fad-checker 2.1.2 → 2.2.0

package/fad-checker.js

@@ -61,8 +61,9 @@ if (process.argv.includes("--show-config")) {
 	const cfg = config.load();
 	const masked = { ...cfg };
 	if (masked.nvd_api_key) masked.nvd_api_key = masked.nvd_api_key.slice(0, 8) + "…" + masked.nvd_api_key.slice(-4);
-	if (Array.isArray(masked.maven_repos)) {
-		masked.maven_repos = masked.maven_repos.map(r => ({ ...r, auth: r.auth ? "***" : undefined }));
+	if (masked.registries && typeof masked.registries === "object") {
+		masked.registries = Object.fromEntries(Object.entries(masked.registries).map(([eco, list]) =>
+			[eco, (list || []).map(r => ({ ...r, auth: r.auth ? "***" : undefined, token: r.token ? "***" : undefined }))]));
 	}
 	console.log(JSON.stringify(masked, null, 2));
 	console.log(chalk.gray("Config file: " + config.CONFIG_PATH));
@@ -72,44 +73,58 @@ if (process.argv.includes("--show-config")) {
 // -------- --add-repo / --remove-repo / --list-repos (run before program.parse) --------
 if (process.argv.includes("--add-repo") || process.argv.includes("--remove-repo") || process.argv.includes("--list-repos")) {
 	const config = require("./lib/config");
+	const { SUPPORTED } = require("./lib/registries");
+	const ecoErr = eco => {
+		if (!SUPPORTED.includes(eco)) {
+			console.error(chalk.red(`❌  unknown ecosystem "${eco}". Supported: ${SUPPORTED.join(", ")}`));
+			process.exit(1);
+		}
+	};
 	if (process.argv.includes("--list-repos")) {
-		const repos = config.getMavenRepos();
-		if (!repos.length) {
-			console.log(chalk.gray("No custom Maven repos configured (Maven Central is always used as fallback)."));
+		const map = config.getRegistryMap();
+		const ecos = Object.keys(map).filter(e => (map[e] || []).length);
+		if (!ecos.length) {
+			console.log(chalk.gray("No custom registries configured (public registries are always the fallback)."));
 		} else {
-			console.log(chalk.bold("Configured Maven repos (tried in order, then Central):"));
-			for (const r of repos) {
-				const authMark = r.auth ? chalk.yellow(" [auth]") : "";
-				console.log(`  • ${chalk.cyan(r.name)} → ${r.url}${authMark}`);
+			for (const eco of ecos) {
+				console.log(chalk.bold(`${eco} (tried in order, then public):`));
+				for (const r of map[eco]) {
+					const authMark = (r.auth || r.token) ? chalk.yellow(" [auth]") : "";
+					console.log(`  • ${chalk.cyan(r.name)} → ${r.url}${authMark}`);
+				}
 			}
 		}
 		process.exit(0);
 	}
 	if (process.argv.includes("--add-repo")) {
 		const idx = process.argv.indexOf("--add-repo");
-		const name = process.argv[idx + 1];
-		const url = process.argv[idx + 2];
-		if (!name || name.startsWith("-") || !url || url.startsWith("-")) {
-			console.error(chalk.red("❌  --add-repo requires <name> <url>"));
-			console.error("   Example: fad-checker --add-repo nexus https://nexus.acme.com/repository/maven-public/");
-			console.error("   Optional auth: --add-repo nexus https://nexus.acme.com/repository/maven-public/ --auth user:pass");
+		const [eco, name, url] = [process.argv[idx + 1], process.argv[idx + 2], process.argv[idx + 3]];
+		if (!eco || !name || !url || [eco, name, url].some(a => a.startsWith("-"))) {
+			console.error(chalk.red("❌  --add-repo requires <ecosystem> <name> <url>"));
+			console.error("   Example: fad-checker --add-repo npm verdaccio https://npm.acme/ --token TOK");
+			console.error("   Maven:   fad-checker --add-repo maven nexus https://nexus.acme/maven-public/ --auth user:pass");
 			process.exit(1);
 		}
+		ecoErr(eco);
 		const authIdx = process.argv.indexOf("--auth");
-		const auth = authIdx > -1 ? process.argv[authIdx + 1] : null;
-		config.addMavenRepo(name, url, auth);
-		console.log(chalk.green(`✅ Added Maven repo "${name}" → ${url}${auth ? " (with auth)" : ""}`));
+		const tokIdx = process.argv.indexOf("--token");
+		config.addRegistry(eco, name, url, {
+			auth: authIdx > -1 ? process.argv[authIdx + 1] : null,
+			token: tokIdx > -1 ? process.argv[tokIdx + 1] : null,
+		});
+		console.log(chalk.green(`✅ Added ${eco} registry "${name}" → ${url}`));
 		process.exit(0);
 	}
 	if (process.argv.includes("--remove-repo")) {
 		const idx = process.argv.indexOf("--remove-repo");
-		const name = process.argv[idx + 1];
