fad-checker 2.0.0 → 2.1.0

package/lib/csaf-export.js

@@ -0,0 +1,159 @@
+/**
+ * lib/csaf-export.js — emit a CSAF 2.0 VEX (csaf_vex) document from the resolved
+ * deps + matches. buildCsaf is pure; writeCsaf writes the JSON to disk.
+ *
+ * Spec: https://docs.oasis-open.org/csaf/csaf/v2.0/csaf-v2.0.html
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
+ */
+const fs = require("fs");
+const { purlFor } = require("./purl");
+
+function humanName(dep) {
+	const ns = dep.namespace || dep.groupId || "";
+	const name = dep.name || dep.artifactId;
+	const base = dep.ecosystem === "composer" && ns ? `${ns}/${name}` : (ns && dep.ecosystem === "maven" ? `${ns}:${name}` : name);
+	return dep.version ? `${base}@${dep.version}` : base;
+}
+
+// NVD "CVSS:3.1" → CVSS v3 JSON `version` field, or null when not a v3 score.
+// Tolerates the legacy "CVSS:V31"/"CVSS:V30" labels still sitting in pre-fix NVD
+// caches (the producer now emits "CVSS:3.1"; this keeps offline caches working).
+function cvssV3Version(cvssVersion) {
+	const v = String(cvssVersion || "");
+	if (v.includes("3.1") || /v31\b/i.test(v)) return "3.1";
+	if (v.includes("3.0") || v === "CVSS:3" || /v30\b/i.test(v)) return "3.0";
+	return null;
+}
+
+// CVSS v3 `baseSeverity` is a closed enum (NONE|LOW|MEDIUM|HIGH|CRITICAL). OSV/GHSA
+// often yield "UNKNOWN", which fails CSAF schema validation — derive it from the
+// base score's standard v3 bands when the label isn't a valid enum value.
+function cvssV3Severity(severity, score) {
+	const s = String(severity || "").toUpperCase();
+	if (["NONE", "LOW", "MEDIUM", "HIGH", "CRITICAL"].includes(s)) return s;
+	if (typeof score !== "number") return "NONE";
+	if (score === 0) return "NONE";
+	if (score < 4) return "LOW";
+	if (score < 7) return "MEDIUM";
+	if (score < 9) return "HIGH";
+	return "CRITICAL";
+}
+
+/**
+ * Build a CSAF 2.0 csaf_vex object.
+ * opts: { projectInfo, toolVersion, timestamp }
+ */
+function buildCsaf(resolvedDeps, cveMatches, opts = {}) {
+	const { projectInfo = {}, toolVersion = "0", timestamp } = opts;
+	const now = timestamp || projectInfo.generatedAt || "1970-01-01T00:00:00Z";
+
+	// Stable product ids + coordKey → product_id lookup.
+	const full_product_names = [];
+	const productIdByCoord = new Map();
+	let n = 0;
+	for (const dep of resolvedDeps.values()) {
+		const pid = `PROD-${n++}`;
+		const purl = purlFor(dep);
+		productIdByCoord.set(dep.coordKey, pid);
+		full_product_names.push({
+			product_id: pid,
+			name: humanName(dep),
+			...(purl ? { product_identification_helper: { purl } } : {}),
+		});
+	}
+
+	// One vulnerability per CVE, listing every affected product id.
+	const byCve = new Map();
+	for (const m of cveMatches || []) {
+		const id = m.cve?.id;
+		if (!id) continue;
+		let pid = productIdByCoord.get(m.dep?.coordKey);
+		// A match whose dep isn't in resolvedDeps (e.g. a Snyk-only finding) has no
+		// product yet — register it on the fly so the CVE never ends up with an empty
+		// known_affected[] (which is schema-invalid: product_status lists need ≥1 item).
+		if (!pid && m.dep && m.dep.coordKey) {
+			pid = `PROD-${n++}`;
+			const purl = purlFor(m.dep);
+			productIdByCoord.set(m.dep.coordKey, pid);
+			full_product_names.push({
+				product_id: pid,
+				name: humanName(m.dep),
+				...(purl ? { product_identification_helper: { purl } } : {}),
+			});
+		}
+		let v = byCve.get(id);
+		if (!v) {
+			const cve = m.cve;
+			const notes = [];
+			if (cve.description) notes.push({ category: "description", text: cve.description, title: "Description" });
+			const extras = [];
+			if (cve.epssPercentile != null) extras.push(`EPSS percentile ${Math.round(cve.epssPercentile * 100)}%`);
+			if (cve.kev) extras.push(`CISA KEV (known exploited)${cve.kevDueDate ? `, remediate by ${cve.kevDueDate}` : ""}`);
+			if (cve.priority?.band) extras.push(`fad-checker priority: ${cve.priority.band} (${cve.priority.score}/100)`);
+			if (extras.length) notes.push({ category: "other", text: extras.join("; "), title: "Prioritization" });
+
+			const v3ver = cvssV3Version(cve.cvssVersion);
+			const scores = (v3ver && cve.score != null) ? [{
+				cvss_v3: {
+					version: v3ver,
+					baseScore: cve.score,
+					baseSeverity: cvssV3Severity(cve.severity, cve.score),
+					// Only carry the vector when it actually IS a v3 vector — a v4 (or
+					// mismatched) vector string fails the v3 schema's vectorString pattern.
+					...((cve.cvssVector && /^CVSS:3\.[01]\//.test(cve.cvssVector)) ? { vectorString: cve.cvssVector } : {}),
+				},
+				products: [],
+			}] : [];
+
+			v = {
+				cve: id,
+				...(notes.length ? { notes } : {}),
+				product_status: { known_affected: [] },
+				...(scores.length ? { scores } : {}),
+				...(cve.kev ? { flags: [{ label: "exploited", product_ids: [] }] } : {}),
+			};
+			byCve.set(id, v);
+		}
+		if (pid && !v.product_status.known_affected.includes(pid)) {
+			v.product_status.known_affected.push(pid);
+			if (v.scores?.[0]) v.scores[0].products.push(pid);
+			if (v.flags?.[0]) v.flags[0].product_ids.push(pid);
+		}
+	}
+
+	return {
+		document: {
+			category: "csaf_vex",
+			csaf_version: "2.0",
+			title: `Vulnerability disclosure (VEX) — ${projectInfo.name || "project"}`,
+			publisher: {
+				category: "vendor",
+				name: "fad-checker",
+				namespace: "https://github.com/nathb2b/fad-checker",
+			},
+			tracking: {
+				id: `fad-checker-${(projectInfo.name || "project").replace(/[^A-Za-z0-9._-]/g, "-")}-${String(now).slice(0, 10)}`,
+				status: "final",
+				version: "1",
+				generator: { engine: { name: "fad-checker", version: String(toolVersion) } },
+				initial_release_date: now,
+				current_release_date: now,
+				revision_history: [{ number: "1", date: now, summary: "Initial automated VEX from fad-checker scan" }],
+			},
+		},
+		product_tree: { full_product_names },
+		// Drop any vulnerability that ended up with zero affected products (e.g. a
+		// match with no usable dep) — an empty product_status is schema-invalid.
+		vulnerabilities: [...byCve.values()].filter(v => v.product_status.known_affected.length > 0),
+	};
+}
+
+function writeCsaf(resolvedDeps, cveMatches, outputPath, opts = {}) {
+	const doc = buildCsaf(resolvedDeps, cveMatches, opts);
+	fs.writeFileSync(outputPath, JSON.stringify(doc, null, 2) + "\n");
+	return doc;
+}
+
+module.exports = { buildCsaf, writeCsaf };

