fad-checker 2.1.2 → 2.2.1

package/lib/scan-completeness.js

@@ -40,22 +40,37 @@ function detectScanCompletenessWarnings(resolvedDeps, opts = {}) {
 	// BOMs themselves: a present-and-correct BOM is not a problem.
 	const unresolved = [];
 	for (const d of resolvedDeps.values()) {
-		if (d.ecosystem === "npm") continue; // lockfile already pins everything
+		// Maven-only: the unresolved-version case (external BOM / out-of-tree
+		// property) is specific to Maven. Other ecosystems pin via lockfile, and
+		// native binaries (provenance:"binary") are identified by checksum, not a
+		// version — they belong to the Unmanaged/vendored-binaries chapter, NOT
+		// here. Including them mislabelled e.g. libeay32.dll as a Maven dep.
+		if (d.ecosystem !== "maven") continue;
+		if (d.provenance === "binary") continue;
 		if (d.scope === "import") continue;  // BOM-pointer entries themselves: not a dep
 		if (!d.version) unresolved.push({ ...d, reason: "no-version" });
 		else if (/\$\{[^}]+\}/.test(String(d.version))) unresolved.push({ ...d, reason: "unresolved-property" });
 	}
 
 	if (unresolved.length) {
-		// Dedupe by g:a (same coord may appear in several modules)
-		const seenKeys = new Set();
-		const items = [];
+		// Dedupe by g:a (same coord may appear in several modules), MERGING the
+		// manifest paths so the report can show WHERE each unresolved dep is declared.
+		// Items are objects ({ id, manifestPaths }) — renderWarningItems() renders the
+		// "defined in: <pom.xml>" line for that shape (same as the private-libs warning).
+		const byKey = new Map();
 		for (const d of unresolved) {
 			const k = `${d.groupId}:${d.artifactId}`;
-			if (seenKeys.has(k)) continue;
-			seenKeys.add(k);
-			items.push(`${k}${d.version ? " (" + d.version + ")" : " (no version resolved)"}`);
+			const paths = (d.manifestPaths && d.manifestPaths.length) ? d.manifestPaths
+				: (d.pomPaths && d.pomPaths.length) ? d.pomPaths
+				: [];
+			let entry = byKey.get(k);
+			if (!entry) {
+				entry = { id: `${k}${d.version ? " (" + d.version + ")" : " (no version resolved)"}`, manifestPaths: [] };
+				byKey.set(k, entry);
+			}
+			for (const p of paths) if (!entry.manifestPaths.includes(p)) entry.manifestPaths.push(p);
 		}
+		const items = [...byKey.values()];
 		warnings.push({
 			type: "unresolved-versions",
 			count: items.length,

package/lib/ui.js

@@ -17,11 +17,12 @@ const SPINNER = ["⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇",
 const TITLE_A = "fad-checker";
 const TITLE_B = "Autonomous Dependency Checker";
 
-function banner() {
-	const raw = `${TITLE_A} · ${TITLE_B}`;
+function banner(version) {
+	const ver = version ? `v${version}` : "";
+	const raw = `${TITLE_A} ${ver} · ${TITLE_B}`.replace("  ", " ");
 	const bar = "─".repeat(raw.length + 2);
 	console.log(chalk.cyan(`\n╭${bar}╮`));
-	console.log(chalk.cyan("│ ") + chalk.bold.white(TITLE_A) + chalk.cyan(" · ") + chalk.whiteBright(TITLE_B) + chalk.cyan(" │"));
+	console.log(chalk.cyan("│ ") + chalk.bold.white(TITLE_A) + (ver ? " " + chalk.dim(ver) : "") + chalk.cyan(" · ") + chalk.whiteBright(TITLE_B) + chalk.cyan(" │"));
 	console.log(chalk.cyan(`╰${bar}╯`));
 }
 

