulnerable code shipped and exploitable in your product?
+      • Not exploitable ...... record it as not_affected with VEX (cra-audit vex)
+      • Exploitable .......... notify the coordinating CSIRT and ENISA through the Single Reporting Platform (SRP):
+          Early warning ...... within 24 hours of becoming aware
+          Notification ....... within 72 hours
+          Final report ....... within 14 days after a corrective measure is available
 ```
 
 Only package names and versions are sent to `api.osv.dev`; the KEV catalogue is downloaded from cisa.gov (or CISA's GitHub mirror). If KEV cannot be reached the report says so instead of silently passing, and if OSV.dev is unreachable the audit falls back to `npm audit`. `--vuln-source npm` uses `npm audit` directly.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cra-audit",
-  "version": "2.4.1",
+  "version": "2.4.2",
   "description": "Audits npm, yarn, and pnpm projects for compliance with the European Cyber Resilience Act (CRA, EU Regulation 2024/2847) and BSI TR-03183: SBOM (CycloneDX/SPDX), known vulnerabilities, third-party components, and licenses.",
   "homepage": "https://github.com/migohe14/cra-audit#readme",
   "repository": {

package/src/core/auditor.js

@@ -189,7 +189,7 @@ function exploitationReasons(vulns, policy) {
   reasons.push({
     label: exploited.length === 0
       ? 'No actively exploited vulnerabilities (CISA KEV)'
-      : `${exploited.length} component(s) with actively exploited vulnerabilities (CISA KEV) — CRA Art. 14 reporting may apply`,
+      : `${exploited.length} component(s) with actively exploited vulnerabilities (CISA KEV) — CRA Art. 14 reporting applies if exploitable in your product`,
     passed: exploited.length === 0 || policy.failOnKev === false,
     warning: exploited.length > 0 && policy.failOnKev === false,
   });

package/src/reporters/console.js

@@ -100,13 +100,13 @@ function describeSources(section) {
 function renderArticle14Notice(reporting) {
   const local = reporting && reporting.local;
   logger.log('');
-  logger.warn(color.bold('CRA Art. 14 — dependency with a known exploited vulnerability (CISA KEV)'));
-  logger.detail('If it affects a product with digital elements you place on the EU market, notify');
-  logger.detail(`${local ? `${local.csirt} and ENISA` : 'the coordinating CSIRT and ENISA'} through the Single Reporting Platform (SRP):`);
-  logger.detail('  • Early warning ........ within 24 hours of becoming aware');
-  logger.detail('  • Notification ......... within 72 hours');
-  logger.detail('  • Final report ......... within 14 days after a corrective measure is available');
-  logger.detail('Assess exploitability in your product first; document the decision either way.');
+  logger.warn(color.bold('CRA Art. 14 — applies if this known exploited (CISA KEV) vulnerability is exploitable in your product'));
+  logger.detail('Assess first: is the vulnerable code shipped and exploitable in your product?');
+  logger.detail('  • Not exploitable ...... record it as not_affected with VEX (cra-audit vex)');
+  logger.detail(`  • Exploitable .......... notify ${local ? `${local.csirt} and ENISA` : 'the coordinating CSIRT and ENISA'} through the Single Reporting Platform (SRP):`);
+  logger.detail('      Early warning ...... within 24 hours of becoming aware');
+  logger.detail('      Notification ....... within 72 hours');
+  logger.detail('      Final report ....... within 14 days after a corrective measure is available');
   if (local) {
     logger.log('');
     logger.detail(color.bold(`${local.csirt} (${local.country}) — access to the SRP:`));

package/src/reporters/sarif.js

@@ -142,7 +142,7 @@ function vulnerabilityMessage(finding, source) {
     return `[MALICIOUS] ${pkg} is a known compromised release (${source.id}). Remove it and rotate exposed credentials.`;
   }
   const parts = [];
-  if (source.kev) parts.push(`[ACTIVELY EXPLOITED — CISA KEV since ${source.kev.dateAdded}; CRA Art. 14 reporting may apply]`);
+  if (source.kev) parts.push(`[ACTIVELY EXPLOITED — CISA KEV since ${source.kev.dateAdded}; CRA Art. 14 reporting applies if exploitable in your product]`);
   parts.push(`${pkg}: ${source.title || source.id}`);
   const cves = (source.aliases || []).filter((a) => /^CVE-/i.test(a));
   if (cves.length) parts.push(`(${cves.join(', ')})`);