package/lib/cve-download.js

@@ -5,6 +5,9 @@
  * The bundle is ~500 MB+. We shell out to curl + unzip rather than
  * bundling a zip library. The extracted JSON is deleted after the index
  * is built.
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
  */
 const fs = require("fs");
 const path = require("path");

package/lib/cve-match.js

@@ -1,6 +1,9 @@
 /**
  * lib/cve-match.js — collect resolved deps from the parsed POM tree and
  * match them against a CVE index built by lib/cve-download.js.
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
  */
 const { coord } = require("./core");
 const { compareMavenVersions, isVersionAffected } = require("./maven-version");
@@ -12,11 +15,21 @@ const SEVERITY_RANK = { CRITICAL: 4, HIGH: 3, MEDIUM: 2, LOW: 1, NONE: 0, UNKNOW
 function resolveDepVersion(rawVersion, allProps) {
 	if (!rawVersion) return null;
 	// Resolve ${prop} references using the merged property map for this POM.
-	return String(rawVersion).replace(/\$\{\s*([\w._-]+)\s*\}/g, (m, k) => {
-		const v = allProps?.[k];
-		if (Array.isArray(v)) return v[0];
-		return v != null ? v : m;
-	});
+	// Maven interpolates recursively (e.g. ${project.version} → ${revision} →
+	// "1.0"), so we re-substitute until the string stops changing. Bounded +
+	// stop-on-no-progress guards against property cycles. Unknown refs are left
+	// verbatim, so they still surface as "unresolved-versions" in chapter 0.
+	let v = String(rawVersion);
+	for (let i = 0; i < 10 && v.includes("${"); i++) {
+		const next = v.replace(/\$\{\s*([\w._-]+)\s*\}/g, (m, k) => {
+			const val = allProps?.[k];
+			if (Array.isArray(val)) return val[0];
+			return val != null ? val : m;
+		});
+		if (next === v) break;   // no progress → remaining refs are unresolvable
+		v = next;
+	}
+	return v;
 }
 
 /**
@@ -109,12 +122,17 @@ async function expandWithTransitives(resolvedDeps, opts = {}) {
 	// project pins a transitive's version via <dependencyManagement>.
 	const rootDepMgmt = new Map();
 	for (const dep of resolvedDeps.values()) {
+		// Embedded-binary coords don't participate in Maven Central resolution (a
+		// fat-jar already ships its deps, discovered by recursion) and must not act as
+		// a depMgmt override for the declared tree.
+		if (dep.provenance === "embedded") continue;
 		if (dep.version && !/\$\{/.test(dep.version)) {
 			rootDepMgmt.set(`${dep.groupId}:${dep.artifactId}`, { version: dep.version });
 		}
 	}
 
