dep-brain 0.7.0 → 0.8.0

package/CHANGELOG.md

@@ -9,3 +9,5 @@ All notable changes to this project will be documented in this file.
 - Improved duplicate detection and unused dependency heuristics.
 - Actionable recommendations for unused, duplicate, outdated, and risk findings.
 - Ranked top-issues summary output with `--top`.
+- Supply-chain trust scoring for risk findings.
+- Structured risk factors in JSON output.

package/README.md

@@ -21,6 +21,7 @@
 - Detect likely unused dependencies from source imports and scripts
 - Detect outdated packages
 - Highlight dependency risk signals
+- Score package trust using supply-chain metadata
 - Generate a simple project health score
 - Output reports in human-readable or JSON format
 
@@ -257,6 +258,8 @@ src/
 
 The project should optimize for trust, clarity, and actionability over flashy UI, generic graphs, or simply adding more checks.
 
+Risk findings now include a `trustScore` plus structured `riskFactors` such as publish recency, maintainer count, and repository presence.
+
 ## Repository Notes
 
 - Project brief: [docs/project-brief.md](./docs/project-brief.md)

package/depbrain.output.schema.json

@@ -17,6 +17,20 @@
         "reasons": { "type": "array", "items": { "type": "string" } }
       }
     },
+    "riskFactors": {
+      "type": "object",
+      "required": ["daysSincePublish", "downloads", "maintainersCount", "versionCount", "recentReleaseCount", "hasRepository", "dependencyType"],
+      "additionalProperties": false,
+      "properties": {
+        "daysSincePublish": { "type": ["number", "null"] },
+        "downloads": { "type": ["number", "null"] },
+        "maintainersCount": { "type": ["number", "null"] },
+        "versionCount": { "type": ["number", "null"] },
+        "recentReleaseCount": { "type": ["number", "null"] },
+        "hasRepository": { "type": "boolean" },
+        "dependencyType": { "type": "string", "enum": ["dependencies", "devDependencies", "unknown"] }
+      }
+    },
     "outputVersion": { "type": "string" },
     "rootDir": { "type": "string" },
     "score": { "type": "number" },
@@ -120,7 +134,7 @@
       "type": "array",
       "items": {
         "type": "object",
-        "required": ["name", "reasons", "confidence", "reasonCodes", "explanation", "recommendation"],
+        "required": ["name", "reasons", "confidence", "reasonCodes", "explanation", "trustScore", "riskFactors", "recommendation"],
         "additionalProperties": false,
         "properties": {
           "name": { "type": "string" },
@@ -129,6 +143,8 @@
           "confidence": { "type": "number", "minimum": 0, "maximum": 1 },
           "reasonCodes": { "type": "array", "items": { "type": "string" } },
           "explanation": { "type": "array", "items": { "type": "string" } },
+          "trustScore": { "type": "string", "enum": ["high", "medium", "low"] },
+          "riskFactors": { "$ref": "#/properties/riskFactors" },
           "recommendation": { "$ref": "#/properties/recommendation" }
         }
       }
@@ -147,6 +163,7 @@
           "priority": { "type": "string", "enum": ["high", "medium", "low"] },
           "confidence": { "type": "number", "minimum": 0, "maximum": 1 },
           "summary": { "type": "string" },
+          "trustScore": { "type": "string", "enum": ["high", "medium", "low"] },
           "recommendation": { "$ref": "#/properties/recommendation" }
         }
       }

package/dist/checks/risk.d.ts

@@ -1,5 +1,9 @@
 import type { DependencyGraph } from "../core/graph-builder.js";
 import type { RiskDependency } from "../core/analyzer.js";
 import type { CheckResult } from "../core/types.js";
-export declare function findRiskDependencies(graph: DependencyGraph): Promise<RiskDependency[]>;
+import { type PackageMetadata } from "../utils/npm-api.js";
+export interface RiskCheckOptions {
+    resolvePackageMetadata?: (name: string) => Promise<PackageMetadata | null>;
+}
+export declare function findRiskDependencies(graph: DependencyGraph, options?: RiskCheckOptions): Promise<RiskDependency[]>;
 export declare function runRiskCheck(graph: DependencyGraph): Promise<CheckResult>;