-		if (!name || name.startsWith("-")) {
-			console.error(chalk.red("❌  --remove-repo requires <name>"));
+		const [eco, name] = [process.argv[idx + 1], process.argv[idx + 2]];
+		if (!eco || !name || [eco, name].some(a => a.startsWith("-"))) {
+			console.error(chalk.red("❌  --remove-repo requires <ecosystem> <name>"));
 			process.exit(1);
 		}
-		const removed = config.removeMavenRepo(name);
-		console.log(removed ? chalk.green(`✅ Removed Maven repo "${name}"`) : chalk.yellow(`⚠️  No Maven repo named "${name}"`));
+		ecoErr(eco);
+		const removed = config.removeRegistry(eco, name);
+		console.log(removed ? chalk.green(`✅ Removed ${eco} registry "${name}"`) : chalk.yellow(`⚠️  No ${eco} registry named "${name}"`));
 		process.exit(removed ? 0 : 1);
 	}
 }
@@ -169,7 +184,11 @@ program
 	.option("-t, --target <target>", "output directory (will be rm before written). If omitted, the run is read-only.")
 	// Not a requiredOption: --import-anonymized scans a descriptor with no source tree.
 	.option("-s, --src <src>", "root directory containing pom.xml files")
-	.option("-e, --exclude <exclude>", "regex of groupId to exclude, e.g. '^(client|private)\\.'")
+	.option("--source <src>", "alias of --src (also the JSON config key 'source')")
+	.option("--config <file>", "load default options from a JSON config file (else ./.fad-env.json)")
+	.option("-e, --exclude <exclude>", "regex of groupId/name to exclude, e.g. '^(client|private)\\.'")
+	.option("--exclude-path <glob...>", "ignore sub-paths during the walk (gitignore-style glob, relative to --src). Repeatable. e.g. 'packages/legacy/**' '**/fixtures/**'")
+	.option("--no-default-excludes", "don't prune the built-in ignored dirs (node_modules, vendor, target, .git, …) — walk everything")
 	.option("-v, --verbose", "verbose")
 	// Defaults: report + transitive + allLibs all ON. Use --no-* to disable.
 	.option("--no-report", "write NO output files at all — the scan, terminal summary and --fail-on gate still run (gate-only / CI mode)")
@@ -207,6 +226,7 @@ program
 	.option("--cve-offline", "use cached CVE index only (no download)")
 	.option("--snyk", "run snyk on cleaned POMs and merge into report (requires --target)")
 	.option("--no-retire", "skip retire.js vendored-JS scan")
+	.option("--no-vendored-js-inventory", "don't list ALL identified vendored JS libs (chapter 1D) — keep only the vulnerable ones (chapter 2)")
 	.option("--retire-refresh", "ignore retire cache and re-scan")
 	.option("--transitive-depth <n>", "max transitive depth", "6")
 	.option("--ecosystem <list>", "codecs to run: auto|all|<comma list> e.g. maven,npm,nuget,composer,pypi,go,ruby (default: auto = detected)", "auto")
@@ -218,16 +238,35 @@ program
 	.option("--no-pypi", "skip the PyPI (Python) codec")
 	.option("--no-go", "skip the Go codec")
 	.option("--no-ruby", "skip the Ruby (Bundler) codec")
+	.option("--no-binaries", "skip scanning committed native binaries (.dll/.exe/.so/.dylib)")
 	.option("--no-jars", "skip scanning embedded .jar/.war/.ear binaries for Maven coordinates")
 	.option("--no-js", "alias: skip JS/npm/yarn manifests even if present (Maven-only)")
-	.option("--repo <url...>", "extra Maven repository URL(s) to try before Maven Central. Supports https://user:pass@host/path/. Repeatable.")
-	.option("--add-repo <name>", "persist a Maven repo: --add-repo <name> <url> [--auth user:pass]")
-	.option("--remove-repo <name>", "remove a persisted Maven repo by name")
-	.option("--list-repos", "list configured Maven repos and exit")
+	.option("--repo <eco=url...>", "extra registry as <ecosystem>=<url> (e.g. npm=https://npm.acme/) tried before the public one. Repeatable. Supports https://user:pass@host/.")
+	.option("--add-repo <eco>", "persist a registry: --add-repo <ecosystem> <name> <url> [--auth user:pass] [--token TOK]")
+	.option("--remove-repo <eco>", "remove a persisted registry: --remove-repo <ecosystem> <name>")
+	.option("--list-repos", "list configured registries (grouped by ecosystem) and exit")
+	.option("--auth <user:pass>", "Basic auth for --add-repo")
+	.option("--token <token>", "Bearer token for --add-repo")
 	.option("--completion <shell>", "print shell completion script (bash|zsh)");
 program.parse(process.argv);
 
