fad-checker 2.2.1 → 2.2.3

package/fad-checker.js

@@ -236,7 +236,10 @@ program
 	.option("--ignore-test", "skip test-scoped dependencies in report")
 	.option("--cve-refresh", "force re-download of CVE database")
 	.option("--cve-offline", "use cached CVE index only (no download)")
+	.option("--osv-db", "import + match the full local OSV database (Maven) — offline-complete recall, independent of the per-dep OSV cache")
+	.option("--osv-db-refresh", "force re-download of the local OSV database")
 	.option("--snyk", "run snyk on cleaned POMs and merge into report (requires --target)")
+	.option("--typosquat", "flag npm/PyPI deps whose name is one edit from a popular package (heuristic typosquat/slopsquat detection)")
 	.option("--no-retire", "skip retire.js vendored-JS scan")
 	.option("--no-vendored-js-inventory", "don't list ALL identified vendored JS libs (chapter 1D) — keep only the vulnerable ones (chapter 2)")
 	.option("--retire-refresh", "ignore retire cache and re-scan")
@@ -597,6 +600,18 @@ async function timedPhase(label, fn) {
 		}
 	}
 
+	// Mirror every non-Maven lockfile/manifest (npm/yarn/pnpm, composer, pypi, nuget,
+	// go, ruby) into the cleaned tree so `snyk test --all-projects` scans the WHOLE
+	// polyglot project, not just the cleaned POMs. Maven POMs are the rewrite above.
+	let copiedManifests = 0;
+	if (!readOnly) {
+		try {
+			const { copyEcosystemManifests } = require("./lib/manifest-copy");
+			const r = await copyEcosystemManifests(options.src, options.target, { excludePath, defaultExcludes });
+			copiedManifests = r.copied;
+		} catch (err) { console.error(chalk.red("  ✗ manifest copy failed:"), err.message); }
+	}
+
 	// ---------- Maven POM analysis summary (parents missing / excluded) ----------
 	let privateLibIds = [];
 	if (runMaven && mavenCtx) {
@@ -674,11 +689,15 @@ async function timedPhase(label, fn) {
 		else ui.info(chalk.dim(`${wrotePom} POM(s) cleanable (read-only — pass -t <dir> to write them)`));
 	}
 
+	if (!readOnly && copiedManifests) {
+		ui.ok(`${chalk.bold(copiedManifests)} non-Maven lockfile/manifest(s) mirrored → ${chalk.white(options.target)} ${chalk.dim("(so snyk --all-projects scans every ecosystem)")}`);
+	}
+
 	// ---------- Scan flow (CVE / EOL / Obsolete) ----------
 	// The scan always runs — it feeds the terminal summary, the file outputs and the
 	// CI gate. Which files get written is decided by the --report-* family inside
 	// (HTML + .doc by default; --no-report writes nothing).
-	await runReportFlow(resolved, { activeIds, runMaven, runNpm, privateLibIds, mavenRepos, regMap, collectWarnings });
+	await runReportFlow(resolved, { activeIds, runMaven, runNpm, privateLibIds, mavenRepos, regMap, collectWarnings, mavenPropsByPom: mavenCtx?.propsByPom, mavenStore: mavenCtx?.store });
 	if (!readOnly) {
 		ui.section("Next step");
 		ui.info(`run Snyk on the cleaned tree:`);
@@ -687,7 +706,7 @@ async function timedPhase(label, fn) {
 })();
 
 async function runReportFlow(resolved, ecoFlags = {}) {
-	const { activeIds = [], runMaven = true, runNpm = false, privateLibIds = [], mavenRepos = [], regMap = {}, collectWarnings = [] } = ecoFlags;
+	const { activeIds = [], runMaven = true, runNpm = false, privateLibIds = [], mavenRepos = [], regMap = {}, collectWarnings = [], mavenPropsByPom = null, mavenStore = null } = ecoFlags;
 	const registriesFor = eco => regMap[eco] || [];
 	const { expandWithTransitives } = require("./lib/cve-match");
 	const { writeReports, computeStats } = require("./lib/cve-report");
@@ -701,13 +720,9 @@ async function runReportFlow(resolved, ecoFlags = {}) {
 	const npmWarnings = collectWarnings || [];
 	let scanWarnings = [];
 	const directCount = resolved.size;
-
-	// Scan-completeness signals: BOMs and unresolved-version deps mean fad-checker
-	// has gone as far as it can without running Maven/Snyk itself.
-	if (runMaven) {
-		const { detectScanCompletenessWarnings } = require("./lib/scan-completeness");
-		scanWarnings = detectScanCompletenessWarnings(resolved, { ranSnyk: !!options.snyk, ranTransitive: !!options.transitive });
-	}
+	// NOTE: scan-completeness (unresolved-versions) is computed LATER — after the BOM
+	// version-resolution step backfills external-BOM-managed versions — so it reflects
+	// what's *genuinely* still unresolved, not what a Maven Central BOM fetch will fix.
 
