fad-checker 2.1.2 → 2.2.0

package/lib/config.js

@@ -44,35 +44,45 @@ function getNvdApiKey() {
 }
 
 /**
- * Custom Maven repositories (Nexus, Artifactory, JBoss, …) the user has
- * configured. Returned as an array of { name, url, auth? } where `auth` is
- * pre-encoded "user:pass" (caller wraps as Basic <base64>).
+ * Per-ecosystem custom registries (Nexus/Artifactory/JBoss, Verdaccio, devpi,
+ * Gemfury, Athens, …) the user has configured. Stored under config key
+ * `registries`: { <ecosystem>: [{ name, url, auth?, token? }] } where `auth` is
+ * "user:pass" (→ Basic) and `token` is a Bearer token.
  *
- * Maven Central is intentionally NOT included here — callers append it as
- * the final fallback. That keeps the user's repos in priority order while
- * always ensuring Central works as a safety net.
+ * Public registries (Maven Central, registry.npmjs.org, …) are intentionally
+ * NOT stored here — callers append them as the final fallback so the user's
+ * registries stay in priority order while the public one is always a safety net.
  */
-function getMavenRepos() {
-	const list = get("maven_repos") || [];
+function getRegistryMap() {
+	const m = get("registries");
+	return (m && typeof m === "object" && !Array.isArray(m)) ? m : {};
+}
+
+function getRegistries(ecosystem) {
+	const list = getRegistryMap()[ecosystem];
 	return Array.isArray(list) ? list : [];
 }
 
-function setMavenRepos(list) {
-	return set("maven_repos", Array.isArray(list) && list.length ? list : null);
+function setRegistryMap(map) {
+	return set("registries", map && Object.keys(map).length ? map : null);
 }
 
-function addMavenRepo(name, url, auth = null) {
-	const list = getMavenRepos().filter(r => r.name !== name);
-	list.push({ name, url, ...(auth ? { auth } : {}) });
-	setMavenRepos(list);
+function addRegistry(ecosystem, name, url, { auth = null, token = null } = {}) {
+	const map = getRegistryMap();
+	const list = (map[ecosystem] || []).filter(r => r.name !== name);
+	list.push({ name, url, ...(auth ? { auth } : {}), ...(token ? { token } : {}) });
+	map[ecosystem] = list;
+	setRegistryMap(map);
 	return list;
 }
 
-function removeMavenRepo(name) {
-	const before = getMavenRepos();
-	const after = before.filter(r => r.name !== name);
-	setMavenRepos(after);
-	return before.length !== after.length;
+function removeRegistry(ecosystem, name) {
+	const map = getRegistryMap();
+	const before = (map[ecosystem] || []).length;
+	map[ecosystem] = (map[ecosystem] || []).filter(r => r.name !== name);
+	if (!map[ecosystem].length) delete map[ecosystem];
+	setRegistryMap(map);
+	return before !== (map[ecosystem]?.length || 0);
 }
 
 module.exports = {
@@ -83,8 +93,9 @@ module.exports = {
 	set,
 	get,
 	getNvdApiKey,
-	getMavenRepos,
-	setMavenRepos,
-	addMavenRepo,
-	removeMavenRepo,
+	getRegistryMap,
+	getRegistries,
+	setRegistryMap,
+	addRegistry,
+	removeRegistry,
 };

package/lib/core.js

@@ -19,7 +19,9 @@ const SKIP_DIRS = new Set([
 
 const coord = v => (v == null ? null : String(v).trim() || null);
 
-function findPomFiles(dir) {
+const defaultPomSkip = child => SKIP_DIRS.has(path.basename(child));
+
+function findPomFiles(dir, skipDir = defaultPomSkip) {
 	const out = [];
 	const stack = [dir];
 	while (stack.length) {
@@ -29,8 +31,9 @@ function findPomFiles(dir) {
 		catch { continue; }
 		for (const e of entries) {
 			if (e.isDirectory()) {
-				if (SKIP_DIRS.has(e.name)) continue;
-				stack.push(path.join(cur, e.name));
+				const child = path.join(cur, e.name);
+				if (skipDir(child, e.name)) continue;
+				stack.push(child);
 			} else if (e.name === "pom.xml") {
 				out.push(path.join(cur, e.name));
 			}
@@ -41,11 +44,11 @@ function findPomFiles(dir) {
 
