fad-checker 2.1.1 → 2.2.0

package/fad-checker.js

@@ -20,7 +20,10 @@ const ui = require("./lib/ui");
 
 const core = require("./lib/core");
 
-const pkg = JSON.parse(fs.readFileSync(path.join(__dirname, "package.json"), "utf8"));
+// require() (not fs.readFileSync) so bun --compile statically bundles package.json
+// into the binary — otherwise the compiled exe tries to read it off disk at runtime
+// (from $bunfs/root) and crashes with ENOENT. Keeps the bun builds fully standalone.
+const pkg = require("./package.json");
 
 // -------- bash/zsh completion shortcut (must run before required-options parse) --------
 if (process.argv.includes("--completion")) {
@@ -58,8 +61,9 @@ if (process.argv.includes("--show-config")) {
 	const cfg = config.load();
 	const masked = { ...cfg };
 	if (masked.nvd_api_key) masked.nvd_api_key = masked.nvd_api_key.slice(0, 8) + "…" + masked.nvd_api_key.slice(-4);
-	if (Array.isArray(masked.maven_repos)) {
-		masked.maven_repos = masked.maven_repos.map(r => ({ ...r, auth: r.auth ? "***" : undefined }));
+	if (masked.registries && typeof masked.registries === "object") {
+		masked.registries = Object.fromEntries(Object.entries(masked.registries).map(([eco, list]) =>
+			[eco, (list || []).map(r => ({ ...r, auth: r.auth ? "***" : undefined, token: r.token ? "***" : undefined }))]));
 	}
 	console.log(JSON.stringify(masked, null, 2));
 	console.log(chalk.gray("Config file: " + config.CONFIG_PATH));
@@ -69,44 +73,58 @@ if (process.argv.includes("--show-config")) {
 // -------- --add-repo / --remove-repo / --list-repos (run before program.parse) --------
 if (process.argv.includes("--add-repo") || process.argv.includes("--remove-repo") || process.argv.includes("--list-repos")) {
 	const config = require("./lib/config");
+	const { SUPPORTED } = require("./lib/registries");
+	const ecoErr = eco => {
+		if (!SUPPORTED.includes(eco)) {
+			console.error(chalk.red(`❌  unknown ecosystem "${eco}". Supported: ${SUPPORTED.join(", ")}`));
+			process.exit(1);
+		}
+	};
 	if (process.argv.includes("--list-repos")) {
-		const repos = config.getMavenRepos();
-		if (!repos.length) {
-			console.log(chalk.gray("No custom Maven repos configured (Maven Central is always used as fallback)."));
+		const map = config.getRegistryMap();
+		const ecos = Object.keys(map).filter(e => (map[e] || []).length);
+		if (!ecos.length) {
+			console.log(chalk.gray("No custom registries configured (public registries are always the fallback)."));
 		} else {
-			console.log(chalk.bold("Configured Maven repos (tried in order, then Central):"));
-			for (const r of repos) {
-				const authMark = r.auth ? chalk.yellow(" [auth]") : "";
-				console.log(`  • ${chalk.cyan(r.name)} → ${r.url}${authMark}`);
+			for (const eco of ecos) {
+				console.log(chalk.bold(`${eco} (tried in order, then public):`));
+				for (const r of map[eco]) {
+					const authMark = (r.auth || r.token) ? chalk.yellow(" [auth]") : "";
+					console.log(`  • ${chalk.cyan(r.name)} → ${r.url}${authMark}`);
+				}
 			}
 		}
 		process.exit(0);
 	}
 	if (process.argv.includes("--add-repo")) {
 		const idx = process.argv.indexOf("--add-repo");
-		const name = process.argv[idx + 1];
-		const url = process.argv[idx + 2];
-		if (!name || name.startsWith("-") || !url || url.startsWith("-")) {
-			console.error(chalk.red("❌  --add-repo requires <name> <url>"));
-			console.error("   Example: fad-checker --add-repo nexus https://nexus.acme.com/repository/maven-public/");
-			console.error("   Optional auth: --add-repo nexus https://nexus.acme.com/repository/maven-public/ --auth user:pass");
+		const [eco, name, url] = [process.argv[idx + 1], process.argv[idx + 2], process.argv[idx + 3]];
+		if (!eco || !name || !url || [eco, name, url].some(a => a.startsWith("-"))) {
+			console.error(chalk.red("❌  --add-repo requires <ecosystem> <name> <url>"));
+			console.error("   Example: fad-checker --add-repo npm verdaccio https://npm.acme/ --token TOK");
+			console.error("   Maven:   fad-checker --add-repo maven nexus https://nexus.acme/maven-public/ --auth user:pass");
 			process.exit(1);
 		}
+		ecoErr(eco);
 		const authIdx = process.argv.indexOf("--auth");
-		const auth = authIdx > -1 ? process.argv[authIdx + 1] : null;
-		config.addMavenRepo(name, url, auth);
-		console.log(chalk.green(`✅ Added Maven repo "${name}" → ${url}${auth ? " (with auth)" : ""}`));
+		const tokIdx = process.argv.indexOf("--token");
+		config.addRegistry(eco, name, url, {
+			auth: authIdx > -1 ? process.argv[authIdx + 1] : null,