 	// ---- Vulnerability database update (global step progress) ----
 	ui.section("Vulnerability database update");
@@ -726,7 +741,21 @@ async function runReportFlow(resolved, ecoFlags = {}) {
 	const otherRegistryIds = activeIds.filter(id => id !== "maven" && id !== "npm" && id !== "yarn" && getCodec(id)?.checkRegistry);
 	const willCve = !!cveScanner && (!(options.cveOffline || offline) || cveIndexExists);
 	const willTransitive = !!(options.transitive && runMaven);
+	// Per-module version mediation overlay: recover transitive versions the global
+	// transitive pass masks via cross-module depMgmt bleed. Runs after (and only when)
+	// the global pass runs, and needs the parsed store + per-module props.
+	const willOverlay = willTransitive && !!mavenPropsByPom && !!mavenStore;
+	// External import BOMs (e.g. spring-boot-dependencies): resolve their managed
+	// versions to backfill declared deps that pin no version of their own (the usual
+	// Spring Boot setup). Cached via poms-cache; offline-aware (uses warmed POMs,
+	// never the network — same as transitive resolution).
+	const importBoms = (runMaven && mavenPropsByPom)
+		? require("./lib/maven-bom").collectImportBoms(mavenPropsByPom) : [];
+	const willBom = importBoms.length > 0;
 	const willOsv = !!options.osv;
+	// Local OSV DB import (Maven): offline-complete OSV recall, independent of the per-dep
+	// OSV.dev cache. Opt-in (downloads ~9 MB once); then matches online or offline.
+	const willOsvDb = !!options.osvDb && runMaven;
 	const willOutdated = !!options.allLibs;
 	const willNvd = !!options.nvd;
 	const willEpss = !!options.epss;
@@ -737,9 +766,18 @@ async function runReportFlow(resolved, ecoFlags = {}) {
 	const willBinaryId = [...resolved.values()].some(d => d.provenance === "binary");
 	// License detection piggybacks on the registry passes (same fetched metadata),
 	// so it adds no progress step of its own.
-	const totalSteps = [willTransitive, willCve, /*EOL*/ true, willOutdated, /*npm reg*/ true, ...otherRegistryIds.map(() => true), willOsv, willNvd, willEpss, willKev, willRetire, willBinaryId].filter(Boolean).length;
+	const totalSteps = [willBom, willTransitive, willOverlay, willCve, /*EOL*/ true, willOutdated, /*npm reg*/ true, ...otherRegistryIds.map(() => true), willOsv, willOsvDb, willNvd, willEpss, willKev, willRetire, willBinaryId].filter(Boolean).length;
 	const progress = new ui.Progress(totalSteps);
 
+	if (willBom) {
+		const st = progress.start("BOM version resolution (Maven Central)");
+		try {
+			const { resolveAndBackfill } = require("./lib/maven-bom");
+			const r = await resolveAndBackfill(mavenPropsByPom, resolved, { repos: mavenRepos, offline, verbose });
+			st.done(`${r.filled} dep version(s) from ${r.boms} import BOM(s)`);
+		} catch (err) { st.fail(err.message); }
+	}
+
 	if (willTransitive) {
 		const st = progress.start("Transitive resolution (Maven Central)");
 		await expandWithTransitives(resolved, {
@@ -752,6 +790,32 @@ async function runReportFlow(resolved, ecoFlags = {}) {
 		st.done(`+${resolved.size - directCount} transitive (total ${resolved.size})`);
 	}
 
