fad-checker 2.1.1 → 2.2.0

package/lib/cve-report.js

@@ -12,12 +12,15 @@ const fs = require("fs");
 const path = require("path");
 const { getCodec, allCodecs, ORDER } = require("./codecs");
 const { computePriority, sortByPriority } = require("./priority");
+const { buildInventory } = require("./unmanaged");
 
 // CWE-id → short human name. Loaded once at module init. Unknown CWEs fall
 // back to the raw id (with a "—" placeholder name where the row asks for one).
 const CWE_NAMES = (() => {
 	try {
-		const raw = JSON.parse(fs.readFileSync(path.join(__dirname, "..", "data", "cwe-names.json"), "utf8"));
+		// require() (not fs.readFileSync) so bun --compile bundles the data file
+		// into the standalone binary instead of reading it off disk at runtime.
+		const raw = { ...require("../data/cwe-names.json") };
 		delete raw._comment;
 		return raw;
 	} catch { return {}; }
@@ -1360,7 +1363,7 @@ function renderLicenseChapter(licenseResults) {
 	return intro + blocks;
 }
 
-function buildBody({ cveMatches, devCveMatches, embeddedMatches, retireMatches, eolResults, obsoleteResults, outdatedResults, licenseResults, resolvedDeps, projectInfo, warnings, wrapTables = true }) {
+function buildBody({ cveMatches, devCveMatches, embeddedMatches, retireMatches, vendoredJsInventory, eolResults, obsoleteResults, outdatedResults, licenseResults, resolvedDeps, projectInfo, warnings, wrapTables = true }) {
 	setRenderCtx({ srcRoot: projectInfo?.src || null });
 	// Dedupe rows so a single (dep, cve) shows once with all via paths merged.
 	cveMatches      = mergeMatches(cveMatches || []);
@@ -1395,6 +1398,10 @@ function buildBody({ cveMatches, devCveMatches, embeddedMatches, retireMatches,
 	const licenseTotal     = licenseResults?.assessed?.length || 0;
 	const licenseFlagged   = licenseResults?.flagged?.length || 0;
 	const embeddedContent  = renderEmbeddedChapter(embMatchesActive, projectInfo?.src);
+	const unmanagedInventory = buildInventory(resolvedDeps || new Map());
+	const unmanagedContent = renderUnmanagedInventory(unmanagedInventory, projectInfo?.src);
+	const vendoredJsInv    = vendoredJsInventory || [];
+	const vendoredJsContent = renderVendoredJsInventory(vendoredJsInv, projectInfo?.src);
 	const fpContent        = renderFalsePositives([...prodMatchesFP, ...devMatchesFP, ...embMatchesFP]);
 
 	const toolbar = `<div class="toolbar">
@@ -1427,6 +1434,8 @@ function buildBody({ cveMatches, devCveMatches, embeddedMatches, retireMatches,
 		licenseTotal,
 		licenseFlagged,
 		embeddedTotal: embStats.total,
+		unmanagedTotal: unmanagedInventory.length,
+		vendoredJsTotal: vendoredJsInv.length,
 		fpTotal: prodMatchesFP.length + devMatchesFP.length + embMatchesFP.length,
 	});
 
@@ -1447,6 +1456,8 @@ function buildBody({ cveMatches, devCveMatches, embeddedMatches, retireMatches,
 		${(warnings?.length || 0) ? majorSection(`0. Warnings & scan-completeness (${warnings.length})`, renderWarnings(warnings), { open: true, id: "ch0" }) : ""}
 		${majorSection(`1. CVE Vulnerabilities — production (${prodStats.total})`, cveContent, { id: "ch1" })}
 		${embStats.total ? majorSection(`1B. Embedded binaries — JAR/WAR/EAR (${embStats.total})`, embeddedContent, { open: embStats.total <= 50, id: "ch1e" }) : ""}
+		${unmanagedInventory.length ? majorSection(`1C. Unmanaged / vendored binaries (${unmanagedInventory.length})`, unmanagedContent, { open: unmanagedInventory.length <= 50, id: "ch1c" }) : ""}
+		${vendoredJsInv.length ? majorSection(`1D. Unmanaged / vendored JavaScript (${vendoredJsInv.length})`, vendoredJsContent, { open: vendoredJsInv.length <= 50, id: "ch1d" }) : ""}
 		${majorSection(`2. Vendored JS scan — retire.js (${retireMatches.length})`, vendoredContent, { open: retireMatches.length > 0 && retireMatches.length <= 50, id: "ch2" })}
 		${majorSection(`3. CVE in dev dependencies (${devStats.total})`, devCveContent, { open: devStats.total > 0 && devStats.total <= 50, id: "ch3" })}
 		${majorSection(`4. End-of-Life Frameworks (${eolResults?.length || 0})`, renderEolTable(eolResults), { id: "ch4" })}
@@ -1491,12 +1502,14 @@ function pickTopCriticalMatches(prodMatches, retireMatches, n) {
 	return out;
 }
 