package/dist/checks/risk.js

@@ -1,50 +1,41 @@
 import { getPackageMetadata } from "../utils/npm-api.js";
 const TWO_YEARS_IN_DAYS = 365 * 2;
-export async function findRiskDependencies(graph) {
+const ONE_YEAR_IN_DAYS = 365;
+export async function findRiskDependencies(graph, options = {}) {
+    const resolvePackageMetadata = options.resolvePackageMetadata ?? getPackageMetadata;
     const names = Object.keys({
         ...graph.dependencies,
         ...graph.devDependencies
     });
     const results = await Promise.all(names.map(async (name) => {
-        const metadata = await getPackageMetadata(name);
-        const reasons = [];
+        const metadata = await resolvePackageMetadata(name);
         if (!metadata) {
             return null;
         }
-        if (metadata.daysSincePublish !== null && metadata.daysSincePublish > TWO_YEARS_IN_DAYS) {
-            reasons.push("No release in over 2 years");
-        }
-        if (metadata.downloads !== null && metadata.downloads < 1000) {
-            reasons.push("Low weekly download volume");
-        }
-        if (!metadata.repository) {
-            reasons.push("Missing repository metadata");
-        }
-        if (reasons.length === 0) {
+        const dependencyType = graph.dependencies[name]
+            ? "dependencies"
+            : graph.devDependencies[name]
+                ? "devDependencies"
+                : "unknown";
+        const assessment = assessRisk(metadata, dependencyType);
+        if (assessment.reasons.length === 0) {
             return null;
         }
         return {
             name,
-            reasons,
-            confidence: calculateRiskConfidence(reasons),
-            reasonCodes: reasons.map(toRiskReasonCode),
-            explanation: reasons,
-            recommendation: buildRiskRecommendation(reasons, calculateRiskConfidence(reasons))
+            reasons: assessment.reasons,
+            confidence: assessment.confidence,
+            reasonCodes: assessment.reasonCodes,
+            explanation: assessment.reasons,
+            trustScore: assessment.trustScore,
+            riskFactors: assessment.riskFactors,
+            recommendation: buildRiskRecommendation(assessment.reasons, assessment.confidence, assessment.trustScore)
         };
     }));
     return results
         .filter((item) => item !== null)
         .sort((left, right) => left.name.localeCompare(right.name));
 }
-function buildRiskRecommendation(reasons, confidence) {
-    return {
-        action: "review",
-        priority: confidence >= 0.79 ? "high" : "medium",
-        safety: "caution",
-        summary: "Review package trust signals and decide whether to keep, replace, or monitor it.",
-        reasons
-    };
-}
 export async function runRiskCheck(graph) {
     const risks = await findRiskDependencies(graph);
     return {
@@ -53,24 +44,89 @@ export async function runRiskCheck(graph) {
         issues: risks.map((item) => ({
             id: `risk:${item.name}`,
             message: `${item.name}: ${item.reasons.join("; ")}`,
-            severity: "warning",
+            severity: item.trustScore === "low"
+                ? "critical"
+                : item.trustScore === "medium"
+                    ? "warning"
+                    : "info",
             confidence: item.confidence,
             reasonCodes: item.reasonCodes,
             explanation: item.explanation,
             meta: {
                 name: item.name,
-                reasons: item.reasons
+                reasons: item.reasons,
+                trustScore: item.trustScore,
+                riskFactors: item.riskFactors
             }
         }))
     };
 }
-function calculateRiskConfidence(reasons) {
-    return Math.min(0.99, 0.55 + reasons.length * 0.12);
+function assessRisk(metadata, dependencyType) {
+    const reasons = [];
+    const reasonCodes = [];
+    let weight = 0;
+    if (metadata.daysSincePublish !== null && metadata.daysSincePublish > TWO_YEARS_IN_DAYS) {
+        reasons.push("No release in over 2 years");
+        reasonCodes.push("stale_release");
+        weight += 3;
+    }
+    else if (metadata.daysSincePublish !== null &&
+        metadata.daysSincePublish > ONE_YEAR_IN_DAYS) {
+        reasons.push("No release in over 12 months");
+        reasonCodes.push("aging_release");
+        weight += 2;
+    }
+    if (metadata.downloads !== null && metadata.downloads < 1000) {
+        reasons.push("Low weekly download volume");
+        reasonCodes.push("low_download_volume");
+        weight += 2;
+    }
+    if (!metadata.repository) {
+        reasons.push("Missing repository metadata");
+        reasonCodes.push("missing_repository_metadata");
+        weight += 2;
+    }
+    if (metadata.maintainersCount !== null && metadata.maintainersCount <= 1) {
+        reasons.push("Single maintainer package");
+        reasonCodes.push("single_maintainer");
+        weight += 2;
+    }
+    if (metadata.recentReleaseCount !== null && metadata.recentReleaseCount === 0) {
+        reasons.push("No releases published in the last 30 days");
+        reasonCodes.push("no_recent_release");
+        weight += 1;
+    }
+    if (metadata.versionCount !== null && metadata.versionCount <= 3) {
+        reasons.push("Very limited published version history");
+        reasonCodes.push("limited_version_history");
+        weight += 1;
+    }
+    const confidence = reasons.length === 0 ? 0.5 : Math.min(0.99, 0.52 + weight * 0.07);
+    const trustScore = weight >= 6 ? "low" : weight >= 3 ? "medium" : "high";
+    return {
+        confidence,
+        trustScore,
+        reasons,
+        reasonCodes,
+        riskFactors: {
+            daysSincePublish: metadata.daysSincePublish,
+            downloads: metadata.downloads,
+            maintainersCount: metadata.maintainersCount,
+            versionCount: metadata.versionCount,
+            recentReleaseCount: metadata.recentReleaseCount,
+            hasRepository: Boolean(metadata.repository),
+            dependencyType
+        }
+    };
 }
-function toRiskReasonCode(reason) {
-    const normalized = reason
-        .toLowerCase()
-        .replace(/[^a-z0-9]+/g, "_")
-        .replace(/^_+|_+$/g, "");
-    return normalized || "risk_signal_detected";
+function buildRiskRecommendation(reasons, confidence, trustScore) {
+    return {
+        action: "review",
+        priority: trustScore === "low" || confidence >= 0.8 ? "high" : "medium",
+        safety: "caution",
+        summary: trustScore === "low"
+            ? "Low trust package; review whether to replace, pin, or monitor it closely."
+            : "Review package trust signals and decide whether to keep, replace, or monitor it.",
+        reasons
+    };
 }

