fad-checker 2.0.1 → 2.1.1

package/lib/cve-report.js

@@ -4,10 +4,14 @@
  *
  * Word opens HTML saved as .doc natively — we use the same HTML body
  * wrapped in Word XML namespace meta tags.
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
  */
 const fs = require("fs");
 const path = require("path");
 const { getCodec, allCodecs, ORDER } = require("./codecs");
+const { computePriority, sortByPriority } = require("./priority");
 
 // CWE-id → short human name. Loaded once at module init. Unknown CWEs fall
 // back to the raw id (with a "—" placeholder name where the row asks for one).
@@ -34,13 +38,14 @@ function esc(s) {
 }
 
 function computeStats(cveMatches) {
-	const buckets = { critical: 0, high: 0, medium: 0, low: 0, none: 0, unknown: 0, transitive: 0, direct: 0 };
+	const buckets = { critical: 0, high: 0, medium: 0, low: 0, none: 0, unknown: 0, transitive: 0, direct: 0, kev: 0 };
 	for (const m of cveMatches || []) {
 		const sev = (m.cve.severity || "UNKNOWN").toLowerCase();
 		if (buckets[sev] != null) buckets[sev]++;
 		else buckets.unknown++;
 		if (m.dep?.scope === "transitive") buckets.transitive++;
 		else buckets.direct++;
+		if (m.cve?.kev) buckets.kev++;
 	}
 	buckets.total = (cveMatches || []).length;
 	return buckets;
@@ -61,6 +66,26 @@ function badge(sev) {
 	return `<span style="display:inline-block;padding:2px 8px;border-radius:3px;background:${c.bg};color:${c.fg};font-weight:600;font-size:11px;letter-spacing:.5px">${esc(s)}</span>`;
 }
 