-function renderToc({ hasWarnings, prodTotal, embeddedTotal, retireTotal, devTotal, eolTotal, obsoleteTotal, outdatedTotal, licenseTotal, licenseFlagged, fpTotal }) {
+function renderToc({ hasWarnings, prodTotal, embeddedTotal, unmanagedTotal, vendoredJsTotal, retireTotal, devTotal, eolTotal, obsoleteTotal, outdatedTotal, licenseTotal, licenseFlagged, fpTotal }) {
 	const entries = [];
 	if (hasWarnings)                  entries.push({ id: "ch0", label: "0. Warnings" });
 	entries.push({ id: "ch1", label: `1. Prod CVE (${prodTotal})` });
 	if (embeddedTotal)                entries.push({ id: "ch1e", label: `1B. Embedded (${embeddedTotal})` });
-	entries.push({ id: "ch2", label: `2. Vendored JS (${retireTotal})` });
+	if (unmanagedTotal)               entries.push({ id: "ch1c", label: `1C. Unmanaged (${unmanagedTotal})` });
+	if (vendoredJsTotal)              entries.push({ id: "ch1d", label: `1D. Vendored JS (${vendoredJsTotal})` });
+	entries.push({ id: "ch2", label: `2. Vendored JS vulns (${retireTotal})` });
 	entries.push({ id: "ch3", label: `3. Dev CVE (${devTotal})` });
 	entries.push({ id: "ch4", label: `4. EOL (${eolTotal})` });
 	entries.push({ id: "ch5", label: `5. Obsolete (${obsoleteTotal})` });
@@ -1526,6 +1539,46 @@ function renderEmbeddedChapter(matches, srcRoot) {
 	return intro + blocks;
 }
 