package/dist/core/analyzer.d.ts

@@ -15,6 +15,16 @@ export interface Recommendation {
     summary: string;
     reasons: string[];
 }
+export interface RiskFactors {
+    daysSincePublish: number | null;
+    downloads: number | null;
+    maintainersCount: number | null;
+    versionCount: number | null;
+    recentReleaseCount: number | null;
+    hasRepository: boolean;
+    dependencyType: "dependencies" | "devDependencies" | "unknown";
+}
+export type TrustScore = "high" | "medium" | "low";
 export interface DuplicateDependency {
     name: string;
     versions: string[];
@@ -51,6 +61,8 @@ export interface RiskDependency {
     confidence: number;
     reasonCodes: string[];
     explanation: string[];
+    trustScore: TrustScore;
+    riskFactors: RiskFactors;
     recommendation: Recommendation;
 }
 export interface TopIssue {
@@ -60,6 +72,7 @@ export interface TopIssue {
     priority: "high" | "medium" | "low";
     confidence: number;
     summary: string;
+    trustScore?: TrustScore;
     recommendation: Recommendation;
 }
 export interface AnalysisResult {
@@ -94,7 +107,7 @@ export interface PackageAnalysisResult {
     suggestions: string[];
     topIssues: TopIssue[];
 }
-export declare const OUTPUT_VERSION = "1.2";
+export declare const OUTPUT_VERSION = "1.3";
 export interface ScoreBreakdown {
     baseScore: number;
     duplicates: number;