 const options = program.opts();
+// Layered config: CLI flags > config file (--config / ./.fad-env.json, JSON) >
+// FAD_CHECKER_ENV (a CLI-flag string) > global ~/.fad-checker/config.json >
+// commander defaults. A file/env value fills an option only if the CLI didn't
+// set it. `registries` are unioned separately (below). Source has src/source aliases.
+const { loadLayers, applyLayers } = require("./lib/options-env");
+let _layers = { fileLayer: {}, envLayer: {}, envRepos: [] };
+try {
+	_layers = loadLayers({ cwd: process.cwd(), configPath: options.config, envStr: process.env.FAD_CHECKER_ENV, program });
+} catch (err) {
+	console.error(chalk.red(`❌  ${err.message}`));
+	process.exit(1);
+}
+Object.assign(options, applyLayers(program, _layers, require("./lib/config").load()));
+// --source CLI alias → src (applyLayers already maps the file/env JSON 'source' key).
+if (!options.src && options.source) options.src = options.source;
+
 const deps2Exclude = options.exclude ? new RegExp(options.exclude) : null;
 const verbose = !!options.verbose;
 
@@ -362,13 +401,44 @@ async function timedPhase(label, fn) {
 	// Build the Maven repo list once: persisted repos (from ~/.fad-checker/config.json)
 	// + ad-hoc --repo URLs + Maven Central as final fallback. Used by transitive
 	// resolution, outdated-version check, and existence check.
-	const { getMavenRepos } = require("./lib/config");
+	const { getRegistryMap } = require("./lib/config");
 	const { buildRepoList } = require("./lib/maven-repo");
-	const extraRepos = (options.repo || []).map(url => ({ url }));
-	const mavenRepos = buildRepoList(getMavenRepos(), extraRepos);
+	const { buildRegistryList } = require("./lib/registries");
+	// One-off --repo eco=url (from the CLI and the env layer), grouped by ecosystem.
+	const cliRepoMap = {};
+	for (const spec of [...(options.repo || []), ...(_layers.envRepos || [])]) {
+		const m = /^([a-z]+)=(.+)$/i.exec(String(spec));
+		if (!m) { console.error(chalk.red(`❌  --repo expects <ecosystem>=<url>, got "${spec}"`)); process.exit(1); }
+		(cliRepoMap[m[1]] ||= []).push({ url: m[2] });
+	}
+	// Union the registry sources: global config + config-file JSON + CLI/env one-offs.
+	const fileRegMap = (_layers.fileLayer && _layers.fileLayer.registries) || {};
+	const globalRegMap = getRegistryMap();
+	const regMap = {};
+	for (const eco of new Set([...Object.keys(globalRegMap), ...Object.keys(fileRegMap), ...Object.keys(cliRepoMap)])) {
+		regMap[eco] = buildRegistryList(eco, [globalRegMap[eco], fileRegMap[eco], cliRepoMap[eco]]);
+	}
+	const registriesFor = eco => regMap[eco] || [];
+	const mavenRepos = buildRepoList(regMap.maven || [], []); // appends Maven Central last
+
+	// Walk-pruning: union --exclude-path globs across every config layer (CLI + file
+	// + env + global), like registries. `defaultExcludes` (a scalar, false via
+	// --no-default-excludes) already flowed through applyLayers.
+	const excludePath = [...new Set([
+		...(options.excludePath || []),
+		...((_layers.fileLayer && _layers.fileLayer.excludePath) || []),
+		...((_layers.envLayer && _layers.envLayer.excludePath) || []),
+		...(require("./lib/config").get("excludePath") || []),
+	].filter(Boolean))];
+	const defaultExcludes = options.defaultExcludes !== false;
+	const walkOpts = { excludePath, defaultExcludes };
 	const runMode = options.importAnonymized ? "import descriptor" : (options.offline ? "offline" : "online");
 	if (options.src) ui.kv("source", chalk.white(options.src));
 	if (mavenRepos.length > 1) ui.kv("repos", chalk.white(mavenRepos.map(r => r.name).join(chalk.dim(" → "))));
+	const otherRegs = Object.keys(regMap).filter(e => e !== "maven" && regMap[e].length);
+	if (otherRegs.length) ui.kv("registries", chalk.white(otherRegs.map(e => `${e}:${regMap[e].length}`).join(" ")));
+	if (excludePath.length) ui.kv("exclude-path", chalk.white(excludePath.join(chalk.dim(", "))));
+	if (!defaultExcludes) ui.kv("default-excludes", chalk.yellow("off (walking node_modules/vendor/.git/…)"));
 	ui.kv("mode", chalk.white(runMode));
 
 	let wrotePom = 0;
@@ -394,7 +464,7 @@ async function timedPhase(label, fn) {
 			const { warmRetireSignatures } = require("./lib/retire");
 			await warmRetireSignatures({ verbose });
 		}
-		await runReportFlow(resolved, { activeIds, runMaven, runNpm, privateLibIds: [], mavenRepos, collectWarnings: [] });
+		await runReportFlow(resolved, { activeIds, runMaven, runNpm, privateLibIds: [], mavenRepos, regMap, collectWarnings: [] });
 		return;
 	}
 
