fad-checker 2.0.1 → 2.1.0

package/lib/purl.js

@@ -0,0 +1,77 @@
+/**
+ * lib/purl.js — build Package URL (purl) strings from a depRecord.
+ *
+ * purl spec: pkg:<type>/<namespace>/<name>@<version>?qualifiers#subpath
+ * We only emit type/namespace/name@version — enough for CycloneDX `bom-ref`
+ * and CSAF `product_identification_helper.purl`.
+ *
+ * Pure (no I/O). Shared by lib/sbom-export.js and lib/csaf-export.js.
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
+ */
+
+// purl type per ecosystem. Maven keeps the dotted groupId as a single namespace
+// segment (not slash-separated); npm/composer carry a namespace; pypi/nuget don't.
+const TYPE = {
+	maven: "maven",
+	npm: "npm",
+	composer: "composer",
+	pypi: "pypi",
+	nuget: "nuget",
+	go: "golang",
+	ruby: "gem",
+};
+
+// Per the purl spec, each namespace segment and the name are percent-encoded,
+// but the dots inside a Maven groupId and the separators are preserved by
+// encodeURIComponent (it leaves "." "-" "_" "~" alone), so it is the right tool.
+function enc(s) {
+	return encodeURIComponent(String(s));
+}
+
+// PEP 503 normalisation for PyPI names (purl mandates the canonical form).
+function normalizePypi(name) {
+	return String(name).toLowerCase().replace(/[-_.]+/g, "-");
+}
+
+/**
+ * Build a purl for a depRecord. Returns null when the dep lacks a usable
+ * ecosystem/name. Version is omitted when absent.
+ */
+function purlFor(dep) {
+	if (!dep || typeof dep !== "object") return null;
+	const eco = dep.ecosystem || dep.ecosystemType;
+	const type = TYPE[eco];
+	if (!type) return null;
+
+	const rawName = dep.name || dep.artifactId;
+	if (!rawName) return null;
+	let namespace = dep.namespace || dep.groupId || "";
+	let name = rawName;
+
+	if (eco === "npm" && !namespace && name.startsWith("@") && name.includes("/")) {
+		// Scoped package: "@scope/pkg" → namespace "@scope", name "pkg".
+		const slash = name.indexOf("/");
+		namespace = name.slice(0, slash);
+		name = name.slice(slash + 1);
+	} else if (eco === "pypi") {
+		name = normalizePypi(name);
+		namespace = "";
+	} else if (eco === "nuget") {
+		namespace = "";
+	} else if (eco === "go" && !namespace && name.includes("/")) {
+		// Go module path: namespace = everything up to the last "/", name = last segment.
+		const slash = name.lastIndexOf("/");
+		namespace = name.slice(0, slash);
+		name = name.slice(slash + 1);
+	}
+
+	// Namespace may itself be slash-separated (Go module paths); encode each
+	// segment but keep the separators.
+	const nsPart = namespace ? `${String(namespace).split("/").map(enc).join("/")}/` : "";
+	const verPart = dep.version ? `@${enc(dep.version)}` : "";
+	return `pkg:${type}/${nsPart}${enc(name)}${verPart}`;
+}
+
+module.exports = { purlFor };

package/lib/retire.js

@@ -12,6 +12,9 @@
  * The CLI is expected at node_modules/.bin/retire (declared in
  * package.json deps). When bundled with bun, we also try `retire`
  * on PATH as a fallback.
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
  */
 const fs = require("fs");
 const path = require("path");

