cve-scanner 0.0.0 → 0.0.2

package/dist/pipeline/dedupeEntries.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dedupeEntries.test.js","sourceRoot":"","sources":["../../src/pipeline/dedupeEntries.test.ts"],"names":[],"mappings":";;;;;AAAA,gEAAwC;AACxC,yCAAiC;AAEjC,mDAAgD;AAEhD,MAAM,KAAK,GAAoB;IAC7B,SAAS,EAAE,KAAK;IAChB,GAAG,EAAE,yCAAyC;IAC9C,mBAAmB,EAAE,SAAS;IAC9B,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;CACjD,CAAC;AAEF,IAAA,gBAAI,EAAC,sDAAsD,EAAE,GAAG,EAAE;IAChE,MAAM,MAAM,GAAG,IAAA,6BAAa,EAAC,CAAC,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC;IAC3D,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC/B,gBAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AACrC,CAAC,CAAC,CAAC;AAEH,IAAA,gBAAI,EAAC,wCAAwC,EAAE,GAAG,EAAE;IAClD,MAAM,KAAK,GAAoB,EAAE,GAAG,KAAK,EAAE,mBAAmB,EAAE,SAAS,EAAE,CAAC;IAC5E,gBAAM,CAAC,SAAS,CAAC,IAAA,6BAAa,EAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;AAClE,CAAC,CAAC,CAAC;AAEH,IAAA,gBAAI,EAAC,uBAAuB,EAAE,GAAG,EAAE;IACjC,gBAAM,CAAC,SAAS,CAAC,IAAA,6BAAa,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;AAC1C,CAAC,CAAC,CAAC"}

package/dist/pipeline/hashDataset.d.ts

@@ -0,0 +1,7 @@
+import { VulnerableEntry } from '../core/types';
+/**
+ * Deterministic content hash of a dataset's entries (not including
+ * generatedAt), used to detect whether a freshly-built dataset actually
+ * differs from the last one that was published. See specs/60-data-pipeline.md.
+ */
+export declare function hashEntries(entries: VulnerableEntry[]): string;

package/dist/pipeline/hashDataset.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.hashEntries = hashEntries;
+const crypto_1 = require("crypto");
+/**
+ * Deterministic content hash of a dataset's entries (not including
+ * generatedAt), used to detect whether a freshly-built dataset actually
+ * differs from the last one that was published. See specs/60-data-pipeline.md.
+ */
+function hashEntries(entries) {
+    return (0, crypto_1.createHash)('sha256').update(JSON.stringify(entries)).digest('hex');
+}
+//# sourceMappingURL=hashDataset.js.map

package/dist/pipeline/hashDataset.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hashDataset.js","sourceRoot":"","sources":["../../src/pipeline/hashDataset.ts"],"names":[],"mappings":";;;AAAA,mCAAoC;AAGpC;;;;GAIG;AACH,qBAA4B,OAA0B;IACpD,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5E,CAAC"}

package/dist/pipeline/hashDataset.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/pipeline/hashDataset.test.js

@@ -0,0 +1,28 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const strict_1 = __importDefault(require("node:assert/strict"));
+const node_test_1 = require("node:test");
+const hashDataset_1 = require("./hashDataset");
+const entry = {
+    ecosystem: 'npm',
+    cpe: 'cpe:2.3:a:lodash:lodash:*:*:*:*:*:*:*:*',
+    versionEndExcluding: '4.17.12',
+    cves: [{ id: 'CVE-1', score: 5, title: 'test' }],
+};
+(0, node_test_1.test)('produces a sha256 hex digest', () => {
+    strict_1.default.match((0, hashDataset_1.hashEntries)([entry]), /^[0-9a-f]{64}$/);
+});
+(0, node_test_1.test)('same entries produce the same hash', () => {
+    strict_1.default.equal((0, hashDataset_1.hashEntries)([entry]), (0, hashDataset_1.hashEntries)([{ ...entry }]));
+});
+(0, node_test_1.test)('different entries produce a different hash', () => {
+    const other = { ...entry, versionEndExcluding: '4.17.21' };
+    strict_1.default.notEqual((0, hashDataset_1.hashEntries)([entry]), (0, hashDataset_1.hashEntries)([other]));
+});
+(0, node_test_1.test)('empty dataset has a stable hash too', () => {
+    strict_1.default.equal((0, hashDataset_1.hashEntries)([]), (0, hashDataset_1.hashEntries)([]));
+});
+//# sourceMappingURL=hashDataset.test.js.map