 // Parallel equivalent of findPomFiles — same result, but readdir runs concurrently
 // so the walk isn't serialized one round-trip at a time on a high-latency filesystem.
-async function findPomFilesAsync(dir) {
+async function findPomFilesAsync(dir, skipDir = defaultPomSkip) {
 	const { walkDirs } = require("./parallel-walk");
 	const out = [];
 	await walkDirs(dir, {
-		skipDir: name => SKIP_DIRS.has(name),
+		skipDir,
 		onDir: (cur, entries) => {
 			for (const e of entries) if (e.isFile() && e.name === "pom.xml") out.push(path.join(cur, e.name));
 		},
@@ -359,6 +362,7 @@ async function rewritePoms(pomPath, allPomMetadata, allPropsByPom, opts) {
 
 module.exports = {
 	coord,
+	SKIP_DIRS,
 	findPomFiles,
 	findPomFilesAsync,
 	newMetadataStore,

package/lib/cve-match.js

@@ -125,14 +125,14 @@ async function expandWithTransitives(resolvedDeps, opts = {}) {
 		// Embedded-binary coords don't participate in Maven Central resolution (a
 		// fat-jar already ships its deps, discovered by recursion) and must not act as
 		// a depMgmt override for the declared tree.
-		if (dep.provenance === "embedded") continue;
+		if (dep.provenance === "embedded" || dep.provenance === "binary") continue;
 		if (dep.version && !/\$\{/.test(dep.version)) {
 			rootDepMgmt.set(`${dep.groupId}:${dep.artifactId}`, { version: dep.version });
 		}
 	}
 
 	const directs = [...resolvedDeps.values()]
-		.filter(d => d.provenance !== "embedded")
+		.filter(d => d.provenance !== "embedded" && d.provenance !== "binary")
 		.filter(d => d.version && !/\$\{/.test(d.version))
 		.filter(d => d.scope !== "test" || opts.includeTestDeps)
 		.filter(d => d.scope !== "parent");
@@ -227,6 +227,7 @@ function matchDepsAgainstCves(resolvedDeps, cveIndex, opts = {}) {
 		// They are caught by the OSV pipeline (which is multi-ecosystem) and
 		// the CPE refinement step (post-NVD).
 		if (dep.ecosystem === "npm") continue;
+		if (dep.provenance === "binary") continue; // no resolved coordinate yet (Plan 2 identifies it)
 		const key = `${dep.groupId}:${dep.artifactId}`.toLowerCase();
 		// Tier 1: exact packageName match
 		const t1 = matchOne(dep, byPackage[key], "exact");

package/lib/cve-report.js

@@ -12,6 +12,7 @@ const fs = require("fs");
 const path = require("path");
 const { getCodec, allCodecs, ORDER } = require("./codecs");
 const { computePriority, sortByPriority } = require("./priority");
+const { buildInventory } = require("./unmanaged");
 
 // CWE-id → short human name. Loaded once at module init. Unknown CWEs fall
 // back to the raw id (with a "—" placeholder name where the row asks for one).
@@ -1362,7 +1363,7 @@ function renderLicenseChapter(licenseResults) {
 	return intro + blocks;
 }
 
-function buildBody({ cveMatches, devCveMatches, embeddedMatches, retireMatches, eolResults, obsoleteResults, outdatedResults, licenseResults, resolvedDeps, projectInfo, warnings, wrapTables = true }) {
+function buildBody({ cveMatches, devCveMatches, embeddedMatches, retireMatches, vendoredJsInventory, eolResults, obsoleteResults, outdatedResults, licenseResults, resolvedDeps, projectInfo, warnings, wrapTables = true }) {
 	setRenderCtx({ srcRoot: projectInfo?.src || null });
 	// Dedupe rows so a single (dep, cve) shows once with all via paths merged.
 	cveMatches      = mergeMatches(cveMatches || []);
@@ -1397,6 +1398,10 @@ function buildBody({ cveMatches, devCveMatches, embeddedMatches, retireMatches,
 	const licenseTotal     = licenseResults?.assessed?.length || 0;
 	const licenseFlagged   = licenseResults?.flagged?.length || 0;
 	const embeddedContent  = renderEmbeddedChapter(embMatchesActive, projectInfo?.src);
+	const unmanagedInventory = buildInventory(resolvedDeps || new Map());
+	const unmanagedContent = renderUnmanagedInventory(unmanagedInventory, projectInfo?.src);
+	const vendoredJsInv    = vendoredJsInventory || [];
+	const vendoredJsContent = renderVendoredJsInventory(vendoredJsInv, projectInfo?.src);
 	const fpContent        = renderFalsePositives([...prodMatchesFP, ...devMatchesFP, ...embMatchesFP]);
 
 	const toolbar = `<div class="toolbar">
@@ -1429,6 +1434,8 @@ function buildBody({ cveMatches, devCveMatches, embeddedMatches, retireMatches,
 		licenseTotal,
 		licenseFlagged,
 		embeddedTotal: embStats.total,
+		unmanagedTotal: unmanagedInventory.length,
+		vendoredJsTotal: vendoredJsInv.length,
 		fpTotal: prodMatchesFP.length + devMatchesFP.length + embMatchesFP.length,
 	});
 