package/lib/unmanaged.js

@@ -0,0 +1,82 @@
+/**
+ * lib/unmanaged.js — enrich unmanaged (hash-bearing) records with online identity
+ * + an integrity classification.
+ *
+ *   integrity:
+ *     "pristine"    — deps.dev matched: file is byte-identical to a PUBLISHED package
+ *                     artifact (so it's unmodified, and ought to be a managed dep).
+ *     "known-good"  — CIRCL matched: a known OS/distro/CDN/NSRL file.
+ *     "unknown"     — no source recognises the hash (suspicious / vendored unknown).
+ *
+ * Records carrying a declared coordinate (embedded jars) gain a "modified" status in
+ * a later refinement; Plan 2 covers the hash-bearing binary records.
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
+ */
+const { lookupHash, loadCache, saveCache } = require("./hash-id");
+
+async function enrichUnmanaged(resolved, opts = {}) {
+	const { fetcher, offline = false, cache, onProgress } = opts;
+	const targets = [...resolved.values()].filter(d => d.hashes && (d.hashes.sha1 || d.hashes.sha256));
+	const summary = { total: targets.length, identified: 0, pristine: 0, knownGood: 0, unknown: 0, malicious: 0 };
+	if (!targets.length) return summary;
+	const entries = cache || loadCache();
+	let done = 0;
+	for (const d of targets) {
+		const id = await lookupHash(d.hashes, { fetcher, offline, cache: entries });
+		d.identity = id || null;
+		if (!id) d.integrity = "unknown";
+		else if (id.source === "deps.dev") d.integrity = "pristine";
+		else d.integrity = "known-good";
+		if (id) summary.identified++;
+		if (d.integrity === "pristine") summary.pristine++;
+		else if (d.integrity === "known-good") summary.knownGood++;
+		else summary.unknown++;
+		if (id?.knownMalicious) summary.malicious++;
+		if (onProgress) onProgress(++done, targets.length);
+	}
+	if (!cache && !offline) saveCache(entries);
+	return summary;
+}
+
+function normName(s) {
+	return String(s || "").toLowerCase()
+		.replace(/\.(dll|exe|so|dylib)(\.\d+)*$/, "")  // drop binary extension (+ soname version)
+		.replace(/^lib/, "")                            // libssl → ssl
+		.replace(/[-_.]?\d[\d.]*$/, "")                 // trailing version
+		.replace(/[^a-z0-9]/g, "");
+}
+
+/** Lenient compare of a filename to an online identity name (last :/ segment). */
+function nameMatches(declared, identityName) {
+	const a = normName(declared);
+	const b = normName(String(identityName).split(/[:/]/).pop());
+	if (!a || !b) return true;        // can't compare → don't raise a false alarm
+	return a.includes(b) || b.includes(a);
+}
+
+/** Turn the unmanaged (hash-bearing) records into an inventory with derived signals. */
+function buildInventory(resolved) {
+	const out = [];
+	for (const d of resolved.values()) {
+		if (!d.hashes || !(d.provenance === "binary" || d.provenance === "embedded")) continue;
+		const identity = d.identity || null;
+		out.push({
+			path: d.manifestPaths?.[0] || d.declaredName || null,
+			declaredName: d.declaredName || d.name || null,
+			provenance: d.provenance,
+			hashes: d.hashes,
+			identity,
+			integrity: d.integrity || "unknown",
+			noOnlineInfo: !identity,
+			shouldBeManaged: !!(identity && identity.ecosystem),
+			nameMismatch: !!(identity && identity.name && !nameMatches(d.declaredName || d.name, identity.name)),
+			knownMalicious: !!(identity && identity.knownMalicious),
+		});
+	}
+	out.sort((a, b) => String(a.path).localeCompare(String(b.path)));
+	return out;
+}
+
+module.exports = { enrichUnmanaged, buildInventory, nameMatches };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fad-checker",
-  "version": "2.1.2",
+  "version": "2.2.1",
   "description": "Scan ALL Maven, npm, Yarn, Composer, Python, C#/.NET, Go & Ruby dependencies — plus embedded JARs (fat-jars/war/ear) — in a source tree ONE SHOT without mvn/python/etc — CVE (EPSS/KEV-prioritised), EOL, obsolete, outdated & licenses, with SBOM/CSAF/SARIF/JSON exports, CI gating and fix recos",
   "keywords": [
     "sca",