package/dist/pipeline/hashDataset.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hashDataset.test.js","sourceRoot":"","sources":["../../src/pipeline/hashDataset.test.ts"],"names":[],"mappings":";;;;;AAAA,gEAAwC;AACxC,yCAAiC;AAEjC,+CAA4C;AAE5C,MAAM,KAAK,GAAoB;IAC7B,SAAS,EAAE,KAAK;IAChB,GAAG,EAAE,yCAAyC;IAC9C,mBAAmB,EAAE,SAAS;IAC9B,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;CACjD,CAAC;AAEF,IAAA,gBAAI,EAAC,8BAA8B,EAAE,GAAG,EAAE;IACxC,gBAAM,CAAC,KAAK,CAAC,IAAA,yBAAW,EAAC,CAAC,KAAK,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;AACvD,CAAC,CAAC,CAAC;AAEH,IAAA,gBAAI,EAAC,oCAAoC,EAAE,GAAG,EAAE;IAC9C,gBAAM,CAAC,KAAK,CAAC,IAAA,yBAAW,EAAC,CAAC,KAAK,CAAC,CAAC,EAAE,IAAA,yBAAW,EAAC,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC,CAAC,CAAC;AAEH,IAAA,gBAAI,EAAC,4CAA4C,EAAE,GAAG,EAAE;IACtD,MAAM,KAAK,GAAoB,EAAE,GAAG,KAAK,EAAE,mBAAmB,EAAE,SAAS,EAAE,CAAC;IAC5E,gBAAM,CAAC,QAAQ,CAAC,IAAA,yBAAW,EAAC,CAAC,KAAK,CAAC,CAAC,EAAE,IAAA,yBAAW,EAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC9D,CAAC,CAAC,CAAC;AAEH,IAAA,gBAAI,EAAC,qCAAqC,EAAE,GAAG,EAAE;IAC/C,gBAAM,CAAC,KAAK,CAAC,IAAA,yBAAW,EAAC,EAAE,CAAC,EAAE,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC,CAAC;AACjD,CAAC,CAAC,CAAC"}

package/dist/pipeline/mapSeverityToScore.d.ts

@@ -0,0 +1,9 @@
+/**
+ * OSV records almost always carry a qualitative severity rating
+ * (database_specific.severity), not a numeric CVSS base score directly.
+ * This maps that rating to a representative numeric score within NVD's own
+ * qualitative bands (Low 0.1-3.9, Medium 4.0-6.9, High 7.0-8.9, Critical
+ * 9.0-10.0) so --fail-on-score gating still works. Approximate by design —
+ * see specs/60-data-pipeline.md.
+ */
+export declare function mapSeverityToScore(severity: string | undefined): number;

package/dist/pipeline/mapSeverityToScore.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.mapSeverityToScore = mapSeverityToScore;
+/**
+ * OSV records almost always carry a qualitative severity rating
+ * (database_specific.severity), not a numeric CVSS base score directly.
+ * This maps that rating to a representative numeric score within NVD's own
+ * qualitative bands (Low 0.1-3.9, Medium 4.0-6.9, High 7.0-8.9, Critical
+ * 9.0-10.0) so --fail-on-score gating still works. Approximate by design —
+ * see specs/60-data-pipeline.md.
+ */
+function mapSeverityToScore(severity) {
+    switch (severity) {
+        case 'CRITICAL':
+            return 9.5;
+        case 'HIGH':
+            return 7.5;
+        case 'MODERATE':
+            return 5.5;
+        case 'LOW':
+            return 2.0;
+        default:
+            return 5.0;
+    }
+}
+//# sourceMappingURL=mapSeverityToScore.js.map

package/dist/pipeline/mapSeverityToScore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mapSeverityToScore.js","sourceRoot":"","sources":["../../src/pipeline/mapSeverityToScore.ts"],"names":[],"mappings":";;;AAAA;;;;;;;GAOG;AACH,4BAAmC,QAA4B;IAC7D,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,UAAU;YACb,OAAO,GAAG,CAAC;QACb,KAAK,MAAM;YACT,OAAO,GAAG,CAAC;QACb,KAAK,UAAU;YACb,OAAO,GAAG,CAAC;QACb,KAAK,KAAK;YACR,OAAO,GAAG,CAAC;QACb;YACE,OAAO,GAAG,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/pipeline/mapSeverityToScore.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/pipeline/mapSeverityToScore.test.js

@@ -0,0 +1,20 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const strict_1 = __importDefault(require("node:assert/strict"));
+const node_test_1 = require("node:test");
+const mapSeverityToScore_1 = require("./mapSeverityToScore");
+(0, node_test_1.test)('maps known severity ratings into their NVD qualitative band', () => {
+    strict_1.default.ok((0, mapSeverityToScore_1.mapSeverityToScore)('CRITICAL') >= 9.0);
+    strict_1.default.ok((0, mapSeverityToScore_1.mapSeverityToScore)('HIGH') >= 7.0 && (0, mapSeverityToScore_1.mapSeverityToScore)('HIGH') < 9.0);
+    strict_1.default.ok((0, mapSeverityToScore_1.mapSeverityToScore)('MODERATE') >= 4.0 &&
+        (0, mapSeverityToScore_1.mapSeverityToScore)('MODERATE') < 7.0);
+    strict_1.default.ok((0, mapSeverityToScore_1.mapSeverityToScore)('LOW') > 0 && (0, mapSeverityToScore_1.mapSeverityToScore)('LOW') < 4.0);
+});
+(0, node_test_1.test)('falls back to a neutral score for unknown/missing severity', () => {
+    strict_1.default.equal((0, mapSeverityToScore_1.mapSeverityToScore)(undefined), 5.0);
+    strict_1.default.equal((0, mapSeverityToScore_1.mapSeverityToScore)('UNKNOWN'), 5.0);
+});
+//# sourceMappingURL=mapSeverityToScore.test.js.map