 	const directs = [...resolvedDeps.values()]
+		.filter(d => d.provenance !== "embedded")
 		.filter(d => d.version && !/\$\{/.test(d.version))
 		.filter(d => d.scope !== "test" || opts.includeTestDeps)
 		.filter(d => d.scope !== "parent");
@@ -228,7 +246,10 @@ function matchDepsAgainstCves(resolvedDeps, cveIndex, opts = {}) {
 	const seen = new Set();
 	const deduped = [];
 	for (const m of all) {
-		const k = `${m.dep.groupId}:${m.dep.artifactId}:${m.dep.version}|${m.cve.id}`;
+		// Key by coordKey (not g:a): identical to g:a for declared Maven deps, but
+		// keeps embedded-binary findings (coordKey "embedded:<path>") distinct from a
+		// declared dep with the same g:a:v so the embedded chapter doesn't lose them.
+		const k = `${m.dep.coordKey}:${m.dep.version}|${m.cve.id}`;
 		if (seen.has(k)) continue;
 		seen.add(k);
 		deduped.push(m);

package/lib/cve-report.js

@@ -4,10 +4,14 @@
  *
  * Word opens HTML saved as .doc natively — we use the same HTML body
  * wrapped in Word XML namespace meta tags.
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
  */
 const fs = require("fs");
 const path = require("path");
 const { getCodec, allCodecs, ORDER } = require("./codecs");
+const { computePriority, sortByPriority } = require("./priority");
 
 // CWE-id → short human name. Loaded once at module init. Unknown CWEs fall
 // back to the raw id (with a "—" placeholder name where the row asks for one).
@@ -34,13 +38,14 @@ function esc(s) {
 }
 
 function computeStats(cveMatches) {
-	const buckets = { critical: 0, high: 0, medium: 0, low: 0, none: 0, unknown: 0, transitive: 0, direct: 0 };
+	const buckets = { critical: 0, high: 0, medium: 0, low: 0, none: 0, unknown: 0, transitive: 0, direct: 0, kev: 0 };
 	for (const m of cveMatches || []) {
 		const sev = (m.cve.severity || "UNKNOWN").toLowerCase();
 		if (buckets[sev] != null) buckets[sev]++;
 		else buckets.unknown++;
 		if (m.dep?.scope === "transitive") buckets.transitive++;
 		else buckets.direct++;
+		if (m.cve?.kev) buckets.kev++;
 	}
 	buckets.total = (cveMatches || []).length;
 	return buckets;
@@ -61,6 +66,26 @@ function badge(sev) {
 	return `<span style="display:inline-block;padding:2px 8px;border-radius:3px;background:${c.bg};color:${c.fg};font-weight:600;font-size:11px;letter-spacing:.5px">${esc(s)}</span>`;
 }
 