package/lib/sarif-export.js

@@ -0,0 +1,134 @@
+/**
+ * lib/sarif-export.js — emit a SARIF 2.1.0 log from CVE matches.
+ *
+ * SARIF is the integration standard for GitHub Code Scanning and GitLab: any
+ * tool that emits it shows up in their dashboards with no custom glue. One
+ * `reportingDescriptor` (rule) per unique CVE, one `result` per (CVE, dep)
+ * match, located at the manifest that declares the dep.
+ *
+ * buildSarif is pure; writeSarif writes the JSON to disk.
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
+ */
+const fs = require("fs");
+const path = require("path");
+const { purlFor } = require("./purl");
+
+// CVSS/severity → SARIF result level.
+function sarifLevel(sev) {
+	switch ((sev || "").toUpperCase()) {
+		case "CRITICAL":
+		case "HIGH": return "error";
+		case "MEDIUM": return "warning";
+		default: return "note";
+	}
+}
+
+function relUri(p, srcRoot) {
+	if (!p) return null;
+	if (srcRoot && path.isAbsolute(p)) {
+		const r = path.relative(srcRoot, p);
+		if (r && !r.startsWith("..")) return r.split(path.sep).join("/");
+	}
+	return String(p).split(path.sep).join("/");
+}
+
+function depCoord(dep) {
+	const ns = dep.namespace || dep.groupId || "";
+	const name = dep.name || dep.artifactId;
+	if (dep.ecosystem === "maven" && ns) return `${ns}:${name}`;
+	if (dep.ecosystem === "composer" && ns) return `${ns}/${name}`;
+	return name;
+}
+
+/**
+ * Build a SARIF 2.1.0 object from matches.
+ * opts: { projectInfo, toolVersion }
+ */
+function buildSarif(matches, opts = {}) {
+	const { projectInfo = {}, toolVersion = "0" } = opts;
+	const srcRoot = projectInfo.src && projectInfo.src.startsWith("(") ? null : projectInfo.src;
+
+	const rulesById = new Map();
+	const results = [];
+
+	for (const m of matches || []) {
+		const id = m.cve?.id;
+		if (!id) continue;
+		const cve = m.cve;
+
+		if (!rulesById.has(id)) {
+			const rule = {
+				id,
+				name: id,
+				shortDescription: { text: `${id} affecting ${depCoord(m.dep)}` },
+				helpUri: id.startsWith("CVE-") ? `https://nvd.nist.gov/vuln/detail/${id}` : `https://osv.dev/vulnerability/${id}`,
+				properties: {},
+			};
+			// GitHub Code Scanning reads `security-severity` (a CVSS number string).
+			if (cve.score != null) rule.properties["security-severity"] = String(cve.score);
+			const tags = ["security", "external/cwe", "dependency"];
+			if (cve.kev) tags.push("known-exploited", "cisa-kev");
+			rule.properties.tags = tags;
+			if (Array.isArray(cve.cwes)) rule.properties.cwe = cve.cwes;
+			rulesById.set(id, rule);
+		}
+
+		const coord = depCoord(m.dep);
+		const purl = purlFor(m.dep);
+		const bits = [`${coord}@${m.dep.version || "?"}`];
+		if (cve.kev) bits.push("CISA-KEV (exploited)");
+		if (cve.epssPercentile != null) bits.push(`EPSS ${Math.round(cve.epssPercentile * 100)}%`);
+		if (cve.fixVersion) bits.push(`fix ≥ ${cve.fixVersion}`);
+		const text = `${id} in ${bits.join(" · ")}${cve.description ? ` — ${cve.description.slice(0, 300)}` : ""}`;
+
+		const locations = (m.dep.manifestPaths || m.dep.pomPaths || [])
+			.map(p => relUri(p, srcRoot))
+			.filter(Boolean)
+			.map(uri => ({ physicalLocation: { artifactLocation: { uri } } }));
+
+		const props = {};
+		if (purl) props.purl = purl;
+		if (cve.epssScore != null) props.epss = cve.epssScore;
+		if (cve.epssPercentile != null) props.epssPercentile = cve.epssPercentile;
+		if (cve.kev) props.kev = true;
+		if (cve.priority?.band) props.priorityBand = cve.priority.band;
+		if (m.dep.provenance && m.dep.provenance !== "manifest") props.provenance = m.dep.provenance;
+		if (m.cpeFiltered) props.cpeFiltered = true;
+		if (m.source) props.sources = m.source;
+
+		results.push({
+			ruleId: id,
+			level: sarifLevel(cve.severity),
+			message: { text },
+			...(locations.length ? { locations } : {}),
+			partialFingerprints: { fadKey: `${coord}@${m.dep.version || "?"}|${id}` },
+			properties: props,
+		});
+	}
+
+	return {
+		$schema: "https://json.schemastore.org/sarif-2.1.0.json",
+		version: "2.1.0",
+		runs: [{
+			tool: {
+				driver: {
+					name: "fad-checker",
+					version: String(toolVersion),
+					informationUri: "https://github.com/n8tz/fad-checker",
+					rules: [...rulesById.values()],
+				},
+			},
+			results,
+		}],
+	};
+}
+
+function writeSarif(matches, outputPath, opts = {}) {
+	const doc = buildSarif(matches, opts);
+	fs.writeFileSync(outputPath, JSON.stringify(doc, null, 2) + "\n");
+	return doc;
+}
+
+module.exports = { buildSarif, writeSarif, sarifLevel };