+	if (willOverlay) {
+		const st = progress.start("Per-module version mediation (masked transitives)");
+		try {
+			const { expandPerModuleOverlay } = require("./lib/version-overlay");
+			const ov = await expandPerModuleOverlay(resolved, mavenStore, mavenPropsByPom, {
+				verbose,
+				offline,
+				maxDepth: parseInt(options.transitiveDepth, 10) || 6,
+				includeTestDeps: !options.ignoreTest,
+				repos: mavenRepos,
+			});
+			st.done(`+${ov.appended} masked version(s) recovered across ${ov.modules} module(s)`);
+			if (verbose && ov.recovered.length) {
+				for (const r of ov.recovered) console.log(`   ↳ ${r.coord}: +${r.version} (had ${r.had})  via ${r.module}`);
+			}
+		} catch (err) { st.fail(err.message); }
+	}
+
+	// Scan-completeness signals — computed NOW (after BOM backfill) so only the deps
+	// still without a concrete version (external BOM truly unreachable, or offline)
+	// are flagged, not the ones we just resolved from spring-boot-dependencies & co.
+	if (runMaven) {
+		const { detectScanCompletenessWarnings } = require("./lib/scan-completeness");
+		scanWarnings = detectScanCompletenessWarnings(resolved, { ranSnyk: !!options.snyk, ranTransitive: !!options.transitive });
+	}
+
 	// 1. CVE — native scanner contributed by the maven codec (local cvelistV5 index).
 	let cveMatches = [];
 	let cveDataDate = null;
@@ -854,6 +918,25 @@ async function runReportFlow(resolved, ecoFlags = {}) {
 		}
 	}
 
+	// 4b'. Local OSV database (Maven) — offline-COMPLETE recall. The per-dep OSV.dev
+	// queries above only cover deps cached online; the imported full OSV DB matches every
+	// dep offline, deterministically, regardless of cache warmth (the OSV-Scanner model).
+	if (willOsvDb) {
+		const st = progress.start("OSV database (local, Maven)");
+		try {
+			const { ensureOsvDb, matchOsvDbDeps } = require("./lib/osv-db");
+			const index = await ensureOsvDb({ offline, refresh: !!options.osvDbRefresh, verbose, ecosystem: "maven" });
+			if (!index) {
+				st.done(offline ? "no local OSV DB (run once online with --osv-db)" : "unavailable");
+			} else {
+				const dbMatches = matchOsvDbDeps(resolved, index);
+				const before = cveMatches.length;
+				cveMatches = mergeBySource(cveMatches, dbMatches);
+				st.done(`${index.count} advisories · ${dbMatches.length} matched · +${cveMatches.length - before} new`);
+			}
+		} catch (err) { st.fail(err.message); }
+	}
+
 	// 4c. NVD enrichment — canonical description + full CVSS for matched CVEs.
 	if (willNvd) {
 		const st = progress.start("NVD enrichment");
@@ -961,6 +1044,22 @@ async function runReportFlow(resolved, ecoFlags = {}) {
 		}
 	}
 
+	// 6b. Supply-chain risk lane (pure + offline): flag KNOWN-MALICIOUS advisories
+	// (OSV MAL-… already in the match set) always, and detect suspected TYPOSQUATS
+	// (opt-in --typosquat, heuristic — names one edit from a popular package).
+	const { flagMalicious, detectTyposquats } = require("./lib/malware");
+	const maliciousCount = flagMalicious(cveMatches);
+	const typosquats = options.typosquat ? detectTyposquats(resolved) : [];
+	if (maliciousCount || typosquats.length) {
+		ui.section("Supply-chain risk");
+		if (maliciousCount) ui.warn(chalk.red.bold(`${maliciousCount} KNOWN-MALICIOUS package advisory(ies) (MAL-…) — treat the build as compromised`));
+		if (typosquats.length) {
+			ui.warn(`${typosquats.length} suspected typosquat(s) — heuristic, verify each is intentional:`);
+			for (const t of typosquats.slice(0, 15)) console.log("    " + chalk.yellow(t.name) + chalk.dim(` (${t.ecosystem}) ≈ ${t.resembles}`));
+			if (typosquats.length > 15) console.log(chalk.dim(`    …and ${typosquats.length - 15} more (see JSON export)`));
+		}
+	}
+
 	// Split prod vs dev based on the dep's isDev flag (set at collection time
 	// from Maven scope=test/provided and npm dev/devOptional/optional). Keep the
 	// full per-bucket list (including cpeFiltered) so the HTML report can render
@@ -1078,7 +1177,12 @@ async function runReportFlow(resolved, ecoFlags = {}) {
 		ui.warn(`${scanWarnings.length} scan-completeness note(s) — a real Maven/Snyk run may surface more:`);
 		for (const w of scanWarnings) {
 			ui.info(chalk.dim(`[${w.type}] ${w.message}`));
-			for (const it of (w.items || []).slice(0, 4)) console.log("      " + chalk.dim(`· ${it}`));
+			// Items may be plain strings or { id, manifestPaths } objects (the
+			// unresolved-versions warning carries the defining manifest paths).
+			for (const it of (w.items || []).slice(0, 4)) {
+				const id = typeof it === "string" ? it : it.id;
+				console.log("      " + chalk.dim(`· ${id}`));
+			}
 			if ((w.items || []).length > 4) console.log("      " + chalk.dim(`· …and ${w.items.length - 4} more`));
 		}
 	}
@@ -1190,7 +1294,7 @@ async function runReportFlow(resolved, ecoFlags = {}) {
 		try {
 			const { writeFindings } = require("./lib/json-export");
 			await ensureDir(out.json);
-			writeFindings({ cveMatches, retireMatches, vendoredJsInventory, eolResults, obsoleteResults, outdatedResults, licenseResults, resolvedDeps: resolved, projectInfo, toolVersion: pkg.version }, out.json);
+			writeFindings({ cveMatches, retireMatches, vendoredJsInventory, eolResults, obsoleteResults, outdatedResults, licenseResults, resolvedDeps: resolved, projectInfo, toolVersion: pkg.version, typosquats }, out.json);
 			wrote.push(["Findings JSON", out.json]);
 		} catch (err) { ui.warn(`JSON export failed: ${err.message}`); }
 	}
@@ -1217,9 +1321,12 @@ async function runReportFlow(resolved, ecoFlags = {}) {
 		const { evaluateGate } = require("./lib/gate");
 		// Embedded-binary findings are real production risk → gate on them too.
 		const gate = evaluateGate([...prodActive, ...embeddedActive], options.failOn);
-		if (gate.failed) {
+		// A known-malicious package always blocks, regardless of the --fail-on level.
+		const maliciousActive = [...prodActive, ...embeddedActive].filter(m => m.malicious);
+		if (gate.failed || maliciousActive.length) {
 			ui.section("Gate");
-			console.log(chalk.red(`✗ --fail-on ${options.failOn}: ${gate.reason}`));
+			if (maliciousActive.length) console.log(chalk.red.bold(`✗ ${maliciousActive.length} known-malicious package(s) detected — always blocks`));
+			if (gate.failed) console.log(chalk.red(`✗ --fail-on ${options.failOn}: ${gate.reason}`));
 			process.exitCode = 1;
 		} else if (verbose) {
 			ui.info(chalk.dim(`--fail-on ${options.failOn}: no blocking finding`));