package/dist/core/analyzer.js

@@ -8,7 +8,7 @@ import { findWorkspacePackages } from "../utils/workspaces.js";
 import { buildDependencyGraph } from "./graph-builder.js";
 import { calculateHealthScore } from "./scorer.js";
 import { buildAnalysisContext } from "./context.js";
-export const OUTPUT_VERSION = "1.2";
+export const OUTPUT_VERSION = "1.3";
 export async function analyzeProject(options = {}) {
     const rootDir = path.resolve(options.rootDir ?? process.cwd());
     const loadedConfig = await loadDepBrainConfig(rootDir, options.configPath);
@@ -309,6 +309,8 @@ function mapRiskIssues(issues) {
         confidence: normalizeConfidence(issue.confidence),
         reasonCodes: normalizeStringArray(issue.reasonCodes),
         explanation: normalizeStringArray(issue.explanation),
+        trustScore: normalizeTrustScore(issue.meta?.trustScore),
+        riskFactors: normalizeRiskFactors(issue.meta?.riskFactors),
         recommendation: buildRiskRecommendation(issue)
     }));
 }
@@ -371,11 +373,14 @@ function buildOutdatedRecommendation(issue) {
 function buildRiskRecommendation(issue) {
     const reasons = normalizeStringArray(issue.explanation);
     const confidence = normalizeConfidence(issue.confidence);
+    const trustScore = normalizeTrustScore(issue.meta?.trustScore);
     return {
         action: "review",
-        priority: confidence >= 0.79 ? "high" : "medium",
+        priority: trustScore === "low" || confidence >= 0.79 ? "high" : "medium",
         safety: "caution",
-        summary: "Review package trust signals and decide whether to keep, replace, or monitor it.",
+        summary: trustScore === "low"
+            ? "Low trust package; review whether to replace, pin, or monitor it closely."
+            : "Review package trust signals and decide whether to keep, replace, or monitor it.",
         reasons
     };
 }
@@ -414,17 +419,24 @@ function buildTopIssues(input) {
             priority: item.recommendation.priority,
             confidence: item.confidence,
             summary: item.recommendation.summary,
+            trustScore: item.trustScore,
             recommendation: item.recommendation
         }))
     ];
     return issues
-        .sort((left, right) => comparePriority(right.priority, left.priority) || right.confidence - left.confidence)
+        .sort((left, right) => comparePriority(right.priority, left.priority) ||
+        compareTrustScore(right.trustScore, left.trustScore) ||
+        right.confidence - left.confidence)
         .slice(0, 5);
 }
 function comparePriority(left, right) {
     const rank = { high: 3, medium: 2, low: 1 };
     return rank[left] - rank[right];
 }
+function compareTrustScore(left, right) {
+    const rank = { low: 3, medium: 2, high: 1, undefined: 0 };
+    return rank[left ?? "undefined"] - rank[right ?? "undefined"];
+}
 function normalizeConfidence(value) {
     if (typeof value !== "number" || Number.isNaN(value)) {
         return 0.5;
@@ -437,6 +449,36 @@ function normalizeStringArray(value) {
     }
     return value.filter((entry) => typeof entry === "string");
 }
+function normalizeTrustScore(value) {
+    return value === "high" || value === "medium" || value === "low"
+        ? value
+        : "medium";
+}
+function normalizeRiskFactors(value) {
+    if (!value || typeof value !== "object") {
+        return {
+            daysSincePublish: null,
+            downloads: null,
+            maintainersCount: null,
+            versionCount: null,
+            recentReleaseCount: null,
+            hasRepository: false,
+            dependencyType: "unknown"
+        };
+    }
+    const factors = value;
+    return {
+        daysSincePublish: typeof factors.daysSincePublish === "number" ? factors.daysSincePublish : null,
+        downloads: typeof factors.downloads === "number" ? factors.downloads : null,
+        maintainersCount: typeof factors.maintainersCount === "number" ? factors.maintainersCount : null,
+        versionCount: typeof factors.versionCount === "number" ? factors.versionCount : null,
+        recentReleaseCount: typeof factors.recentReleaseCount === "number" ? factors.recentReleaseCount : null,
+        hasRepository: factors.hasRepository === true,
+        dependencyType: factors.dependencyType === "dependencies" || factors.dependencyType === "devDependencies"
+            ? factors.dependencyType
+            : "unknown"
+    };
+}
 function buildScoreBreakdown(counts, config) {
     return {
         baseScore: 100,

package/dist/reporters/console.js

@@ -3,7 +3,7 @@ export function renderConsoleReport(result) {
     if (result.topIssues.length > 0) {
         lines.push("Top Issues:");
         for (const item of result.topIssues) {
-            lines.push(`- [${item.priority.toUpperCase()}] ${item.kind} ${item.name}${item.package ? ` [${item.package}]` : ""} | confidence ${Math.round(item.confidence * 100)}% | ${item.summary}`);
+            lines.push(`- [${item.priority.toUpperCase()}] ${item.kind} ${item.name}${item.package ? ` [${item.package}]` : ""}${item.trustScore ? ` | trust ${item.trustScore.toUpperCase()}` : ""} | confidence ${Math.round(item.confidence * 100)}% | ${item.summary}`);
         }
         lines.push("");
     }
@@ -31,8 +31,8 @@ export function renderConsoleReport(result) {
         ? `${item.name}: ${item.current} -> ${item.latest} [${item.updateType}] [${item.package}]`
         : `${item.name}: ${item.current} -> ${item.latest} [${item.updateType}]`, item.confidence, item.explanation, item.recommendation)));
     appendSection(lines, "Risky dependencies", result.risks.map((item) => formatEntry(item.package
-        ? `${item.name}: ${item.reasons.join("; ")} [${item.package}]`
-        : `${item.name}: ${item.reasons.join("; ")}`, item.confidence, item.explanation, item.recommendation)));
+        ? `${item.name}: ${item.reasons.join("; ")} [${item.package}] [trust ${item.trustScore.toUpperCase()}]`
+        : `${item.name}: ${item.reasons.join("; ")} [trust ${item.trustScore.toUpperCase()}]`, item.confidence, item.explanation, item.recommendation)));
     appendSection(lines, "Policy reasons", result.policy.reasons);
     if (result.suggestions.length > 0) {
         lines.push("");