@@ -1449,6 +1456,8 @@ function buildBody({ cveMatches, devCveMatches, embeddedMatches, retireMatches,
 		${(warnings?.length || 0) ? majorSection(`0. Warnings & scan-completeness (${warnings.length})`, renderWarnings(warnings), { open: true, id: "ch0" }) : ""}
 		${majorSection(`1. CVE Vulnerabilities — production (${prodStats.total})`, cveContent, { id: "ch1" })}
 		${embStats.total ? majorSection(`1B. Embedded binaries — JAR/WAR/EAR (${embStats.total})`, embeddedContent, { open: embStats.total <= 50, id: "ch1e" }) : ""}
+		${unmanagedInventory.length ? majorSection(`1C. Unmanaged / vendored binaries (${unmanagedInventory.length})`, unmanagedContent, { open: unmanagedInventory.length <= 50, id: "ch1c" }) : ""}
+		${vendoredJsInv.length ? majorSection(`1D. Unmanaged / vendored JavaScript (${vendoredJsInv.length})`, vendoredJsContent, { open: vendoredJsInv.length <= 50, id: "ch1d" }) : ""}
 		${majorSection(`2. Vendored JS scan — retire.js (${retireMatches.length})`, vendoredContent, { open: retireMatches.length > 0 && retireMatches.length <= 50, id: "ch2" })}
 		${majorSection(`3. CVE in dev dependencies (${devStats.total})`, devCveContent, { open: devStats.total > 0 && devStats.total <= 50, id: "ch3" })}
 		${majorSection(`4. End-of-Life Frameworks (${eolResults?.length || 0})`, renderEolTable(eolResults), { id: "ch4" })}
@@ -1493,12 +1502,14 @@ function pickTopCriticalMatches(prodMatches, retireMatches, n) {
 	return out;
 }
 
-function renderToc({ hasWarnings, prodTotal, embeddedTotal, retireTotal, devTotal, eolTotal, obsoleteTotal, outdatedTotal, licenseTotal, licenseFlagged, fpTotal }) {
+function renderToc({ hasWarnings, prodTotal, embeddedTotal, unmanagedTotal, vendoredJsTotal, retireTotal, devTotal, eolTotal, obsoleteTotal, outdatedTotal, licenseTotal, licenseFlagged, fpTotal }) {
 	const entries = [];
 	if (hasWarnings)                  entries.push({ id: "ch0", label: "0. Warnings" });
 	entries.push({ id: "ch1", label: `1. Prod CVE (${prodTotal})` });
 	if (embeddedTotal)                entries.push({ id: "ch1e", label: `1B. Embedded (${embeddedTotal})` });
-	entries.push({ id: "ch2", label: `2. Vendored JS (${retireTotal})` });
+	if (unmanagedTotal)               entries.push({ id: "ch1c", label: `1C. Unmanaged (${unmanagedTotal})` });
+	if (vendoredJsTotal)              entries.push({ id: "ch1d", label: `1D. Vendored JS (${vendoredJsTotal})` });
+	entries.push({ id: "ch2", label: `2. Vendored JS vulns (${retireTotal})` });
 	entries.push({ id: "ch3", label: `3. Dev CVE (${devTotal})` });
 	entries.push({ id: "ch4", label: `4. EOL (${eolTotal})` });
 	entries.push({ id: "ch5", label: `5. Obsolete (${obsoleteTotal})` });
@@ -1528,6 +1539,46 @@ function renderEmbeddedChapter(matches, srcRoot) {
 	return intro + blocks;
 }
 