@@ -403,9 +473,15 @@ async function timedPhase(label, fn) {
 	const { resolveActiveCodecs } = require("./lib/codecs/select");
 	const eco = (options.ecosystem || "auto").toLowerCase();
 	const detected = (eco === "auto")
-		? (await timedPhase("detecting ecosystems", () => detectCodecs(options.src))).map(c => c.id)
+		? (await timedPhase("detecting ecosystems", () => detectCodecs(options.src, walkOpts))).map(c => c.id)
 		: allCodecs().map(c => c.id);
+	// The binary scanner is a cross-cutting catch-all (committed native libs in ANY
+	// project), and detectCodecs' manifest-glob matcher misses versioned sonames
+	// (libz.so.1). Always make it a candidate in auto mode; --no-binaries removes it.
+	if (eco === "auto" && !detected.includes("binary")) detected.push("binary");
 	const noCodecs = ["maven", "npm", "yarn", "nuget", "composer", "pypi", "go", "ruby"].filter(id => options[id] === false);
+	// `--no-binaries` maps to options.binaries (plural) but the codec id is `binary`.
+	if (options.binaries === false) noCodecs.push("binary");
 	const activeIds = resolveActiveCodecs(eco, detected, { noCodecs, noJs: !options.js });
 	const runMaven = activeIds.includes("maven");
 	const runNpm = activeIds.includes("npm") || activeIds.includes("yarn");
@@ -422,7 +498,7 @@ async function timedPhase(label, fn) {
 		const codec = getCodec(id);
 		let res;
 		try {
-			res = await timedPhase(`collecting ${codec.label || id}`, () => codec.collect(options.src, { ignoreTest: !!options.ignoreTest, deps2Exclude, verbose, scanJars: options.jars !== false, srcRoot: options.src, onJarProgress: makeJarProgress() }));
+			res = await timedPhase(`collecting ${codec.label || id}`, () => codec.collect(options.src, { ignoreTest: !!options.ignoreTest, deps2Exclude, verbose, scanJars: options.jars !== false, srcRoot: options.src, excludePath, defaultExcludes, onJarProgress: makeJarProgress(), onBinaryProgress: null }));
 		} catch (err) {
 			console.warn(chalk.red(`❌  ${id} collect failed:`), chalk.dim(err.message));
 			continue;
@@ -435,8 +511,10 @@ async function timedPhase(label, fn) {
 	// --- Collection summary ---
 	const ecoCount = {};
 	let embeddedCount = 0;
+	let binaryCount = 0;
 	for (const d of resolved.values()) {
 		if (d.provenance === "embedded") { embeddedCount++; continue; } // counted separately below
+		if (d.provenance === "binary") { binaryCount++; continue; }     // committed native libs, no manifest
 		ecoCount[d.ecosystem] = (ecoCount[d.ecosystem] || 0) + 1;
 	}
 	if (runMaven) ui.ok(`${chalk.bold("Maven".padEnd(8))} ${mavenCtx ? mavenCtx.pomFiles.length + " module(s) · " : ""}${ecoCount.maven || 0} direct dep(s)`);
@@ -446,6 +524,7 @@ async function timedPhase(label, fn) {
 		ui.ok(`${chalk.bold(((getCodec(id)?.label) || id).padEnd(8))} ${n} dep(s)`);
 	}
 	if (embeddedCount) ui.ok(`${chalk.bold("Embedded".padEnd(8))} ${embeddedCount} coord(s) in .jar/.war/.ear`);
+	if (binaryCount) ui.ok(`${chalk.bold("Binary".padEnd(8))} ${binaryCount} native lib(s) (.dll/.exe/.so/.dylib)`);
 	if (!ecoCount.maven && !ecoCount.npm && !Object.keys(ecoCount).length) ui.warn("no dependencies found in the source tree");
 	if (collectWarnings.length) {
 		ui.warn(`${collectWarnings.length} manifest warning(s) — best-effort / no lockfile:`);
@@ -567,7 +646,7 @@ async function timedPhase(label, fn) {
 	// The scan always runs — it feeds the terminal summary, the file outputs and the
 	// CI gate. Which files get written is decided by the --report-* family inside
 	// (HTML + .doc by default; --no-report writes nothing).
-	await runReportFlow(resolved, { activeIds, runMaven, runNpm, privateLibIds, mavenRepos, collectWarnings });
+	await runReportFlow(resolved, { activeIds, runMaven, runNpm, privateLibIds, mavenRepos, regMap, collectWarnings });
 	if (!readOnly) {
 		ui.section("Next step");
 		ui.info(`run Snyk on the cleaned tree:`);
@@ -576,7 +655,8 @@ async function timedPhase(label, fn) {
 })();
 
 async function runReportFlow(resolved, ecoFlags = {}) {
-	const { activeIds = [], runMaven = true, runNpm = false, privateLibIds = [], mavenRepos = [], collectWarnings = [] } = ecoFlags;
+	const { activeIds = [], runMaven = true, runNpm = false, privateLibIds = [], mavenRepos = [], regMap = {}, collectWarnings = [] } = ecoFlags;
+	const registriesFor = eco => regMap[eco] || [];
 	const { expandWithTransitives } = require("./lib/cve-match");
 	const { writeReports, computeStats } = require("./lib/cve-report");
 	const { getCodec } = require("./lib/codecs");
@@ -621,9 +701,11 @@ async function runReportFlow(resolved, ecoFlags = {}) {
 	const willKev = !!options.kev;
 	const willLicenses = !!options.licenses;
 	const willRetire = !!options.retire;
+	// Identify committed native binaries by checksum (deps.dev + CIRCL) when present.
+	const willBinaryId = [...resolved.values()].some(d => d.provenance === "binary");
 	// License detection piggybacks on the registry passes (same fetched metadata),
 	// so it adds no progress step of its own.
-	const totalSteps = [willTransitive, willCve, /*EOL*/ true, willOutdated, /*npm reg*/ true, ...otherRegistryIds.map(() => true), willOsv, willNvd, willEpss, willKev, willRetire].filter(Boolean).length;
+	const totalSteps = [willTransitive, willCve, /*EOL*/ true, willOutdated, /*npm reg*/ true, ...otherRegistryIds.map(() => true), willOsv, willNvd, willEpss, willKev, willRetire, willBinaryId].filter(Boolean).length;
 	const progress = new ui.Progress(totalSteps);
 