+// Unmanaged native-binary inventory (Part C). Committed .dll/.exe/.so/.dylib that no
+// package manager governs, identified by checksum (deps.dev + CIRCL). Self-contained
+// inline styles, matching the report's no-external-CSS philosophy.
+function pill(text, bg, fg = "#fff") {
+	return `<span style="display:inline-block;padding:2px 8px;border-radius:3px;background:${bg};color:${fg};font-weight:600;font-size:11px">${esc(text)}</span>`;
+}
+function renderUnmanagedInventory(inventory, srcRoot) {
+	if (!inventory.length) return `<div class="empty">No committed native binaries found.</div>`;
+	const intro = `<div class="fp-intro">Committed native binaries (<code>.dll</code>/<code>.exe</code>/<code>.so</code>/<code>.dylib</code>) — not governed by any package manager. Identified by checksum (deps.dev + CIRCL). <strong>should-be-managed</strong> = a published package committed as a blob; <strong>name≠checksum</strong> = the filename disagrees with what the hash resolves to; <strong>not recognised by any source</strong> = neither deps.dev nor CIRCL knows this exact file (vendored/custom build — verify its origin manually). Identification is by checksum only; a file absent from both databases stays unidentified even when its name is suggestive (e.g. <code>openssl.exe</code>).</div>`;
+	const rows = inventory.map(e => {
+		let rel = e.path;
+		if (srcRoot) { try { rel = path.relative(srcRoot, e.path); } catch { /* keep abs */ } }
+		const id = e.identity
+			? `${esc(e.identity.ecosystem ? e.identity.ecosystem + ":" : "")}${esc(e.identity.name || "")}${e.identity.version ? "@" + esc(e.identity.version) : ""} <span style="color:#6b7280">(${esc(e.identity.source || "")})</span>`
+			: `<span style="color:#6b7280">unknown</span>`;
+		const flags = [
+			e.knownMalicious ? pill("⚠ MALICIOUS", "#7c0008") : null,
+			e.integrity === "pristine" ? pill("pristine", "#166534") : (e.integrity === "known-good" ? pill("known-good", "#15803d") : null),
+			e.shouldBeManaged ? pill("should-be-managed", "#2563eb") : null,
+			e.nameMismatch ? pill("name≠checksum", "#ea580c") : null,
+			e.noOnlineInfo ? pill("not recognised by any source", "#6b7280") : null,
+		].filter(Boolean).join(" ");
+		return `<tr><td class="dep"><code class="path">${esc(rel)}</code></td><td>${id}</td><td>${flags}</td><td><code class="path" style="color:#6b7280">${esc((e.hashes?.sha256 || "").slice(0, 16))}…</code></td></tr>`;
+	}).join("\n");
+	return intro + `<table><thead><tr><th>File</th><th>Identity (by checksum)</th><th>Status</th><th>SHA-256</th></tr></thead><tbody>${rows}</tbody></table>`;
+}
+
+function renderVendoredJsInventory(inventory, srcRoot) {
+	if (!inventory || !inventory.length) return `<div class="empty">No vendored JavaScript libraries identified.</div>`;
+	const vulnN = inventory.filter(e => e.vulnerable).length;
+	const intro = `<div class="fp-intro">Standalone JavaScript libraries committed into the tree (jQuery, Bootstrap, PDF.js, …) that <strong>no package manager governs</strong> — unknown provenance, integrity and patch story, identified by signature (retire.js). This is a cyber-hygiene inventory: even a non-vulnerable copy is unmanaged third-party code. <strong>${vulnN}</strong> of ${inventory.length} carry known vulnerabilities (detailed in chapter 2).</div>`;
+	const rows = inventory.map(e => {
+		const sevPill = e.vulnerable
+			? pill(`${e.vulnCount} vuln${e.vulnCount > 1 ? "s" : ""}${e.maxSeverity ? " · " + e.maxSeverity : ""}`, "#b91c1c")
+			: pill("no known vuln", "#15803d");
+		return `<tr><td>${esc(e.component || "?")}</td><td>${esc(e.version || "?")}</td><td class="dep"><code class="path">${esc(e.file || "")}</code></td><td><span style="color:#6b7280">${esc(e.detection || "")}</span></td><td>${sevPill}</td></tr>`;
+	}).join("\n");
+	return intro + `<table><thead><tr><th>Library</th><th>Version</th><th>File</th><th>Detection</th><th>Status</th></tr></thead><tbody>${rows}</tbody></table>`;
+}
+
 function renderFalsePositives(matches) {
 	if (!matches.length) return `<div class="empty">No CPE-filtered findings.</div>`;
 	const intro = `<div class="fp-intro">These entries were initially matched by name but NVD's CPE configurations show your dep version is outside every vulnerable range. They are almost certainly false positives — kept here for audit transparency.</div>`;
@@ -1909,12 +1962,12 @@ ${WORD_SECTION_PR}
 // Render the HTML and/or Word report. Callers pass explicit target paths;
 // a null/omitted path skips that format (so `--report-html` alone writes only HTML).
 // Back-compat: `outputDir` still writes both under the default file names.
-async function writeReports({ cveMatches, devCveMatches, embeddedMatches, retireMatches, eolResults, obsoleteResults, outdatedResults, licenseResults, resolvedDeps, projectInfo, outputDir, htmlPath, docPath, warnings }) {
+async function writeReports({ cveMatches, devCveMatches, embeddedMatches, retireMatches, vendoredJsInventory, eolResults, obsoleteResults, outdatedResults, licenseResults, resolvedDeps, projectInfo, outputDir, htmlPath, docPath, warnings }) {
 	if (outputDir) {
 		if (htmlPath === undefined) htmlPath = path.join(outputDir, "cve-report.html");
 		if (docPath === undefined) docPath = path.join(outputDir, "cve-report.doc");
 	}
-	const payload = { cveMatches, devCveMatches, embeddedMatches, retireMatches, eolResults, obsoleteResults, outdatedResults, licenseResults, resolvedDeps, projectInfo, warnings };
+	const payload = { cveMatches, devCveMatches, embeddedMatches, retireMatches, vendoredJsInventory, eolResults, obsoleteResults, outdatedResults, licenseResults, resolvedDeps, projectInfo, warnings };
 	const written = { htmlPath: null, docPath: null };
 	if (htmlPath) {
 		await fs.promises.mkdir(path.dirname(path.resolve(htmlPath)), { recursive: true });