+// Unmanaged native-binary inventory (Part C). Committed .dll/.exe/.so/.dylib that no
+// package manager governs, identified by checksum (deps.dev + CIRCL). Self-contained
+// inline styles, matching the report's no-external-CSS philosophy.
+function pill(text, bg, fg = "#fff") {
+	return `<span style="display:inline-block;padding:2px 8px;border-radius:3px;background:${bg};color:${fg};font-weight:600;font-size:11px">${esc(text)}</span>`;
+}
+function renderUnmanagedInventory(inventory, srcRoot) {
+	if (!inventory.length) return `<div class="empty">No committed native binaries found.</div>`;
+	const intro = `<div class="fp-intro">Committed native binaries (<code>.dll</code>/<code>.exe</code>/<code>.so</code>/<code>.dylib</code>) — not governed by any package manager. Identified by checksum (deps.dev + CIRCL). <strong>should-be-managed</strong> = a published package committed as a blob; <strong>name≠checksum</strong> = the filename disagrees with what the hash resolves to; <strong>not recognised by any source</strong> = neither deps.dev nor CIRCL knows this exact file (vendored/custom build — verify its origin manually). Identification is by checksum only; a file absent from both databases stays unidentified even when its name is suggestive (e.g. <code>openssl.exe</code>).</div>`;
+	const rows = inventory.map(e => {
+		let rel = e.path;
+		if (srcRoot) { try { rel = path.relative(srcRoot, e.path); } catch { /* keep abs */ } }
+		const id = e.identity
+			? `${esc(e.identity.ecosystem ? e.identity.ecosystem + ":" : "")}${esc(e.identity.name || "")}${e.identity.version ? "@" + esc(e.identity.version) : ""} <span style="color:#6b7280">(${esc(e.identity.source || "")})</span>`
+			: `<span style="color:#6b7280">unknown</span>`;
+		const flags = [
+			e.knownMalicious ? pill("⚠ MALICIOUS", "#7c0008") : null,
+			e.integrity === "pristine" ? pill("pristine", "#166534") : (e.integrity === "known-good" ? pill("known-good", "#15803d") : null),
+			e.shouldBeManaged ? pill("should-be-managed", "#2563eb") : null,
+			e.nameMismatch ? pill("name≠checksum", "#ea580c") : null,
+			e.noOnlineInfo ? pill("not recognised by any source", "#6b7280") : null,
+		].filter(Boolean).join(" ");
+		return `<tr><td class="dep"><code class="path">${esc(rel)}</code></td><td>${id}</td><td>${flags}</td><td><code class="path" style="color:#6b7280">${esc((e.hashes?.sha256 || "").slice(0, 16))}…</code></td></tr>`;
+	}).join("\n");
+	return intro + `<table><thead><tr><th>File</th><th>Identity (by checksum)</th><th>Status</th><th>SHA-256</th></tr></thead><tbody>${rows}</tbody></table>`;
+}
+
+function renderVendoredJsInventory(inventory, srcRoot) {
+	if (!inventory || !inventory.length) return `<div class="empty">No vendored JavaScript libraries identified.</div>`;
+	const vulnN = inventory.filter(e => e.vulnerable).length;
+	const intro = `<div class="fp-intro">Standalone JavaScript libraries committed into the tree (jQuery, Bootstrap, PDF.js, …) that <strong>no package manager governs</strong> — unknown provenance, integrity and patch story, identified by signature (retire.js). This is a cyber-hygiene inventory: even a non-vulnerable copy is unmanaged third-party code. <strong>${vulnN}</strong> of ${inventory.length} carry known vulnerabilities (detailed in chapter 2).</div>`;
+	const rows = inventory.map(e => {
+		const sevPill = e.vulnerable
+			? pill(`${e.vulnCount} vuln${e.vulnCount > 1 ? "s" : ""}${e.maxSeverity ? " · " + e.maxSeverity : ""}`, "#b91c1c")
+			: pill("no known vuln", "#15803d");
+		return `<tr><td>${esc(e.component || "?")}</td><td>${esc(e.version || "?")}</td><td class="dep"><code class="path">${esc(e.file || "")}</code></td><td><span style="color:#6b7280">${esc(e.detection || "")}</span></td><td>${sevPill}</td></tr>`;
+	}).join("\n");
+	return intro + `<table><thead><tr><th>Library</th><th>Version</th><th>File</th><th>Detection</th><th>Status</th></tr></thead><tbody>${rows}</tbody></table>`;
+}
+
 function renderFalsePositives(matches) {
 	if (!matches.length) return `<div class="empty">No CPE-filtered findings.</div>`;
 	const intro = `<div class="fp-intro">These entries were initially matched by name but NVD's CPE configurations show your dep version is outside every vulnerable range. They are almost certainly false positives — kept here for audit transparency.</div>`;
@@ -1911,12 +1962,12 @@ ${WORD_SECTION_PR}
 // Render the HTML and/or Word report. Callers pass explicit target paths;
 // a null/omitted path skips that format (so `--report-html` alone writes only HTML).
 // Back-compat: `outputDir` still writes both under the default file names.
-async function writeReports({ cveMatches, devCveMatches, embeddedMatches, retireMatches, eolResults, obsoleteResults, outdatedResults, licenseResults, resolvedDeps, projectInfo, outputDir, htmlPath, docPath, warnings }) {
+async function writeReports({ cveMatches, devCveMatches, embeddedMatches, retireMatches, vendoredJsInventory, eolResults, obsoleteResults, outdatedResults, licenseResults, resolvedDeps, projectInfo, outputDir, htmlPath, docPath, warnings }) {
 	if (outputDir) {
 		if (htmlPath === undefined) htmlPath = path.join(outputDir, "cve-report.html");
 		if (docPath === undefined) docPath = path.join(outputDir, "cve-report.doc");
 	}
-	const payload = { cveMatches, devCveMatches, embeddedMatches, retireMatches, eolResults, obsoleteResults, outdatedResults, licenseResults, resolvedDeps, projectInfo, warnings };
+	const payload = { cveMatches, devCveMatches, embeddedMatches, retireMatches, vendoredJsInventory, eolResults, obsoleteResults, outdatedResults, licenseResults, resolvedDeps, projectInfo, warnings };
 	const written = { htmlPath: null, docPath: null };
 	if (htmlPath) {
 		await fs.promises.mkdir(path.dirname(path.resolve(htmlPath)), { recursive: true });