+const BAND_BADGE = {
+	exploited: { bg: "#7c0008", fg: "#fff", label: "EXPLOITED" },
+	critical:  { bg: "#b91c1c", fg: "#fff", label: "CRITICAL" },
+	high:      { bg: "#ea580c", fg: "#fff", label: "HIGH" },
+	medium:    { bg: "#ca8a04", fg: "#fff", label: "MEDIUM" },
+	low:       { bg: "#2563eb", fg: "#fff", label: "LOW" },
+};
+
+// Priority cell: composite band badge (KEV-aware) + EPSS percentile + KEV chip.
+function priorityCell(m) {
+	const p = m.cve?.priority || computePriority(m.cve || {});
+	const b = BAND_BADGE[p.band] || BAND_BADGE.low;
+	const bandBadge = `<span class="prio-band" style="display:inline-block;padding:2px 7px;border-radius:3px;background:${b.bg};color:${b.fg};font-weight:700;font-size:10px;letter-spacing:.4px">${esc(b.label)}</span>`;
+	const kev = p.kev ? `<div class="kev-chip" title="CISA Known Exploited Vulnerability${m.cve?.kevDueDate ? ` — remediate by ${esc(m.cve.kevDueDate)}` : ""}">🛑 KEV${m.cve?.kevRansomware ? " · ransomware" : ""}</div>` : "";
+	const epss = m.cve?.epssPercentile != null
+		? `<div class="epss-chip" title="EPSS score ${(m.cve.epssScore != null ? (m.cve.epssScore * 100).toFixed(1) : "?")}%">EPSS ${Math.round(m.cve.epssPercentile * 100)}%</div>`
+		: "";
+	return `${bandBadge}${kev}${epss}`;
+}
+
 const CSS = `
 * { box-sizing: border-box; }
 body { font-family: -apple-system, "Segoe UI", Roboto, sans-serif; color: #1f2937; margin: 24px; background: #f9fafb; }
@@ -95,6 +120,19 @@ h2 { margin: 32px 0 12px; font-size: 20px; border-bottom: 2px solid #e5e7eb; pad
 .exec-summary .exec-ver { color: #6b7280; }
 .exec-summary .exec-fix { color: #065f46; font-weight: 600; }
 .fp-intro { background: #f3f4f6; border-left: 3px solid #6b7280; padding: 10px 14px; margin: 8px 0 16px; font-size: 12px; color: #4b5563; line-height: 1.5; }
+td.prio { white-space: normal; }
+td.prio .prio-band { white-space: nowrap; }
+td.prio .kev-chip { display: block; margin-top: 3px; font-size: 10px; font-weight: 700; color: #7c0008; white-space: nowrap; }
+td.prio .epss-chip { display: block; margin-top: 2px; font-size: 10px; color: #6b7280; font-family: ui-monospace, monospace; white-space: nowrap; }
+.summary .card.sev-kev { border-left: 4px solid #7c0008; background: #fff1f2; }
+.summary .card.sev-kev .v { color: #7c0008; }
+.lic-group { margin: 14px 0; }
+.lic-group .lic-h { font-size: 14px; margin: 8px 0 4px; padding: 4px 8px; border-radius: 4px; }
+.lic-group .lic-n { font-size: 11px; color: #6b7280; font-weight: 500; }
+.lic-group.lic-strong .lic-h { background: #fee2e2; color: #7c0008; }
+.lic-group.lic-weak .lic-h { background: #fef3c7; color: #92400e; }
+.lic-group.lic-unknown .lic-h { background: #e5e7eb; color: #374151; }
+.lic-group.lic-ok .lic-h { background: #dcfce7; color: #065f46; }
 td.cwe { font-family: ui-monospace, monospace; font-size: 11px; color: #4b5563; }
 td.cwe .cwe-link { color: #6366f1; text-decoration: none; }
 td.cwe .cwe-link:hover { text-decoration: underline; }
@@ -479,6 +517,9 @@ function renderDetailPanel(m) {
 	const kv = [];
 	if (cve.cvssVector) kv.push(`<div><label>${esc(cve.cvssVersion || "CVSS")}</label><span class="cvss-vector">${esc(cve.cvssVector)}</span></div>`);
 	if (cve.score != null) kv.push(`<div><label>Base score</label><span>${esc(cve.score.toFixed ? cve.score.toFixed(1) : cve.score)} (${esc(cve.severity || "?")})</span></div>`);
+	if (cve.priority) kv.push(`<div><label>Priority</label><span>${esc((cve.priority.band || "").toUpperCase())} · ${esc(cve.priority.score)}/100</span></div>`);
+	if (cve.epssPercentile != null) kv.push(`<div><label>EPSS</label><span>${(cve.epssScore != null ? (cve.epssScore * 100).toFixed(1) + "% prob · " : "")}${Math.round(cve.epssPercentile * 100)}th pct</span></div>`);
+	if (cve.kev) kv.push(`<div><label>CISA KEV</label><span>Known exploited${cve.kevDateAdded ? ` · added ${esc(cve.kevDateAdded)}` : ""}${cve.kevDueDate ? ` · due ${esc(cve.kevDueDate)}` : ""}${cve.kevRansomware ? " · ransomware" : ""}</span></div>`);
 	if (cve.fixVersion) kv.push(`<div><label>Fix version</label><span>${esc(cve.fixVersion)}</span></div>`);
 	if (cve.published) kv.push(`<div><label>Published</label><span>${esc(cve.published.slice(0, 10))}</span></div>`);
 	if (cve.modified) kv.push(`<div><label>Modified</label><span>${esc(cve.modified.slice(0, 10))}</span></div>`);
@@ -585,7 +626,7 @@ function renderCveRow(m, opts = {}) {
 	const source = sourceParts.map(s => `<span class="source ${esc(s)}">${esc(s)}</span>`).join("");
 	const conf = m.confidence ? `<div class="confidence">${esc(m.confidence)}</div>` : "";
 	const actionCell = withAction ? `<td class="action">${renderActionCell(m)}</td>` : "";
-	const baseCols = 8; // Sev, CVE, Dep, CWE, Published, Description, Fix, Source
+	const baseCols = 9; // Priority, Sev, CVE, Dep, CWE, Published, Description, Fix, Source
 	const colspan = withAction ? baseCols + 1 : baseCols;
 	const pub = formatPubDate(m.cve.published);
 	const cwes = formatCwes(m.cve.cwes);
@@ -593,6 +634,7 @@ function renderCveRow(m, opts = {}) {
 	// tr.detail-row. JS toggle is at the bottom of the document; links inside
 	// cells stay clickable (the handler ignores anchor/button clicks).
 	return `<tr class="cve-row${m.cpeFiltered ? " cpe-fp" : ""}">
+		<td class="prio">${priorityCell(m)}</td>
 		<td>${badge(m.cve.severity)}${m.cve.score != null ? `<div class="confidence">${esc(m.cve.score.toFixed(1))}</div>` : ""}</td>
 		<td class="cve"><a href="${link}" target="_blank">${esc(m.cve.id)}</a>${conf}${m.cpeFiltered ? `<div class="cpe-tag">CPE-filtered</div>` : ""}</td>
 		${depCell(m.dep)}
@@ -629,10 +671,11 @@ function renderActionCell(m) {
 function renderCveTable(cveMatches, opts = {}) {
 	if (!cveMatches?.length) return `<div class="empty">No CVEs matched.</div>`;
 	const { withAction } = opts;
-	const rows = cveMatches.map(m => renderCveRow(m, opts)).join("\n");
+	// Highest composite priority (KEV → EPSS-weighted CVSS) first.
+	const rows = sortByPriority(cveMatches).map(m => renderCveRow(m, opts)).join("\n");
 	const actionHeader = withAction ? `<th>Recommended action</th>` : "";
 	return `<table>
-		<thead><tr><th>Severity</th><th>CVE ID</th><th>Dependency</th><th>CWE</th><th>Published</th><th>Description</th><th>Fix Version</th><th>Source</th>${actionHeader}</tr></thead>
+		<thead><tr><th>Priority</th><th>Severity</th><th>CVE ID</th><th>Dependency</th><th>CWE</th><th>Published</th><th>Description</th><th>Fix Version</th><th>Source</th>${actionHeader}</tr></thead>
 		<tbody>${rows}</tbody>
 	</table>`;
 }
@@ -966,6 +1009,7 @@ function summaryCards(stats, eol, obs, out, extra = {}) {
 		{ v: stats.high,     l: "High",        cls: "sev-high" },
 		{ v: stats.medium,   l: "Medium",      cls: "sev-medium" },
 		{ v: stats.low,      l: "Low",         cls: "sev-low" },
+		...(stats.kev ? [{ v: stats.kev, l: "KEV exploited", cls: "sev-kev" }] : []),
 		{ v: stats.total,    l: "Total CVEs" },
 		{ v: stats.direct,     l: "in Direct" },
 		{ v: stats.transitive, l: "in Transitive" },
@@ -973,6 +1017,7 @@ function summaryCards(stats, eol, obs, out, extra = {}) {
 		{ v: eol?.length || 0, l: "EOL" },
 		{ v: obs?.length || 0, l: "Obsolete" },
 		{ v: out?.length || 0, l: "Outdated" },
+		...(extra.licenseFlagged ? [{ v: extra.licenseFlagged, l: "Licenses to review", cls: "sev-medium" }] : []),
 		{ v: extra.warnings?.length || 0, l: "Scan alerts", cls: "sev-warn" },
 	];
 	return `<div class="summary">${cards.map(c => `<div class="card${c.cls ? " " + c.cls : ""}"><div class="v">${c.v}</div><div class="l">${esc(c.l)}</div></div>`).join("")}</div>`;
@@ -1278,11 +1323,49 @@ function renderWarningItems(items, itemLimit) {
 	return `<ul class="warn-items">${lis}${overflow}</ul>`;
 }
 