package/lib/dep-record.js

@@ -35,17 +35,18 @@ function coordKeyFor(ecosystem, namespace, name) {
 }
 
 function makeDepRecord(input) {
-	const { ecosystem, namespace = "", name, version = null, manifestPath, scope = "compile", isDev = false, ecosystemType, provenance = "manifest" } = input;
+	const { ecosystem, namespace = "", name, version = null, manifestPath, scope = "compile", isDev = false, ecosystemType, provenance = "manifest", hashes = null, declaredName = null } = input;
 	const concrete = version && !/\$\{/.test(version) ? version : null;
 	const manifestPaths = manifestPath ? [manifestPath] : [];
-	// Embedded binaries (a dep discovered INSIDE a .jar/.war/.ear, not declared in a
-	// manifest) must not share the Map key of a declared dep with the same g:a — else
-	// they'd merge and the "embedded binaries" report chapter would lose them. Key
-	// them by their unique physical location instead. provenance stays on the record
-	// so the report/exports can label & group them; "both" is set later if a merge
-	// across provenances ever happens.
-	const coordKey = provenance === "embedded" && manifestPath
-		? `embedded:${manifestPath}`
+	// Embedded binaries (a dep discovered INSIDE a .jar/.war/.ear) and standalone
+	// committed native binaries (.dll/.so/…) must not share the Map key of a declared
+	// dep with the same coordinate — they'd merge and the unmanaged report chapter
+	// would lose them. Key them by their unique physical location instead. provenance
+	// stays on the record so the report/exports can label & group them; "both" is set
+	// later if a merge across provenances ever happens.
+	const byLocation = (provenance === "embedded" || provenance === "binary") && manifestPath;
+	const coordKey = byLocation
+		? `${provenance}:${manifestPath}`
 		: coordKeyFor(ecosystem, namespace, name);
 	return {
 		ecosystem,
@@ -56,6 +57,8 @@ function makeDepRecord(input) {
 		versions: concrete ? [concrete] : [],
 		coordKey,
 		provenance,
+		hashes,
+		declaredName,
 		scope,
 		isDev: !!isDev,
 		manifestPaths,

package/lib/hash-id.js

@@ -0,0 +1,78 @@
+/**
+ * lib/hash-id.js — identity-by-checksum for unmanaged artifacts.
+ *
+ * Two known-good sources, tried in order:
+ *  1. deps.dev query-by-hash → exact package coordinate (whole published archive).
+ *  2. CIRCL hashlookup → known OS/distro/CDN/NSRL file + free KnownMalicious flag.
+ *
+ * Cache-backed (~/.fad-checker/hash-id-cache.json, 24h) and --offline-aware: offline
+ * reads cache only and never touches the network (project air-gapped principle).
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
+ */
+const fs = require("fs");
+const path = require("path");
+const os = require("os");
+
+const CACHE_DIR = path.join(os.homedir(), ".fad-checker");
+const CACHE_PATH = path.join(CACHE_DIR, "hash-id-cache.json");
+const CACHE_TTL_MS = 24 * 3600 * 1000;
+const DEPSDEV = "https://api.deps.dev/v3/query";
+const CIRCL = "https://hashlookup.circl.lu/lookup/sha256";
+
+const SYSTEM_TO_ECO = { MAVEN: "maven", NPM: "npm", NUGET: "nuget", PYPI: "pypi", RUBYGEMS: "ruby", CARGO: "cargo", GO: "go" };
+
+function sha1ToBase64(hex) { return Buffer.from(hex, "hex").toString("base64"); }
+
+function parseDepsDev(body) {
+	const vk = body?.results?.[0]?.version?.versionKey;
+	if (!vk?.name) return null;
+	return { ecosystem: SYSTEM_TO_ECO[vk.system] || (vk.system || "").toLowerCase() || null, name: vk.name, version: vk.version || null, source: "deps.dev" };
+}
+
+function parseCircl(body) {
+	if (!body || body.message || !(body.FileName || body.ProductCode)) return null;
+	const malicious = Array.isArray(body.KnownMalicious) ? body.KnownMalicious.length > 0 : !!body.KnownMalicious;
+	return {
+		ecosystem: null,
+		name: body.ProductCode?.ProductName || body.FileName || null,
+		version: body.ProductCode?.ProductVersion || null,
+		source: `circl:${body.db || "hashlookup"}`,
+		trust: body["hashlookup:trust"] != null ? body["hashlookup:trust"] : null,
+		knownMalicious: malicious,
+	};
+}
+
+function loadCache() { try { const d = JSON.parse(fs.readFileSync(CACHE_PATH, "utf8")); if (Date.now() - (d._fetchedAt || 0) < CACHE_TTL_MS) return d.entries || {}; } catch { /* ignore */ } return {}; }
+function saveCache(entries) { try { fs.mkdirSync(CACHE_DIR, { recursive: true }); fs.writeFileSync(CACHE_PATH, JSON.stringify({ _fetchedAt: Date.now(), entries })); } catch { /* ignore */ } }
+
+async function lookupHash(hashes, opts = {}) {
+	const { fetcher = globalThis.fetch, offline = false, cache } = opts;
+	const entries = cache || loadCache();
+	const key = hashes.sha256 || hashes.sha1;
+	if (!key) return null;
+	if (Object.prototype.hasOwnProperty.call(entries, key)) return entries[key];
+	if (offline) return null;
+
+	let identity = null;
+	// 1) deps.dev (SHA1 base64)
+	if (hashes.sha1) {
+		try {
+			const r = await fetcher(`${DEPSDEV}?hash.type=SHA1&hash.value=${encodeURIComponent(sha1ToBase64(hashes.sha1))}`, { headers: { "User-Agent": "fad-checker-hashid" } });
+			if (r.ok) identity = parseDepsDev(await r.json());
+		} catch { /* ignore, try CIRCL */ }
+	}
+	// 2) CIRCL (SHA-256)
+	if (!identity && hashes.sha256) {
+		try {
+			const r = await fetcher(`${CIRCL}/${hashes.sha256}`, { headers: { "User-Agent": "fad-checker-hashid", Accept: "application/json" } });
+			if (r.ok) identity = parseCircl(await r.json());
+		} catch { /* ignore */ }
+	}
+	entries[key] = identity;
+	if (!cache) saveCache(entries);
+	return identity;
+}
+
+module.exports = { sha1ToBase64, parseDepsDev, parseCircl, lookupHash, loadCache, saveCache, CACHE_PATH };