package/lib/dep-record.js

@@ -35,17 +35,18 @@ function coordKeyFor(ecosystem, namespace, name) {
 }
 
 function makeDepRecord(input) {
-	const { ecosystem, namespace = "", name, version = null, manifestPath, scope = "compile", isDev = false, ecosystemType, provenance = "manifest" } = input;
+	const { ecosystem, namespace = "", name, version = null, manifestPath, scope = "compile", isDev = false, ecosystemType, provenance = "manifest", hashes = null, declaredName = null } = input;
 	const concrete = version && !/\$\{/.test(version) ? version : null;
 	const manifestPaths = manifestPath ? [manifestPath] : [];
-	// Embedded binaries (a dep discovered INSIDE a .jar/.war/.ear, not declared in a
-	// manifest) must not share the Map key of a declared dep with the same g:a — else
-	// they'd merge and the "embedded binaries" report chapter would lose them. Key
-	// them by their unique physical location instead. provenance stays on the record
-	// so the report/exports can label & group them; "both" is set later if a merge
-	// across provenances ever happens.
-	const coordKey = provenance === "embedded" && manifestPath
-		? `embedded:${manifestPath}`
+	// Embedded binaries (a dep discovered INSIDE a .jar/.war/.ear) and standalone
+	// committed native binaries (.dll/.so/…) must not share the Map key of a declared
+	// dep with the same coordinate — they'd merge and the unmanaged report chapter
+	// would lose them. Key them by their unique physical location instead. provenance
+	// stays on the record so the report/exports can label & group them; "both" is set
+	// later if a merge across provenances ever happens.
+	const byLocation = (provenance === "embedded" || provenance === "binary") && manifestPath;
+	const coordKey = byLocation
+		? `${provenance}:${manifestPath}`
 		: coordKeyFor(ecosystem, namespace, name);
 	return {
 		ecosystem,
@@ -56,6 +57,8 @@ function makeDepRecord(input) {
 		versions: concrete ? [concrete] : [],
 		coordKey,
 		provenance,
+		hashes,
+		declaredName,
 		scope,
 		isDev: !!isDev,
 		manifestPaths,