package/dist/pipeline/mapSeverityToScore.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mapSeverityToScore.test.js","sourceRoot":"","sources":["../../src/pipeline/mapSeverityToScore.test.ts"],"names":[],"mappings":";;;;;AAAA,gEAAwC;AACxC,yCAAiC;AACjC,6DAA0D;AAE1D,IAAA,gBAAI,EAAC,6DAA6D,EAAE,GAAG,EAAE;IACvE,gBAAM,CAAC,EAAE,CAAC,IAAA,uCAAkB,EAAC,UAAU,CAAC,IAAI,GAAG,CAAC,CAAC;IACjD,gBAAM,CAAC,EAAE,CACP,IAAA,uCAAkB,EAAC,MAAM,CAAC,IAAI,GAAG,IAAI,IAAA,uCAAkB,EAAC,MAAM,CAAC,GAAG,GAAG,CACtE,CAAC;IACF,gBAAM,CAAC,EAAE,CACP,IAAA,uCAAkB,EAAC,UAAU,CAAC,IAAI,GAAG;QACnC,IAAA,uCAAkB,EAAC,UAAU,CAAC,GAAG,GAAG,CACvC,CAAC;IACF,gBAAM,CAAC,EAAE,CAAC,IAAA,uCAAkB,EAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAA,uCAAkB,EAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC;AAC9E,CAAC,CAAC,CAAC;AAEH,IAAA,gBAAI,EAAC,4DAA4D,EAAE,GAAG,EAAE;IACtE,gBAAM,CAAC,KAAK,CAAC,IAAA,uCAAkB,EAAC,SAAS,CAAC,EAAE,GAAG,CAAC,CAAC;IACjD,gBAAM,CAAC,KAAK,CAAC,IAAA,uCAAkB,EAAC,SAAS,CAAC,EAAE,GAAG,CAAC,CAAC;AACnD,CAAC,CAAC,CAAC"}

package/dist/pipeline/parseOsvRecord.d.ts

@@ -0,0 +1,37 @@
+import { VulnerableEntry } from '../core/types';
+export type OsvEcosystem = 'Maven' | 'npm';
+interface OsvEvent {
+    introduced?: string;
+    fixed?: string;
+    last_affected?: string;
+    limit?: string;
+}
+interface OsvRange {
+    type: string;
+    events: OsvEvent[];
+}
+interface OsvAffected {
+    package?: {
+        name?: string;
+        ecosystem?: string;
+    };
+    ranges?: OsvRange[];
+    versions?: string[];
+}
+export interface OsvRecord {
+    id: string;
+    summary?: string;
+    details?: string;
+    aliases?: string[];
+    affected?: OsvAffected[];
+    database_specific?: {
+        severity?: string;
+    };
+}
+/**
+ * Pure function: an OSV vulnerability record -> zero or more VulnerableEntry
+ * for the given ecosystem. Records without a CVE alias are dropped entirely
+ * (this tool is CVE-keyed throughout). See specs/60-data-pipeline.md.
+ */
+export declare function parseOsvRecord(record: OsvRecord, targetEcosystem: OsvEcosystem): VulnerableEntry[];
+export {};

package/dist/pipeline/parseOsvRecord.js

@@ -0,0 +1,88 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseOsvRecord = parseOsvRecord;
+const cpe_1 = require("../core/cpe");
+const mapSeverityToScore_1 = require("./mapSeverityToScore");
+/**
+ * Walks an OSV range's `events`, which alternate "introduced" (opens a bound
+ * group) and "fixed"/"last_affected" (closes it). A group left open at the
+ * end of the array has no upper bound (still affected, no known fix).
+ * `limit` events are not supported in v1. See specs/60-data-pipeline.md.
+ */
+function extractBoundGroups(events) {
+    const groups = [];
+    let current;
+    for (const event of events) {
+        if (event.introduced !== undefined) {
+            if (current)
+                groups.push(current);
+            current = { start: event.introduced };
+        }
+        else if (event.fixed !== undefined && current) {
+            current.fixedExclusive = event.fixed;
+            groups.push(current);
+            current = undefined;
+        }
+        else if (event.last_affected !== undefined && current) {
+            current.lastAffectedInclusive = event.last_affected;
+            groups.push(current);
+            current = undefined;
+        }
+    }
+    if (current)
+        groups.push(current);
+    return groups;
+}
+function selectRanges(ranges) {
+    const ecosystemRanges = ranges.filter((r) => r.type === 'ECOSYSTEM');
+    if (ecosystemRanges.length > 0)
+        return ecosystemRanges;
+    return ranges.filter((r) => r.type === 'SEMVER');
+}
+/**
+ * Pure function: an OSV vulnerability record -> zero or more VulnerableEntry
+ * for the given ecosystem. Records without a CVE alias are dropped entirely
+ * (this tool is CVE-keyed throughout). See specs/60-data-pipeline.md.
+ */
+function parseOsvRecord(record, targetEcosystem) {
+    const cveIds = (record.aliases ?? []).filter((a) => /^CVE-\d{4}-\d+$/.test(a));
+    if (cveIds.length === 0)
+        return [];
+    const title = record.summary || record.details?.slice(0, 200) || record.id;
+    const score = (0, mapSeverityToScore_1.mapSeverityToScore)(record.database_specific?.severity);
+    const cves = cveIds.map((id) => ({ id, score, title }));
+    const ecosystem = targetEcosystem === 'Maven' ? 'maven' : 'npm';
+    const entries = [];
+    for (const affected of record.affected ?? []) {
+        if (affected.package?.ecosystem !== targetEcosystem)
+            continue;
+        const coordinate = affected.package?.name;
+        if (!coordinate)
+            continue;
+        const ranges = selectRanges(affected.ranges ?? []);
+        const cpe = (0, cpe_1.buildCpe)(ecosystem, coordinate);
+        if (ranges.length > 0) {
+            for (const range of ranges) {
+                for (const group of extractBoundGroups(range.events)) {
+                    entries.push({
+                        ecosystem,
+                        cpe,
+                        versionStartIncluding: group.start,
+                        versionEndExcluding: group.fixedExclusive,
+                        versionEndIncluding: group.lastAffectedInclusive,
+                        cves,
+                    });
+                }
+            }
+        }
+        else if (affected.versions && affected.versions.length > 0) {
+            // No ranges at all, just an enumerated list of affected versions -
+            // one exact-match VulnerableEntry per version. See specs/60-data-pipeline.md.
+            for (const version of affected.versions) {
+                entries.push({ ecosystem, cpe, versionExact: version, cves });
+            }
+        }
+    }
+    return entries;
+}
+//# sourceMappingURL=parseOsvRecord.js.map