package/lib/json-export.js

@@ -65,10 +65,13 @@ const SEV = ["critical", "high", "medium", "low", "none", "unknown"];
  */
 function buildFindings(payload = {}) {
 	const {
-		cveMatches = [], retireMatches = [], eolResults = [], obsoleteResults = [],
+		cveMatches = [], retireMatches = [], vendoredJsInventory = [], eolResults = [], obsoleteResults = [],
 		outdatedResults = [], licenseResults = null, resolvedDeps, projectInfo = {}, toolVersion = "0",
 	} = payload;
 
+	const { buildInventory } = require("./unmanaged");
+	const unmanaged = resolvedDeps ? buildInventory(resolvedDeps) : [];
+
 	const sevCounts = Object.fromEntries(SEV.map(s => [s, 0]));
 	let kev = 0;
 	for (const m of cveMatches) {
@@ -90,6 +93,8 @@ function buildFindings(payload = {}) {
 			outdated: outdatedResults.length,
 			licensesFlagged: licenseResults?.flagged?.length || 0,
 			vendored: retireMatches.length,
+			unmanaged: unmanaged.length,
+			vendoredJs: vendoredJsInventory.length,
 			suppressed: cveMatches.filter(m => m.suppressed).length,
 		},
 		cve: cveMatches.map(cveFinding),
@@ -98,6 +103,8 @@ function buildFindings(payload = {}) {
 		obsolete: obsoleteResults.map(o => ({ reason: o.reason || null, replacement: o.replacement || null, source: o.source || null, dep: depBrief(o.dep) })),
 		outdated: outdatedResults.map(o => ({ latest: o.latest, releaseDate: o.releaseDate || null, dep: depBrief(o.dep) })),
 		licenses: (licenseResults?.assessed || []).map(e => ({ category: e.category, licenses: e.ids.concat(e.raw), source: e.source || null, dep: depBrief(e.dep) })),
+		unmanaged,
+		vendoredJs: vendoredJsInventory,
 	};
 }
 

package/lib/license-policy.js

@@ -14,7 +14,9 @@ const path = require("path");
 
 const POLICY = (() => {
 	try {
-		const raw = JSON.parse(fs.readFileSync(path.join(__dirname, "..", "data", "license-policy.json"), "utf8"));
+		// require() (not fs.readFileSync) so bun --compile bundles the data file
+		// into the standalone binary instead of reading it off disk at runtime.
+		const raw = require("../data/license-policy.json");
 		return { categories: raw.categories || {}, aliases: raw.aliases || {} };
 	} catch { return { categories: {}, aliases: {} }; }
 })();