+			token: tokIdx > -1 ? process.argv[tokIdx + 1] : null,
+		});
+		console.log(chalk.green(`✅ Added ${eco} registry "${name}" → ${url}`));
 		process.exit(0);
 	}
 	if (process.argv.includes("--remove-repo")) {
 		const idx = process.argv.indexOf("--remove-repo");
-		const name = process.argv[idx + 1];
-		if (!name || name.startsWith("-")) {
-			console.error(chalk.red("❌  --remove-repo requires <name>"));
+		const [eco, name] = [process.argv[idx + 1], process.argv[idx + 2]];
+		if (!eco || !name || [eco, name].some(a => a.startsWith("-"))) {
+			console.error(chalk.red("❌  --remove-repo requires <ecosystem> <name>"));
 			process.exit(1);
 		}
-		const removed = config.removeMavenRepo(name);
-		console.log(removed ? chalk.green(`✅ Removed Maven repo "${name}"`) : chalk.yellow(`⚠️  No Maven repo named "${name}"`));
+		ecoErr(eco);
+		const removed = config.removeRegistry(eco, name);
+		console.log(removed ? chalk.green(`✅ Removed ${eco} registry "${name}"`) : chalk.yellow(`⚠️  No ${eco} registry named "${name}"`));
 		process.exit(removed ? 0 : 1);
 	}
 }
@@ -166,7 +184,11 @@ program
 	.option("-t, --target <target>", "output directory (will be rm before written). If omitted, the run is read-only.")
 	// Not a requiredOption: --import-anonymized scans a descriptor with no source tree.
 	.option("-s, --src <src>", "root directory containing pom.xml files")
-	.option("-e, --exclude <exclude>", "regex of groupId to exclude, e.g. '^(client|private)\\.'")
+	.option("--source <src>", "alias of --src (also the JSON config key 'source')")
+	.option("--config <file>", "load default options from a JSON config file (else ./.fad-env.json)")
+	.option("-e, --exclude <exclude>", "regex of groupId/name to exclude, e.g. '^(client|private)\\.'")
+	.option("--exclude-path <glob...>", "ignore sub-paths during the walk (gitignore-style glob, relative to --src). Repeatable. e.g. 'packages/legacy/**' '**/fixtures/**'")
+	.option("--no-default-excludes", "don't prune the built-in ignored dirs (node_modules, vendor, target, .git, …) — walk everything")
 	.option("-v, --verbose", "verbose")
 	// Defaults: report + transitive + allLibs all ON. Use --no-* to disable.
 	.option("--no-report", "write NO output files at all — the scan, terminal summary and --fail-on gate still run (gate-only / CI mode)")
@@ -204,6 +226,7 @@ program
 	.option("--cve-offline", "use cached CVE index only (no download)")
 	.option("--snyk", "run snyk on cleaned POMs and merge into report (requires --target)")
 	.option("--no-retire", "skip retire.js vendored-JS scan")
+	.option("--no-vendored-js-inventory", "don't list ALL identified vendored JS libs (chapter 1D) — keep only the vulnerable ones (chapter 2)")
 	.option("--retire-refresh", "ignore retire cache and re-scan")
 	.option("--transitive-depth <n>", "max transitive depth", "6")
 	.option("--ecosystem <list>", "codecs to run: auto|all|<comma list> e.g. maven,npm,nuget,composer,pypi,go,ruby (default: auto = detected)", "auto")
@@ -215,16 +238,35 @@ program
 	.option("--no-pypi", "skip the PyPI (Python) codec")
 	.option("--no-go", "skip the Go codec")
 	.option("--no-ruby", "skip the Ruby (Bundler) codec")
+	.option("--no-binaries", "skip scanning committed native binaries (.dll/.exe/.so/.dylib)")
 	.option("--no-jars", "skip scanning embedded .jar/.war/.ear binaries for Maven coordinates")
 	.option("--no-js", "alias: skip JS/npm/yarn manifests even if present (Maven-only)")
-	.option("--repo <url...>", "extra Maven repository URL(s) to try before Maven Central. Supports https://user:pass@host/path/. Repeatable.")
-	.option("--add-repo <name>", "persist a Maven repo: --add-repo <name> <url> [--auth user:pass]")
-	.option("--remove-repo <name>", "remove a persisted Maven repo by name")
-	.option("--list-repos", "list configured Maven repos and exit")
+	.option("--repo <eco=url...>", "extra registry as <ecosystem>=<url> (e.g. npm=https://npm.acme/) tried before the public one. Repeatable. Supports https://user:pass@host/.")
+	.option("--add-repo <eco>", "persist a registry: --add-repo <ecosystem> <name> <url> [--auth user:pass] [--token TOK]")
+	.option("--remove-repo <eco>", "remove a persisted registry: --remove-repo <ecosystem> <name>")
+	.option("--list-repos", "list configured registries (grouped by ecosystem) and exit")
+	.option("--auth <user:pass>", "Basic auth for --add-repo")
+	.option("--token <token>", "Bearer token for --add-repo")
 	.option("--completion <shell>", "print shell completion script (bash|zsh)");
 program.parse(process.argv);
 
