fad-checker 2.1.1 → 2.2.0

package/lib/retire.js

@@ -101,6 +101,11 @@ async function ensureSignatures({ verbose, offline } = {}) {
 // when available so retire loads signatures from disk instead of the network.
 function buildRetireArgs({ srcDir, outPath, ignoredDirs, jsRepo }) {
 	const args = [
+		// --verbose makes retire list EVERY identified library, not just the
+		// vulnerable ones (its own wording: "by default only vulnerable files are
+		// shown"). We need the full set for the vendored-JS inventory chapter;
+		// vulnerable findings are still flagged in each result's `vulnerabilities`.
+		"--verbose",
 		"--outputformat", "json",
 		"--outputpath", outPath,
 		"--jspath", srcDir,
@@ -110,6 +115,51 @@ function buildRetireArgs({ srcDir, outPath, ignoredDirs, jsRepo }) {
 	return args;
 }
 
+const SEV_RANK = { critical: 5, high: 4, medium: 3, low: 2, none: 1 };
+
+/**
+ * Extract the full inventory of identified vendored JS libraries (vulnerable or
+ * not) from retire's --verbose output. Each entry: the standalone library, where
+ * it lives, how retire identified it, and whether it carries known vulns.
+ * This is a governance/cyber-hygiene signal: third-party code no package manager
+ * governs (unknown provenance, integrity, patch story) — the JS twin of the
+ * native-binary inventory (chapter 1C).
+ */
+function extractVendoredInventory(raw, srcDir) {
+	const out = [];
+	if (!raw) return out;
+	const files = Array.isArray(raw) ? raw : (raw.data || []);
+	for (const f of files) {
+		const file = f.file;
+		const relFile = srcDir && file?.startsWith(srcDir) ? path.relative(srcDir, file) : file;
+		for (const res of f.results || []) {
+			if (!res.component) continue;
+			const vulns = res.vulnerabilities || [];
+			let maxSeverity = null;
+			for (const v of vulns) {
+				const s = (v.severity || "").toLowerCase();
+				if (!maxSeverity || (SEV_RANK[s] || 0) > (SEV_RANK[maxSeverity] || 0)) maxSeverity = s;
+			}
+			out.push({
+				component: res.component,
+				version: res.version || null,
+				file: relFile || null,
+				detection: res.detection || null,
+				vulnerable: vulns.length > 0,
+				vulnCount: vulns.length,
+				maxSeverity: maxSeverity ? maxSeverity.toUpperCase() : null,
+			});
+		}
+	}
+	// Vulnerable first (by severity), then by component/version/file for stability.
+	out.sort((a, b) =>
+		(SEV_RANK[(b.maxSeverity || "").toLowerCase()] || 0) - (SEV_RANK[(a.maxSeverity || "").toLowerCase()] || 0)
+		|| String(a.component).localeCompare(String(b.component))
+		|| String(a.version).localeCompare(String(b.version))
+		|| String(a.file).localeCompare(String(b.file)));
+	return out;
+}
+
 /**
  * Run retire.js against `srcDir`. Returns the parsed JSON output (an array
  * of file-level findings) or null if retire is unavailable.
@@ -263,8 +313,24 @@ async function scanWithRetire(srcDir, opts = {}) {
 	return normaliseRetireResults(raw, srcDir);
 }
 
+/**
+ * Like scanWithRetire but returns BOTH the vulnerable matches (chapter "Vendored
+ * JS") and the full identified-library inventory (chapter "Unmanaged / vendored
+ * JavaScript"). One retire run feeds both.
+ */
+async function scanWithRetireFull(srcDir, opts = {}) {
+	const raw = await runRetire(srcDir, opts);
+	if (!raw) return { matches: [], inventory: [] };
+	return {
+		matches: normaliseRetireResults(raw, srcDir),
+		inventory: extractVendoredInventory(raw, srcDir),
+	};
+}
+
 module.exports = {
 	scanWithRetire,
+	scanWithRetireFull,
+	extractVendoredInventory,
 	runRetire,
 	normaliseRetireResults,
 	findRetireBin,

package/lib/scan-completeness.js

@@ -40,7 +40,13 @@ function detectScanCompletenessWarnings(resolvedDeps, opts = {}) {
 	// BOMs themselves: a present-and-correct BOM is not a problem.
 	const unresolved = [];
 	for (const d of resolvedDeps.values()) {
-		if (d.ecosystem === "npm") continue; // lockfile already pins everything
+		// Maven-only: the unresolved-version case (external BOM / out-of-tree
+		// property) is specific to Maven. Other ecosystems pin via lockfile, and
+		// native binaries (provenance:"binary") are identified by checksum, not a
+		// version — they belong to the Unmanaged/vendored-binaries chapter, NOT
+		// here. Including them mislabelled e.g. libeay32.dll as a Maven dep.
+		if (d.ecosystem !== "maven") continue;
+		if (d.provenance === "binary") continue;
 		if (d.scope === "import") continue;  // BOM-pointer entries themselves: not a dep
 		if (!d.version) unresolved.push({ ...d, reason: "no-version" });
 		else if (/\$\{[^}]+\}/.test(String(d.version))) unresolved.push({ ...d, reason: "unresolved-property" });