package/lib/sbom-export.js

@@ -0,0 +1,153 @@
+/**
+ * lib/sbom-export.js — emit a CycloneDX 1.6 SBOM with vulnerabilities inline
+ * (a VDR — Vulnerability Disclosure Report) from the resolved deps + matches.
+ *
+ * buildCycloneDx is pure (testable); writeCycloneDx writes the JSON to disk.
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
+ */
+const fs = require("fs");
+const { purlFor } = require("./purl");
+
+// NVD "CVSS:3.1" → CycloneDX rating method enum. Tolerates the legacy
+// "CVSS:V31"/"V30"/"V40"/"V2" labels left in pre-fix NVD caches.
+function cvssMethod(cvssVersion) {
+	const v = String(cvssVersion || "");
+	if (v.includes("4.0") || /v40\b/i.test(v)) return "CVSSv4";
+	if (v.includes("3.1") || /v31\b/i.test(v)) return "CVSSv31";
+	if (v.includes("3.0") || v === "CVSS:3" || /v30\b/i.test(v)) return "CVSSv3";
+	if (v.includes("2.0") || v === "CVSS:2" || /v2\b/i.test(v)) return "CVSSv2";
+	return "other";
+}
+
+// Point the advisory source at the right database for the id type — a GHSA/OSV id
+// has no page on nvd.nist.gov, so the old hardcoded NVD url was a dead link.
+function advisorySource(id, source) {
+	if (/^CVE-/i.test(id)) return { name: "NVD", url: `https://nvd.nist.gov/vuln/detail/${encodeURIComponent(id)}` };
+	if (/^GHSA-/i.test(id)) return { name: "GitHub Advisory Database", url: `https://github.com/advisories/${encodeURIComponent(id)}` };
+	return { name: (source || "").includes("nvd") ? "NVD" : "OSV", url: `https://osv.dev/vulnerability/${encodeURIComponent(id)}` };
+}
+
+// Stable, UNIQUE bom-ref. Declared deps use their purl (unchanged). Embedded
+// binaries get a location-qualified ref so two copies of the same coordinate
+// (one declared, one shaded into a jar) don't collide on the same bom-ref.
+function bomRefFor(dep, purl) {
+	if (dep.provenance === "embedded") return dep.coordKey; // already "embedded:<path>" — unique
+	return purl || null;
+}
+
+function cdxSeverity(sev) {
+	const s = (sev || "unknown").toLowerCase();
+	return ["critical", "high", "medium", "low", "none", "info"].includes(s) ? s : "unknown";
+}
+
+function cweNum(c) {
+	const m = String(c).match(/(\d+)/);
+	return m ? parseInt(m[1], 10) : null;
+}
+
+function licenseEntry(ids) {
+	// CycloneDX: {license:{id}} for SPDX ids, {license:{name}} otherwise.
+	return (ids || []).map(x => /^[A-Za-z0-9.+-]+$/.test(x) && /[A-Z]/.test(x) ? { license: { id: x } } : { license: { name: x } });
+}
+
+/**
+ * Build a CycloneDX 1.6 object.
+ * opts: { projectInfo, toolVersion, timestamp, licenseResults }
+ */
+function buildCycloneDx(resolvedDeps, cveMatches, opts = {}) {
+	const { projectInfo = {}, toolVersion = "0", timestamp, licenseResults } = opts;
+
+	// coordKey → [spdx ids] for component licenses (optional).
+	const licByCoord = new Map();
+	for (const e of licenseResults?.assessed || []) {
+		const key = e.dep?.coordKey || `${e.dep?.namespace || ""}:${e.dep?.name}`;
+		const ids = (e.ids || []).concat(e.raw || []);
+		if (ids.length) licByCoord.set(key, ids);
+	}
+
+	const components = [];
+	for (const dep of resolvedDeps.values()) {
+		const purl = purlFor(dep);
+		const comp = { type: "library", name: dep.name || dep.artifactId, version: dep.version || undefined };
+		if (dep.namespace || dep.groupId) comp.group = dep.namespace || dep.groupId;