-function buildBody({ cveMatches, devCveMatches, retireMatches, eolResults, obsoleteResults, outdatedResults, resolvedDeps, projectInfo, warnings, wrapTables = true }) {
+const LICENSE_CAT_META = {
+	"network-copyleft": { label: "Network copyleft (AGPL/SSPL)", cls: "lic-strong" },
+	"strong-copyleft":  { label: "Strong copyleft (GPL)", cls: "lic-strong" },
+	"proprietary":      { label: "Proprietary / commercial", cls: "lic-strong" },
+	"weak-copyleft":    { label: "Weak copyleft (LGPL/MPL/EPL)", cls: "lic-weak" },
+	"unknown":          { label: "Unknown / unrecognized", cls: "lic-unknown" },
+	"permissive":       { label: "Permissive (MIT/Apache/BSD)", cls: "lic-ok" },
+};
+const LICENSE_CAT_ORDER = ["network-copyleft", "strong-copyleft", "proprietary", "weak-copyleft", "unknown", "permissive"];
+
+function renderLicenseChapter(licenseResults) {
+	if (!licenseResults || !licenseResults.assessed?.length) {
+		return `<div class="empty">No license data resolved (offline, or registries returned none).</div>`;
+	}
+	const { byCategory } = licenseResults;
+	const blocks = LICENSE_CAT_ORDER.filter(cat => byCategory[cat]?.length).map(cat => {
+		const meta = LICENSE_CAT_META[cat] || { label: cat, cls: "lic-unknown" };
+		const rows = byCategory[cat].slice().sort((a, b) => depDisplayName(a.dep).localeCompare(depDisplayName(b.dep))).map(e => {
+			const lics = e.ids.concat(e.raw);
+			return `<tr>
+				<td>${depCell(e.dep)}</td>
+				<td>${esc(lics.join(", ") || "—")}</td>
+				<td>${esc(e.source || "—")}</td>
+			</tr>`;
+		}).join("");
+		return `<div class="lic-group ${meta.cls}">
+			<h3 class="lic-h">${esc(meta.label)} <span class="lic-n">${byCategory[cat].length}</span></h3>
+			<table><thead><tr><th>Dependency</th><th>License(s)</th><th>Source</th></tr></thead><tbody>${rows}</tbody></table>
+		</div>`;
+	}).join("");
+	const flaggedN = licenseResults.flagged?.length || 0;
+	const intro = flaggedN
+		? `<div class="fp-intro">${flaggedN} dependency(ies) carry a copyleft, proprietary, or unrecognized license that may impose redistribution obligations — review against your distribution model. Permissive licenses are listed for completeness.</div>`
+		: `<div class="fp-intro">All resolved licenses are permissive. Listed for completeness.</div>`;
+	return intro + blocks;
+}
+
+function buildBody({ cveMatches, devCveMatches, embeddedMatches, retireMatches, eolResults, obsoleteResults, outdatedResults, licenseResults, resolvedDeps, projectInfo, warnings, wrapTables = true }) {
 	setRenderCtx({ srcRoot: projectInfo?.src || null });
 	// Dedupe rows so a single (dep, cve) shows once with all via paths merged.
-	cveMatches    = mergeMatches(cveMatches || []);
-	devCveMatches = mergeMatches(devCveMatches || []);
+	cveMatches      = mergeMatches(cveMatches || []);
+	devCveMatches   = mergeMatches(devCveMatches || []);
+	embeddedMatches = mergeMatches(embeddedMatches || []);
 	retireMatches = retireMatches || [];
 	attachRootUpdates(cveMatches, outdatedResults, resolvedDeps);
 	attachRootUpdates(devCveMatches, outdatedResults, resolvedDeps);
@@ -1294,9 +1377,12 @@ function buildBody({ cveMatches, devCveMatches, retireMatches, eolResults, obsol
 	const prodMatchesFP     = cveMatches.filter(m =>  m.cpeFiltered);
 	const devMatchesActive  = devCveMatches.filter(m => !m.cpeFiltered);
 	const devMatchesFP      = devCveMatches.filter(m =>  m.cpeFiltered);
+	const embMatchesActive  = embeddedMatches.filter(m => !m.cpeFiltered);
+	const embMatchesFP      = embeddedMatches.filter(m =>  m.cpeFiltered);
 
 	const prodStats   = computeStats(prodMatchesActive);
 	const devStats    = computeStats(devMatchesActive);
+	const embStats    = computeStats(embMatchesActive);
 	const retireStats = computeStats(retireMatches);
 