 	if (willTransitive) {
@@ -653,6 +735,17 @@ async function runReportFlow(resolved, ecoFlags = {}) {
 		}
 	}
 
+	// 1c. Identify committed native binaries by checksum (deps.dev → CIRCL).
+	if (willBinaryId) {
+		const st = progress.start("Binary identification (deps.dev + CIRCL)");
+		try {
+			const { enrichUnmanaged } = require("./lib/unmanaged");
+			const s = await enrichUnmanaged(resolved, { offline, onProgress: (p, t) => st.tick(p, t) });
+			const bits = [`${s.identified}/${s.total} identified`, s.pristine ? `${s.pristine} pristine` : null, s.unknown ? `${s.unknown} unknown` : null, s.malicious ? `${s.malicious} ⚠ malicious` : null].filter(Boolean).join(", ");
+			st.done(bits);
+		} catch (err) { st.fail(err.message); }
+	}
+
 	// 2. EOL frameworks (endoflife.date) — always a step.
 	let eolResults = [];
 	{
@@ -686,7 +779,7 @@ async function runReportFlow(resolved, ecoFlags = {}) {
 		const st = progress.start("npm registry");
 		try {
 			const { checkNpmRegistryDeps } = require("./lib/codecs/npm/registry");
-			const npmReg = await checkNpmRegistryDeps(resolved, { verbose, offline, allLibs: options.allLibs, onProgress: (p, t) => st.tick(p, t) });
+			const npmReg = await checkNpmRegistryDeps(resolved, { verbose, offline, allLibs: options.allLibs, registries: registriesFor("npm"), onProgress: (p, t) => st.tick(p, t) });
 			obsoleteResults = obsoleteResults.concat(npmReg.deprecated);
 			outdatedResults = outdatedResults.concat(npmReg.outdated);
 			licenseFindings = licenseFindings.concat(npmReg.licensed || []);
@@ -699,7 +792,7 @@ async function runReportFlow(resolved, ecoFlags = {}) {
 		const codec = getCodec(id);
 		const st = progress.start(`${codec.label || id} registry`);
 		try {
-			const reg = await codec.checkRegistry(resolved, { verbose, offline, allLibs: options.allLibs, onProgress: (p, t) => st.tick(p, t) });
+			const reg = await codec.checkRegistry(resolved, { verbose, offline, allLibs: options.allLibs, registries: registriesFor(id), onProgress: (p, t) => st.tick(p, t) });
 			obsoleteResults = obsoleteResults.concat(reg.deprecated || []);
 			outdatedResults = outdatedResults.concat(reg.outdated || []);
 			licenseFindings = licenseFindings.concat(reg.licensed || []);
@@ -793,6 +886,7 @@ async function runReportFlow(resolved, ecoFlags = {}) {
 	// vendored .js (which can live in a Maven project's resources too). The
 	// scanner is owned by the npm codec but runs whenever --retire is on.
 	let retireMatches = [];
+	let vendoredJsInventory = [];
 	if (willRetire) {
 		const st = progress.start("retire.js (vendored JS)");
 		const sc = (getCodec("npm").nativeScanners || []).find(s => s.kind === "vendored");
@@ -802,7 +896,9 @@ async function runReportFlow(resolved, ecoFlags = {}) {
 			try {
 				const r = await sc.scan(resolved, { src: options.src, verbose, retireRefresh: !!options.retireRefresh, offline });
 				retireMatches = r.matches || [];
-				st.done(`${retireMatches.length} finding(s)`);
+				if (options.vendoredJsInventory !== false) vendoredJsInventory = r.meta?.inventory || [];
+				const invN = vendoredJsInventory.length;
+				st.done(`${retireMatches.length} finding(s)${invN ? ` · ${invN} lib(s) inventoried` : ""}`);
 			} catch (err) { st.fail(err.message); }
 		}
 	}
@@ -865,6 +961,15 @@ async function runReportFlow(resolved, ecoFlags = {}) {
 	const sev = ui.sevColor;
 	const depLabel = d => d.ecosystem === "npm" ? `npm:${d.artifactId}` : `${d.groupId}:${d.artifactId}`;
 	const coordOf = depLabel;   // npm deps show as "npm:name", others as "g:a"
+	// Where a finding's dependency was declared — the pom.xml / package.json / jar
+	// (embedded jars carry a "app.jar!/BOOT-INF/lib/…" manifestPath). Shown so EOL /
+	// obsolete / outdated entries point at the file the reader has to edit.
+	const definedInOf = d => {
+		const paths = (d?.manifestPaths?.length ? d.manifestPaths : d?.pomPaths?.length ? d.pomPaths : []);
+		if (!paths.length) return "";
+		const rel = paths.map(p => { try { return path.relative(options.src, p); } catch { return p; } });
+		return chalk.dim(`  ← ${rel[0]}${rel.length > 1 ? ` (+${rel.length - 1})` : ""}`);
+	};
 	const fmtStats = s => [
 		s.critical ? sev("CRITICAL")(`${s.critical} critical`) : null,
 		s.high ? sev("HIGH")(`${s.high} high`) : null,
@@ -896,16 +1001,30 @@ async function runReportFlow(resolved, ecoFlags = {}) {
 		if (embeddedActive.length > 8) console.log(chalk.dim(`    …and ${embeddedActive.length - 8} more (see report ch.1B)`));
 	}
 