+		const ref = bomRefFor(dep, purl);
+		if (ref) comp["bom-ref"] = ref;
+		if (purl) comp.purl = purl;
+		const lic = licByCoord.get(dep.coordKey);
+		if (lic) comp.licenses = licenseEntry(lic);
+		// Mark embedded-binary components so the SBOM consumer can tell a vendored/fat-jar
+		// coordinate apart from a declared dependency, and where it physically lives.
+		if (dep.provenance === "embedded") {
+			comp.properties = [
+				{ name: "fad:provenance", value: "embedded" },
+				...((dep.manifestPaths || [])[0] ? [{ name: "fad:location", value: dep.manifestPaths[0] }] : []),
+			];
+		}
+		components.push(comp);
+	}
+
+	// One vulnerability entry per CVE id, aggregating affected component refs.
+	const byCve = new Map();
+	for (const m of cveMatches || []) {
+		const id = m.cve?.id;
+		if (!id) continue;
+		const ref = bomRefFor(m.dep, purlFor(m.dep)); // match the component bom-ref (unique for embedded)
+		let v = byCve.get(id);
+		if (!v) {
+			const cve = m.cve;
+			v = {
+				"bom-ref": `vuln-${id}`,
+				id,
+				source: advisorySource(id, m.source),
+				ratings: cve.score != null ? [{
+					source: { name: "NVD" },
+					score: cve.score,
+					severity: cdxSeverity(cve.severity),
+					method: cvssMethod(cve.cvssVersion),
+					...(cve.cvssVector ? { vector: cve.cvssVector } : {}),
+				}] : [],
+				...(Array.isArray(cve.cwes) && cve.cwes.length ? { cwes: cve.cwes.map(cweNum).filter(n => n != null) } : {}),
+				...(cve.description ? { description: cve.description } : {}),
+				affects: [],
+				properties: buildVulnProps(cve),
+			};
+			byCve.set(id, v);
+		}
+		if (ref && !v.affects.some(a => a.ref === ref)) v.affects.push({ ref });
+		if (m.cpeFiltered) v.properties.push({ name: "fad:cpe-filtered", value: "true" });
+	}
+
+	const bom = {
+		bomFormat: "CycloneDX",
+		specVersion: "1.6",
+		version: 1,
+		metadata: {
+			...(timestamp ? { timestamp } : {}),
+			tools: { components: [{ type: "application", name: "fad-checker", version: String(toolVersion) }] },
+			component: { type: "application", name: projectInfo.name || "project" },
+		},
+		components,
+		vulnerabilities: [...byCve.values()],
+	};
+	return bom;
+}
+
+function buildVulnProps(cve) {
+	const props = [];
+	if (cve.epssScore != null) props.push({ name: "fad:epss", value: String(cve.epssScore) });
+	if (cve.epssPercentile != null) props.push({ name: "fad:epssPercentile", value: String(cve.epssPercentile) });
+	if (cve.kev) props.push({ name: "fad:kev", value: "true" });
+	if (cve.priority?.band) props.push({ name: "fad:priorityBand", value: cve.priority.band });
+	if (cve.priority?.score != null) props.push({ name: "fad:priorityScore", value: String(cve.priority.score) });
+	return props;
+}
+
+function writeCycloneDx(resolvedDeps, cveMatches, outputPath, opts = {}) {
+	const bom = buildCycloneDx(resolvedDeps, cveMatches, opts);
+	fs.writeFileSync(outputPath, JSON.stringify(bom, null, 2) + "\n");
+	return bom;
+}
+
+module.exports = { buildCycloneDx, writeCycloneDx, cvssMethod, cdxSeverity };

package/lib/scan-completeness.js

@@ -18,6 +18,9 @@
  *
  * Output: an array of warning objects matching the same shape as
  * lib/npm/collect.js warnings ({ type, manifestPath?, message, ... }).
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
  */
 /**
  * Scan the resolved deps map and return warnings.