package/lib/hash-id.js

@@ -0,0 +1,78 @@
+/**
+ * lib/hash-id.js — identity-by-checksum for unmanaged artifacts.
+ *
+ * Two known-good sources, tried in order:
+ *  1. deps.dev query-by-hash → exact package coordinate (whole published archive).
+ *  2. CIRCL hashlookup → known OS/distro/CDN/NSRL file + free KnownMalicious flag.
+ *
+ * Cache-backed (~/.fad-checker/hash-id-cache.json, 24h) and --offline-aware: offline
+ * reads cache only and never touches the network (project air-gapped principle).
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
+ */
+const fs = require("fs");
+const path = require("path");
+const os = require("os");
+
+const CACHE_DIR = path.join(os.homedir(), ".fad-checker");
+const CACHE_PATH = path.join(CACHE_DIR, "hash-id-cache.json");
+const CACHE_TTL_MS = 24 * 3600 * 1000;
+const DEPSDEV = "https://api.deps.dev/v3/query";
+const CIRCL = "https://hashlookup.circl.lu/lookup/sha256";
+
+const SYSTEM_TO_ECO = { MAVEN: "maven", NPM: "npm", NUGET: "nuget", PYPI: "pypi", RUBYGEMS: "ruby", CARGO: "cargo", GO: "go" };
+
+function sha1ToBase64(hex) { return Buffer.from(hex, "hex").toString("base64"); }
+
+function parseDepsDev(body) {
+	const vk = body?.results?.[0]?.version?.versionKey;
+	if (!vk?.name) return null;
+	return { ecosystem: SYSTEM_TO_ECO[vk.system] || (vk.system || "").toLowerCase() || null, name: vk.name, version: vk.version || null, source: "deps.dev" };
+}
+
+function parseCircl(body) {
+	if (!body || body.message || !(body.FileName || body.ProductCode)) return null;
+	const malicious = Array.isArray(body.KnownMalicious) ? body.KnownMalicious.length > 0 : !!body.KnownMalicious;
+	return {
+		ecosystem: null,
+		name: body.ProductCode?.ProductName || body.FileName || null,
+		version: body.ProductCode?.ProductVersion || null,
+		source: `circl:${body.db || "hashlookup"}`,
+		trust: body["hashlookup:trust"] != null ? body["hashlookup:trust"] : null,
+		knownMalicious: malicious,
+	};
+}
+
+function loadCache() { try { const d = JSON.parse(fs.readFileSync(CACHE_PATH, "utf8")); if (Date.now() - (d._fetchedAt || 0) < CACHE_TTL_MS) return d.entries || {}; } catch { /* ignore */ } return {}; }
+function saveCache(entries) { try { fs.mkdirSync(CACHE_DIR, { recursive: true }); fs.writeFileSync(CACHE_PATH, JSON.stringify({ _fetchedAt: Date.now(), entries })); } catch { /* ignore */ } }
+
+async function lookupHash(hashes, opts = {}) {
+	const { fetcher = globalThis.fetch, offline = false, cache } = opts;
+	const entries = cache || loadCache();
+	const key = hashes.sha256 || hashes.sha1;
+	if (!key) return null;
+	if (Object.prototype.hasOwnProperty.call(entries, key)) return entries[key];
+	if (offline) return null;
+
+	let identity = null;
+	// 1) deps.dev (SHA1 base64)
+	if (hashes.sha1) {
+		try {
+			const r = await fetcher(`${DEPSDEV}?hash.type=SHA1&hash.value=${encodeURIComponent(sha1ToBase64(hashes.sha1))}`, { headers: { "User-Agent": "fad-checker-hashid" } });
+			if (r.ok) identity = parseDepsDev(await r.json());
+		} catch { /* ignore, try CIRCL */ }
+	}
+	// 2) CIRCL (SHA-256)
+	if (!identity && hashes.sha256) {
+		try {
+			const r = await fetcher(`${CIRCL}/${hashes.sha256}`, { headers: { "User-Agent": "fad-checker-hashid", Accept: "application/json" } });
+			if (r.ok) identity = parseCircl(await r.json());
+		} catch { /* ignore */ }
+	}
+	entries[key] = identity;
+	if (!cache) saveCache(entries);
+	return identity;
+}
+
+module.exports = { sha1ToBase64, parseDepsDev, parseCircl, lookupHash, loadCache, saveCache, CACHE_PATH };

package/lib/json-export.js

@@ -65,10 +65,13 @@ const SEV = ["critical", "high", "medium", "low", "none", "unknown"];
  */
 function buildFindings(payload = {}) {
 	const {
-		cveMatches = [], retireMatches = [], eolResults = [], obsoleteResults = [],
+		cveMatches = [], retireMatches = [], vendoredJsInventory = [], eolResults = [], obsoleteResults = [],
 		outdatedResults = [], licenseResults = null, resolvedDeps, projectInfo = {}, toolVersion = "0",
 	} = payload;
 
+	const { buildInventory } = require("./unmanaged");
+	const unmanaged = resolvedDeps ? buildInventory(resolvedDeps) : [];
+
 	const sevCounts = Object.fromEntries(SEV.map(s => [s, 0]));
 	let kev = 0;
 	for (const m of cveMatches) {
@@ -90,6 +93,8 @@ function buildFindings(payload = {}) {
 			outdated: outdatedResults.length,
 			licensesFlagged: licenseResults?.flagged?.length || 0,
 			vendored: retireMatches.length,
+			unmanaged: unmanaged.length,
+			vendoredJs: vendoredJsInventory.length,
 			suppressed: cveMatches.filter(m => m.suppressed).length,
 		},
 		cve: cveMatches.map(cveFinding),
@@ -98,6 +103,8 @@ function buildFindings(payload = {}) {
 		obsolete: obsoleteResults.map(o => ({ reason: o.reason || null, replacement: o.replacement || null, source: o.source || null, dep: depBrief(o.dep) })),
 		outdated: outdatedResults.map(o => ({ latest: o.latest, releaseDate: o.releaseDate || null, dep: depBrief(o.dep) })),
 		licenses: (licenseResults?.assessed || []).map(e => ({ category: e.category, licenses: e.ids.concat(e.raw), source: e.source || null, dep: depBrief(e.dep) })),
+		unmanaged,
+		vendoredJs: vendoredJsInventory,
 	};
 }
 