+const BAND_BADGE = {
+	exploited: { bg: "#7c0008", fg: "#fff", label: "EXPLOITED" },
+	critical:  { bg: "#b91c1c", fg: "#fff", label: "CRITICAL" },
+	high:      { bg: "#ea580c", fg: "#fff", label: "HIGH" },
+	medium:    { bg: "#ca8a04", fg: "#fff", label: "MEDIUM" },
+	low:       { bg: "#2563eb", fg: "#fff", label: "LOW" },
+};
+
+// Priority cell: composite band badge (KEV-aware) + EPSS percentile + KEV chip.
+function priorityCell(m) {
+	const p = m.cve?.priority || computePriority(m.cve || {});
+	const b = BAND_BADGE[p.band] || BAND_BADGE.low;
+	const bandBadge = `<span class="prio-band" style="display:inline-block;padding:2px 7px;border-radius:3px;background:${b.bg};color:${b.fg};font-weight:700;font-size:10px;letter-spacing:.4px">${esc(b.label)}</span>`;
+	const kev = p.kev ? `<div class="kev-chip" title="CISA Known Exploited Vulnerability${m.cve?.kevDueDate ? ` — remediate by ${esc(m.cve.kevDueDate)}` : ""}">🛑 KEV${m.cve?.kevRansomware ? " · ransomware" : ""}</div>` : "";
+	const epss = m.cve?.epssPercentile != null
+		? `<div class="epss-chip" title="EPSS score ${(m.cve.epssScore != null ? (m.cve.epssScore * 100).toFixed(1) : "?")}%">EPSS ${Math.round(m.cve.epssPercentile * 100)}%</div>`
+		: "";
+	return `${bandBadge}${kev}${epss}`;
+}
+
 const CSS = `
 * { box-sizing: border-box; }
 body { font-family: -apple-system, "Segoe UI", Roboto, sans-serif; color: #1f2937; margin: 24px; background: #f9fafb; }
@@ -95,6 +120,19 @@ h2 { margin: 32px 0 12px; font-size: 20px; border-bottom: 2px solid #e5e7eb; pad
 .exec-summary .exec-ver { color: #6b7280; }
 .exec-summary .exec-fix { color: #065f46; font-weight: 600; }
 .fp-intro { background: #f3f4f6; border-left: 3px solid #6b7280; padding: 10px 14px; margin: 8px 0 16px; font-size: 12px; color: #4b5563; line-height: 1.5; }
+td.prio { white-space: normal; }
+td.prio .prio-band { white-space: nowrap; }
+td.prio .kev-chip { display: block; margin-top: 3px; font-size: 10px; font-weight: 700; color: #7c0008; white-space: nowrap; }
+td.prio .epss-chip { display: block; margin-top: 2px; font-size: 10px; color: #6b7280; font-family: ui-monospace, monospace; white-space: nowrap; }
+.summary .card.sev-kev { border-left: 4px solid #7c0008; background: #fff1f2; }
+.summary .card.sev-kev .v { color: #7c0008; }
+.lic-group { margin: 14px 0; }
+.lic-group .lic-h { font-size: 14px; margin: 8px 0 4px; padding: 4px 8px; border-radius: 4px; }
+.lic-group .lic-n { font-size: 11px; color: #6b7280; font-weight: 500; }
+.lic-group.lic-strong .lic-h { background: #fee2e2; color: #7c0008; }
+.lic-group.lic-weak .lic-h { background: #fef3c7; color: #92400e; }
+.lic-group.lic-unknown .lic-h { background: #e5e7eb; color: #374151; }
+.lic-group.lic-ok .lic-h { background: #dcfce7; color: #065f46; }
 td.cwe { font-family: ui-monospace, monospace; font-size: 11px; color: #4b5563; }
 td.cwe .cwe-link { color: #6366f1; text-decoration: none; }
 td.cwe .cwe-link:hover { text-decoration: underline; }
@@ -479,6 +517,9 @@ function renderDetailPanel(m) {
 	const kv = [];
 	if (cve.cvssVector) kv.push(`<div><label>${esc(cve.cvssVersion || "CVSS")}</label><span class="cvss-vector">${esc(cve.cvssVector)}</span></div>`);
 	if (cve.score != null) kv.push(`<div><label>Base score</label><span>${esc(cve.score.toFixed ? cve.score.toFixed(1) : cve.score)} (${esc(cve.severity || "?")})</span></div>`);
+	if (cve.priority) kv.push(`<div><label>Priority</label><span>${esc((cve.priority.band || "").toUpperCase())} · ${esc(cve.priority.score)}/100</span></div>`);
+	if (cve.epssPercentile != null) kv.push(`<div><label>EPSS</label><span>${(cve.epssScore != null ? (cve.epssScore * 100).toFixed(1) + "% prob · " : "")}${Math.round(cve.epssPercentile * 100)}th pct</span></div>`);
+	if (cve.kev) kv.push(`<div><label>CISA KEV</label><span>Known exploited${cve.kevDateAdded ? ` · added ${esc(cve.kevDateAdded)}` : ""}${cve.kevDueDate ? ` · due ${esc(cve.kevDueDate)}` : ""}${cve.kevRansomware ? " · ransomware" : ""}</span></div>`);
 	if (cve.fixVersion) kv.push(`<div><label>Fix version</label><span>${esc(cve.fixVersion)}</span></div>`);
 	if (cve.published) kv.push(`<div><label>Published</label><span>${esc(cve.published.slice(0, 10))}</span></div>`);
 	if (cve.modified) kv.push(`<div><label>Modified</label><span>${esc(cve.modified.slice(0, 10))}</span></div>`);
@@ -585,7 +626,7 @@ function renderCveRow(m, opts = {}) {
 	const source = sourceParts.map(s => `<span class="source ${esc(s)}">${esc(s)}</span>`).join("");
 	const conf = m.confidence ? `<div class="confidence">${esc(m.confidence)}</div>` : "";
 	const actionCell = withAction ? `<td class="action">${renderActionCell(m)}</td>` : "";
-	const baseCols = 8; // Sev, CVE, Dep, CWE, Published, Description, Fix, Source
+	const baseCols = 9; // Priority, Sev, CVE, Dep, CWE, Published, Description, Fix, Source
 	const colspan = withAction ? baseCols + 1 : baseCols;
 	const pub = formatPubDate(m.cve.published);
 	const cwes = formatCwes(m.cve.cwes);
@@ -593,6 +634,7 @@ function renderCveRow(m, opts = {}) {
 	// tr.detail-row. JS toggle is at the bottom of the document; links inside
 	// cells stay clickable (the handler ignores anchor/button clicks).
 	return `<tr class="cve-row${m.cpeFiltered ? " cpe-fp" : ""}">
+		<td class="prio">${priorityCell(m)}</td>
 		<td>${badge(m.cve.severity)}${m.cve.score != null ? `<div class="confidence">${esc(m.cve.score.toFixed(1))}</div>` : ""}</td>
 		<td class="cve"><a href="${link}" target="_blank">${esc(m.cve.id)}</a>${conf}${m.cpeFiltered ? `<div class="cpe-tag">CPE-filtered</div>` : ""}</td>
 		${depCell(m.dep)}
@@ -629,10 +671,11 @@ function renderActionCell(m) {
 function renderCveTable(cveMatches, opts = {}) {
 	if (!cveMatches?.length) return `<div class="empty">No CVEs matched.</div>`;
 	const { withAction } = opts;
-	const rows = cveMatches.map(m => renderCveRow(m, opts)).join("\n");
+	// Highest composite priority (KEV → EPSS-weighted CVSS) first.
+	const rows = sortByPriority(cveMatches).map(m => renderCveRow(m, opts)).join("\n");
 	const actionHeader = withAction ? `<th>Recommended action</th>` : "";
 	return `<table>
-		<thead><tr><th>Severity</th><th>CVE ID</th><th>Dependency</th><th>CWE</th><th>Published</th><th>Description</th><th>Fix Version</th><th>Source</th>${actionHeader}</tr></thead>
+		<thead><tr><th>Priority</th><th>Severity</th><th>CVE ID</th><th>Dependency</th><th>CWE</th><th>Published</th><th>Description</th><th>Fix Version</th><th>Source</th>${actionHeader}</tr></thead>
 		<tbody>${rows}</tbody>
 	</table>`;
 }
@@ -966,6 +1009,7 @@ function summaryCards(stats, eol, obs, out, extra = {}) {
 		{ v: stats.high,     l: "High",        cls: "sev-high" },
 		{ v: stats.medium,   l: "Medium",      cls: "sev-medium" },
 		{ v: stats.low,      l: "Low",         cls: "sev-low" },
+		...(stats.kev ? [{ v: stats.kev, l: "KEV exploited", cls: "sev-kev" }] : []),
 		{ v: stats.total,    l: "Total CVEs" },
 		{ v: stats.direct,     l: "in Direct" },
 		{ v: stats.transitive, l: "in Transitive" },
@@ -973,6 +1017,7 @@ function summaryCards(stats, eol, obs, out, extra = {}) {
 		{ v: eol?.length || 0, l: "EOL" },
 		{ v: obs?.length || 0, l: "Obsolete" },
 		{ v: out?.length || 0, l: "Outdated" },
+		...(extra.licenseFlagged ? [{ v: extra.licenseFlagged, l: "Licenses to review", cls: "sev-medium" }] : []),
 		{ v: extra.warnings?.length || 0, l: "Scan alerts", cls: "sev-warn" },
 	];
 	return `<div class="summary">${cards.map(c => `<div class="card${c.cls ? " " + c.cls : ""}"><div class="v">${c.v}</div><div class="l">${esc(c.l)}</div></div>`).join("")}</div>`;
@@ -1278,11 +1323,49 @@ function renderWarningItems(items, itemLimit) {
 	return `<ul class="warn-items">${lis}${overflow}</ul>`;
 }
 