 const options = program.opts();
+// Layered config: CLI flags > config file (--config / ./.fad-env.json, JSON) >
+// FAD_CHECKER_ENV (a CLI-flag string) > global ~/.fad-checker/config.json >
+// commander defaults. A file/env value fills an option only if the CLI didn't
+// set it. `registries` are unioned separately (below). Source has src/source aliases.
+const { loadLayers, applyLayers } = require("./lib/options-env");
+let _layers = { fileLayer: {}, envLayer: {}, envRepos: [] };
+try {
+	_layers = loadLayers({ cwd: process.cwd(), configPath: options.config, envStr: process.env.FAD_CHECKER_ENV, program });
+} catch (err) {
+	console.error(chalk.red(`❌  ${err.message}`));
+	process.exit(1);
+}
+Object.assign(options, applyLayers(program, _layers, require("./lib/config").load()));
+// --source CLI alias → src (applyLayers already maps the file/env JSON 'source' key).
+if (!options.src && options.source) options.src = options.source;
+
 const deps2Exclude = options.exclude ? new RegExp(options.exclude) : null;
 const verbose = !!options.verbose;
 
@@ -269,20 +311,87 @@ if (options.src && options.target) {
 	}
 }
 
-async function checkMavenLibExist(groupId, artifactId, repos) {
+// Maven Central presence cache (~/.fad-checker/maven-exists-cache.json) — keyed by
+// "g:a", value true (on a repo) / false (absent → likely private). Persisted so an
+// online warm-up populates it, --export-cache ships it, and an --offline air-gapped
+// run reads it instead of probing the network. Returns:
+//   true  → present on a configured repo
+//   false → absent (likely private)
+//   null  → unknown (offline + not cached, or probe error) — caller must NOT guess
+const MAVEN_EXISTS_CACHE_PATH = require("path").join(require("./lib/outdated").CACHE_DIR, "maven-exists-cache.json");
+const MAVEN_EXISTS_MAX_AGE_MS = 7 * 24 * 3600 * 1000; // 7 days
+
+async function checkMavenLibExist(groupId, artifactId, repos, cache, opts = {}) {
 	const g = core.coord(groupId);
 	const a = core.coord(artifactId);
-	if (!g || !a) return false;
+	if (!g || !a) return null;
+	const key = `${g}:${a}`;
+	if (cache && Object.prototype.hasOwnProperty.call(cache.entries, key)) return cache.entries[key];
+	if (opts.offline) return null;  // air-gapped + not warmed: honestly unknown, never network
 	const p = `${g.replace(/\./g, "/")}/${a}/maven-metadata.xml`;
 	const { existsInAny } = require("./lib/maven-repo");
 	try {
 		const hit = await existsInAny(repos, p, { userAgent: "fad-checker-existence" });
-		if (hit) return true;
-		if (verbose) console.log(chalk.dim(`   not on any repo: ${g}:${a}`));
-		return false;
+		if (cache) cache.entries[key] = !!hit;
+		if (!hit && verbose) console.log(chalk.dim(`   not on any repo: ${g}:${a}`));
+		return !!hit;
 	} catch (err) {
 		if (verbose) console.info(chalk.dim(`   error querying repos: ${g}:${a} — ${err.message}`));
-		return false;
+		return null;  // probe failed → unknown, don't poison the cache or mislabel as private
+	}
+}
+
+/**
+ * Build an onProgress callback for the embedded-JAR scan so the user sees what's
+ * happening — the scan reads + unzips archives synchronously and can block for a
+ * while on big or numerous fat-jars (incl. the silent recursion through a fat-jar's
+ * bundled libs). The scanner reports EVERY archive (top-level + nested):
+ *   - On a TTY: one transient line, rewritten in place, naming the archive being
+ *     read right now (so a long pause clearly points at the culprit). Cleared at end.
+ *   - Off a TTY (CI/pipe): a throttled line every ~250 archives so logs show forward
+ *     motion without being spammed, plus a start and a final summary line.
+ * Returns a fresh closure per codec.
+ */
+function makeJarProgress() {
+	let total = 0, lastLogged = 0;
+	const STEP = 250;
+	return (ev) => {
+		if (!ev) return;
+		if (ev.phase === "start") {
+			total = ev.total || 0;
+			if (total && !ui.isTTY) ui.info(chalk.dim(`scanning ${total} embedded archive(s) (.jar/.war/.ear)…`));
+		} else if (ev.phase === "scan" && total) {
+			if (ui.isTTY) {
+				const head = total ? `${ev.scanned}/${total}+` : String(ev.scanned);
+				process.stdout.write(`\r  ${chalk.dim("·")} ${chalk.dim(`reading embedded JARs (${head})`)} ${chalk.dim(ev.path)}\x1b[K`);
+			} else if (ev.scanned - lastLogged >= STEP) {
+				lastLogged = ev.scanned;
+				ui.info(chalk.dim(`… ${ev.scanned} archive(s) read (current: ${ev.path})`));
+			}
+		} else if (ev.phase === "done") {
+			if (total && ui.isTTY) process.stdout.write("\r\x1b[K");
+			else if (total && !ui.isTTY) ui.info(chalk.dim(`scanned ${ev.scanned} archive(s) → ${ev.found} embedded coord(s)`));
+		}
+	};
+}
+
+/**
+ * Run `fn` (sync or async) while telling the user which phase is in flight, so a
+ * long pause is attributable instead of a silent hang. TTY: a transient line that's
+ * cleared when done. Non-TTY: a plain "· <label> …" line. Either way, a phase that
+ * takes >3s prints "· <label> took Ns" so slow steps self-report even without -v.
+ */
+async function timedPhase(label, fn) {
+	if (ui.isTTY) process.stdout.write(`  ${chalk.dim("·")} ${chalk.dim(label + " …")}\x1b[K`);
+	else ui.info(chalk.dim(label + " …"));
+	const t0 = Date.now();
+	try {
+		return await fn();
+	} finally {
+		const ms = Date.now() - t0;
+		if (ui.isTTY) process.stdout.write("\r\x1b[K");
+		if (ms > 3000) ui.info(chalk.dim(`${label} took ${(ms / 1000).toFixed(1)}s`));
+		else if (verbose) ui.info(chalk.dim(`${label} done in ${ms}ms`));
 	}
 }
 
