fad-checker 2.1.2 → 2.2.0

package/lib/registries.js

@@ -0,0 +1,112 @@
+/**
+ * lib/registries.js — per-ecosystem registry list assembly + auth + fan-out.
+ *
+ * Generalizes lib/maven-repo.js's list-building to npm/pypi/ruby/go. Custom
+ * registries are tried first (declared order); callers append the public base
+ * last via withPublic(). Lists are unioned across config layers, deduped by URL.
+ *
+ * Entry shape: { name?, url, auth?, token? }
+ *   auth  "user:pass" → Authorization: Basic <base64>
+ *   token "…"         → Authorization: Bearer <token>
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
+ */
+const SUPPORTED = ["maven", "npm", "pypi", "ruby", "go"];
+
+const PUBLIC_BASES = {
+	maven: "https://repo1.maven.org/maven2/",
+	npm: "https://registry.npmjs.org/",
+	pypi: "https://pypi.org/pypi/",
+	ruby: "https://rubygems.org/api/v1/gems/",
+	go: "https://proxy.golang.org/",
+};
+
+function normalise(url) {
+	if (!url) return url;
+	return url.endsWith("/") ? url : url + "/";
+}
+
+function splitUrlAuth(url) {
+	if (!url) return { url, auth: null };
+	try {
+		const u = new URL(url);
+		if (u.username || u.password) {
+			const auth = decodeURIComponent(u.username) + ":" + decodeURIComponent(u.password);
+			u.username = ""; u.password = "";
+			return { url: u.toString(), auth };
+		}
+	} catch { /* not a URL */ }
+	return { url, auth: null };
+}
+
+function authHeaderFor(entry) {
+	if (!entry) return null;
+	if (entry.token) return "Bearer " + entry.token;
+	if (entry.auth) return "Basic " + Buffer.from(entry.auth).toString("base64");
+	return null;
+}
+
+/** Union of registry entries from several layers (arrays). Dedup by URL, first wins. */
+function buildRegistryList(_ecosystem, layers = []) {
+	const out = [];
+	const seen = new Set();
+	for (const layer of layers) {
+		for (const r of layer || []) {
+			if (!r?.url) continue;
+			const { url, auth } = splitUrlAuth(normalise(r.url));
+			if (seen.has(url)) continue;
+			seen.add(url);
+			out.push({ name: r.name || url, url, auth: r.auth || auth || null, token: r.token || null });
+		}
+	}
+	return out;
+}
+
+/** Append the ecosystem's public base (no auth) as the final fallback. */
+function withPublic(ecosystem, list) {
+	const pub = PUBLIC_BASES[ecosystem];
+	const out = [...(list || [])];
+	if (pub && !out.some(r => normalise(r.url) === pub)) out.push({ name: "public", url: pub, auth: null, token: null });
+	return out;
+}
+
+/** Merge two registry maps (eco → entries[]) into one (concat per eco). */
+function mergeRegistryMaps(...maps) {
+	const out = {};
+	for (const m of maps) {
+		if (!m || typeof m !== "object") continue;
+		for (const eco of Object.keys(m)) {
+			if (!Array.isArray(m[eco])) continue;
+			out[eco] = (out[eco] || []).concat(m[eco]);
+		}
+	}
+	return out;
+}
+
+/**
+ * Try each base in order; return the first response whose `res.ok` is true,
+ * as { res, base, url }. Applies per-base auth. opts.fetcher for tests.
+ */
+async function fetchFirstOk(bases, buildUrl, opts = {}) {
+	const { fetcher = globalThis.fetch, userAgent = "fad-checker", timeoutMs, onMiss } = opts;
+	for (const base of bases) {
+		const url = buildUrl(normalise(base.url));
+		const headers = { "User-Agent": userAgent, Accept: "application/json" };
+		const ah = authHeaderFor(base);
+		if (ah) headers.Authorization = ah;
+		let res;
+		try {
+			res = await fetcher(url, { headers, ...(timeoutMs ? { signal: AbortSignal.timeout(timeoutMs) } : {}) });
+		} catch (err) { if (onMiss) onMiss(base, `network: ${err.message}`); continue; }
+		if (res.ok) return { res, base, url };
+		if (onMiss) onMiss(base, `HTTP ${res.status}`);
+	}
+	return null;
+}
+
+module.exports = {
+	SUPPORTED, PUBLIC_BASES,
+	normalise, splitUrlAuth, authHeaderFor,
+	buildRegistryList, withPublic, mergeRegistryMaps, fetchFirstOk,
+};

package/lib/retire.js

@@ -101,6 +101,11 @@ async function ensureSignatures({ verbose, offline } = {}) {
 // when available so retire loads signatures from disk instead of the network.
 function buildRetireArgs({ srcDir, outPath, ignoredDirs, jsRepo }) {
 	const args = [
+		// --verbose makes retire list EVERY identified library, not just the
+		// vulnerable ones (its own wording: "by default only vulnerable files are
+		// shown"). We need the full set for the vendored-JS inventory chapter;
+		// vulnerable findings are still flagged in each result's `vulnerabilities`.
+		"--verbose",
 		"--outputformat", "json",
 		"--outputpath", outPath,
 		"--jspath", srcDir,
@@ -110,6 +115,51 @@ function buildRetireArgs({ srcDir, outPath, ignoredDirs, jsRepo }) {
 	return args;
 }
 