-function buildBody({ cveMatches, devCveMatches, retireMatches, eolResults, obsoleteResults, outdatedResults, resolvedDeps, projectInfo, warnings, wrapTables = true }) {
+const LICENSE_CAT_META = {
+	"network-copyleft": { label: "Network copyleft (AGPL/SSPL)", cls: "lic-strong" },
+	"strong-copyleft":  { label: "Strong copyleft (GPL)", cls: "lic-strong" },
+	"proprietary":      { label: "Proprietary / commercial", cls: "lic-strong" },
+	"weak-copyleft":    { label: "Weak copyleft (LGPL/MPL/EPL)", cls: "lic-weak" },
+	"unknown":          { label: "Unknown / unrecognized", cls: "lic-unknown" },
+	"permissive":       { label: "Permissive (MIT/Apache/BSD)", cls: "lic-ok" },
+};
+const LICENSE_CAT_ORDER = ["network-copyleft", "strong-copyleft", "proprietary", "weak-copyleft", "unknown", "permissive"];
+
+function renderLicenseChapter(licenseResults) {
+	if (!licenseResults || !licenseResults.assessed?.length) {
+		return `<div class="empty">No license data resolved (offline, or registries returned none).</div>`;
+	}
+	const { byCategory } = licenseResults;
+	const blocks = LICENSE_CAT_ORDER.filter(cat => byCategory[cat]?.length).map(cat => {
+		const meta = LICENSE_CAT_META[cat] || { label: cat, cls: "lic-unknown" };
+		const rows = byCategory[cat].slice().sort((a, b) => depDisplayName(a.dep).localeCompare(depDisplayName(b.dep))).map(e => {
+			const lics = e.ids.concat(e.raw);
+			return `<tr>
+				<td>${depCell(e.dep)}</td>
+				<td>${esc(lics.join(", ") || "—")}</td>
+				<td>${esc(e.source || "—")}</td>
+			</tr>`;
+		}).join("");
+		return `<div class="lic-group ${meta.cls}">
+			<h3 class="lic-h">${esc(meta.label)} <span class="lic-n">${byCategory[cat].length}</span></h3>
+			<table><thead><tr><th>Dependency</th><th>License(s)</th><th>Source</th></tr></thead><tbody>${rows}</tbody></table>
+		</div>`;
+	}).join("");
+	const flaggedN = licenseResults.flagged?.length || 0;
+	const intro = flaggedN
+		? `<div class="fp-intro">${flaggedN} dependency(ies) carry a copyleft, proprietary, or unrecognized license that may impose redistribution obligations — review against your distribution model. Permissive licenses are listed for completeness.</div>`
+		: `<div class="fp-intro">All resolved licenses are permissive. Listed for completeness.</div>`;
+	return intro + blocks;
+}
+
+function buildBody({ cveMatches, devCveMatches, embeddedMatches, retireMatches, eolResults, obsoleteResults, outdatedResults, licenseResults, resolvedDeps, projectInfo, warnings, wrapTables = true }) {
 	setRenderCtx({ srcRoot: projectInfo?.src || null });
 	// Dedupe rows so a single (dep, cve) shows once with all via paths merged.
-	cveMatches    = mergeMatches(cveMatches || []);
-	devCveMatches = mergeMatches(devCveMatches || []);
+	cveMatches      = mergeMatches(cveMatches || []);
+	devCveMatches   = mergeMatches(devCveMatches || []);
+	embeddedMatches = mergeMatches(embeddedMatches || []);
 	retireMatches = retireMatches || [];
 	attachRootUpdates(cveMatches, outdatedResults, resolvedDeps);
 	attachRootUpdates(devCveMatches, outdatedResults, resolvedDeps);
@@ -1294,9 +1377,12 @@ function buildBody({ cveMatches, devCveMatches, retireMatches, eolResults, obsol
 	const prodMatchesFP     = cveMatches.filter(m =>  m.cpeFiltered);
 	const devMatchesActive  = devCveMatches.filter(m => !m.cpeFiltered);
 	const devMatchesFP      = devCveMatches.filter(m =>  m.cpeFiltered);
+	const embMatchesActive  = embeddedMatches.filter(m => !m.cpeFiltered);
+	const embMatchesFP      = embeddedMatches.filter(m =>  m.cpeFiltered);
 