package/dist/reporters/markdown.js

@@ -5,7 +5,7 @@ export function renderMarkdownReport(result) {
     if (result.topIssues.length > 0) {
         lines.push("## Top Issues");
         for (const item of result.topIssues) {
-            lines.push(`- **${item.priority.toUpperCase()}** ${item.kind} \`${item.name}\`${item.package ? ` [${item.package}]` : ""} | confidence ${Math.round(item.confidence * 100)}% | ${item.summary}`);
+            lines.push(`- **${item.priority.toUpperCase()}** ${item.kind} \`${item.name}\`${item.package ? ` [${item.package}]` : ""}${item.trustScore ? ` | trust ${item.trustScore.toUpperCase()}` : ""} | confidence ${Math.round(item.confidence * 100)}% | ${item.summary}`);
         }
         lines.push("");
     }
@@ -35,8 +35,8 @@ export function renderMarkdownReport(result) {
         ? `${item.name}: ${item.current} -> ${item.latest} [${item.updateType}] [${item.package}]`
         : `${item.name}: ${item.current} -> ${item.latest} [${item.updateType}]`, item.confidence, item.explanation, item.recommendation)));
     appendSection(lines, "Risky dependencies", result.risks.map((item) => formatEntry(item.package
-        ? `${item.name}: ${item.reasons.join("; ")} [${item.package}]`
-        : `${item.name}: ${item.reasons.join("; ")}`, item.confidence, item.explanation, item.recommendation)));
+        ? `${item.name}: ${item.reasons.join("; ")} [${item.package}] [trust ${item.trustScore.toUpperCase()}]`
+        : `${item.name}: ${item.reasons.join("; ")} [trust ${item.trustScore.toUpperCase()}]`, item.confidence, item.explanation, item.recommendation)));
     appendSection(lines, "Policy reasons", result.policy.reasons);
     if (result.suggestions.length > 0) {
         lines.push("## Suggestions");

package/dist/utils/npm-api.d.ts

@@ -3,6 +3,9 @@ export interface PackageMetadata {
     repository: string | null;
     downloads: number | null;
     daysSincePublish: number | null;
+    maintainersCount: number | null;
+    versionCount: number | null;
+    recentReleaseCount: number | null;
 }
 export declare function getLatestVersion(name: string): Promise<string | null>;
 export declare function getPackageMetadata(name: string): Promise<PackageMetadata | null>;

package/dist/utils/npm-api.js

@@ -39,14 +39,35 @@ async function fetchPackageMetadata(name) {
         const repository = typeof packageJson.repository === "string"
             ? packageJson.repository
             : packageJson.repository?.url ?? null;
+        const maintainersCount = Array.isArray(packageJson.maintainers)
+            ? packageJson.maintainers.length
+            : null;
+        const versionCount = packageJson.versions
+            ? Object.keys(packageJson.versions).length
+            : null;
+        const recentReleaseCount = countRecentReleases(packageJson.time ?? {});
         return {
             latestVersion,
             repository,
             downloads: downloadsJson.downloads ?? null,
-            daysSincePublish
+            daysSincePublish,
+            maintainersCount,
+            versionCount,
+            recentReleaseCount
         };
     }
     catch {
         return null;
     }
 }
+function countRecentReleases(time) {
+    const values = Object.entries(time)
+        .filter(([key]) => key !== "created" && key !== "modified")
+        .map(([, value]) => new Date(value).getTime())
+        .filter((value) => Number.isFinite(value));
+    if (values.length === 0) {
+        return null;
+    }
+    const thirtyDaysAgo = Date.now() - 30 * 24 * 60 * 60 * 1000;
+    return values.filter((value) => value >= thirtyDaysAgo).length;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dep-brain",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "CLI and library for dependency health analysis",
   "type": "module",
   "main": "dist/index.js",