 	// Recos are built from prod matches only (dev/test issues aren't a release blocker).
@@ -1305,7 +1391,11 @@ function buildBody({ cveMatches, devCveMatches, retireMatches, eolResults, obsol
 	const cveContent       = renderCveBySectionByEco(prodMatchesActive, "1", projectInfo?.src);
 	const vendoredContent  = renderRetireTable(retireMatches);
 	const devCveContent    = renderCveBySectionByEco(devMatchesActive, "3", projectInfo?.src);
-	const fpContent        = renderFalsePositives([...prodMatchesFP, ...devMatchesFP]);
+	const licenseContent   = renderLicenseChapter(licenseResults);
+	const licenseTotal     = licenseResults?.assessed?.length || 0;
+	const licenseFlagged   = licenseResults?.flagged?.length || 0;
+	const embeddedContent  = renderEmbeddedChapter(embMatchesActive, projectInfo?.src);
+	const fpContent        = renderFalsePositives([...prodMatchesFP, ...devMatchesFP, ...embMatchesFP]);
 
 	const toolbar = `<div class="toolbar">
 		<button class="btn" type="button" data-action="expand-all">⊕ Expand all</button>
@@ -1334,7 +1424,10 @@ function buildBody({ cveMatches, devCveMatches, retireMatches, eolResults, obsol
 		eolTotal: eolResults?.length || 0,
 		obsoleteTotal: obsoleteResults?.length || 0,
 		outdatedTotal: outdatedResults?.length || 0,
-		fpTotal: prodMatchesFP.length + devMatchesFP.length,
+		licenseTotal,
+		licenseFlagged,
+		embeddedTotal: embStats.total,
+		fpTotal: prodMatchesFP.length + devMatchesFP.length + embMatchesFP.length,
 	});
 
 	const body = `
@@ -1347,19 +1440,21 @@ function buildBody({ cveMatches, devCveMatches, retireMatches, eolResults, obsol
 			</div>
 		</header>
 		${exec}
-		${summaryCards(prodStats, eolResults, obsoleteResults, outdatedResults, { warnings, vendored: retireMatches.length })}
+		${summaryCards(prodStats, eolResults, obsoleteResults, outdatedResults, { warnings, vendored: retireMatches.length, licenseFlagged })}
 		${toc}
 		${toolbar}
 
 		${(warnings?.length || 0) ? majorSection(`0. Warnings & scan-completeness (${warnings.length})`, renderWarnings(warnings), { open: true, id: "ch0" }) : ""}
 		${majorSection(`1. CVE Vulnerabilities — production (${prodStats.total})`, cveContent, { id: "ch1" })}
+		${embStats.total ? majorSection(`1B. Embedded binaries — JAR/WAR/EAR (${embStats.total})`, embeddedContent, { open: embStats.total <= 50, id: "ch1e" }) : ""}
 		${majorSection(`2. Vendored JS scan — retire.js (${retireMatches.length})`, vendoredContent, { open: retireMatches.length > 0 && retireMatches.length <= 50, id: "ch2" })}
 		${majorSection(`3. CVE in dev dependencies (${devStats.total})`, devCveContent, { open: devStats.total > 0 && devStats.total <= 50, id: "ch3" })}
 		${majorSection(`4. End-of-Life Frameworks (${eolResults?.length || 0})`, renderEolTable(eolResults), { id: "ch4" })}
 		${majorSection(`5. Obsolete / Deprecated Libraries (${obsoleteResults?.length || 0})`, renderObsoleteTable(obsoleteResults), { id: "ch5" })}
 		${majorSection(`6. Outdated Libraries (${outdatedResults?.length || 0})`, renderOutdatedTable(outdatedResults), { open: (outdatedResults?.length || 0) <= 50, id: "ch6" })}
-		${majorSection(`7. Fix Recommendations`, renderFixRecommendations(recos, prodMatchesActive, outdatedResults), { open: false, id: "ch7" })}
-		${(prodMatchesFP.length + devMatchesFP.length) ? majorSection(`8. Appendix: Likely false positives (CPE-filtered) (${prodMatchesFP.length + devMatchesFP.length})`, fpContent, { open: false, id: "ch8" }) : ""}
+		${majorSection(`7. Licenses (${licenseTotal}${licenseFlagged ? `, ${licenseFlagged} to review` : ""})`, licenseContent, { open: licenseFlagged > 0, id: "ch7" })}
+		${majorSection(`8. Fix Recommendations`, renderFixRecommendations(recos, prodMatchesActive, outdatedResults), { open: false, id: "ch8" })}
+		${(prodMatchesFP.length + devMatchesFP.length + embMatchesFP.length) ? majorSection(`9. Appendix: Likely false positives (CPE-filtered) (${prodMatchesFP.length + devMatchesFP.length + embMatchesFP.length})`, fpContent, { open: false, id: "ch9" }) : ""}
 	`;
 	return wrapTables ? wrapTablesWithCopyButtons(body) : body;
 }
@@ -1396,20 +1491,41 @@ function pickTopCriticalMatches(prodMatches, retireMatches, n) {
 	return out;
 }
 