 	const prodStats   = computeStats(prodMatchesActive);
 	const devStats    = computeStats(devMatchesActive);
+	const embStats    = computeStats(embMatchesActive);
 	const retireStats = computeStats(retireMatches);
 
 	// Recos are built from prod matches only (dev/test issues aren't a release blocker).
@@ -1305,7 +1391,11 @@ function buildBody({ cveMatches, devCveMatches, retireMatches, eolResults, obsol
 	const cveContent       = renderCveBySectionByEco(prodMatchesActive, "1", projectInfo?.src);
 	const vendoredContent  = renderRetireTable(retireMatches);
 	const devCveContent    = renderCveBySectionByEco(devMatchesActive, "3", projectInfo?.src);
-	const fpContent        = renderFalsePositives([...prodMatchesFP, ...devMatchesFP]);
+	const licenseContent   = renderLicenseChapter(licenseResults);
+	const licenseTotal     = licenseResults?.assessed?.length || 0;
+	const licenseFlagged   = licenseResults?.flagged?.length || 0;
+	const embeddedContent  = renderEmbeddedChapter(embMatchesActive, projectInfo?.src);
+	const fpContent        = renderFalsePositives([...prodMatchesFP, ...devMatchesFP, ...embMatchesFP]);
 
 	const toolbar = `<div class="toolbar">
 		<button class="btn" type="button" data-action="expand-all">⊕ Expand all</button>
@@ -1334,7 +1424,10 @@ function buildBody({ cveMatches, devCveMatches, retireMatches, eolResults, obsol
 		eolTotal: eolResults?.length || 0,
 		obsoleteTotal: obsoleteResults?.length || 0,
 		outdatedTotal: outdatedResults?.length || 0,
-		fpTotal: prodMatchesFP.length + devMatchesFP.length,
+		licenseTotal,
+		licenseFlagged,
+		embeddedTotal: embStats.total,
+		fpTotal: prodMatchesFP.length + devMatchesFP.length + embMatchesFP.length,
 	});
 
 	const body = `
@@ -1347,19 +1440,21 @@ function buildBody({ cveMatches, devCveMatches, retireMatches, eolResults, obsol
 			</div>
 		</header>
 		${exec}
-		${summaryCards(prodStats, eolResults, obsoleteResults, outdatedResults, { warnings, vendored: retireMatches.length })}
+		${summaryCards(prodStats, eolResults, obsoleteResults, outdatedResults, { warnings, vendored: retireMatches.length, licenseFlagged })}
 		${toc}
 		${toolbar}
 