package/lib/core.js

@@ -312,11 +312,33 @@ async function rewritePoms(pomPath, allPomMetadata, allPropsByPom, opts) {
 		if (!keep.has(k)) delete props[k];
 	}
 
+	// Interpolate ${…} in coordinates against THIS pom's resolved props (incl. the
+	// project.* built-ins via getAllInheritedProps' localVars). A reactor sibling dep
+	// declared <groupId>${project.groupId}</groupId> must resolve to the real groupId for
+	// the byId/local-module lookup + the "missing/private" classification below — otherwise
+	// it's wrongly reported as a private lib (e.g. "${project.groupId}:cnaps-core"). The
+	// dep NODE itself is left raw, so the rewritten cleaned POM keeps ${…} for Snyk's mvn.
+	const pomProps = (allPropsByPom && allPropsByPom[pomPath] && allPropsByPom[pomPath].properties) || {};
+	const interp = (s) => {
+		if (s == null) return s;
+		let out = String(s);
+		for (let i = 0; i < 10 && out.includes("${"); i++) {
+			const next = out.replace(/\$\{\s*([\w.\-]+)\s*\}/g, (m, k) => {
+				const val = pomProps[k];
+				if (val == null) return m;
+				return Array.isArray(val) ? String(val[0]) : String(val);
+			});
+			if (next === out) break;
+			out = next;
+		}
+		return out;
+	};
+
 	const cleanDeps = list =>
 		list?.filter(dep => {
-			const g = coord(dep.groupId?.[0]);
-			const a = coord(dep.artifactId?.[0]);
-			const v = coord(dep.version?.[0]);
+			const g = interp(coord(dep.groupId?.[0]));
+			const a = interp(coord(dep.artifactId?.[0]));
+			const v = interp(coord(dep.version?.[0]));
 			if (!g || !a) return false;
 			if (deps2Exclude) {
 				// Versionless deps inside dependencyManagement-merged result are