package/lib/options-env.js

@@ -0,0 +1,113 @@
+/**
+ * lib/options-env.js — layered option resolution.
+ *
+ * Layers (highest → lowest): CLI flags > config file (--config / ./.fad-env.json,
+ * JSON) > FAD_CHECKER_ENV (a CLI-flag string) > global ~/.fad-checker/config.json
+ * > commander defaults. Scalar options follow precedence; `registries` are unioned
+ * elsewhere (lib/registries.js). The source flag has aliases (src/source).
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
+ */
+const fs = require("fs");
+const path = require("path");
+const { Command } = require("commander");
+
+/** Quote/escape-aware shell-ish tokenizer (single+double quotes, backslash). */
+function tokenize(str) {
+	const out = [];
+	let cur = "", q = null, esc = false, has = false;
+	for (const ch of String(str)) {
+		if (esc) { cur += ch; esc = false; has = true; continue; }
+		if (ch === "\\" && q !== "'") { esc = true; continue; }
+		if (q) { if (ch === q) q = null; else cur += ch; has = true; continue; }
+		if (ch === '"' || ch === "'") { q = ch; has = true; continue; }
+		if (/\s/.test(ch)) { if (has) { out.push(cur); cur = ""; has = false; } continue; }
+		cur += ch; has = true;
+	}
+	if (has) out.push(cur);
+	return out;
+}
+
+function loadConfigFile(p) {
+	const raw = fs.readFileSync(p, "utf8");
+	try { return JSON.parse(raw); }
+	catch (e) { throw new Error(`invalid JSON in config file ${p}: ${e.message}`); }
+}
+
+/** Map `source` → `src` (src wins if both present). Returns a NEW object. */
+function normalizeSource(obj) {
+	const o = { ...obj };
+	if (o.source != null && o.src == null) o.src = o.source;
+	delete o.source;
+	return o;
+}
+
+/**
+ * Parse a CLI-flag string into { options, repos } using a throwaway clone of the
+ * real program. Only options whose source !== "default" are returned, so unset
+ * flags don't clobber higher layers. `repos` (variadic --repo) returned separately.
+ */
+function parseEnvFlags(str, program) {
+	const tokens = tokenize(str);
+	if (!tokens.length) return { options: {}, repos: [] };
+	const clone = new Command();
+	clone.exitOverride().allowUnknownOption(true).configureOutput({ writeErr() {}, writeOut() {} });
+	for (const o of program.options) clone.addOption(o);
+	try { clone.parse(tokens, { from: "user" }); } catch { /* tolerate */ }
+	const all = clone.opts();
+	const options = {};
+	for (const name of Object.keys(all)) {
+		const src = clone.getOptionValueSource(name);
+		if (src && src !== "default") options[name] = all[name];
+	}
+	const repos = Array.isArray(options.repo) ? options.repo : [];
+	delete options.repo;
+	return { options: normalizeSource(options), repos };
+}
+
+/** Resolve { fileLayer, envLayer, envRepos }. */
+function loadLayers({ cwd = process.cwd(), configPath = null, envStr = process.env.FAD_CHECKER_ENV, program = null } = {}) {
+	let fileLayer = {};
+	const chosen = configPath || path.join(cwd, ".fad-env.json");
+	if (configPath) fileLayer = loadConfigFile(chosen);
+	else if (fs.existsSync(chosen)) fileLayer = loadConfigFile(chosen);
+	fileLayer = normalizeSource(fileLayer || {});
+	let envLayer = {}, envRepos = [];
+	if (envStr && program) {
+		// If FAD_CHECKER_ENV points to a readable file, treat its content as flags too.
+		let s = envStr;
+		try { if (fs.existsSync(envStr) && fs.statSync(envStr).isFile()) s = fs.readFileSync(envStr, "utf8"); } catch { /* inline */ }
+		const parsed = parseEnvFlags(s, program);
+		envLayer = parsed.options; envRepos = parsed.repos;
+	}
+	return { fileLayer, envLayer, envRepos };
+}
+
+/**
+ * Merge layers onto the parsed program. A file/env/global value fills an option
+ * ONLY when the CLI did not set it (source default/undefined). Order: file > env
+ * > global. Returns the effective options object (a copy of program.opts()).
+ */
+function applyLayers(program, layers = {}, globalStore = {}) {
+	const eff = normalizeSource(program.opts());
+	const fileLayer = normalizeSource(layers.fileLayer || {});
+	const envLayer = normalizeSource(layers.envLayer || {});
+	const cliSet = name => {
+		const s = program.getOptionValueSource(name);
+		return s && s !== "default";
+	};
+	const candidates = new Set([...Object.keys(fileLayer), ...Object.keys(envLayer), ...Object.keys(globalStore || {})]);
+	candidates.delete("registries");  // unioned separately
+	candidates.delete("excludePath"); // unioned separately
+	candidates.delete("source");
+	for (const name of candidates) {
+		if (cliSet(name)) continue; // CLI wins
+		if (name in fileLayer) eff[name] = fileLayer[name];
+		else if (name in envLayer) eff[name] = envLayer[name];
+		else if (globalStore && name in globalStore) eff[name] = globalStore[name];
+	}
+	return eff;
+}
+
+module.exports = { tokenize, loadConfigFile, normalizeSource, parseEnvFlags, loadLayers, applyLayers };