package/dist/pipeline/parseOsvRecord.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parseOsvRecord.js","sourceRoot":"","sources":["../../src/pipeline/parseOsvRecord.ts"],"names":[],"mappings":";;;AAAA,qCAAuC;AAEvC,6DAA0D;AAqC1D;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,MAAkB;IAC5C,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,OAA+B,CAAC;IAEpC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACnC,IAAI,OAAO;gBAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAClC,OAAO,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;QACxC,CAAC;aAAM,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,EAAE,CAAC;YAChD,OAAO,CAAC,cAAc,GAAG,KAAK,CAAC,KAAK,CAAC;YACrC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACrB,OAAO,GAAG,SAAS,CAAC;QACtB,CAAC;aAAM,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS,IAAI,OAAO,EAAE,CAAC;YACxD,OAAO,CAAC,qBAAqB,GAAG,KAAK,CAAC,aAAa,CAAC;YACpD,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACrB,OAAO,GAAG,SAAS,CAAC;QACtB,CAAC;IACH,CAAC;IAED,IAAI,OAAO;QAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAClC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,YAAY,CAAC,MAAkB;IACtC,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC;IACrE,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,eAAe,CAAC;IACvD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;AACnD,CAAC;AAED;;;;GAIG;AACH,wBACE,MAAiB,EACjB,eAA6B;IAE7B,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CACjD,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAC1B,CAAC;IACF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEnC,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,EAAE,CAAC;IAC3E,MAAM,KAAK,GAAG,IAAA,uCAAkB,EAAC,MAAM,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC;IACrE,MAAM,IAAI,GAAU,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IAC/D,MAAM,SAAS,GAAc,eAAe,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;IAE3E,MAAM,OAAO,GAAsB,EAAE,CAAC;IAEtC,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;QAC7C,IAAI,QAAQ,CAAC,OAAO,EAAE,SAAS,KAAK,eAAe;YAAE,SAAS;QAC9D,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC;QAC1C,IAAI,CAAC,UAAU;YAAE,SAAS;QAE1B,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QACnD,MAAM,GAAG,GAAG,IAAA,cAAQ,EAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QAE5C,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,KAAK,MAAM,KAAK,IAAI,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;oBACrD,OAAO,CAAC,IAAI,CAAC;wBACX,SAAS;wBACT,GAAG;wBACH,qBAAqB,EAAE,KAAK,CAAC,KAAK;wBAClC,mBAAmB,EAAE,KAAK,CAAC,cAAc;wBACzC,mBAAmB,EAAE,KAAK,CAAC,qBAAqB;wBAChD,IAAI;qBACL,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;aAAM,IAAI,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7D,mEAAmE;YACnE,8EAA8E;YAC9E,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;gBACxC,OAAO,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YAChE,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/pipeline/parseOsvRecord.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/pipeline/parseOsvRecord.test.js