package/lib/snyk.js

@@ -4,6 +4,9 @@
  * Runs `snyk test --all-projects --json` on the cleaned POM directory and
  * normalises the output to fad-checker's CVE match shape so the report can
  * merge findings from both engines.
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
  */
 const { execFile } = require("child_process");
 const { promisify } = require("util");

package/lib/suppress.js

@@ -0,0 +1,113 @@
+/**
+ * lib/suppress.js — triage: suppress accepted-risk / false-positive findings so
+ * re-audits of the same codebase stay signal-rich.
+ *
+ * Two inputs:
+ *   --ignore <file> : plain text rules, one per line:
+ *        CVE-2021-44228                  # suppress this CVE everywhere
+ *        CVE-2021-44228 org.apache.*     # …only for matching coord/purl (glob)
+ *        * com.acme.internal:*           # any CVE for these coords
+ *        anything after '#' is a reason
+ *   --vex <file>    : a CSAF VEX document — CVEs whose product_status is
+ *        known_not_affected / fixed are suppressed (round-trips fad's own
+ *        --report-csaf output; products mapped back to coords via their purl).
+ *
+ * Pure parsing + matching; the caller reads the files and mutates matches.
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
+ */
+const { purlFor } = require("./purl");
+
+function coordOf(dep) {
+	const ns = dep.namespace || dep.groupId || "";
+	const name = dep.name || dep.artifactId;
+	if (dep.ecosystem === "maven" && ns) return `${ns}:${name}`;
+	if (dep.ecosystem === "composer" && ns) return `${ns}/${name}`;
+	return name;
+}
+
+// Glob → anchored RegExp ('*' = any run). Everything else is literal.
+function globToRe(glob) {
+	const esc = String(glob).replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
+	return new RegExp(`^${esc}$`);
+}
+
+/** Parse an --ignore file body into rules [{ cve, coordRe, coord, reason }]. */
+function parseIgnoreFile(text) {
+	const rules = [];
+	for (const raw of String(text || "").split(/\r?\n/)) {
+		const hash = raw.indexOf("#");
+		const reason = hash >= 0 ? raw.slice(hash + 1).trim() : null;
+		const line = (hash >= 0 ? raw.slice(0, hash) : raw).trim();
+		if (!line) continue;
+		const parts = line.split(/\s+/);
+		const cve = parts[0];
+		const coord = parts[1] || null;
+		rules.push({ cve, coord, coordRe: coord ? globToRe(coord) : null, reason: reason || "ignored" });
+	}
+	return rules;
+}
+
+/** Parse a CSAF VEX document into suppression rules for not_affected/fixed CVEs. */
+function parseVex(csaf) {
+	const rules = [];
+	if (!csaf || typeof csaf !== "object") return rules;
+	// product_id → purl, to map suppressed products back to coordinates.
+	const purlByPid = {};
+	for (const p of csaf.product_tree?.full_product_names || []) {
+		const purl = p.product_identification_helper?.purl;
+		if (p.product_id && purl) purlByPid[p.product_id] = purl;
+	}
+	for (const v of csaf.vulnerabilities || []) {
+		const cve = v.cve;
+		if (!cve) continue;
+		const cleared = [
+			...(v.product_status?.known_not_affected || []),
+			...(v.product_status?.fixed || []),
+		];
+		if (!cleared.length) {
+			// No product scope → suppress the CVE globally.
+			rules.push({ cve, coord: null, coordRe: null, reason: "VEX: not affected / fixed" });
+			continue;
+		}
+		for (const pid of cleared) {
+			const purl = purlByPid[pid];
+			// A product we can't map back to a coord must NOT become a coordRe:null
+			// rule — that would suppress this CVE for EVERY dependency (a security
+			// false-negative). Skip it: a product-scoped clearance only ever narrows.
+			if (!purl) continue;
+			rules.push({ cve, coord: purl, coordRe: globToRe(purl), reason: "VEX: not affected / fixed" });
+		}
+	}
+	return rules;
+}
+
+function ruleMatches(rule, m) {
+	if (rule.cve && rule.cve !== "*" && rule.cve !== m.cve?.id) return false;
+	if (!rule.coordRe) return true;
+	const coord = coordOf(m.dep);
+	const purl = purlFor(m.dep) || "";
+	return rule.coordRe.test(coord) || rule.coordRe.test(purl) || rule.coordRe.test(m.dep.name || "");
+}
+
+/** Build a matcher from a flat rule list. */
+function buildSuppressor(rules) {
+	return (m) => {
+		for (const r of rules || []) if (ruleMatches(r, m)) return { suppressed: true, reason: r.reason };
+		return null;
+	};
+}
+
+/** Mark matches in place; returns the number suppressed. */
+function applySuppressions(matches, rules) {
+	const suppressor = buildSuppressor(rules);
+	let n = 0;
+	for (const m of matches || []) {
+		const hit = suppressor(m);
+		if (hit) { m.suppressed = true; m.suppressedReason = hit.reason; n++; }
+	}
+	return n;
+}
+
+module.exports = { parseIgnoreFile, parseVex, buildSuppressor, applySuppressions, globToRe };