+	{
+		const { buildInventory } = require("./lib/unmanaged");
+		const inv = buildInventory(resolved);
+		if (inv.length) {
+			heading("Unmanaged binaries", inv.length);
+			for (const e of inv.slice(0, 10)) {
+				const id = e.identity ? `${e.identity.ecosystem ? e.identity.ecosystem + ":" : ""}${e.identity.name || ""}${e.identity.version ? "@" + e.identity.version : ""}` : chalk.dim("unknown");
+				const flags = [e.knownMalicious ? chalk.bgRed.white(" malicious ") : null, e.nameMismatch ? chalk.yellow("name≠checksum") : null, e.shouldBeManaged ? chalk.cyan("should-be-managed") : null, (e.noOnlineInfo ? chalk.dim("unknown") : null)].filter(Boolean).join(" ");
+				console.log("    " + chalk.white(path.basename(String(e.path))) + "  " + chalk.dim(id) + (flags ? "  " + flags : ""));
+			}
+			if (inv.length > 10) console.log(chalk.dim(`    …and ${inv.length - 10} more (see report ch.1C)`));
+		}
+	}
+
 	heading("EOL frameworks", eolResults.length);
-	for (const e of eolResults.slice(0, 8)) console.log("    " + chalk.yellow(e.product.padEnd(18)) + " " + chalk.dim(`${coordOf(e.dep)}:${e.dep.version}`) + " " + chalk.dim(e.eol === true ? "EOL" : String(e.eol)));
+	for (const e of eolResults.slice(0, 8)) console.log("    " + chalk.yellow(e.product.padEnd(18)) + " " + chalk.dim(`${coordOf(e.dep)}:${e.dep.version}`) + " " + chalk.dim(e.eol === true ? "EOL" : String(e.eol)) + definedInOf(e.dep));
 	if (eolResults.length > 8) console.log(chalk.dim(`    …and ${eolResults.length - 8} more`));
 
 	heading("Obsolete / deprecated", obsoleteResults.length);
-	for (const o of obsoleteResults.slice(0, 8)) console.log("    " + chalk.dim(`${coordOf(o.dep)}:${o.dep.version}`) + " → " + (o.replacement || chalk.dim("n/a")));
+	for (const o of obsoleteResults.slice(0, 8)) console.log("    " + chalk.dim(`${coordOf(o.dep)}:${o.dep.version}`) + " → " + (o.replacement || chalk.dim("n/a")) + definedInOf(o.dep));
 	if (obsoleteResults.length > 8) console.log(chalk.dim(`    …and ${obsoleteResults.length - 8} more`));
 
 	heading("Outdated", outdatedResults.length, options.allLibs ? "" : chalk.dim("pass -a/--allLibs to query registries"));
-	for (const o of outdatedResults.slice(0, 8)) console.log("    " + chalk.dim(coordOf(o.dep)) + ` ${o.dep.version} → ${chalk.green(o.latest)}`);
+	for (const o of outdatedResults.slice(0, 8)) console.log("    " + chalk.dim(coordOf(o.dep)) + ` ${o.dep.version} → ${chalk.green(o.latest)}` + definedInOf(o.dep));
 	if (outdatedResults.length > 8) console.log(chalk.dim(`    …and ${outdatedResults.length - 8} more`));
 