@@ -0,0 +1,220 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const strict_1 = __importDefault(require("node:assert/strict"));
+const node_test_1 = require("node:test");
+const parseOsvRecord_1 = require("./parseOsvRecord");
+const mavenRecord = {
+    id: 'GHSA-xxv9-w5hm-328j',
+    aliases: ['CVE-2024-28155'],
+    summary: 'Jenkins AppSpider Plugin missing permission checks',
+    database_specific: { severity: 'MODERATE' },
+    affected: [
+        {
+            package: {
+                name: 'com.rapid7:jenkinsci-appspider-plugin',
+                ecosystem: 'Maven',
+            },
+            ranges: [
+                {
+                    type: 'ECOSYSTEM',
+                    events: [{ introduced: '0' }, { fixed: '1.0.17' }],
+                },
+            ],
+        },
+    ],
+};
+(0, node_test_1.test)('maps a Maven OSV record to a VulnerableEntry with the package.name as-is', () => {
+    const entries = (0, parseOsvRecord_1.parseOsvRecord)(mavenRecord, 'Maven');
+    strict_1.default.deepEqual(entries, [
+        {
+            ecosystem: 'maven',
+            cpe: 'cpe:2.3:a:com.rapid7:jenkinsci-appspider-plugin:*:*:*:*:*:*:*:*',
+            versionStartIncluding: '0',
+            versionEndExcluding: '1.0.17',
+            versionEndIncluding: undefined,
+            cves: [
+                {
+                    id: 'CVE-2024-28155',
+                    score: 5.5,
+                    title: 'Jenkins AppSpider Plugin missing permission checks',
+                },
+            ],
+        },
+    ]);
+});
+(0, node_test_1.test)('drops records with no CVE alias', () => {
+    const noCve = { ...mavenRecord, aliases: [] };
+    strict_1.default.deepEqual((0, parseOsvRecord_1.parseOsvRecord)(noCve, 'Maven'), []);
+});
+(0, node_test_1.test)('skips affected entries for a different ecosystem', () => {
+    strict_1.default.deepEqual((0, parseOsvRecord_1.parseOsvRecord)(mavenRecord, 'npm'), []);
+});
+(0, node_test_1.test)('falls back to details/id when summary is missing, and to a neutral score when severity is missing', () => {
+    const record = {
+        id: 'GHSA-aaaa-bbbb-cccc',
+        aliases: ['CVE-2023-0001'],
+        details: 'A very long details field that should be truncated at some point for the title fallback use case here',
+        affected: [
+            {
+                package: { name: 'lodash', ecosystem: 'npm' },
+                ranges: [
+                    {
+                        type: 'ECOSYSTEM',
+                        events: [{ introduced: '0' }, { fixed: '4.17.12' }],
+                    },
+                ],
+            },
+        ],
+    };
+    const [entry] = (0, parseOsvRecord_1.parseOsvRecord)(record, 'npm');
+    strict_1.default.equal(entry.cpe, 'cpe:2.3:a:lodash:lodash:*:*:*:*:*:*:*:*');
+    strict_1.default.equal(entry.cves[0].score, 5.0);
+    strict_1.default.match(entry.cves[0].title, /^A very long details field/);
+});
+(0, node_test_1.test)('produces one entry per disjoint bound group within a single range', () => {
+    const record = {
+        id: 'GHSA-multi',
+        aliases: ['CVE-2023-0002'],
+        summary: 'two independently-fixed branches',
+        affected: [
+            {
+                package: { name: 'left-pad', ecosystem: 'npm' },
+                ranges: [
+                    {
+                        type: 'ECOSYSTEM',
+                        events: [
+                            { introduced: '0' },
+                            { fixed: '1.2.0' },
+                            { introduced: '2.0.0' },
+                            { fixed: '2.5.0' },
+                        ],
+                    },
+                ],
+            },
+        ],
+    };
+    const entries = (0, parseOsvRecord_1.parseOsvRecord)(record, 'npm');
+    strict_1.default.equal(entries.length, 2);
+    strict_1.default.equal(entries[0].versionStartIncluding, '0');
+    strict_1.default.equal(entries[0].versionEndExcluding, '1.2.0');
+    strict_1.default.equal(entries[1].versionStartIncluding, '2.0.0');
+    strict_1.default.equal(entries[1].versionEndExcluding, '2.5.0');
+});
+(0, node_test_1.test)('uses last_affected as an inclusive upper bound when there is no fixed version', () => {
+    const record = {
+        id: 'GHSA-last-affected',
+        aliases: ['CVE-2023-0003'],
+        summary: 'no known fix',
+        affected: [
+            {
+                package: { name: 'left-pad', ecosystem: 'npm' },
+                ranges: [
+                    {
+                        type: 'ECOSYSTEM',
+                        events: [{ introduced: '0' }, { last_affected: '1.0.0' }],
+                    },
+                ],
+            },
+        ],
+    };
+    const [entry] = (0, parseOsvRecord_1.parseOsvRecord)(record, 'npm');
+    strict_1.default.equal(entry.versionEndIncluding, '1.0.0');
+    strict_1.default.equal(entry.versionEndExcluding, undefined);
+});
+(0, node_test_1.test)('leaves the upper bound open when no fixed/last_affected event ever closes the group', () => {
+    const record = {
+        id: 'GHSA-open-ended',
+        aliases: ['CVE-2023-0004'],
+        summary: 'still vulnerable, no fix released',
+        affected: [
+            {
+                package: { name: 'left-pad', ecosystem: 'npm' },
+                ranges: [{ type: 'ECOSYSTEM', events: [{ introduced: '0' }] }],
+            },
+        ],
+    };
+    const [entry] = (0, parseOsvRecord_1.parseOsvRecord)(record, 'npm');
+    strict_1.default.equal(entry.versionStartIncluding, '0');
+    strict_1.default.equal(entry.versionEndExcluding, undefined);
+    strict_1.default.equal(entry.versionEndIncluding, undefined);
+});
+(0, node_test_1.test)('falls back to SEMVER ranges when no ECOSYSTEM range is present', () => {
+    const record = {
+        id: 'GHSA-semver-only',
+        aliases: ['CVE-2023-0005'],
+        summary: 'semver only',
+        affected: [
+            {
+                package: { name: 'left-pad', ecosystem: 'npm' },
+                ranges: [
+                    { type: 'SEMVER', events: [{ introduced: '0' }, { fixed: '1.0.0' }] },
+                ],
+            },
+        ],
+    };
+    const entries = (0, parseOsvRecord_1.parseOsvRecord)(record, 'npm');
+    strict_1.default.equal(entries.length, 1);
+    strict_1.default.equal(entries[0].versionEndExcluding, '1.0.0');
+});
+(0, node_test_1.test)('emits multiple Cve entries when a record has multiple CVE aliases', () => {
+    const record = {
+        id: 'GHSA-multi-cve',
+        aliases: ['CVE-2023-0006', 'CVE-2023-0007'],
+        summary: 'two CVEs for the same advisory',
+        affected: [
+            {
+                package: { name: 'left-pad', ecosystem: 'npm' },
+                ranges: [
+                    {
+                        type: 'ECOSYSTEM',
+                        events: [{ introduced: '0' }, { fixed: '1.0.0' }],
+                    },
+                ],
+            },
+        ],
+    };
+    const [entry] = (0, parseOsvRecord_1.parseOsvRecord)(record, 'npm');
+    strict_1.default.deepEqual(entry.cves.map((c) => c.id), ['CVE-2023-0006', 'CVE-2023-0007']);
+});
+(0, node_test_1.test)('falls back to an enumerated versions[] list as exact matches when there are no ranges at all', () => {
+    const record = {
+        id: 'GHSA-versions-only',
+        aliases: ['CVE-2023-0008'],
+        summary: 'no ranges, just a version list',
+        affected: [
+            {
+                package: { name: 'left-pad', ecosystem: 'npm' },
+                versions: ['1.0.0', '1.0.1', '1.0.2'],
+            },
+        ],
+    };
+    const entries = (0, parseOsvRecord_1.parseOsvRecord)(record, 'npm');
+    strict_1.default.deepEqual(entries.map((e) => e.versionExact), ['1.0.0', '1.0.1', '1.0.2']);
+    strict_1.default.ok(entries.every((e) => e.versionStartIncluding === undefined));
+});
+(0, node_test_1.test)('prefers ranges over versions[] when both are present', () => {
+    const record = {
+        id: 'GHSA-both',
+        aliases: ['CVE-2023-0009'],
+        summary: 'has both',
+        affected: [
+            {
+                package: { name: 'left-pad', ecosystem: 'npm' },
+                ranges: [
+                    {
+                        type: 'ECOSYSTEM',
+                        events: [{ introduced: '0' }, { fixed: '1.0.0' }],
+                    },
+                ],
+                versions: ['0.5.0'],
+            },
+        ],
+    };
+    const entries = (0, parseOsvRecord_1.parseOsvRecord)(record, 'npm');
+    strict_1.default.equal(entries.length, 1);
+    strict_1.default.equal(entries[0].versionEndExcluding, '1.0.0');
+});
+//# sourceMappingURL=parseOsvRecord.test.js.map