+const SEV_RANK = { critical: 5, high: 4, medium: 3, low: 2, none: 1 };
+
+/**
+ * Extract the full inventory of identified vendored JS libraries (vulnerable or
+ * not) from retire's --verbose output. Each entry: the standalone library, where
+ * it lives, how retire identified it, and whether it carries known vulns.
+ * This is a governance/cyber-hygiene signal: third-party code no package manager
+ * governs (unknown provenance, integrity, patch story) — the JS twin of the
+ * native-binary inventory (chapter 1C).
+ */
+function extractVendoredInventory(raw, srcDir) {
+	const out = [];
+	if (!raw) return out;
+	const files = Array.isArray(raw) ? raw : (raw.data || []);
+	for (const f of files) {
+		const file = f.file;
+		const relFile = srcDir && file?.startsWith(srcDir) ? path.relative(srcDir, file) : file;
+		for (const res of f.results || []) {
+			if (!res.component) continue;
+			const vulns = res.vulnerabilities || [];
+			let maxSeverity = null;
+			for (const v of vulns) {
+				const s = (v.severity || "").toLowerCase();
+				if (!maxSeverity || (SEV_RANK[s] || 0) > (SEV_RANK[maxSeverity] || 0)) maxSeverity = s;
+			}
+			out.push({
+				component: res.component,
+				version: res.version || null,
+				file: relFile || null,
+				detection: res.detection || null,
+				vulnerable: vulns.length > 0,
+				vulnCount: vulns.length,
+				maxSeverity: maxSeverity ? maxSeverity.toUpperCase() : null,
+			});
+		}
+	}
+	// Vulnerable first (by severity), then by component/version/file for stability.
+	out.sort((a, b) =>
+		(SEV_RANK[(b.maxSeverity || "").toLowerCase()] || 0) - (SEV_RANK[(a.maxSeverity || "").toLowerCase()] || 0)
+		|| String(a.component).localeCompare(String(b.component))
+		|| String(a.version).localeCompare(String(b.version))
+		|| String(a.file).localeCompare(String(b.file)));
+	return out;
+}
+
 /**
  * Run retire.js against `srcDir`. Returns the parsed JSON output (an array
  * of file-level findings) or null if retire is unavailable.
@@ -263,8 +313,24 @@ async function scanWithRetire(srcDir, opts = {}) {
 	return normaliseRetireResults(raw, srcDir);
 }
 
+/**
+ * Like scanWithRetire but returns BOTH the vulnerable matches (chapter "Vendored
+ * JS") and the full identified-library inventory (chapter "Unmanaged / vendored
+ * JavaScript"). One retire run feeds both.
+ */
+async function scanWithRetireFull(srcDir, opts = {}) {
+	const raw = await runRetire(srcDir, opts);
+	if (!raw) return { matches: [], inventory: [] };
+	return {
+		matches: normaliseRetireResults(raw, srcDir),
+		inventory: extractVendoredInventory(raw, srcDir),
+	};
+}
+
 module.exports = {
 	scanWithRetire,
+	scanWithRetireFull,
+	extractVendoredInventory,
 	runRetire,
 	normaliseRetireResults,
 	findRetireBin,

package/lib/scan-completeness.js

@@ -40,7 +40,13 @@ function detectScanCompletenessWarnings(resolvedDeps, opts = {}) {
 	// BOMs themselves: a present-and-correct BOM is not a problem.
 	const unresolved = [];
 	for (const d of resolvedDeps.values()) {
-		if (d.ecosystem === "npm") continue; // lockfile already pins everything
+		// Maven-only: the unresolved-version case (external BOM / out-of-tree
+		// property) is specific to Maven. Other ecosystems pin via lockfile, and
+		// native binaries (provenance:"binary") are identified by checksum, not a
+		// version — they belong to the Unmanaged/vendored-binaries chapter, NOT
+		// here. Including them mislabelled e.g. libeay32.dll as a Maven dep.
+		if (d.ecosystem !== "maven") continue;
+		if (d.provenance === "binary") continue;
 		if (d.scope === "import") continue;  // BOM-pointer entries themselves: not a dep
 		if (!d.version) unresolved.push({ ...d, reason: "no-version" });
 		else if (/\$\{[^}]+\}/.test(String(d.version))) unresolved.push({ ...d, reason: "unresolved-property" });