package/lib/cve-match.js

@@ -49,11 +49,18 @@ function collectResolvedDeps(allPomMetadata, allPropsByPom, opts = {}) {
 	const collectFrom = (depList, pomPath, props) => {
 		if (!depList) return;
 		for (const dep of depList) {
-			const g = coord(dep.groupId?.[0]);
-			const a = coord(dep.artifactId?.[0]);
+			let g = coord(dep.groupId?.[0]);
+			let a = coord(dep.artifactId?.[0]);
 			let v = coord(dep.version?.[0]);
 			const scope = dep.scope?.[0] || "compile";
 			if (!g || !a) continue;
+			// Interpolate ${…} in the COORDINATE too, not just the version. Reactor sibling
+			// deps routinely use ${project.groupId}/${project.artifactId} (Maven built-ins,
+			// already in `props` via core.js localVars) — without this they'd enter the scan
+			// set as a literal "${project.groupId}:…" coord. Resolve BEFORE the exclude test
+			// so `-e` matches the real groupId.
+			g = resolveDepVersion(g, props);
+			a = resolveDepVersion(a, props);
 			if (ignoreTest && scope === "test") continue;
 			if (deps2Exclude && deps2Exclude.test(g)) continue;
 			if (v) v = resolveDepVersion(v, props);
@@ -180,12 +187,17 @@ function matchOne(dep, entries, confidence) {
 	// the same g:a), not just the representative highest — otherwise a CVE that
 	// only affects a lower-versioned profile variant would be missed.
 	const versions = (dep.versions && dep.versions.length) ? dep.versions : [dep.version];
+	// Only CONCRETE, resolved versions can be matched. A dep whose version is null
+	// or an unresolved `${property}` (typically pinned by an external BOM like
+	// spring-boot-dependencies) carries NO version we can compare — matching it
+	// against every "affected" range would flag it as vulnerable to ALL the
+	// coordinate's CVEs (a flood of false CRITICALs with version "?"). Skip it;
+	// it's already reported in chapter 0 as an "unresolved-versions" warning.
+	const concrete = versions.filter(v => v && !/\$\{/.test(String(v)));
+	if (!concrete.length) return matches;
 	for (const e of entries) {
-		for (const ver of versions) {
-			const affected = (e.ranges || []).some(r => {
-				if (!ver) return r.status === "affected"; // unknown version → assume affected
-				return isVersionAffected(ver, r);
-			});
+		for (const ver of concrete) {
+			const affected = (e.ranges || []).some(r => isVersionAffected(ver, r));
 			if (affected) {
 				const vdep = ver === dep.version ? dep : { ...dep, version: ver };
 				matches.push({ dep: vdep, cve: { ...e }, confidence });

package/lib/json-export.js

@@ -49,6 +49,7 @@ function cveFinding(m) {
 		fixVersion: c.fixVersion || null,
 		source: m.source || null,
 		confidence: m.confidence || null,
+		malicious: !!m.malicious,
 		cpeFiltered: !!m.cpeFiltered,
 		suppressed: !!m.suppressed,
 		suppressedReason: m.suppressedReason || null,
@@ -67,6 +68,7 @@ function buildFindings(payload = {}) {
 	const {
 		cveMatches = [], retireMatches = [], vendoredJsInventory = [], eolResults = [], obsoleteResults = [],
 		outdatedResults = [], licenseResults = null, resolvedDeps, projectInfo = {}, toolVersion = "0",
+		typosquats = [],
 	} = payload;
 
 	const { buildInventory } = require("./unmanaged");
@@ -101,6 +103,8 @@ function buildFindings(payload = {}) {
 			embedded: embedded.length,
 			vendoredJs: vendoredJsInventory.length,
 			suppressed: cveMatches.filter(m => m.suppressed).length,
+			malicious: cveMatches.filter(m => m.malicious && !m.suppressed).length,
+			typosquat: typosquats.length,
 		},
 		cve: cveMatches.map(cveFinding),
 		vendored: retireMatches.map(cveFinding),
@@ -111,6 +115,7 @@ function buildFindings(payload = {}) {
 		unmanaged,
 		embedded,
 		vendoredJs: vendoredJsInventory,
+		typosquat: typosquats,
 	};
 }
 