package/dist/pipeline/parseOsvRecord.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parseOsvRecord.test.js","sourceRoot":"","sources":["../../src/pipeline/parseOsvRecord.test.ts"],"names":[],"mappings":";;;;;AAAA,gEAAwC;AACxC,yCAAiC;AACjC,qDAA6D;AAE7D,MAAM,WAAW,GAAc;IAC7B,EAAE,EAAE,qBAAqB;IACzB,OAAO,EAAE,CAAC,gBAAgB,CAAC;IAC3B,OAAO,EAAE,oDAAoD;IAC7D,iBAAiB,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE;IAC3C,QAAQ,EAAE;QACR;YACE,OAAO,EAAE;gBACP,IAAI,EAAE,uCAAuC;gBAC7C,SAAS,EAAE,OAAO;aACnB;YACD,MAAM,EAAE;gBACN;oBACE,IAAI,EAAE,WAAW;oBACjB,MAAM,EAAE,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;iBACnD;aACF;SACF;KACF;CACF,CAAC;AAEF,IAAA,gBAAI,EAAC,0EAA0E,EAAE,GAAG,EAAE;IACpF,MAAM,OAAO,GAAG,IAAA,+BAAc,EAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IACrD,gBAAM,CAAC,SAAS,CAAC,OAAO,EAAE;QACxB;YACE,SAAS,EAAE,OAAO;YAClB,GAAG,EAAE,iEAAiE;YACtE,qBAAqB,EAAE,GAAG;YAC1B,mBAAmB,EAAE,QAAQ;YAC7B,mBAAmB,EAAE,SAAS;YAC9B,IAAI,EAAE;gBACJ;oBACE,EAAE,EAAE,gBAAgB;oBACpB,KAAK,EAAE,GAAG;oBACV,KAAK,EAAE,oDAAoD;iBAC5D;aACF;SACF;KACF,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAA,gBAAI,EAAC,iCAAiC,EAAE,GAAG,EAAE;IAC3C,MAAM,KAAK,GAAc,EAAE,GAAG,WAAW,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACzD,gBAAM,CAAC,SAAS,CAAC,IAAA,+BAAc,EAAC,KAAK,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;AACvD,CAAC,CAAC,CAAC;AAEH,IAAA,gBAAI,EAAC,kDAAkD,EAAE,GAAG,EAAE;IAC5D,gBAAM,CAAC,SAAS,CAAC,IAAA,+BAAc,EAAC,WAAW,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;AAC3D,CAAC,CAAC,CAAC;AAEH,IAAA,gBAAI,EAAC,mGAAmG,EAAE,GAAG,EAAE;IAC7G,MAAM,MAAM,GAAc;QACxB,EAAE,EAAE,qBAAqB;QACzB,OAAO,EAAE,CAAC,eAAe,CAAC;QAC1B,OAAO,EACL,uGAAuG;QACzG,QAAQ,EAAE;YACR;gBACE,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE;gBAC7C,MAAM,EAAE;oBACN;wBACE,IAAI,EAAE,WAAW;wBACjB,MAAM,EAAE,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;qBACpD;iBACF;aACF;SACF;KACF,CAAC;IACF,MAAM,CAAC,KAAK,CAAC,GAAG,IAAA,+BAAc,EAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC9C,gBAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,yCAAyC,CAAC,CAAC;IACnE,gBAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACvC,gBAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,4BAA4B,CAAC,CAAC;AAClE,CAAC,CAAC,CAAC;AAEH,IAAA,gBAAI,EAAC,mEAAmE,EAAE,GAAG,EAAE;IAC7E,MAAM,MAAM,GAAc;QACxB,EAAE,EAAE,YAAY;QAChB,OAAO,EAAE,CAAC,eAAe,CAAC;QAC1B,OAAO,EAAE,kCAAkC;QAC3C,QAAQ,EAAE;YACR;gBACE,OAAO,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE;gBAC/C,MAAM,EAAE;oBACN;wBACE,IAAI,EAAE,WAAW;wBACjB,MAAM,EAAE;4BACN,EAAE,UAAU,EAAE,GAAG,EAAE;4BACnB,EAAE,KAAK,EAAE,OAAO,EAAE;4BAClB,EAAE,UAAU,EAAE,OAAO,EAAE;4BACvB,EAAE,KAAK,EAAE,OAAO,EAAE;yBACnB;qBACF;iBACF;aACF;SACF;KACF,CAAC;IACF,MAAM,OAAO,GAAG,IAAA,+BAAc,EAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC9C,gBAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAChC,gBAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAC;IACpD,gBAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;IACtD,gBAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,qBAAqB,EAAE,OAAO,CAAC,CAAC;IACxD,gBAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;AACxD,CAAC,CAAC,CAAC;AAEH,IAAA,gBAAI,EAAC,+EAA+E,EAAE,GAAG,EAAE;IACzF,MAAM,MAAM,GAAc;QACxB,EAAE,EAAE,oBAAoB;QACxB,OAAO,EAAE,CAAC,eAAe,CAAC;QAC1B,OAAO,EAAE,cAAc;QACvB,QAAQ,EAAE;YACR;gBACE,OAAO,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE;gBAC/C,MAAM,EAAE;oBACN;wBACE,IAAI,EAAE,WAAW;wBACjB,MAAM,EAAE,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,EAAE,