 		${(warnings?.length || 0) ? majorSection(`0. Warnings & scan-completeness (${warnings.length})`, renderWarnings(warnings), { open: true, id: "ch0" }) : ""}
 		${majorSection(`1. CVE Vulnerabilities — production (${prodStats.total})`, cveContent, { id: "ch1" })}
+		${embStats.total ? majorSection(`1B. Embedded binaries — JAR/WAR/EAR (${embStats.total})`, embeddedContent, { open: embStats.total <= 50, id: "ch1e" }) : ""}
 		${majorSection(`2. Vendored JS scan — retire.js (${retireMatches.length})`, vendoredContent, { open: retireMatches.length > 0 && retireMatches.length <= 50, id: "ch2" })}
 		${majorSection(`3. CVE in dev dependencies (${devStats.total})`, devCveContent, { open: devStats.total > 0 && devStats.total <= 50, id: "ch3" })}
 		${majorSection(`4. End-of-Life Frameworks (${eolResults?.length || 0})`, renderEolTable(eolResults), { id: "ch4" })}
 		${majorSection(`5. Obsolete / Deprecated Libraries (${obsoleteResults?.length || 0})`, renderObsoleteTable(obsoleteResults), { id: "ch5" })}
 		${majorSection(`6. Outdated Libraries (${outdatedResults?.length || 0})`, renderOutdatedTable(outdatedResults), { open: (outdatedResults?.length || 0) <= 50, id: "ch6" })}
-		${majorSection(`7. Fix Recommendations`, renderFixRecommendations(recos, prodMatchesActive, outdatedResults), { open: false, id: "ch7" })}
-		${(prodMatchesFP.length + devMatchesFP.length) ? majorSection(`8. Appendix: Likely false positives (CPE-filtered) (${prodMatchesFP.length + devMatchesFP.length})`, fpContent, { open: false, id: "ch8" }) : ""}
+		${majorSection(`7. Licenses (${licenseTotal}${licenseFlagged ? `, ${licenseFlagged} to review` : ""})`, licenseContent, { open: licenseFlagged > 0, id: "ch7" })}
+		${majorSection(`8. Fix Recommendations`, renderFixRecommendations(recos, prodMatchesActive, outdatedResults), { open: false, id: "ch8" })}
+		${(prodMatchesFP.length + devMatchesFP.length + embMatchesFP.length) ? majorSection(`9. Appendix: Likely false positives (CPE-filtered) (${prodMatchesFP.length + devMatchesFP.length + embMatchesFP.length})`, fpContent, { open: false, id: "ch9" }) : ""}
 	`;
 	return wrapTables ? wrapTablesWithCopyButtons(body) : body;
 }
@@ -1396,20 +1491,41 @@ function pickTopCriticalMatches(prodMatches, retireMatches, n) {
 	return out;
 }
 
-function renderToc({ hasWarnings, prodTotal, retireTotal, devTotal, eolTotal, obsoleteTotal, outdatedTotal, fpTotal }) {
+function renderToc({ hasWarnings, prodTotal, embeddedTotal, retireTotal, devTotal, eolTotal, obsoleteTotal, outdatedTotal, licenseTotal, licenseFlagged, fpTotal }) {
 	const entries = [];
 	if (hasWarnings)                  entries.push({ id: "ch0", label: "0. Warnings" });
 	entries.push({ id: "ch1", label: `1. Prod CVE (${prodTotal})` });
+	if (embeddedTotal)                entries.push({ id: "ch1e", label: `1B. Embedded (${embeddedTotal})` });
 	entries.push({ id: "ch2", label: `2. Vendored JS (${retireTotal})` });
 	entries.push({ id: "ch3", label: `3. Dev CVE (${devTotal})` });
 	entries.push({ id: "ch4", label: `4. EOL (${eolTotal})` });
 	entries.push({ id: "ch5", label: `5. Obsolete (${obsoleteTotal})` });
 	entries.push({ id: "ch6", label: `6. Outdated (${outdatedTotal})` });
-	entries.push({ id: "ch7", label: `7. Fix Recos` });
-	if (fpTotal)                      entries.push({ id: "ch8", label: `8. Likely FP (${fpTotal})` });
+	entries.push({ id: "ch7", label: `7. Licenses (${licenseTotal || 0}${licenseFlagged ? `, ${licenseFlagged}⚠` : ""})` });
+	entries.push({ id: "ch8", label: `8. Fix Recos` });
+	if (fpTotal)                      entries.push({ id: "ch9", label: `9. Likely FP (${fpTotal})` });
 	return `<nav class="toc">${entries.map(e => `<a href="#${e.id}">${esc(e.label)}</a>`).join("")}</nav>`;
 }
 