package/lib/malware.js

@@ -0,0 +1,100 @@
+/**
+ * lib/malware.js — supply-chain risk lane: known-malicious advisories + typosquat
+ * heuristic. Pure + fully offline (no extra network; data/popular-packages.json is bundled).
+ *
+ * Two distinct signals:
+ *   1. flagMalicious(matches) — PRECISE. Marks any match whose advisory is a known
+ *      malicious-package report (OSV `MAL-…` id/alias, or a `malicious` database flag)
+ *      as malicious. These already flow into the match set via OSV / the local OSV DB;
+ *      this just recognises and elevates them (gate hard-fails on them, like KEV).
+ *   2. detectTyposquats(resolvedDeps) — PROACTIVE / heuristic. Flags an npm or PyPI
+ *      dependency whose name is edit-distance 1 from a well-known popular package (but
+ *      isn't it) — the classic typosquat / "slopsquat" pattern (reqeusts, lodahs, …),
+ *      which no vuln DB catches until after the fact. Conservative (distance 1, length
+ *      ≥ 5, non-scoped) to bound false positives; opt-in via --typosquat.
+ */
+const fs = require("fs");
+const path = require("path");
+
+/**
+ * Damerau-Levenshtein (optimal string alignment) distance, bounded by `max`.
+ * Counts an ADJACENT TRANSPOSITION as 1 — the dominant typosquat pattern (lodahs↔lodash,
+ * reqeusts↔requests) that plain Levenshtein would score as 2. Returns max+1 when the
+ * length gap alone already exceeds the budget. Package names are short, so the full
+ * matrix is cheap; the length prefilter handles the obvious skips.
+ */
+function editDistance(a, b, max) {
+	if (a === b) return 0;
+	const la = a.length, lb = b.length;
+	if (Math.abs(la - lb) > max) return max + 1;
+	const d = Array.from({ length: la + 1 }, () => new Array(lb + 1).fill(0));
+	for (let i = 0; i <= la; i++) d[i][0] = i;
+	for (let j = 0; j <= lb; j++) d[0][j] = j;
+	for (let i = 1; i <= la; i++) {
+		for (let j = 1; j <= lb; j++) {
+			const cost = a.charCodeAt(i - 1) === b.charCodeAt(j - 1) ? 0 : 1;
+			let v = Math.min(d[i - 1][j] + 1, d[i][j - 1] + 1, d[i - 1][j - 1] + cost);
+			if (i > 1 && j > 1 && a.charCodeAt(i - 1) === b.charCodeAt(j - 2) && a.charCodeAt(i - 2) === b.charCodeAt(j - 1)) {
+				v = Math.min(v, d[i - 2][j - 2] + 1); // adjacent transposition
+			}
+			d[i][j] = v;
+		}
+	}
+	return d[la][lb] <= max ? d[la][lb] : max + 1;
+}
+
+let _popular = null;
+function loadPopular(file = path.join(__dirname, "..", "data", "popular-packages.json")) {
+	if (_popular) return _popular;
+	try {
+		const j = JSON.parse(fs.readFileSync(file, "utf8"));
+		// PyPI names normalised per PEP 503 (lowercase, fold -/_/.) — same rule the matcher applies.
+		_popular = { npm: new Set(j.npm || []), pypi: new Set((j.pypi || []).map(s => s.toLowerCase().replace(/[-_.]+/g, "-"))) };
+	} catch { _popular = { npm: new Set(), pypi: new Set() }; }
+	return _popular;
+}
+
+/** Mark matches that are known-malicious advisories. Mutates + returns the count. */
+function flagMalicious(matches) {
+	let n = 0;
+	for (const m of matches || []) {
+		const id = String(m.cve?.id || "");
+		const aliases = m.cve?.aliases || [];
+		const isMal = id.startsWith("MAL-") || aliases.some(a => String(a).startsWith("MAL-")) || m.cve?.malicious === true;
+		if (isMal) { m.malicious = true; if (m.cve) m.cve.malicious = true; n++; }
+	}
+	return n;
+}
+
+/**
+ * Heuristic typosquat detection for npm/PyPI deps. Returns
+ * [{ ecosystem, coord, name, resembles, distance }]. PyPI names are normalised
+ * (lowercase, - / _ folded) per PEP 503 before comparison.
+ */
+function detectTyposquats(resolvedDeps, opts = {}) {
+	const popular = opts.popular || loadPopular();
+	const out = [];
+	const norm = (eco, name) => eco === "pypi" ? name.toLowerCase().replace(/[-_.]+/g, "-") : name;
+	for (const dep of resolvedDeps.values()) {
+		const eco = dep.ecosystem;
+		if (eco !== "npm" && eco !== "pypi") continue;
+		if (dep.provenance === "embedded" || dep.provenance === "binary") continue;
+		const rawName = dep.name || dep.artifactId || "";
+		if (!rawName || rawName.startsWith("@")) continue;      // skip scoped npm (namespace-protected)
+		const name = norm(eco, rawName);
+		const set = eco === "npm" ? popular.npm : popular.pypi;
+		if (!set.size || set.has(eco === "pypi" ? name : rawName)) continue; // a popular pkg itself is not a squat
+		if (name.length < 5) continue;                          // too short → noisy
+		let best = null;
+		for (const pop of set) {
+			const target = eco === "pypi" ? pop : pop;          // pypi set already normalised at load
+			if (Math.abs(target.length - name.length) > 1) continue;
+			const d = editDistance(name, target, 1);
+			if (d === 1) { best = target; break; }
+		}
+		if (best) out.push({ ecosystem: eco, coord: dep.coordKey || rawName, name: rawName, resembles: best, distance: 1 });
+	}
+	return out;
+}
+
+module.exports = { flagMalicious, detectTyposquats, editDistance, loadPopular };