@@ -292,13 +401,44 @@ async function checkMavenLibExist(groupId, artifactId, repos) {
 	// Build the Maven repo list once: persisted repos (from ~/.fad-checker/config.json)
 	// + ad-hoc --repo URLs + Maven Central as final fallback. Used by transitive
 	// resolution, outdated-version check, and existence check.
-	const { getMavenRepos } = require("./lib/config");
+	const { getRegistryMap } = require("./lib/config");
 	const { buildRepoList } = require("./lib/maven-repo");
-	const extraRepos = (options.repo || []).map(url => ({ url }));
-	const mavenRepos = buildRepoList(getMavenRepos(), extraRepos);
+	const { buildRegistryList } = require("./lib/registries");
+	// One-off --repo eco=url (from the CLI and the env layer), grouped by ecosystem.
+	const cliRepoMap = {};
+	for (const spec of [...(options.repo || []), ...(_layers.envRepos || [])]) {
+		const m = /^([a-z]+)=(.+)$/i.exec(String(spec));
+		if (!m) { console.error(chalk.red(`❌  --repo expects <ecosystem>=<url>, got "${spec}"`)); process.exit(1); }
+		(cliRepoMap[m[1]] ||= []).push({ url: m[2] });
+	}
+	// Union the registry sources: global config + config-file JSON + CLI/env one-offs.
+	const fileRegMap = (_layers.fileLayer && _layers.fileLayer.registries) || {};
+	const globalRegMap = getRegistryMap();
+	const regMap = {};
+	for (const eco of new Set([...Object.keys(globalRegMap), ...Object.keys(fileRegMap), ...Object.keys(cliRepoMap)])) {
+		regMap[eco] = buildRegistryList(eco, [globalRegMap[eco], fileRegMap[eco], cliRepoMap[eco]]);
+	}
+	const registriesFor = eco => regMap[eco] || [];
+	const mavenRepos = buildRepoList(regMap.maven || [], []); // appends Maven Central last
+
+	// Walk-pruning: union --exclude-path globs across every config layer (CLI + file
+	// + env + global), like registries. `defaultExcludes` (a scalar, false via
+	// --no-default-excludes) already flowed through applyLayers.
+	const excludePath = [...new Set([
+		...(options.excludePath || []),
+		...((_layers.fileLayer && _layers.fileLayer.excludePath) || []),
+		...((_layers.envLayer && _layers.envLayer.excludePath) || []),
+		...(require("./lib/config").get("excludePath") || []),
+	].filter(Boolean))];
+	const defaultExcludes = options.defaultExcludes !== false;
+	const walkOpts = { excludePath, defaultExcludes };
 	const runMode = options.importAnonymized ? "import descriptor" : (options.offline ? "offline" : "online");
 	if (options.src) ui.kv("source", chalk.white(options.src));
 	if (mavenRepos.length > 1) ui.kv("repos", chalk.white(mavenRepos.map(r => r.name).join(chalk.dim(" → "))));
+	const otherRegs = Object.keys(regMap).filter(e => e !== "maven" && regMap[e].length);
+	if (otherRegs.length) ui.kv("registries", chalk.white(otherRegs.map(e => `${e}:${regMap[e].length}`).join(" ")));
+	if (excludePath.length) ui.kv("exclude-path", chalk.white(excludePath.join(chalk.dim(", "))));
+	if (!defaultExcludes) ui.kv("default-excludes", chalk.yellow("off (walking node_modules/vendor/.git/…)"));
 	ui.kv("mode", chalk.white(runMode));
 
 	let wrotePom = 0;
@@ -324,7 +464,7 @@ async function checkMavenLibExist(groupId, artifactId, repos) {
 			const { warmRetireSignatures } = require("./lib/retire");
 			await warmRetireSignatures({ verbose });
 		}
-		await runReportFlow(resolved, { activeIds, runMaven, runNpm, privateLibIds: [], mavenRepos, collectWarnings: [] });
+		await runReportFlow(resolved, { activeIds, runMaven, runNpm, privateLibIds: [], mavenRepos, regMap, collectWarnings: [] });
 		return;
 	}
 
@@ -332,13 +472,24 @@ async function checkMavenLibExist(groupId, artifactId, repos) {
 	const { detectCodecs, allCodecs, getCodec } = require("./lib/codecs");
 	const { resolveActiveCodecs } = require("./lib/codecs/select");
 	const eco = (options.ecosystem || "auto").toLowerCase();
-	const detected = (eco === "auto") ? detectCodecs(options.src).map(c => c.id) : allCodecs().map(c => c.id);
+	const detected = (eco === "auto")
+		? (await timedPhase("detecting ecosystems", () => detectCodecs(options.src, walkOpts))).map(c => c.id)
+		: allCodecs().map(c => c.id);
+	// The binary scanner is a cross-cutting catch-all (committed native libs in ANY
+	// project), and detectCodecs' manifest-glob matcher misses versioned sonames
+	// (libz.so.1). Always make it a candidate in auto mode; --no-binaries removes it.
+	if (eco === "auto" && !detected.includes("binary")) detected.push("binary");
 	const noCodecs = ["maven", "npm", "yarn", "nuget", "composer", "pypi", "go", "ruby"].filter(id => options[id] === false);
+	// `--no-binaries` maps to options.binaries (plural) but the codec id is `binary`.
+	if (options.binaries === false) noCodecs.push("binary");
 	const activeIds = resolveActiveCodecs(eco, detected, { noCodecs, noJs: !options.js });
 	const runMaven = activeIds.includes("maven");
 	const runNpm = activeIds.includes("npm") || activeIds.includes("yarn");
 