+// Embedded-binary CVE chapter: group findings by their top-level archive (the
+// part of the manifestPath before the first "!/"), so a fat-jar lists all the
+// vulnerable libraries shaded inside it.
+function renderEmbeddedChapter(matches, srcRoot) {
+	if (!matches.length) return `<div class="empty">No CVEs found in embedded binaries.</div>`;
+	const intro = `<div class="fp-intro">Maven coordinates discovered inside committed <code>.jar</code>/<code>.war</code>/<code>.ear</code> binaries (vendored libs, fat-jars) — not declared in any <code>pom.xml</code>. Patch by rebuilding/replacing the containing archive.</div>`;
+	const byArchive = new Map();
+	for (const m of matches) {
+		const mp = (m.dep?.manifestPaths || [])[0] || "(unknown archive)";
+		const top = String(mp).split("!/")[0];
+		if (!byArchive.has(top)) byArchive.set(top, []);
+		byArchive.get(top).push(m);
+	}
+	const blocks = [...byArchive.entries()].sort((a, b) => a[0].localeCompare(b[0])).map(([archive, list]) =>
+		minorSection(`📦 <code class="path">${esc(archive)}</code> (${list.length})`, renderCveTable(list), { open: list.length <= 30 })
+	).join("\n");
+	return intro + blocks;
+}
+
 function renderFalsePositives(matches) {
 	if (!matches.length) return `<div class="empty">No CPE-filtered findings.</div>`;
 	const intro = `<div class="fp-intro">These entries were initially matched by name but NVD's CPE configurations show your dep version is outside every vulnerable range. They are almost certainly false positives — kept here for audit transparency.</div>`;
@@ -1721,10 +1837,10 @@ const WORD_SECTION_PR = `<!--[if gte mso 9]>
 // so Word can lay out the columns deterministically instead of inflating wide
 // columns based on natural content width.
 const TABLE_COLGROUPS = {
-	// 8-col CVE table (header starts with <th>Severity</th><th>CVE ID</th>…)
-	cve: { match: /<thead><tr><th>Severity<\/th><th>CVE ID<\/th><th>Dependency<\/th><th>CWE<\/th><th>Published<\/th><th>Description<\/th><th>Fix Version<\/th><th>Source<\/th>(<th>Recommended action<\/th>)?<\/tr><\/thead>/,
-	  widths8: [7, 10, 15, 10, 7, 26, 11, 14],
-	  widths9: [6, 9, 13, 9, 6, 22, 10, 13, 12] },
+	// 9-col CVE table (header starts with <th>Priority</th><th>Severity</th>…)
+	cve: { match: /<thead><tr><th>Priority<\/th><th>Severity<\/th><th>CVE ID<\/th><th>Dependency<\/th><th>CWE<\/th><th>Published<\/th><th>Description<\/th><th>Fix Version<\/th><th>Source<\/th>(<th>Recommended action<\/th>)?<\/tr><\/thead>/,
+	  widths9: [9, 7, 9, 14, 9, 6, 22, 10, 14],
+	  widths10: [8, 6, 8, 12, 8, 6, 18, 9, 13, 12] },
 	// 5-col EOL table
 	eol: { match: /<thead><tr><th>Product<\/th><th>Dependency<\/th><th>EOL date<\/th><th>Latest<\/th><th>Notes<\/th><\/tr><\/thead>/,
 	  widths: [15, 25, 12, 12, 36] },
@@ -1748,7 +1864,7 @@ function colgroupHtml(widths) {
 function injectColgroups(html) {
 	// CVE 8-col / 9-col (action variant)
 	html = html.replace(new RegExp(`(<table[^>]*>)\\s*(${TABLE_COLGROUPS.cve.match.source})`, "g"), (m, tableTag, thead) => {
-		const widths = thead.includes("Recommended action") ? TABLE_COLGROUPS.cve.widths9 : TABLE_COLGROUPS.cve.widths8;
+		const widths = thead.includes("Recommended action") ? TABLE_COLGROUPS.cve.widths10 : TABLE_COLGROUPS.cve.widths9;
 		return `${tableTag}${colgroupHtml(widths)}${thead}`;
 	});
 	for (const key of ["eol", "obsolete", "outdated", "retire"]) {
@@ -1790,14 +1906,27 @@ ${WORD_SECTION_PR}
 </html>`;
 }
 
-async function writeReports({ cveMatches, devCveMatches, retireMatches, eolResults, obsoleteResults, outdatedResults, resolvedDeps, projectInfo, outputDir, warnings }) {
-	await fs.promises.mkdir(outputDir, { recursive: true });
-	const payload = { cveMatches, devCveMatches, retireMatches, eolResults, obsoleteResults, outdatedResults, resolvedDeps, projectInfo, warnings };
-	const htmlPath = path.join(outputDir, "cve-report.html");
-	const docPath = path.join(outputDir, "cve-report.doc");
-	await fs.promises.writeFile(htmlPath, generateHtmlReport(payload));
-	await fs.promises.writeFile(docPath, generateWordReport(payload));
-	return { htmlPath, docPath };
+// Render the HTML and/or Word report. Callers pass explicit target paths;
+// a null/omitted path skips that format (so `--report-html` alone writes only HTML).
+// Back-compat: `outputDir` still writes both under the default file names.
+async function writeReports({ cveMatches, devCveMatches, embeddedMatches, retireMatches, eolResults, obsoleteResults, outdatedResults, licenseResults, resolvedDeps, projectInfo, outputDir, htmlPath, docPath, warnings }) {
+	if (outputDir) {
+		if (htmlPath === undefined) htmlPath = path.join(outputDir, "cve-report.html");
+		if (docPath === undefined) docPath = path.join(outputDir, "cve-report.doc");
+	}
+	const payload = { cveMatches, devCveMatches, embeddedMatches, retireMatches, eolResults, obsoleteResults, outdatedResults, licenseResults, resolvedDeps, projectInfo, warnings };
+	const written = { htmlPath: null, docPath: null };
+	if (htmlPath) {
+		await fs.promises.mkdir(path.dirname(path.resolve(htmlPath)), { recursive: true });
+		await fs.promises.writeFile(htmlPath, generateHtmlReport(payload));
+		written.htmlPath = htmlPath;
+	}
+	if (docPath) {
+		await fs.promises.mkdir(path.dirname(path.resolve(docPath)), { recursive: true });
+		await fs.promises.writeFile(docPath, generateWordReport(payload));
+		written.docPath = docPath;
+	}
+	return written;
 }
 