package/lib/unmanaged.js

@@ -0,0 +1,82 @@
+/**
+ * lib/unmanaged.js — enrich unmanaged (hash-bearing) records with online identity
+ * + an integrity classification.
+ *
+ *   integrity:
+ *     "pristine"    — deps.dev matched: file is byte-identical to a PUBLISHED package
+ *                     artifact (so it's unmodified, and ought to be a managed dep).
+ *     "known-good"  — CIRCL matched: a known OS/distro/CDN/NSRL file.
+ *     "unknown"     — no source recognises the hash (suspicious / vendored unknown).
+ *
+ * Records carrying a declared coordinate (embedded jars) gain a "modified" status in
+ * a later refinement; Plan 2 covers the hash-bearing binary records.
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
+ */
+const { lookupHash, loadCache, saveCache } = require("./hash-id");
+
+async function enrichUnmanaged(resolved, opts = {}) {
+	const { fetcher, offline = false, cache, onProgress } = opts;
+	const targets = [...resolved.values()].filter(d => d.hashes && (d.hashes.sha1 || d.hashes.sha256));
+	const summary = { total: targets.length, identified: 0, pristine: 0, knownGood: 0, unknown: 0, malicious: 0 };
+	if (!targets.length) return summary;
+	const entries = cache || loadCache();
+	let done = 0;
+	for (const d of targets) {
+		const id = await lookupHash(d.hashes, { fetcher, offline, cache: entries });
+		d.identity = id || null;
+		if (!id) d.integrity = "unknown";
+		else if (id.source === "deps.dev") d.integrity = "pristine";
+		else d.integrity = "known-good";
+		if (id) summary.identified++;
+		if (d.integrity === "pristine") summary.pristine++;
+		else if (d.integrity === "known-good") summary.knownGood++;
+		else summary.unknown++;
+		if (id?.knownMalicious) summary.malicious++;
+		if (onProgress) onProgress(++done, targets.length);
+	}
+	if (!cache && !offline) saveCache(entries);
+	return summary;
+}
+
+function normName(s) {
+	return String(s || "").toLowerCase()
+		.replace(/\.(dll|exe|so|dylib)(\.\d+)*$/, "")  // drop binary extension (+ soname version)
+		.replace(/^lib/, "")                            // libssl → ssl
+		.replace(/[-_.]?\d[\d.]*$/, "")                 // trailing version
+		.replace(/[^a-z0-9]/g, "");
+}
+
+/** Lenient compare of a filename to an online identity name (last :/ segment). */
+function nameMatches(declared, identityName) {
+	const a = normName(declared);
+	const b = normName(String(identityName).split(/[:/]/).pop());
+	if (!a || !b) return true;        // can't compare → don't raise a false alarm
+	return a.includes(b) || b.includes(a);
+}
+
+/** Turn the unmanaged (hash-bearing) records into an inventory with derived signals. */
+function buildInventory(resolved) {
+	const out = [];
+	for (const d of resolved.values()) {
+		if (!d.hashes || !(d.provenance === "binary" || d.provenance === "embedded")) continue;
+		const identity = d.identity || null;
+		out.push({
+			path: d.manifestPaths?.[0] || d.declaredName || null,
+			declaredName: d.declaredName || d.name || null,
+			provenance: d.provenance,
+			hashes: d.hashes,
+			identity,
+			integrity: d.integrity || "unknown",
+			noOnlineInfo: !identity,
+			shouldBeManaged: !!(identity && identity.ecosystem),
+			nameMismatch: !!(identity && identity.name && !nameMatches(d.declaredName || d.name, identity.name)),
+			knownMalicious: !!(identity && identity.knownMalicious),
+		});
+	}
+	out.sort((a, b) => String(a.path).localeCompare(String(b.path)));
+	return out;
+}
+
+module.exports = { enrichUnmanaged, buildInventory, nameMatches };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fad-checker",
-  "version": "2.1.1",
+  "version": "2.2.0",
   "description": "Scan ALL Maven, npm, Yarn, Composer, Python, C#/.NET, Go & Ruby dependencies — plus embedded JARs (fat-jars/war/ear) — in a source tree ONE SHOT without mvn/python/etc — CVE (EPSS/KEV-prioritised), EOL, obsolete, outdated & licenses, with SBOM/CSAF/SARIF/JSON exports, CI gating and fix recos",
   "keywords": [
     "sca",