 	// --- Collect deps from every active codec into one Map (coordKeys never collide) ---
+	// Section header first so the embedded-JAR scan can print live progress under it
+	// (the scan reads + unzips archives synchronously and would otherwise block silently).
+	ui.section("Collection");
 	const resolved = new Map();
 	let mavenCtx = null;
 	const collectWarnings = [];
@@ -347,7 +498,7 @@ async function checkMavenLibExist(groupId, artifactId, repos) {
 		const codec = getCodec(id);
 		let res;
 		try {
-			res = await codec.collect(options.src, { ignoreTest: !!options.ignoreTest, deps2Exclude, verbose, scanJars: options.jars !== false, srcRoot: options.src });
+			res = await timedPhase(`collecting ${codec.label || id}`, () => codec.collect(options.src, { ignoreTest: !!options.ignoreTest, deps2Exclude, verbose, scanJars: options.jars !== false, srcRoot: options.src, excludePath, defaultExcludes, onJarProgress: makeJarProgress(), onBinaryProgress: null }));
 		} catch (err) {
 			console.warn(chalk.red(`❌  ${id} collect failed:`), chalk.dim(err.message));
 			continue;
@@ -358,11 +509,12 @@ async function checkMavenLibExist(groupId, artifactId, repos) {
 	}
 
 	// --- Collection summary ---
-	ui.section("Collection");
 	const ecoCount = {};
 	let embeddedCount = 0;
+	let binaryCount = 0;
 	for (const d of resolved.values()) {
 		if (d.provenance === "embedded") { embeddedCount++; continue; } // counted separately below
+		if (d.provenance === "binary") { binaryCount++; continue; }     // committed native libs, no manifest
 		ecoCount[d.ecosystem] = (ecoCount[d.ecosystem] || 0) + 1;
 	}
 	if (runMaven) ui.ok(`${chalk.bold("Maven".padEnd(8))} ${mavenCtx ? mavenCtx.pomFiles.length + " module(s) · " : ""}${ecoCount.maven || 0} direct dep(s)`);
@@ -372,6 +524,7 @@ async function checkMavenLibExist(groupId, artifactId, repos) {
 		ui.ok(`${chalk.bold(((getCodec(id)?.label) || id).padEnd(8))} ${n} dep(s)`);
 	}
 	if (embeddedCount) ui.ok(`${chalk.bold("Embedded".padEnd(8))} ${embeddedCount} coord(s) in .jar/.war/.ear`);
+	if (binaryCount) ui.ok(`${chalk.bold("Binary".padEnd(8))} ${binaryCount} native lib(s) (.dll/.exe/.so/.dylib)`);
 	if (!ecoCount.maven && !ecoCount.npm && !Object.keys(ecoCount).length) ui.warn("no dependencies found in the source tree");
 	if (collectWarnings.length) {
 		ui.warn(`${collectWarnings.length} manifest warning(s) — best-effort / no lockfile:`);
@@ -432,7 +585,18 @@ async function checkMavenLibExist(groupId, artifactId, repos) {
 			ui.ok("no missing Maven parent POMs");
 		}
 
+		// Private-lib detection asks each configured repo whether a missing coord
+		// exists (→ absent = likely private). Results are cached + bundled, so an
+		// --offline run reads the online-warmed cache instead of probing the network.
+		// A coord that's neither cached nor probeable (offline + cold) stays UNKNOWN —
+		// we never fake it as "private", which is what made offline both wrong and slow.
 		if (options.allLibs) {
+			const { loadJsonCache, saveJsonCache } = require("./lib/outdated");
+			const existsCache = loadJsonCache(MAVEN_EXISTS_CACHE_PATH);
+			const fresh = existsCache.meta?.fetchedAt && (Date.now() - existsCache.meta.fetchedAt) < MAVEN_EXISTS_MAX_AGE_MS;
+			if (!fresh && !options.offline) existsCache.entries = {};   // refresh stale probes when online
+			if (!existsCache.entries) existsCache.entries = {};
+
 			const anyMissingLibs = Object.keys(allPomMetadata.anyMissingById)
 				.filter(id => {
 					const parts = id.split(":");
@@ -442,14 +606,20 @@ async function checkMavenLibExist(groupId, artifactId, repos) {
 			const limit = pLimit(10);
 			const results = await Promise.all(anyMissingLibs.map(id => {
 				const [g, a] = id.split(":");
-				return limit(async () => ({ id, found: await checkMavenLibExist(g, a, mavenRepos) }));
+				return limit(async () => ({ id, found: await checkMavenLibExist(g, a, mavenRepos, existsCache, { offline: options.offline }) }));
 			}));
-			for (const r of results) if (r && r.found === false) privateLibIds.push(r.id);
+			let unknown = 0;
+			for (const r of results) {
+				if (r.found === false) privateLibIds.push(r.id);
+				else if (r.found === null) unknown++;
+			}
+			if (!options.offline) { existsCache.meta = { fetchedAt: Date.now() }; saveJsonCache(MAVEN_EXISTS_CACHE_PATH, existsCache); }
 			if (privateLibIds.length) {
 				ui.warn(`${privateLibIds.length} lib(s) absent from Maven Central (likely private):`);
 				for (const id of privateLibIds.slice(0, 10)) ui.info(chalk.magenta(id));
 				if (privateLibIds.length > 10) ui.info(chalk.dim(`…and ${privateLibIds.length - 10} more`));
 			}
+			if (unknown) ui.info(chalk.dim(`${unknown} lib(s) not in the presence cache — run online once (or --export-cache from an online host) to classify them`));
 		}
 