 module.exports = {

package/lib/dep-record.js

@@ -5,6 +5,9 @@
  * écosystèmes grâce au préfixe `ecosystem:`. `groupId`/`artifactId`/`pomPaths`
  * sont conservés comme alias rétro-compat le temps de migrer tous les
  * consommateurs vers `namespace`/`name`/`manifestPaths`.
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
  */
 
 // NuGet, Composer et PyPI sont case-insensitive : on normalise la clé en lower
@@ -32,9 +35,18 @@ function coordKeyFor(ecosystem, namespace, name) {
 }
 
 function makeDepRecord(input) {
-	const { ecosystem, namespace = "", name, version = null, manifestPath, scope = "compile", isDev = false, ecosystemType } = input;
+	const { ecosystem, namespace = "", name, version = null, manifestPath, scope = "compile", isDev = false, ecosystemType, provenance = "manifest" } = input;
 	const concrete = version && !/\$\{/.test(version) ? version : null;
 	const manifestPaths = manifestPath ? [manifestPath] : [];
+	// Embedded binaries (a dep discovered INSIDE a .jar/.war/.ear, not declared in a
+	// manifest) must not share the Map key of a declared dep with the same g:a — else
+	// they'd merge and the "embedded binaries" report chapter would lose them. Key
+	// them by their unique physical location instead. provenance stays on the record
+	// so the report/exports can label & group them; "both" is set later if a merge
+	// across provenances ever happens.
+	const coordKey = provenance === "embedded" && manifestPath
+		? `embedded:${manifestPath}`
+		: coordKeyFor(ecosystem, namespace, name);
 	return {
 		ecosystem,
 		ecosystemType: ecosystemType || ecosystem,
@@ -42,7 +54,8 @@ function makeDepRecord(input) {
 		name,
 		version: version || null,
 		versions: concrete ? [concrete] : [],
-		coordKey: coordKeyFor(ecosystem, namespace, name),
+		coordKey,
+		provenance,
 		scope,
 		isDev: !!isDev,
 		manifestPaths,

package/lib/deps-descriptor.js

@@ -13,6 +13,9 @@
  * See docs/superpowers/specs/2026-05-30-anonymized-deps-descriptor-passi-design.md
  *
  * Pure functions: no I/O, no console. The caller does file read/write.
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
  */
 const { makeDepRecord, coordKeyFor } = require("./dep-record");
 