package/lib/options-env.js

@@ -0,0 +1,113 @@
+/**
+ * lib/options-env.js — layered option resolution.
+ *
+ * Layers (highest → lowest): CLI flags > config file (--config / ./.fad-env.json,
+ * JSON) > FAD_CHECKER_ENV (a CLI-flag string) > global ~/.fad-checker/config.json
+ * > commander defaults. Scalar options follow precedence; `registries` are unioned
+ * elsewhere (lib/registries.js). The source flag has aliases (src/source).
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
+ */
+const fs = require("fs");
+const path = require("path");
+const { Command } = require("commander");
+
+/** Quote/escape-aware shell-ish tokenizer (single+double quotes, backslash). */
+function tokenize(str) {
+	const out = [];
+	let cur = "", q = null, esc = false, has = false;
+	for (const ch of String(str)) {
+		if (esc) { cur += ch; esc = false; has = true; continue; }
+		if (ch === "\\" && q !== "'") { esc = true; continue; }
+		if (q) { if (ch === q) q = null; else cur += ch; has = true; continue; }
+		if (ch === '"' || ch === "'") { q = ch; has = true; continue; }
+		if (/\s/.test(ch)) { if (has) { out.push(cur); cur = ""; has = false; } continue; }
+		cur += ch; has = true;
+	}
+	if (has) out.push(cur);
+	return out;
+}
+
+function loadConfigFile(p) {
+	const raw = fs.readFileSync(p, "utf8");
+	try { return JSON.parse(raw); }
+	catch (e) { throw new Error(`invalid JSON in config file ${p}: ${e.message}`); }
+}
+
+/** Map `source` → `src` (src wins if both present). Returns a NEW object. */
+function normalizeSource(obj) {
+	const o = { ...obj };
+	if (o.source != null && o.src == null) o.src = o.source;
+	delete o.source;
+	return o;
+}
+
+/**
+ * Parse a CLI-flag string into { options, repos } using a throwaway clone of the
+ * real program. Only options whose source !== "default" are returned, so unset
+ * flags don't clobber higher layers. `repos` (variadic --repo) returned separately.
+ */
+function parseEnvFlags(str, program) {
+	const tokens = tokenize(str);
+	if (!tokens.length) return { options: {}, repos: [] };
+	const clone = new Command();
+	clone.exitOverride().allowUnknownOption(true).configureOutput({ writeErr() {}, writeOut() {} });
+	for (const o of program.options) clone.addOption(o);
+	try { clone.parse(tokens, { from: "user" }); } catch { /* tolerate */ }
+	const all = clone.opts();
+	const options = {};
+	for (const name of Object.keys(all)) {
+		const src = clone.getOptionValueSource(name);
+		if (src && src !== "default") options[name] = all[name];
+	}
+	const repos = Array.isArray(options.repo) ? options.repo : [];
+	delete options.repo;
+	return { options: normalizeSource(options), repos };
+}
+
+/** Resolve { fileLayer, envLayer, envRepos }. */
+function loadLayers({ cwd = process.cwd(), configPath = null, envStr = process.env.FAD_CHECKER_ENV, program = null } = {}) {
+	let fileLayer = {};
+	const chosen = configPath || path.join(cwd, ".fad-env.json");
+	if (configPath) fileLayer = loadConfigFile(chosen);
+	else if (fs.existsSync(chosen)) fileLayer = loadConfigFile(chosen);
+	fileLayer = normalizeSource(fileLayer || {});
+	let envLayer = {}, envRepos = [];
+	if (envStr && program) {
+		// If FAD_CHECKER_ENV points to a readable file, treat its content as flags too.
+		let s = envStr;
+		try { if (fs.existsSync(envStr) && fs.statSync(envStr).isFile()) s = fs.readFileSync(envStr, "utf8"); } catch { /* inline */ }
+		const parsed = parseEnvFlags(s, program);
+		envLayer = parsed.options; envRepos = parsed.repos;
+	}
+	return { fileLayer, envLayer, envRepos };
+}
+
+/**
+ * Merge layers onto the parsed program. A file/env/global value fills an option
+ * ONLY when the CLI did not set it (source default/undefined). Order: file > env
+ * > global. Returns the effective options object (a copy of program.opts()).
+ */
+function applyLayers(program, layers = {}, globalStore = {}) {
+	const eff = normalizeSource(program.opts());
+	const fileLayer = normalizeSource(layers.fileLayer || {});
+	const envLayer = normalizeSource(layers.envLayer || {});
+	const cliSet = name => {
+		const s = program.getOptionValueSource(name);
+		return s && s !== "default";
+	};
+	const candidates = new Set([...Object.keys(fileLayer), ...Object.keys(envLayer), ...Object.keys(globalStore || {})]);
+	candidates.delete("registries");  // unioned separately
+	candidates.delete("excludePath"); // unioned separately
+	candidates.delete("source");
+	for (const name of candidates) {
+		if (cliSet(name)) continue; // CLI wins
+		if (name in fileLayer) eff[name] = fileLayer[name];
+		else if (name in envLayer) eff[name] = envLayer[name];
+		else if (globalStore && name in globalStore) eff[name] = globalStore[name];
+	}
+	return eff;
+}
+
+module.exports = { tokenize, loadConfigFile, normalizeSource, parseEnvFlags, loadLayers, applyLayers };

package/lib/outdated.js

@@ -318,4 +318,7 @@ module.exports = {
 	EOL_MAPPING,
 	EOL_CACHE_PATH,
 	KNOWN_OBSOLETE,
+	loadJsonCache,
+	saveJsonCache,
+	CACHE_DIR,
 };