package/lib/transitive.js

@@ -18,6 +18,9 @@
  *   - <relocation> handling (rare in modern artifacts)
  *   - non-central repositories (everything fetched from repo1.maven.org)
  *   - SNAPSHOT version resolution (we just return the literal version)
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
  */
 const fs = require("fs");
 const path = require("path");

package/lib/ui.js

@@ -5,6 +5,9 @@
  * The Progress indicator renders a "[n/N] <spinner> label — summary" checklist.
  * TTY: one animated line per step, rewritten in place, finalized with ✓/⊘/✗.
  * Non-TTY (pipes, CI, files): a single plain line per finished step, no escapes.
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
  */
 const chalk = require("chalk");
 

package/package.json

@@ -1,9 +1,54 @@
 {
   "name": "fad-checker",
-  "version": "2.0.1",
-  "description": "Scan ALL Maven, npm, Yarn, Composer, Python & C#/.NET dependencies in a source tree ONE SHOT without mvn/python/etc, deal with private deps, multi mvn modules, EOL, obsolete, outdated deps & give fix recos",
+  "version": "2.1.0",
+  "description": "Scan ALL Maven, npm, Yarn, Composer, Python, C#/.NET, Go & Ruby dependencies — plus embedded JARs (fat-jars/war/ear) — in a source tree ONE SHOT without mvn/python/etc — CVE (EPSS/KEV-prioritised), EOL, obsolete, outdated & licenses, with SBOM/CSAF/SARIF/JSON exports, CI gating and fix recos",
+  "keywords": [
+    "sca",
+    "software-composition-analysis",
+    "dependency-scanner",
+    "vulnerability-scanner",
+    "security",
+    "cve",
+    "osv",
+    "nvd",
+    "epss",
+    "kev",
+    "cyclonedx",
+    "sbom",
+    "csaf",
+    "vex",
+    "sarif",
+    "license-compliance",
+    "eol",
+    "end-of-life",
+    "outdated",
+    "deprecated",
+    "audit",
+    "devsecops",
+    "appsec",
+    "supply-chain",
+    "offline",
+    "air-gapped",
+    "passi",
+    "maven",
+    "npm",
+    "yarn",
+    "pnpm",
+    "composer",
+    "pypi",
+    "nuget",
+    "go",
+    "golang",
+    "ruby",
+    "rubygems",
+    "retirejs",
+    "polyglot",
+    "cli"
+  ],
   "license": "MIT",
   "repository": "https://github.com/n8tz/fad-checker",
+  "homepage": "https://github.com/n8tz/fad-checker#readme",
+  "bugs": "https://github.com/n8tz/fad-checker/issues",
   "author": "pp9Ping <pp9Ping@gmail.com>",
   "maintainers": [
     "pp9Ping <pp9Ping@gmail.com>"
@@ -25,6 +70,7 @@
   "dependencies": {
     "chalk": "^4.1.2",
     "commander": "^14.0.1",
+    "fflate": "^0.8.3",
     "js-yaml": "^4.1.1",
     "p-limit": "^3.1.0",
     "retire": "^5.4.2",