package/lib/unmanaged.js

@@ -0,0 +1,82 @@
+/**
+ * lib/unmanaged.js — enrich unmanaged (hash-bearing) records with online identity
+ * + an integrity classification.
+ *
+ *   integrity:
+ *     "pristine"    — deps.dev matched: file is byte-identical to a PUBLISHED package
+ *                     artifact (so it's unmodified, and ought to be a managed dep).
+ *     "known-good"  — CIRCL matched: a known OS/distro/CDN/NSRL file.
+ *     "unknown"     — no source recognises the hash (suspicious / vendored unknown).
+ *
+ * Records carrying a declared coordinate (embedded jars) gain a "modified" status in
+ * a later refinement; Plan 2 covers the hash-bearing binary records.
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
+ */
+const { lookupHash, loadCache, saveCache } = require("./hash-id");
+
+async function enrichUnmanaged(resolved, opts = {}) {
+	const { fetcher, offline = false, cache, onProgress } = opts;
+	const targets = [...resolved.values()].filter(d => d.hashes && (d.hashes.sha1 || d.hashes.sha256));
+	const summary = { total: targets.length, identified: 0, pristine: 0, knownGood: 0, unknown: 0, malicious: 0 };
+	if (!targets.length) return summary;
+	const entries = cache || loadCache();
+	let done = 0;
+	for (const d of targets) {
+		const id = await lookupHash(d.hashes, { fetcher, offline, cache: entries });
+		d.identity = id || null;
+		if (!id) d.integrity = "unknown";
+		else if (id.source === "deps.dev") d.integrity = "pristine";
+		else d.integrity = "known-good";
+		if (id) summary.identified++;
+		if (d.integrity === "pristine") summary.pristine++;
+		else if (d.integrity === "known-good") summary.knownGood++;
+		else summary.unknown++;
+		if (id?.knownMalicious) summary.malicious++;
+		if (onProgress) onProgress(++done, targets.length);
+	}
+	if (!cache && !offline) saveCache(entries);
+	return summary;
+}
+
+function normName(s) {
+	return String(s || "").toLowerCase()
+		.replace(/\.(dll|exe|so|dylib)(\.\d+)*$/, "")  // drop binary extension (+ soname version)
+		.replace(/^lib/, "")                            // libssl → ssl
+		.replace(/[-_.]?\d[\d.]*$/, "")                 // trailing version
+		.replace(/[^a-z0-9]/g, "");
+}
+
+/** Lenient compare of a filename to an online identity name (last :/ segment). */
+function nameMatches(declared, identityName) {
+	const a = normName(declared);
+	const b = normName(String(identityName).split(/[:/]/).pop());
+	if (!a || !b) return true;        // can't compare → don't raise a false alarm
+	return a.includes(b) || b.includes(a);
+}
+
+/** Turn the unmanaged (hash-bearing) records into an inventory with derived signals. */
+function buildInventory(resolved) {
+	const out = [];
+	for (const d of resolved.values()) {
+		if (!d.hashes || !(d.provenance === "binary" || d.provenance === "embedded")) continue;
+		const identity = d.identity || null;
+		out.push({
+			path: d.manifestPaths?.[0] || d.declaredName || null,
+			declaredName: d.declaredName || d.name || null,
+			provenance: d.provenance,
+			hashes: d.hashes,
+			identity,
+			integrity: d.integrity || "unknown",
+			noOnlineInfo: !identity,
+			shouldBeManaged: !!(identity && identity.ecosystem),
+			nameMismatch: !!(identity && identity.name && !nameMatches(d.declaredName || d.name, identity.name)),
+			knownMalicious: !!(identity && identity.knownMalicious),
+		});
+	}
+	out.sort((a, b) => String(a.path).localeCompare(String(b.path)));
+	return out;
+}
+
+module.exports = { enrichUnmanaged, buildInventory, nameMatches };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fad-checker",
-  "version": "2.1.2",
+  "version": "2.2.0",
   "description": "Scan ALL Maven, npm, Yarn, Composer, Python, C#/.NET, Go & Ruby dependencies — plus embedded JARs (fat-jars/war/ear) — in a source tree ONE SHOT without mvn/python/etc — CVE (EPSS/KEV-prioritised), EOL, obsolete, outdated & licenses, with SBOM/CSAF/SARIF/JSON exports, CI gating and fix recos",
   "keywords": [
     "sca",