package/lib/manifest-copy.js

@@ -0,0 +1,75 @@
+/**
+ * lib/manifest-copy.js — when writing a cleaned tree (`-t`), copy every NON-Maven
+ * ecosystem manifest / lockfile from the source into the target at the same relative
+ * path, so `snyk test --all-projects` on the cleaned tree scans every ecosystem — not
+ * just the cleaned Maven POMs (which are written separately by core.rewritePoms).
+ *
+ * Maven is excluded (its cleaned POMs are the whole point of the rewrite); the binary
+ * codec is excluded (its files aren't dependency manifests). node_modules / vendor and
+ * friends are pruned so we copy the project's own lockfiles, not vendored ones.
+ */
+const fs = require("fs");
+const path = require("path");
+const { makeDirFilter } = require("./path-filter");
+const { allCodecs } = require("./codecs");
+
+// Ecosystems whose manifests/lockfiles Snyk reads off disk.
+const COPY_ECOSYSTEMS = new Set(["npm", "nuget", "composer", "pypi", "go", "ruby"]);
+// Companion files that aren't a codec's primary manifest but Snyk/the build need.
+const COMPANION_FILES = ["Directory.Packages.props", "Directory.Build.props", "nuget.config", "Gemfile", "Pipfile", "go.work", "go.work.sum"];
+// Directories never worth copying manifests from (installed/vendored trees).
+const SKIP_DIRS = new Set([
+	"node_modules", "bower_components", "jspm_packages", "vendor",
+	".git", ".svn", ".hg", ".idea", ".vscode", ".gradle", ".mvn",
+	"target", "dist", "build", "out", "bin", "obj", ".next", ".nuxt", "coverage",
+]);
+
+/** Pure: the exact filenames + extensions that count as a copyable manifest. */
+function manifestMatchers() {
+	const exact = new Set(COMPANION_FILES);
+	const exts = [];
+	for (const c of allCodecs()) {
+		if (!COPY_ECOSYSTEMS.has(c.id)) continue;
+		for (const n of c.manifestNames || []) {
+			if (n.startsWith("*.")) exts.push(n.slice(1)); // "*.csproj" → ".csproj"
+			else exact.add(n);
+		}
+	}
+	return { exact, exts };
+}
+
+/** Pure: is this basename a manifest we copy? */
+function isManifestName(name, matchers = manifestMatchers()) {
+	return matchers.exact.has(name) || matchers.exts.some(e => name.endsWith(e));
+}
+
+/**
+ * Copy every matching manifest from srcRoot into targetRoot at the same relative path.
+ * @returns { copied: number, files: string[] } (files are relative paths)
+ */
+async function copyEcosystemManifests(srcRoot, targetRoot, opts = {}) {
+	const matchers = manifestMatchers();
+	const skipDir = makeDirFilter({ srcRoot, defaultSkip: SKIP_DIRS, excludePath: opts.excludePath, useDefaults: opts.defaultExcludes !== false });
+	const files = [];
+	const walk = async (dir) => {
+		let entries;
+		try { entries = await fs.promises.readdir(dir, { withFileTypes: true }); } catch { return; }
+		for (const e of entries) {
+			const abs = path.join(dir, e.name);
+			if (e.isDirectory()) { if (!skipDir(abs, e.name)) await walk(abs); continue; }
+			if (!e.isFile()) continue;
+			if (!isManifestName(e.name, matchers)) continue;
+			const rel = path.relative(srcRoot, abs);
+			const dest = path.join(targetRoot, rel);
+			try {
+				await fs.promises.mkdir(path.dirname(dest), { recursive: true });
+				await fs.promises.copyFile(abs, dest);
+				files.push(rel);
+			} catch { /* best effort per file */ }
+		}
+	};
+	await walk(srcRoot);
+	return { copied: files.length, files };
+}
+
+module.exports = { manifestMatchers, isManifestName, copyEcosystemManifests, COPY_ECOSYSTEMS };