package/lib/epss.js

@@ -0,0 +1,115 @@
+/**
+ * lib/epss.js — enrich matches with EPSS (Exploit Prediction Scoring System).
+ *
+ * EPSS gives the probability (0-1) a CVE will be exploited in the next 30 days,
+ * plus a percentile rank against all scored CVEs. FIRST.org recomputes it daily.
+ *
+ * API: https://api.first.org/data/v1/epss?cve=CVE-a,CVE-b,…  (batch ≤ ~100)
+ * Cache: ~/.fad-checker/epss-cache.json, 24h TTL (aligned with the daily refresh).
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
+ */
+const fs = require("fs");
+const path = require("path");
+const os = require("os");
+
+const CACHE_DIR = path.join(os.homedir(), ".fad-checker");
+const CACHE_PATH = path.join(CACHE_DIR, "epss-cache.json");
+const CACHE_TTL_MS = 24 * 3600 * 1000;
+const EPSS_BASE = "https://api.first.org/data/v1/epss";
+const BATCH = 100;
+
+function loadCache() {
+	try { return JSON.parse(fs.readFileSync(CACHE_PATH, "utf8")); }
+	catch { return { meta: { fetchedAt: 0 }, entries: {} }; }
+}
+
+function saveCache(data) {
+	try {
+		fs.mkdirSync(CACHE_DIR, { recursive: true });
+		fs.writeFileSync(CACHE_PATH, JSON.stringify(data));
+	} catch { /* ignore */ }
+}
+
+/** Pure: FIRST.org JSON → Map<cveId, {score, percentile}>. */
+function parseEpssResponse(json) {
+	const out = new Map();
+	for (const row of json?.data || []) {
+		if (!row?.cve) continue;
+		const score = parseFloat(row.epss);
+		const percentile = parseFloat(row.percentile);
+		out.set(row.cve, {
+			score: Number.isFinite(score) ? score : null,
+			percentile: Number.isFinite(percentile) ? percentile : null,
+		});
+	}
+	return out;
+}
+
+function chunk(arr, n) {
+	const out = [];
+	for (let i = 0; i < arr.length; i += n) out.push(arr.slice(i, i + n));
+	return out;
+}
+
+/**
+ * Enrich matches in place with cve.epssScore / cve.epssPercentile.
+ * opts: { offline, verbose, fetcher, onProgress }
+ */
+async function enrichEpss(matches, opts = {}) {
+	const { offline, verbose, fetcher = globalThis.fetch, onProgress } = opts;
+	const ids = new Set();
+	for (const m of matches || []) if (m.cve?.id?.startsWith("CVE-")) ids.add(m.cve.id);
+	if (!ids.size) return matches;
+
+	const cache = loadCache();
+	const fresh = cache.meta?.fetchedAt && (Date.now() - cache.meta.fetchedAt) < CACHE_TTL_MS;
+	if (!fresh && !offline) cache.entries = {};
+
+	const byId = new Map();
+	const liveIds = [];
+	for (const id of ids) {
+		if (cache.entries[id]) byId.set(id, cache.entries[id]);
+		else if (offline) byId.set(id, null);
+		else liveIds.push(id);
+	}
+
+	let done = 0;
+	const total = liveIds.length;
+	const report = () => { if (onProgress) onProgress(done, total); };
+	for (const group of chunk(liveIds, BATCH)) {
+		try {
+			const url = `${EPSS_BASE}?cve=${encodeURIComponent(group.join(","))}`;
+			const r = await fetcher(url, { headers: { "User-Agent": "fad-checker-epss" } });
+			if (r.ok) {
+				const parsed = parseEpssResponse(await r.json());
+				for (const id of group) {
+					// Not every CVE has an EPSS score; cache the null so we don't refetch.
+					const v = parsed.get(id) || { score: null, percentile: null };
+					cache.entries[id] = v;
+					byId.set(id, v);
+				}
+			} else if (verbose) {
+				console.warn(`   EPSS HTTP ${r.status}`);
+			}
+		} catch (err) {
+			if (verbose) console.warn(`   EPSS fetch failed: ${err.message}`);
+		}
+		done += group.length;
+		report();
+	}
+
+	cache.meta = { fetchedAt: fresh ? cache.meta.fetchedAt : Date.now() };
+	if (!offline) saveCache(cache);
+
+	for (const m of matches || []) {
+		const v = byId.get(m.cve?.id);
+		if (!v) continue;
+		if (v.score != null) m.cve.epssScore = v.score;
+		if (v.percentile != null) m.cve.epssPercentile = v.percentile;
+	}
+	return matches;
+}
+
+module.exports = { enrichEpss, parseEpssResponse, CACHE_PATH };

package/lib/gate.js

@@ -0,0 +1,45 @@
+/**
+ * lib/gate.js — CI gating: decide whether a finding set should fail the build.
+ *
+ * Levels: none | low | medium | high | critical | kev. A severity level fails
+ * when any (non-suppressed) match is at or above it; `kev` fails only on a CISA
+ * known-exploited finding — the modern "patch what's actually attacked" gate.
+ * Pure — the caller sets process.exitCode.
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
+ */
+
+const SEV_RANK = { none: 0, low: 1, medium: 2, high: 3, critical: 4 };
+
+/**
+ * evaluateGate(matches, level) → { failed, reason, count, level }.
+ * `matches` should already exclude cpe-filtered/dev — typically the prodActive set.
+ */
+function evaluateGate(matches, level) {
+	const lvl = String(level || "none").toLowerCase();
+	const active = (matches || []).filter(m => !m.suppressed);
+	if (lvl === "none") return { failed: false, reason: "gating disabled", count: 0, level: lvl };
+
+	if (lvl === "kev") {
+		const hits = active.filter(m => m.cve?.kev);
+		return {
+			failed: hits.length > 0,
+			count: hits.length,
+			level: lvl,
+			reason: hits.length ? `${hits.length} known-exploited (CISA KEV) finding(s)` : "no known-exploited finding",
+		};
+	}
+
+	const threshold = SEV_RANK[lvl];
+	if (threshold == null) return { failed: false, reason: `unknown level "${lvl}"`, count: 0, level: lvl };
+	const hits = active.filter(m => (SEV_RANK[(m.cve?.severity || "none").toLowerCase()] ?? 0) >= threshold);
+	return {
+		failed: hits.length > 0,
+		count: hits.length,
+		level: lvl,
+		reason: hits.length ? `${hits.length} finding(s) at or above ${lvl}` : `no finding at or above ${lvl}`,
+	};
+}
+
+module.exports = { evaluateGate, SEV_RANK };