package/lib/parallel-walk.js

@@ -9,7 +9,8 @@
  * into something close to a single round-trip deep, which is dramatically faster.
  *
  * `onDir(absDir, entries)` is called once per visited directory with its Dirent[].
- * `skipDir(name)` prunes a child directory by basename (caller's own skip policy).
+ * `skipDir(absChildDir, name)` prunes a child directory (caller's own skip policy);
+ * it receives the child's absolute path (for path-relative globs) plus its basename.
  *
  * @author: N.BRAUN
  * @email: pp9ping@gmail.com
@@ -34,7 +35,9 @@ async function walkDirs(root, { skipDir = () => false, concurrency = DEFAULT_CON
 				fs.promises.readdir(cur, { withFileTypes: true }).then(entries => {
 					if (onDir) onDir(cur, entries);
 					for (const e of entries) {
-						if (e.isDirectory() && !skipDir(e.name)) queue.push(path.join(cur, e.name));
+						if (!e.isDirectory()) continue;
+						const child = path.join(cur, e.name);
+						if (!skipDir(child, e.name)) queue.push(child);
 					}
 				}).catch(() => { /* unreadable dir → skip, same as readdirSync catch */ })
 					.finally(() => { active--; pump(); });

package/lib/path-filter.js

@@ -0,0 +1,58 @@
+/**
+ * lib/path-filter.js — directory-walk pruning policy shared by every codec walker.
+ *
+ * Two layers:
+ *   - default skips: each walker's own basename set (node_modules, vendor, target,
+ *     .git, …). Bypassable with useDefaults=false (CLI --no-default-excludes).
+ *   - user globs: --exclude-path / `excludePath` config, matched gitignore-style
+ *     against the directory's path RELATIVE to the scan root (`srcRoot`). A bare
+ *     `foo/bar` matches that directory and its whole subtree (`foo/bar/**`).
+ *
+ * makeDirFilter() returns a predicate over a child directory's ABSOLUTE path, so
+ * it drops straight into parallel-walk's skipDir and the serial readdir walkers.
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
+ */
+const path = require("path");
+const { minimatch } = require("minimatch");
+
+/**
+ * Compile glob strings into (relPath) → bool matchers. Each glob prunes both the
+ * matched directory itself and its whole subtree, so `packages/legacy/**` (or the
+ * bare `packages/legacy`) stops the walk at `packages/legacy` — a manifest sitting
+ * directly in it is never collected.
+ */
+function compileGlobs(globs) {
+	return (globs || []).filter(Boolean).map(String).map(g => g.trim()).filter(Boolean).map(g => {
+		// Paths match relative to srcRoot, so they're already root-anchored. Accept
+		// `truc`, `/truc` and `./truc` as the same thing (strip a leading ./ or /).
+		const base = g.replace(/^\.?\/+/, "").replace(/\/+$/, "");
+		const patterns = base.endsWith("/**")
+			? [base, base.slice(0, -3).replace(/\/+$/, "")] // dir + its subtree
+			: [base, base + "/**"];
+		return rel => patterns.some(p => p && minimatch(rel, p, { dot: true }));
+	});
+}
+
+/**
+ * Build a skipDir(absChildDir) predicate.
+ *   srcRoot       scan root the globs are relative to
+ *   defaultSkip   Set of basenames the walker prunes by default (its own SKIP)
+ *   excludePath   user glob strings
+ *   useDefaults   when false, ignore defaultSkip entirely (--no-default-excludes)
+ */
+function makeDirFilter({ srcRoot, defaultSkip = null, excludePath = [], useDefaults = true } = {}) {
+	const matchers = compileGlobs(excludePath);
+	return function skipDir(absChild) {
+		const name = path.basename(absChild);
+		if (useDefaults && defaultSkip && defaultSkip.has(name)) return true;
+		if (matchers.length && srcRoot) {
+			const rel = path.relative(srcRoot, absChild).split(path.sep).join("/");
+			if (rel && !rel.startsWith("..") && matchers.some(m => m(rel))) return true;
+		}
+		return false;
+	};
+}
+
+module.exports = { makeDirFilter, compileGlobs };