 	if (retireMatches.length) {
@@ -999,7 +1118,7 @@ async function runReportFlow(resolved, ecoFlags = {}) {
 	if (out.html || out.doc) {
 		await ensureDir(out.html); await ensureDir(out.doc);
 		const { htmlPath, docPath } = await writeReports({
-			cveMatches: prodMatches, devCveMatches: devMatches, embeddedMatches, retireMatches,
+			cveMatches: prodMatches, devCveMatches: devMatches, embeddedMatches, retireMatches, vendoredJsInventory,
 			eolResults, obsoleteResults, outdatedResults, licenseResults,
 			resolvedDeps: resolved, projectInfo, warnings: reportWarnings,
 			htmlPath: out.html, docPath: out.doc,
@@ -1030,7 +1149,7 @@ async function runReportFlow(resolved, ecoFlags = {}) {
 		try {
 			const { writeFindings } = require("./lib/json-export");
 			await ensureDir(out.json);
-			writeFindings({ cveMatches, retireMatches, eolResults, obsoleteResults, outdatedResults, licenseResults, resolvedDeps: resolved, projectInfo, toolVersion: pkg.version }, out.json);
+			writeFindings({ cveMatches, retireMatches, vendoredJsInventory, eolResults, obsoleteResults, outdatedResults, licenseResults, resolvedDeps: resolved, projectInfo, toolVersion: pkg.version }, out.json);
 			wrote.push(["Findings JSON", out.json]);
 		} catch (err) { ui.warn(`JSON export failed: ${err.message}`); }
 	}

package/lib/codecs/binary/scan.js

@@ -0,0 +1,71 @@
+/**
+ * lib/codecs/binary/scan.js — walk a source tree for committed NATIVE binaries
+ * (.dll/.exe/.so/.dylib) and hash each. Dependency archives (.jar/.war/.ear) are
+ * owned by the Maven codec's jar-scan.js, not here.
+ *
+ * Selection requires BOTH an allowlisted extension AND a confirming magic byte
+ * (sniff.js), so images/fonts/assets — even with a spoofed extension — are never
+ * hashed or reported.
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
+ */
+const fs = require("fs");
+const path = require("path");
+const crypto = require("crypto");
+const { sniffKind, extKind } = require("./sniff");
+
+// Same skip set the other codecs use; never a place vendored binaries we own live.
+const SKIP = new Set([
+	".git", ".idea", ".vscode", "node_modules", "dist", "build", "out",
+	"target", "vendor", "testdata", ".svn", ".hg", ".gradle", ".cache",
+]);
+
+const MAGIC_BYTES = 8;   // enough for every signature we sniff
+
+function hashFile(fp) {
+	const buf = fs.readFileSync(fp);
+	return {
+		size: buf.length,
+		sha1: crypto.createHash("sha1").update(buf).digest("hex"),
+		sha256: crypto.createHash("sha256").update(buf).digest("hex"),
+	};
+}
+
+function readMagic(fp) {
+	let fd;
+	try {
+		fd = fs.openSync(fp, "r");
+		const buf = Buffer.alloc(MAGIC_BYTES);
+		const n = fs.readSync(fd, buf, 0, MAGIC_BYTES, 0);
+		return buf.subarray(0, n);
+	} catch { return Buffer.alloc(0); }
+	finally { if (fd !== undefined) try { fs.closeSync(fd); } catch { /* ignore */ } }
+}
+
+/** Walk `dir`, return [{ path, kind, size, sha1, sha256, declaredName }]. */
+function scanBinaries(dir, opts = {}) {
+	const { onProgress } = opts;
+	const { makeDirFilter } = require("../../path-filter");
+	const skipDir = makeDirFilter({ srcRoot: opts.srcRoot || dir, defaultSkip: SKIP, excludePath: opts.excludePath, useDefaults: opts.defaultExcludes !== false });
+	const out = [];
+	const stack = [dir];
+	while (stack.length) {
+		const cur = stack.pop();
+		let entries; try { entries = fs.readdirSync(cur, { withFileTypes: true }); } catch { continue; }
+		for (const e of entries) {
+			const fp = path.join(cur, e.name);
+			if (e.isDirectory()) { if (!skipDir(fp, e.name)) stack.push(fp); continue; }
+			if (!e.isFile()) continue;
+			const ext = extKind(e.name);
+			if (!ext) continue;                          // not an allowlisted extension
+			if (sniffKind(readMagic(fp)) !== ext) continue;  // magic must confirm the extension
+			if (onProgress) onProgress(fp);
+			const h = hashFile(fp);
+			out.push({ path: fp, kind: ext, size: h.size, sha1: h.sha1, sha256: h.sha256, declaredName: e.name });
+		}
+	}
+	return out;
+}
+
+module.exports = { scanBinaries };

package/lib/codecs/binary/sniff.js

@@ -0,0 +1,37 @@
+/**
+ * lib/codecs/binary/sniff.js — file-type confirmation for the binary codec.
+ *
+ * Two gates: extKind() (extension allowlist) AND sniffKind() (magic bytes). A
+ * candidate is accepted only when both agree, so an image renamed `.so` (PNG
+ * magic) is rejected. We never trust the extension alone.
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
+ */
+
+// Magic-byte signatures → family. Mach-O has four (32/64-bit + fat, both endian).
+function sniffKind(buf) {
+	if (!buf || buf.length < 4) return null;
+	const b0 = buf[0], b1 = buf[1], b2 = buf[2], b3 = buf[3];
+	if (b0 === 0x4d && b1 === 0x5a) return "pe";                                   // MZ
+	if (b0 === 0x7f && b1 === 0x45 && b2 === 0x4c && b3 === 0x46) return "elf";    // \x7FELF
+	if (b0 === 0x50 && b1 === 0x4b && b2 === 0x03 && b3 === 0x04) return "zip";    // PK\x03\x04
+	const be = ((b0 << 24) | (b1 << 16) | (b2 << 8) | b3) >>> 0;
+	const le = ((b3 << 24) | (b2 << 16) | (b1 << 8) | b0) >>> 0;
+	const machO = new Set([0xfeedface, 0xfeedfacf, 0xcafebabe, 0xcafebabf]);
+	if (machO.has(be) || machO.has(le)) return "macho";
+	return null;
+}
+
+const EXT_PE = /\.(dll|exe)$/i;
+const EXT_MACHO = /\.dylib$/i;
+const EXT_ELF = /\.so(\.\d+)*$/i;   // .so, .so.1, .so.1.2.3
+
+function extKind(name) {
+	if (EXT_PE.test(name)) return "pe";
+	if (EXT_MACHO.test(name)) return "macho";
+	if (EXT_ELF.test(name)) return "elf";
+	return null;
+}
+
+module.exports = { sniffKind, extKind };