 		if (deps2Exclude) {
@@ -476,7 +646,7 @@ async function checkMavenLibExist(groupId, artifactId, repos) {
 	// The scan always runs — it feeds the terminal summary, the file outputs and the
 	// CI gate. Which files get written is decided by the --report-* family inside
 	// (HTML + .doc by default; --no-report writes nothing).
-	await runReportFlow(resolved, { activeIds, runMaven, runNpm, privateLibIds, mavenRepos, collectWarnings });
+	await runReportFlow(resolved, { activeIds, runMaven, runNpm, privateLibIds, mavenRepos, regMap, collectWarnings });
 	if (!readOnly) {
 		ui.section("Next step");
 		ui.info(`run Snyk on the cleaned tree:`);
@@ -485,7 +655,8 @@ async function checkMavenLibExist(groupId, artifactId, repos) {
 })();
 
 async function runReportFlow(resolved, ecoFlags = {}) {
-	const { activeIds = [], runMaven = true, runNpm = false, privateLibIds = [], mavenRepos = [], collectWarnings = [] } = ecoFlags;
+	const { activeIds = [], runMaven = true, runNpm = false, privateLibIds = [], mavenRepos = [], regMap = {}, collectWarnings = [] } = ecoFlags;
+	const registriesFor = eco => regMap[eco] || [];
 	const { expandWithTransitives } = require("./lib/cve-match");
 	const { writeReports, computeStats } = require("./lib/cve-report");
 	const { getCodec } = require("./lib/codecs");
@@ -530,9 +701,11 @@ async function runReportFlow(resolved, ecoFlags = {}) {
 	const willKev = !!options.kev;
 	const willLicenses = !!options.licenses;
 	const willRetire = !!options.retire;
+	// Identify committed native binaries by checksum (deps.dev + CIRCL) when present.
+	const willBinaryId = [...resolved.values()].some(d => d.provenance === "binary");
 	// License detection piggybacks on the registry passes (same fetched metadata),
 	// so it adds no progress step of its own.
-	const totalSteps = [willTransitive, willCve, /*EOL*/ true, willOutdated, /*npm reg*/ true, ...otherRegistryIds.map(() => true), willOsv, willNvd, willEpss, willKev, willRetire].filter(Boolean).length;
+	const totalSteps = [willTransitive, willCve, /*EOL*/ true, willOutdated, /*npm reg*/ true, ...otherRegistryIds.map(() => true), willOsv, willNvd, willEpss, willKev, willRetire, willBinaryId].filter(Boolean).length;
 	const progress = new ui.Progress(totalSteps);
 
 	if (willTransitive) {
@@ -562,6 +735,17 @@ async function runReportFlow(resolved, ecoFlags = {}) {
 		}
 	}
 