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;qBAC1D;iBACF;aACF;SACF;KACF,CAAC;IACF,MAAM,CAAC,KAAK,CAAC,GAAG,IAAA,+BAAc,EAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC9C,gBAAM,CAAC,KAAK,CAAC,KAAK,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;IACjD,gBAAM,CAAC,KAAK,CAAC,KAAK,CAAC,mBAAmB,EAAE,SAAS,CAAC,CAAC;AACrD,CAAC,CAAC,CAAC;AAEH,IAAA,gBAAI,EAAC,qFAAqF,EAAE,GAAG,EAAE;IAC/F,MAAM,MAAM,GAAc;QACxB,EAAE,EAAE,iBAAiB;QACrB,OAAO,EAAE,CAAC,eAAe,CAAC;QAC1B,OAAO,EAAE,mCAAmC;QAC5C,QAAQ,EAAE;YACR;gBACE,OAAO,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE;gBAC/C,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;aAC/D;SACF;KACF,CAAC;IACF,MAAM,CAAC,KAAK,CAAC,GAAG,IAAA,+BAAc,EAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC9C,gBAAM,CAAC,KAAK,CAAC,KAAK,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAC;IAC/C,gBAAM,CAAC,KAAK,CAAC,KAAK,CAAC,mBAAmB,EAAE,SAAS,CAAC,CAAC;IACnD,gBAAM,CAAC,KAAK,CAAC,KAAK,CAAC,mBAAmB,EAAE,SAAS,CAAC,CAAC;AACrD,CAAC,CAAC,CAAC;AAEH,IAAA,gBAAI,EAAC,gEAAgE,EAAE,GAAG,EAAE;IAC1E,MAAM,MAAM,GAAc;QACxB,EAAE,EAAE,kBAAkB;QACtB,OAAO,EAAE,CAAC,eAAe,CAAC;QAC1B,OAAO,EAAE,aAAa;QACtB,QAAQ,EAAE;YACR;gBACE,OAAO,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE;gBAC/C,MAAM,EAAE;oBACN,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE;iBACtE;aACF;SACF;KACF,CAAC;IACF,MAAM,OAAO,GAAG,IAAA,+BAAc,EAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC9C,gBAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAChC,gBAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;AACxD,CAAC,CAAC,CAAC;AAEH,IAAA,gBAAI,EAAC,mEAAmE,EAAE,GAAG,EAAE;IAC7E,MAAM,MAAM,GAAc;QACxB,EAAE,EAAE,gBAAgB;QACpB,OAAO,EAAE,CAAC,eAAe,EAAE,eAAe,CAAC;QAC3C,OAAO,EAAE,gCAAgC;QACzC,QAAQ,EAAE;YACR;gBACE,OAAO,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE;gBAC/C,MAAM,EAAE;oBACN;wBACE,IAAI,EAAE,WAAW;wBACjB,MAAM,EAAE,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;qBAClD;iBACF;aACF;SACF;KACF,CAAC;IACF,MAAM,CAAC,KAAK,CAAC,GAAG,IAAA,+BAAc,EAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC9C,gBAAM,CAAC,SAAS,CACd,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAC3B,CAAC,eAAe,EAAE,eAAe,CAAC,CACnC,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,IAAA,gBAAI,EAAC,8FAA8F,EAAE,GAAG,EAAE;IACxG,MAAM,MAAM,GAAc;QACxB,EAAE,EAAE,oBAAoB;QACxB,OAAO,EAAE,CAAC,eAAe,CAAC;QAC1B,OAAO,EAAE,gCAAgC;QACzC,QAAQ,EAAE;YACR;gBACE,OAAO,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE;gBAC/C,QAAQ,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC;aACtC;SACF;KACF,CAAC;IACF,MAAM,OAAO,GAAG,IAAA,+BAAc,EAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC9C,gBAAM,CAAC,SAAS,CACd,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,EAClC,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAC5B,CAAC;IACF,gBAAM,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,qBAAqB,KAAK,SAAS,CAAC,CAAC,CAAC;AACzE,CAAC,CAAC,CAAC;AAEH,IAAA,gBAAI,EAAC,sDAAsD,EAAE,GAAG,EAAE;IAChE,MAAM,MAAM,GAAc;QACxB,EAAE,EAAE,WAAW;QACf,OAAO,EAAE,CAAC,eAAe,CAAC;QAC1B,OAAO,EAAE,UAAU;QACnB,QAAQ,EAAE;YACR;gBACE,OAAO,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE;gBAC/C,MAAM,EAAE;oBACN;wBACE,IAAI,EAAE,WAAW;wBACjB,MAAM,EAAE,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;qBAClD;iBACF;gBACD,QAAQ,EAAE,CAAC,OAAO,CAAC;aACpB;SACF;KACF,CAAC;IACF,MAAM,OAAO,GAAG,IAAA,+BAAc,EAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC9C,gBAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAChC,gBAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;AACxD,CAAC,CAAC,CAAC"}