-function renderToc({ hasWarnings, prodTotal, retireTotal, devTotal, eolTotal, obsoleteTotal, outdatedTotal, fpTotal }) {
+function renderToc({ hasWarnings, prodTotal, embeddedTotal, retireTotal, devTotal, eolTotal, obsoleteTotal, outdatedTotal, licenseTotal, licenseFlagged, fpTotal }) {
 	const entries = [];
 	if (hasWarnings)                  entries.push({ id: "ch0", label: "0. Warnings" });
 	entries.push({ id: "ch1", label: `1. Prod CVE (${prodTotal})` });
+	if (embeddedTotal)                entries.push({ id: "ch1e", label: `1B. Embedded (${embeddedTotal})` });
 	entries.push({ id: "ch2", label: `2. Vendored JS (${retireTotal})` });
 	entries.push({ id: "ch3", label: `3. Dev CVE (${devTotal})` });
 	entries.push({ id: "ch4", label: `4. EOL (${eolTotal})` });
 	entries.push({ id: "ch5", label: `5. Obsolete (${obsoleteTotal})` });
 	entries.push({ id: "ch6", label: `6. Outdated (${outdatedTotal})` });
-	entries.push({ id: "ch7", label: `7. Fix Recos` });
-	if (fpTotal)                      entries.push({ id: "ch8", label: `8. Likely FP (${fpTotal})` });
+	entries.push({ id: "ch7", label: `7. Licenses (${licenseTotal || 0}${licenseFlagged ? `, ${licenseFlagged}⚠` : ""})` });
+	entries.push({ id: "ch8", label: `8. Fix Recos` });
+	if (fpTotal)                      entries.push({ id: "ch9", label: `9. Likely FP (${fpTotal})` });
 	return `<nav class="toc">${entries.map(e => `<a href="#${e.id}">${esc(e.label)}</a>`).join("")}</nav>`;
 }
 
+// Embedded-binary CVE chapter: group findings by their top-level archive (the
+// part of the manifestPath before the first "!/"), so a fat-jar lists all the
+// vulnerable libraries shaded inside it.
+function renderEmbeddedChapter(matches, srcRoot) {
+	if (!matches.length) return `<div class="empty">No CVEs found in embedded binaries.</div>`;
+	const intro = `<div class="fp-intro">Maven coordinates discovered inside committed <code>.jar</code>/<code>.war</code>/<code>.ear</code> binaries (vendored libs, fat-jars) — not declared in any <code>pom.xml</code>. Patch by rebuilding/replacing the containing archive.</div>`;
+	const byArchive = new Map();
+	for (const m of matches) {
+		const mp = (m.dep?.manifestPaths || [])[0] || "(unknown archive)";
+		const top = String(mp).split("!/")[0];
+		if (!byArchive.has(top)) byArchive.set(top, []);
+		byArchive.get(top).push(m);
+	}
+	const blocks = [...byArchive.entries()].sort((a, b) => a[0].localeCompare(b[0])).map(([archive, list]) =>
+		minorSection(`📦 <code class="path">${esc(archive)}</code> (${list.length})`, renderCveTable(list), { open: list.length <= 30 })
+	).join("\n");
+	return intro + blocks;
+}
+
 function renderFalsePositives(matches) {
 	if (!matches.length) return `<div class="empty">No CPE-filtered findings.</div>`;
 	const intro = `<div class="fp-intro">These entries were initially matched by name but NVD's CPE configurations show your dep version is outside every vulnerable range. They are almost certainly false positives — kept here for audit transparency.</div>`;
@@ -1721,10 +1837,10 @@ const WORD_SECTION_PR = `<!--[if gte mso 9]>
 // so Word can lay out the columns deterministically instead of inflating wide
 // columns based on natural content width.
 const TABLE_COLGROUPS = {
-	// 8-col CVE table (header starts with <th>Severity</th><th>CVE ID</th>…)
-	cve: { match: /<thead><tr><th>Severity<\/th><th>CVE ID<\/th><th>Dependency<\/th><th>CWE<\/th><th>Published<\/th><th>Description<\/th><th>Fix Version<\/th><th>Source<\/th>(<th>Recommended action<\/th>)?<\/tr><\/thead>/,
-	  widths8: [7, 10, 15, 10, 7, 26, 11, 14],
-	  widths9: [6, 9, 13, 9, 6, 22, 10, 13, 12] },
+	// 9-col CVE table (header starts with <th>Priority</th><th>Severity</th>…)
+	cve: { match: /<thead><tr><th>Priority<\/th><th>Severity<\/th><th>CVE ID<\/th><th>Dependency<\/th><th>CWE<\/th><th>Published<\/th><th>Description<\/th><th>Fix Version<\/th><th>Source<\/th>(<th>Recommended action<\/th>)?<\/tr><\/thead>/,
+	  widths9: [9, 7, 9, 14, 9, 6, 22, 10, 14],
+	  widths10: [8, 6, 8, 12, 8, 6, 18, 9, 13, 12] },
 	// 5-col EOL table
 	eol: { match: /<thead><tr><th>Product<\/th><th>Dependency<\/th><th>EOL date<\/th><th>Latest<\/th><th>Notes<\/th><\/tr><\/thead>/,
 	  widths: [15, 25, 12, 12, 36] },
@@ -1748,7 +1864,7 @@ function colgroupHtml(widths) {
 function injectColgroups(html) {
 	// CVE 8-col / 9-col (action variant)
 	html = html.replace(new RegExp(`(<table[^>]*>)\\s*(${TABLE_COLGROUPS.cve.match.source})`, "g"), (m, tableTag, thead) => {
-		const widths = thead.includes("Recommended action") ? TABLE_COLGROUPS.cve.widths9 : TABLE_COLGROUPS.cve.widths8;
+		const widths = thead.includes("Recommended action") ? TABLE_COLGROUPS.cve.widths10 : TABLE_COLGROUPS.cve.widths9;
 		return `${tableTag}${colgroupHtml(widths)}${thead}`;
 	});
 	for (const key of ["eol", "obsolete", "outdated", "retire"]) {
@@ -1790,14 +1906,27 @@ ${WORD_SECTION_PR}
 </html>`;
 }
 