+	// 1c. Identify committed native binaries by checksum (deps.dev → CIRCL).
+	if (willBinaryId) {
+		const st = progress.start("Binary identification (deps.dev + CIRCL)");
+		try {
+			const { enrichUnmanaged } = require("./lib/unmanaged");
+			const s = await enrichUnmanaged(resolved, { offline, onProgress: (p, t) => st.tick(p, t) });
+			const bits = [`${s.identified}/${s.total} identified`, s.pristine ? `${s.pristine} pristine` : null, s.unknown ? `${s.unknown} unknown` : null, s.malicious ? `${s.malicious} ⚠ malicious` : null].filter(Boolean).join(", ");
+			st.done(bits);
+		} catch (err) { st.fail(err.message); }
+	}
+
 	// 2. EOL frameworks (endoflife.date) — always a step.
 	let eolResults = [];
 	{
@@ -595,7 +779,7 @@ async function runReportFlow(resolved, ecoFlags = {}) {
 		const st = progress.start("npm registry");
 		try {
 			const { checkNpmRegistryDeps } = require("./lib/codecs/npm/registry");
-			const npmReg = await checkNpmRegistryDeps(resolved, { verbose, offline, allLibs: options.allLibs, onProgress: (p, t) => st.tick(p, t) });
+			const npmReg = await checkNpmRegistryDeps(resolved, { verbose, offline, allLibs: options.allLibs, registries: registriesFor("npm"), onProgress: (p, t) => st.tick(p, t) });
 			obsoleteResults = obsoleteResults.concat(npmReg.deprecated);
 			outdatedResults = outdatedResults.concat(npmReg.outdated);
 			licenseFindings = licenseFindings.concat(npmReg.licensed || []);
@@ -608,7 +792,7 @@ async function runReportFlow(resolved, ecoFlags = {}) {
 		const codec = getCodec(id);
 		const st = progress.start(`${codec.label || id} registry`);
 		try {
-			const reg = await codec.checkRegistry(resolved, { verbose, offline, allLibs: options.allLibs, onProgress: (p, t) => st.tick(p, t) });
+			const reg = await codec.checkRegistry(resolved, { verbose, offline, allLibs: options.allLibs, registries: registriesFor(id), onProgress: (p, t) => st.tick(p, t) });
 			obsoleteResults = obsoleteResults.concat(reg.deprecated || []);
 			outdatedResults = outdatedResults.concat(reg.outdated || []);
 			licenseFindings = licenseFindings.concat(reg.licensed || []);
@@ -702,6 +886,7 @@ async function runReportFlow(resolved, ecoFlags = {}) {
 	// vendored .js (which can live in a Maven project's resources too). The
 	// scanner is owned by the npm codec but runs whenever --retire is on.
 	let retireMatches = [];
+	let vendoredJsInventory = [];
 	if (willRetire) {
 		const st = progress.start("retire.js (vendored JS)");
 		const sc = (getCodec("npm").nativeScanners || []).find(s => s.kind === "vendored");
@@ -711,7 +896,9 @@ async function runReportFlow(resolved, ecoFlags = {}) {
 			try {
 				const r = await sc.scan(resolved, { src: options.src, verbose, retireRefresh: !!options.retireRefresh, offline });
 				retireMatches = r.matches || [];
-				st.done(`${retireMatches.length} finding(s)`);
+				if (options.vendoredJsInventory !== false) vendoredJsInventory = r.meta?.inventory || [];
+				const invN = vendoredJsInventory.length;
+				st.done(`${retireMatches.length} finding(s)${invN ? ` · ${invN} lib(s) inventoried` : ""}`);
 			} catch (err) { st.fail(err.message); }
 		}
 	}
@@ -774,6 +961,15 @@ async function runReportFlow(resolved, ecoFlags = {}) {
 	const sev = ui.sevColor;
 	const depLabel = d => d.ecosystem === "npm" ? `npm:${d.artifactId}` : `${d.groupId}:${d.artifactId}`;
 	const coordOf = depLabel;   // npm deps show as "npm:name", others as "g:a"
+	// Where a finding's dependency was declared — the pom.xml / package.json / jar
+	// (embedded jars carry a "app.jar!/BOOT-INF/lib/…" manifestPath). Shown so EOL /
+	// obsolete / outdated entries point at the file the reader has to edit.
+	const definedInOf = d => {
+		const paths = (d?.manifestPaths?.length ? d.manifestPaths : d?.pomPaths?.length ? d.pomPaths : []);
+		if (!paths.length) return "";
+		const rel = paths.map(p => { try { return path.relative(options.src, p); } catch { return p; } });
+		return chalk.dim(`  ← ${rel[0]}${rel.length > 1 ? ` (+${rel.length - 1})` : ""}`);
+	};
 	const fmtStats = s => [
 		s.critical ? sev("CRITICAL")(`${s.critical} critical`) : null,
 		s.high ? sev("HIGH")(`${s.high} high`) : null,
@@ -805,16 +1001,30 @@ async function runReportFlow(resolved, ecoFlags = {}) {
 		if (embeddedActive.length > 8) console.log(chalk.dim(`    …and ${embeddedActive.length - 8} more (see report ch.1B)`));
 	}
 
+	{
+		const { buildInventory } = require("./lib/unmanaged");
+		const inv = buildInventory(resolved);
+		if (inv.length) {
+			heading("Unmanaged binaries", inv.length);
+			for (const e of inv.slice(0, 10)) {
+				const id = e.identity ? `${e.identity.ecosystem ? e.identity.ecosystem + ":" : ""}${e.identity.name || ""}${e.identity.version ? "@" + e.identity.version : ""}` : chalk.dim("unknown");
+				const flags = [e.knownMalicious ? chalk.bgRed.white(" malicious ") : null, e.nameMismatch ? chalk.yellow("name≠checksum") : null, e.shouldBeManaged ? chalk.cyan("should-be-managed") : null, (e.noOnlineInfo ? chalk.dim("unknown") : null)].filter(Boolean).join(" ");
+				console.log("    " + chalk.white(path.basename(String(e.path))) + "  " + chalk.dim(id) + (flags ? "  " + flags : ""));
+			}
+			if (inv.length > 10) console.log(chalk.dim(`    …and ${inv.length - 10} more (see report ch.1C)`));
+		}
+	}
+
 	heading("EOL frameworks", eolResults.length);
-	for (const e of eolResults.slice(0, 8)) console.log("    " + chalk.yellow(e.product.padEnd(18)) + " " + chalk.dim(`${coordOf(e.dep)}:${e.dep.version}`) + " " + chalk.dim(e.eol === true ? "EOL" : String(e.eol)));
+	for (const e of eolResults.slice(0, 8)) console.log("    " + chalk.yellow(e.product.padEnd(18)) + " " + chalk.dim(`${coordOf(e.dep)}:${e.dep.version}`) + " " + chalk.dim(e.eol === true ? "EOL" : String(e.eol)) + definedInOf(e.dep));
 	if (eolResults.length > 8) console.log(chalk.dim(`    …and ${eolResults.length - 8} more`));
 
 	heading("Obsolete / deprecated", obsoleteResults.length);
-	for (const o of obsoleteResults.slice(0, 8)) console.log("    " + chalk.dim(`${coordOf(o.dep)}:${o.dep.version}`) + " → " + (o.replacement || chalk.dim("n/a")));
+	for (const o of obsoleteResults.slice(0, 8)) console.log("    " + chalk.dim(`${coordOf(o.dep)}:${o.dep.version}`) + " → " + (o.replacement || chalk.dim("n/a")) + definedInOf(o.dep));
 	if (obsoleteResults.length > 8) console.log(chalk.dim(`    …and ${obsoleteResults.length - 8} more`));
 