package/package.json

@@ -1,10 +1,41 @@
 {
   "name": "cve-scanner",
-  "version": "0.0.0",
-  "description": "OIDC trusted publishing setup package for cve-scanner",
+  "version": "0.0.2",
+  "scripts": {
+    "build": "npm run format && tsc -p .",
+    "format": "prettier --write .",
+    "release": "npm run refresh-dataset && npm run check-dataset-changed && git add data/dataset.hash && npm version patch && npm run build && npm publish && git push --follow-tags",
+    "run": "npm run build && node ./dist/cmd/cve-scanner.js",
+    "test": "npm run build && node --test ./dist",
+    "fetch-osv-data": "node scripts/fetch-osv-data.js .osv-data",
+    "build-dataset": "npm run build && node scripts/build-dataset.js .osv-data/maven .osv-data/npm data/dataset.json",
+    "refresh-dataset": "npm run fetch-osv-data && npm run build-dataset",
+    "check-dataset-changed": "node scripts/check-dataset-changed.js data/dataset.json data/dataset.hash"
+  },
+  "bin": "dist/cmd/cve-scanner.js",
+  "devDependencies": {
+    "@types/node": "^26.6.5",
+    "@types/yauzl": "^3.4.0",
+    "prettier": "^3.9.10",
+    "typescript": "^7.0.2"
+  },
+  "dependencies": {
+    "commander": "^15.0.0",
+    "yauzl": "^3.4.0"
+  },
+  "homepage": "https://github.com/tomasbjerre/cve-scanner",
+  "repository": "git@github.com:tomasbjerre/cve-scanner.git",
+  "files": [
+    "dist",
+    "data",
+    "assets"
+  ],
+  "author": "Tomas Bjerre",
   "keywords": [
-    "oidc",
-    "trusted-publishing",
-    "setup"
-  ]
+    "cve",
+    "security",
+    "vulnerability",
+    "sca"
+  ],
+  "license": "Apache 2"
 }