package/lib/parallel-walk.js

@@ -0,0 +1,50 @@
+/**
+ * lib/parallel-walk.js — bounded-concurrency recursive directory walk.
+ *
+ * A serial readdirSync walk is fine on a fast local disk, but on a high-latency
+ * filesystem (WSL/9p, network mounts, the air-gapped VM in the field) each readdir
+ * pays a round-trip, so a big tree takes tens of seconds per walk — and fad-checker
+ * walks the tree several times (detection, pom discovery, jar discovery, JS manifest
+ * discovery). Issuing many readdirs concurrently turns that latency-bound serial walk
+ * into something close to a single round-trip deep, which is dramatically faster.
+ *
+ * `onDir(absDir, entries)` is called once per visited directory with its Dirent[].
+ * `skipDir(absChildDir, name)` prunes a child directory (caller's own skip policy);
+ * it receives the child's absolute path (for path-relative globs) plus its basename.
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
+ */
+const fs = require("fs");
+const path = require("path");
+
+const DEFAULT_CONCURRENCY = 48;
+
+async function walkDirs(root, { skipDir = () => false, concurrency = DEFAULT_CONCURRENCY, onDir } = {}) {
+	const queue = [root];
+	let active = 0;
+	await new Promise(resolve => {
+		let settled = false;
+		const finish = () => { if (!settled) { settled = true; resolve(); } };
+		const pump = () => {
+			if (settled) return;
+			if (queue.length === 0 && active === 0) return finish();
+			while (active < concurrency && queue.length) {
+				const cur = queue.pop();
+				active++;
+				fs.promises.readdir(cur, { withFileTypes: true }).then(entries => {
+					if (onDir) onDir(cur, entries);
+					for (const e of entries) {
+						if (!e.isDirectory()) continue;
+						const child = path.join(cur, e.name);
+						if (!skipDir(child, e.name)) queue.push(child);
+					}
+				}).catch(() => { /* unreadable dir → skip, same as readdirSync catch */ })
+					.finally(() => { active--; pump(); });
+			}
+		};
+		pump();
+	});
+}
+
+module.exports = { walkDirs };

package/lib/path-filter.js

@@ -0,0 +1,58 @@
+/**
+ * lib/path-filter.js — directory-walk pruning policy shared by every codec walker.
+ *
+ * Two layers:
+ *   - default skips: each walker's own basename set (node_modules, vendor, target,
+ *     .git, …). Bypassable with useDefaults=false (CLI --no-default-excludes).
+ *   - user globs: --exclude-path / `excludePath` config, matched gitignore-style
+ *     against the directory's path RELATIVE to the scan root (`srcRoot`). A bare
+ *     `foo/bar` matches that directory and its whole subtree (`foo/bar/**`).
+ *
+ * makeDirFilter() returns a predicate over a child directory's ABSOLUTE path, so
+ * it drops straight into parallel-walk's skipDir and the serial readdir walkers.
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
+ */
+const path = require("path");
+const { minimatch } = require("minimatch");
+
+/**
+ * Compile glob strings into (relPath) → bool matchers. Each glob prunes both the
+ * matched directory itself and its whole subtree, so `packages/legacy/**` (or the
+ * bare `packages/legacy`) stops the walk at `packages/legacy` — a manifest sitting
+ * directly in it is never collected.
+ */
+function compileGlobs(globs) {
+	return (globs || []).filter(Boolean).map(String).map(g => g.trim()).filter(Boolean).map(g => {
+		// Paths match relative to srcRoot, so they're already root-anchored. Accept
+		// `truc`, `/truc` and `./truc` as the same thing (strip a leading ./ or /).
+		const base = g.replace(/^\.?\/+/, "").replace(/\/+$/, "");
+		const patterns = base.endsWith("/**")
+			? [base, base.slice(0, -3).replace(/\/+$/, "")] // dir + its subtree
+			: [base, base + "/**"];
+		return rel => patterns.some(p => p && minimatch(rel, p, { dot: true }));
+	});
+}
+
+/**
+ * Build a skipDir(absChildDir) predicate.
+ *   srcRoot       scan root the globs are relative to
+ *   defaultSkip   Set of basenames the walker prunes by default (its own SKIP)
+ *   excludePath   user glob strings
+ *   useDefaults   when false, ignore defaultSkip entirely (--no-default-excludes)
+ */
+function makeDirFilter({ srcRoot, defaultSkip = null, excludePath = [], useDefaults = true } = {}) {
+	const matchers = compileGlobs(excludePath);
+	return function skipDir(absChild) {
+		const name = path.basename(absChild);
+		if (useDefaults && defaultSkip && defaultSkip.has(name)) return true;
+		if (matchers.length && srcRoot) {
+			const rel = path.relative(srcRoot, absChild).split(path.sep).join("/");
+			if (rel && !rel.startsWith("..") && matchers.some(m => m(rel))) return true;
+		}
+		return false;
+	};
+}
+
+module.exports = { makeDirFilter, compileGlobs };