 	heading("Outdated", outdatedResults.length, options.allLibs ? "" : chalk.dim("pass -a/--allLibs to query registries"));
-	for (const o of outdatedResults.slice(0, 8)) console.log("    " + chalk.dim(coordOf(o.dep)) + ` ${o.dep.version} → ${chalk.green(o.latest)}`);
+	for (const o of outdatedResults.slice(0, 8)) console.log("    " + chalk.dim(coordOf(o.dep)) + ` ${o.dep.version} → ${chalk.green(o.latest)}` + definedInOf(o.dep));
 	if (outdatedResults.length > 8) console.log(chalk.dim(`    …and ${outdatedResults.length - 8} more`));
 
 	if (retireMatches.length) {
@@ -908,7 +1118,7 @@ async function runReportFlow(resolved, ecoFlags = {}) {
 	if (out.html || out.doc) {
 		await ensureDir(out.html); await ensureDir(out.doc);
 		const { htmlPath, docPath } = await writeReports({
-			cveMatches: prodMatches, devCveMatches: devMatches, embeddedMatches, retireMatches,
+			cveMatches: prodMatches, devCveMatches: devMatches, embeddedMatches, retireMatches, vendoredJsInventory,
 			eolResults, obsoleteResults, outdatedResults, licenseResults,
 			resolvedDeps: resolved, projectInfo, warnings: reportWarnings,
 			htmlPath: out.html, docPath: out.doc,
@@ -939,7 +1149,7 @@ async function runReportFlow(resolved, ecoFlags = {}) {
 		try {
 			const { writeFindings } = require("./lib/json-export");
 			await ensureDir(out.json);
-			writeFindings({ cveMatches, retireMatches, eolResults, obsoleteResults, outdatedResults, licenseResults, resolvedDeps: resolved, projectInfo, toolVersion: pkg.version }, out.json);
+			writeFindings({ cveMatches, retireMatches, vendoredJsInventory, eolResults, obsoleteResults, outdatedResults, licenseResults, resolvedDeps: resolved, projectInfo, toolVersion: pkg.version }, out.json);
 			wrote.push(["Findings JSON", out.json]);
 		} catch (err) { ui.warn(`JSON export failed: ${err.message}`); }
 	}

package/lib/codecs/binary/scan.js

@@ -0,0 +1,71 @@
+/**
+ * lib/codecs/binary/scan.js — walk a source tree for committed NATIVE binaries
+ * (.dll/.exe/.so/.dylib) and hash each. Dependency archives (.jar/.war/.ear) are
+ * owned by the Maven codec's jar-scan.js, not here.
+ *
+ * Selection requires BOTH an allowlisted extension AND a confirming magic byte
+ * (sniff.js), so images/fonts/assets — even with a spoofed extension — are never
+ * hashed or reported.
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
+ */
+const fs = require("fs");
+const path = require("path");
+const crypto = require("crypto");
+const { sniffKind, extKind } = require("./sniff");
+
+// Same skip set the other codecs use; never a place vendored binaries we own live.
+const SKIP = new Set([
+	".git", ".idea", ".vscode", "node_modules", "dist", "build", "out",
+	"target", "vendor", "testdata", ".svn", ".hg", ".gradle", ".cache",
+]);
+
+const MAGIC_BYTES = 8;   // enough for every signature we sniff
+
+function hashFile(fp) {
+	const buf = fs.readFileSync(fp);
+	return {
+		size: buf.length,
+		sha1: crypto.createHash("sha1").update(buf).digest("hex"),
+		sha256: crypto.createHash("sha256").update(buf).digest("hex"),
+	};
+}
+
+function readMagic(fp) {
+	let fd;
+	try {
+		fd = fs.openSync(fp, "r");
+		const buf = Buffer.alloc(MAGIC_BYTES);
+		const n = fs.readSync(fd, buf, 0, MAGIC_BYTES, 0);
+		return buf.subarray(0, n);
+	} catch { return Buffer.alloc(0); }
+	finally { if (fd !== undefined) try { fs.closeSync(fd); } catch { /* ignore */ } }
+}
+
+/** Walk `dir`, return [{ path, kind, size, sha1, sha256, declaredName }]. */
+function scanBinaries(dir, opts = {}) {
+	const { onProgress } = opts;
+	const { makeDirFilter } = require("../../path-filter");
+	const skipDir = makeDirFilter({ srcRoot: opts.srcRoot || dir, defaultSkip: SKIP, excludePath: opts.excludePath, useDefaults: opts.defaultExcludes !== false });
+	const out = [];
+	const stack = [dir];
+	while (stack.length) {
+		const cur = stack.pop();
+		let entries; try { entries = fs.readdirSync(cur, { withFileTypes: true }); } catch { continue; }
+		for (const e of entries) {
+			const fp = path.join(cur, e.name);
+			if (e.isDirectory()) { if (!skipDir(fp, e.name)) stack.push(fp); continue; }
+			if (!e.isFile()) continue;
+			const ext = extKind(e.name);
+			if (!ext) continue;                          // not an allowlisted extension
+			if (sniffKind(readMagic(fp)) !== ext) continue;  // magic must confirm the extension
+			if (onProgress) onProgress(fp);
+			const h = hashFile(fp);
+			out.push({ path: fp, kind: ext, size: h.size, sha1: h.sha1, sha256: h.sha256, declaredName: e.name });
+		}
+	}
+	return out;
+}
+
+module.exports = { scanBinaries };