package/lib/maven-bom.js

@@ -0,0 +1,104 @@
+/**
+ * lib/maven-bom.js — resolve EXTERNAL import-scope BOMs (e.g. spring-boot-dependencies)
+ * from Maven Central and backfill the versions of declared deps that the BOM manages.
+ *
+ * core.js follows LOCAL `<scope>import</scope>` BOMs (their POM is in the source tree)
+ * but cannot enumerate an external BOM's managed-version table without fetching it. So
+ * in a typical Spring Boot project every `spring-boot-starter-*` (declared without a
+ * version, version pinned by the imported BOM) ends up unresolved — flooding chapter 0
+ * and dropping out of the CVE/EOL/outdated scans.
+ *
+ * This module fetches each external import BOM via transitive.js#effectivePom (which
+ * already merges the parent chain, resolves `${properties}` and recursively expands
+ * nested import BOMs), builds a g:a → version map, and fills it into the versionless
+ * declared deps. Network + cached (poms-cache, immutable) + offline-aware (the caller
+ * skips it offline). Pure except for the injected/real effectivePom fetch.
+ */
+const transitive = require("./transitive");
+
+/**
+ * Extract the distinct external import-BOM coordinates from the parsed poms' merged
+ * dependencyManagement. `version` is resolved against each pom's property map; entries
+ * that stay unresolved (`${…}`) or lack a g/a are skipped.
+ * @param propsByPom map pomPath → { properties, dependencyManagement } (xml2js-shaped)
+ * @returns [{ groupId, artifactId, version }] deduped by g:a:v
+ */
+function collectImportBoms(propsByPom) {
+	const seen = new Set();
+	const out = [];
+	for (const pom of Object.keys(propsByPom || {})) {
+		const entry = propsByPom[pom];
+		if (!entry) continue;
+		const props = entry.properties || {};
+		for (const d of (entry.dependencyManagement || [])) {
+			if (d?.scope?.[0] !== "import") continue;
+			const g = transitive.resolveProps(d.groupId?.[0], props);
+			const a = transitive.resolveProps(d.artifactId?.[0], props);
+			const v = transitive.resolveProps(d.version?.[0], props);
+			if (!g || !a || !v || /\$\{/.test(String(v))) continue;
+			const k = `${g}:${a}:${v}`;
+			if (seen.has(k)) continue;
+			seen.add(k);
+			out.push({ groupId: g, artifactId: a, version: v });
+		}
+	}
+	return out;
+}
+
+/**
+ * Resolve each import BOM to its managed-version table and merge them into one map.
+ * First BOM to manage a given g:a wins (mirrors Maven's declaration-order precedence).
+ */
+async function resolveBomManagedVersions(boms, opts = {}) {
+	const effectivePom = opts.effectivePom || transitive.effectivePom;
+	const map = new Map();
+	for (const bom of boms) {
+		let eff = null;
+		try { eff = await effectivePom(bom.groupId, bom.artifactId, bom.version, opts); }
+		catch { eff = null; }
+		if (!eff || !eff.depMgmt) continue;
+		for (const d of eff.depMgmt) {
+			if (!d.groupId || !d.artifactId) continue;
+			const k = `${d.groupId}:${d.artifactId}`;
+			if (map.has(k)) continue;
+			if (d.version && !/\$\{/.test(String(d.version))) map.set(k, String(d.version));
+		}
+	}
+	return map;
+}
+
+/**
+ * Fill the version of every Maven dep that has no concrete version (null or `${…}`)
+ * from the BOM-managed map. Mutates the resolvedDeps Map entries in place.
+ * @returns number of deps filled
+ */
+function backfillVersions(resolvedDeps, mgmtMap) {
+	let filled = 0;
+	for (const dep of resolvedDeps.values()) {
+		if (dep.ecosystem !== "maven") continue;
+		if (dep.provenance === "embedded" || dep.provenance === "binary") continue;
+		if (dep.version && !/\$\{/.test(String(dep.version))) continue; // already concrete
+		const v = mgmtMap.get(`${dep.groupId}:${dep.artifactId}`);
+		if (!v) continue;
+		dep.version = v;
+		if (!Array.isArray(dep.versions)) dep.versions = [];
+		if (!dep.versions.includes(v)) dep.versions.push(v);
+		filled++;
+	}
+	return filled;
+}
+
+/**
+ * One-shot: collect external import BOMs from the poms, resolve their managed versions
+ * online, and backfill the versionless declared deps.
+ * @returns { boms, filled, mgmtSize }
+ */
+async function resolveAndBackfill(propsByPom, resolvedDeps, opts = {}) {
+	const boms = collectImportBoms(propsByPom);
+	if (!boms.length) return { boms: 0, filled: 0, mgmtSize: 0 };
+	const map = await resolveBomManagedVersions(boms, opts);
+	const filled = backfillVersions(resolvedDeps, map);
+	return { boms: boms.length, filled, mgmtSize: map.size };
+}
+
+module.exports = { collectImportBoms, resolveBomManagedVersions, backfillVersions, resolveAndBackfill };