package/lib/codecs/binary.codec.js

@@ -0,0 +1,54 @@
+/**
+ * lib/codecs/binary.codec.js — codec for committed NATIVE binaries
+ * (.dll/.exe/.so/.dylib) that no package manager governs.
+ *
+ * Plan 1 scope: discover + hash only. The records carry no resolved coordinate
+ * (just a filename); Plan 2's hash-id service fills `identity`, Plan 3 builds the
+ * unmanaged inventory + report. Until then the records are `provenance:"binary"`
+ * and the CVE/OSV/EOL/outdated stages skip them (no coordinate to query).
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
+ */
+const { makeDepRecord } = require("../dep-record");
+const { scanBinaries } = require("./binary/scan");
+
+module.exports = {
+	id: "binary",
+	label: "Binaries",
+	osvEcosystem: null,                                   // no OSV ecosystem until identified
+	manifestNames: ["*.dll", "*.exe", "*.so", "*.dylib"], // lets detectCodecs include us in auto mode
+
+	detect(dir) {
+		try { return scanBinaries(dir, { onProgress: null }).length > 0; }
+		catch { return false; }
+	},
+
+	async collect(dir, opts = {}) {
+		const out = new Map();
+		const warnings = [];
+		let records;
+		try { records = scanBinaries(dir, { onProgress: opts.onBinaryProgress, srcRoot: opts.srcRoot || dir, excludePath: opts.excludePath, defaultExcludes: opts.defaultExcludes }); }
+		catch (e) { return { deps: out, warnings: [{ type: "scan-error", message: `binary scan failed: ${e.message}` }] }; }
+		for (const r of records) {
+			out.set(`binary:${r.path}`, makeDepRecord({
+				ecosystem: "binary",
+				name: r.declaredName,
+				version: null,
+				manifestPath: r.path,
+				provenance: "binary",
+				hashes: { sha1: r.sha1, sha256: r.sha256 },
+				declaredName: r.declaredName,
+			}));
+		}
+		return { deps: out, warnings };
+	},
+
+	coordKey(d) { return `binary:${d.manifestPaths?.[0] || d.name}`; },
+	formatCoord(d) { return d.declaredName || d.name; },
+	osvPackageName() { return null; },
+	async checkRegistry() { return { deprecated: [], outdated: [], licensed: [] }; },
+	resolveEolProduct() { return null; },
+	recipe: require("./recipes").binary,
+	nativeScanners: [],
+};

package/lib/codecs/composer.codec.js

@@ -15,7 +15,7 @@ const { parseComposerLock, parseComposerJson, isConcrete } = require("./composer
 
 const SKIP = new Set(["vendor", ".git", ".idea", ".vscode", "node_modules", "dist", "build", "out", "target"]);
 
-function findComposerManifests(dir) {
+function findComposerManifests(dir, skipDir = (child, name) => SKIP.has(name)) {
 	const groups = [];
 	const stack = [dir];
 	while (stack.length) {
@@ -29,11 +29,15 @@ function findComposerManifests(dir) {
 				composerLock: names.has("composer.lock") ? path.join(cur, "composer.lock") : null,
 			});
 		}
-		for (const e of entries) if (e.isDirectory() && !SKIP.has(e.name)) stack.push(path.join(cur, e.name));
+		for (const e of entries) if (e.isDirectory() && !skipDir(path.join(cur, e.name), e.name)) stack.push(path.join(cur, e.name));
 	}
 	return groups;
 }
 
+function dirFilter(dir, opts) {
+	return require("../path-filter").makeDirFilter({ srcRoot: opts.srcRoot || dir, defaultSkip: SKIP, excludePath: opts.excludePath, useDefaults: opts.defaultExcludes !== false });
+}
+
 module.exports = {
 	id: "composer",
 	label: "Composer",
@@ -46,7 +50,7 @@ module.exports = {
 		const { ignoreTest, deps2Exclude } = opts;
 		const out = new Map();
 		const warnings = [];
-		for (const g of findComposerManifests(dir)) {
+		for (const g of findComposerManifests(dir, dirFilter(dir, opts))) {
 			if (g.composerLock) {
 				let parsed;
 				try { parsed = parseComposerLock(g.composerLock); }