package/lib/registries.js

@@ -0,0 +1,112 @@
+/**
+ * lib/registries.js — per-ecosystem registry list assembly + auth + fan-out.
+ *
+ * Generalizes lib/maven-repo.js's list-building to npm/pypi/ruby/go. Custom
+ * registries are tried first (declared order); callers append the public base
+ * last via withPublic(). Lists are unioned across config layers, deduped by URL.
+ *
+ * Entry shape: { name?, url, auth?, token? }
+ *   auth  "user:pass" → Authorization: Basic <base64>
+ *   token "…"         → Authorization: Bearer <token>
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
+ */
+const SUPPORTED = ["maven", "npm", "pypi", "ruby", "go"];
+
+const PUBLIC_BASES = {
+	maven: "https://repo1.maven.org/maven2/",
+	npm: "https://registry.npmjs.org/",
+	pypi: "https://pypi.org/pypi/",
+	ruby: "https://rubygems.org/api/v1/gems/",
+	go: "https://proxy.golang.org/",
+};
+
+function normalise(url) {
+	if (!url) return url;
+	return url.endsWith("/") ? url : url + "/";
+}
+
+function splitUrlAuth(url) {
+	if (!url) return { url, auth: null };
+	try {
+		const u = new URL(url);
+		if (u.username || u.password) {
+			const auth = decodeURIComponent(u.username) + ":" + decodeURIComponent(u.password);
+			u.username = ""; u.password = "";
+			return { url: u.toString(), auth };
+		}
+	} catch { /* not a URL */ }
+	return { url, auth: null };
+}
+
+function authHeaderFor(entry) {
+	if (!entry) return null;
+	if (entry.token) return "Bearer " + entry.token;
+	if (entry.auth) return "Basic " + Buffer.from(entry.auth).toString("base64");
+	return null;
+}
+
+/** Union of registry entries from several layers (arrays). Dedup by URL, first wins. */
+function buildRegistryList(_ecosystem, layers = []) {
+	const out = [];
+	const seen = new Set();
+	for (const layer of layers) {
+		for (const r of layer || []) {
+			if (!r?.url) continue;
+			const { url, auth } = splitUrlAuth(normalise(r.url));
+			if (seen.has(url)) continue;
+			seen.add(url);
+			out.push({ name: r.name || url, url, auth: r.auth || auth || null, token: r.token || null });
+		}
+	}
+	return out;
+}
+
+/** Append the ecosystem's public base (no auth) as the final fallback. */
+function withPublic(ecosystem, list) {
+	const pub = PUBLIC_BASES[ecosystem];
+	const out = [...(list || [])];
+	if (pub && !out.some(r => normalise(r.url) === pub)) out.push({ name: "public", url: pub, auth: null, token: null });
+	return out;
+}
+
+/** Merge two registry maps (eco → entries[]) into one (concat per eco). */
+function mergeRegistryMaps(...maps) {
+	const out = {};
+	for (const m of maps) {
+		if (!m || typeof m !== "object") continue;
+		for (const eco of Object.keys(m)) {
+			if (!Array.isArray(m[eco])) continue;
+			out[eco] = (out[eco] || []).concat(m[eco]);
+		}
+	}
+	return out;
+}
+
+/**
+ * Try each base in order; return the first response whose `res.ok` is true,
+ * as { res, base, url }. Applies per-base auth. opts.fetcher for tests.
+ */
+async function fetchFirstOk(bases, buildUrl, opts = {}) {
+	const { fetcher = globalThis.fetch, userAgent = "fad-checker", timeoutMs, onMiss } = opts;
+	for (const base of bases) {
+		const url = buildUrl(normalise(base.url));
+		const headers = { "User-Agent": userAgent, Accept: "application/json" };
+		const ah = authHeaderFor(base);
+		if (ah) headers.Authorization = ah;
+		let res;
+		try {
+			res = await fetcher(url, { headers, ...(timeoutMs ? { signal: AbortSignal.timeout(timeoutMs) } : {}) });
+		} catch (err) { if (onMiss) onMiss(base, `network: ${err.message}`); continue; }
+		if (res.ok) return { res, base, url };
+		if (onMiss) onMiss(base, `HTTP ${res.status}`);
+	}
+	return null;
+}
+
+module.exports = {
+	SUPPORTED, PUBLIC_BASES,
+	normalise, splitUrlAuth, authHeaderFor,
+	buildRegistryList, withPublic, mergeRegistryMaps, fetchFirstOk,
+};