-async function writeReports({ cveMatches, devCveMatches, retireMatches, eolResults, obsoleteResults, outdatedResults, resolvedDeps, projectInfo, outputDir, warnings }) {
-	await fs.promises.mkdir(outputDir, { recursive: true });
-	const payload = { cveMatches, devCveMatches, retireMatches, eolResults, obsoleteResults, outdatedResults, resolvedDeps, projectInfo, warnings };
-	const htmlPath = path.join(outputDir, "cve-report.html");
-	const docPath = path.join(outputDir, "cve-report.doc");
-	await fs.promises.writeFile(htmlPath, generateHtmlReport(payload));
-	await fs.promises.writeFile(docPath, generateWordReport(payload));
-	return { htmlPath, docPath };
+// Render the HTML and/or Word report. Callers pass explicit target paths;
+// a null/omitted path skips that format (so `--report-html` alone writes only HTML).
+// Back-compat: `outputDir` still writes both under the default file names.
+async function writeReports({ cveMatches, devCveMatches, embeddedMatches, retireMatches, eolResults, obsoleteResults, outdatedResults, licenseResults, resolvedDeps, projectInfo, outputDir, htmlPath, docPath, warnings }) {
+	if (outputDir) {
+		if (htmlPath === undefined) htmlPath = path.join(outputDir, "cve-report.html");
+		if (docPath === undefined) docPath = path.join(outputDir, "cve-report.doc");
+	}
+	const payload = { cveMatches, devCveMatches, embeddedMatches, retireMatches, eolResults, obsoleteResults, outdatedResults, licenseResults, resolvedDeps, projectInfo, warnings };
+	const written = { htmlPath: null, docPath: null };
+	if (htmlPath) {
+		await fs.promises.mkdir(path.dirname(path.resolve(htmlPath)), { recursive: true });
+		await fs.promises.writeFile(htmlPath, generateHtmlReport(payload));
+		written.htmlPath = htmlPath;
+	}
+	if (docPath) {
+		await fs.promises.mkdir(path.dirname(path.resolve(docPath)), { recursive: true });
+		await fs.promises.writeFile(docPath, generateWordReport(payload));
+		written.docPath = docPath;
+	}
+	return written;
 }
 
 module.exports = {

package/lib/dep-record.js

@@ -5,6 +5,9 @@
  * écosystèmes grâce au préfixe `ecosystem:`. `groupId`/`artifactId`/`pomPaths`
  * sont conservés comme alias rétro-compat le temps de migrer tous les
  * consommateurs vers `namespace`/`name`/`manifestPaths`.
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
  */
 
 // NuGet, Composer et PyPI sont case-insensitive : on normalise la clé en lower
@@ -32,9 +35,18 @@ function coordKeyFor(ecosystem, namespace, name) {
 }
 
 function makeDepRecord(input) {
-	const { ecosystem, namespace = "", name, version = null, manifestPath, scope = "compile", isDev = false, ecosystemType } = input;
+	const { ecosystem, namespace = "", name, version = null, manifestPath, scope = "compile", isDev = false, ecosystemType, provenance = "manifest" } = input;
 	const concrete = version && !/\$\{/.test(version) ? version : null;
 	const manifestPaths = manifestPath ? [manifestPath] : [];
+	// Embedded binaries (a dep discovered INSIDE a .jar/.war/.ear, not declared in a
+	// manifest) must not share the Map key of a declared dep with the same g:a — else
+	// they'd merge and the "embedded binaries" report chapter would lose them. Key
+	// them by their unique physical location instead. provenance stays on the record
+	// so the report/exports can label & group them; "both" is set later if a merge
+	// across provenances ever happens.
+	const coordKey = provenance === "embedded" && manifestPath
+		? `embedded:${manifestPath}`
+		: coordKeyFor(ecosystem, namespace, name);
 	return {
 		ecosystem,
 		ecosystemType: ecosystemType || ecosystem,
@@ -42,7 +54,8 @@ function makeDepRecord(input) {
 		name,
 		version: version || null,
 		versions: concrete ? [concrete] : [],
-		coordKey: coordKeyFor(ecosystem, namespace, name),
+		coordKey,
+		provenance,
 		scope,
 		isDev: !!isDev,
 		manifestPaths,