iamsecure 0.0.0-stage → 0.1.0

package/src/deps/lockfiles/yarn.js

@@ -0,0 +1,93 @@
+import { DepGraph } from '../graph.js';
+import { parseYaml } from '../../util/yaml.js';
+
+const specName = (spec) => spec.slice(0, spec.indexOf('@', 1));
+
+const unquote = (s) => (s.startsWith('"') && s.endsWith('"') ? s.slice(1, -1) : s);
+
+/** Classic yarn.lock (v1) — its own non-YAML format. Returns Map<spec, entry>. */
+function parseClassic(text) {
+  const entries = new Map();
+  let current = null;
+  let section = null;
+  for (const raw of text.split(/\r?\n/)) {
+    if (!raw.trim() || raw.trimStart().startsWith('#')) continue;
+    const indent = raw.length - raw.trimStart().length;
+    const line = raw.trim();
+    if (indent === 0 && line.endsWith(':')) {
+      const specs = line.slice(0, -1).split(/,\s*/).map(unquote);
+      current = { name: specName(specs[0]), version: null, dependencies: {}, optionalDependencies: {} };
+      for (const s of specs) entries.set(s, current);
+      section = null;
+    } else if (current && indent <= 2) {
+      const m = line.match(/^(\S+)\s+"?([^"]*)"?$/);
+      if (line === 'dependencies:' || line === 'optionalDependencies:') section = current[line.slice(0, -1)];
+      else {
+        section = null;
+        if (m && m[1] === 'version') current.version = m[2];
+      }
+    } else if (current && section) {
+      const m = line.match(/^("(?:[^"\\]|\\.)*"|\S+)\s+("(?:[^"\\]|\\.)*"|\S+)$/);
+      if (m) section[unquote(m[1])] = unquote(m[2]);
+    }
+  }
+  return entries;
+}
+
+/** Yarn 2+ (berry) lockfile — YAML with "name@npm:range" keys. */
+function parseBerry(text) {
+  const doc = parseYaml(text);
+  const entries = new Map();
+  for (const [keyList, e] of Object.entries(doc)) {
+    if (keyList === '__metadata' || typeof e !== 'object') continue;
+    const resolution = e.resolution ?? keyList.split(/,\s*/)[0];
+    const entry = {
+      name: specName(resolution),
+      version: e.version,
+      local: resolution.includes('@workspace:'),
+      dependencies: e.dependencies ?? {},
+      optionalDependencies: e.optionalDependencies ?? {},
+    };
+    for (const s of keyList.split(/,\s*/)) entries.set(s, entry);
+  }
+  return entries;
+}
+
+/**
+ * @param {string} text yarn.lock contents
+ * @param {{dir:string, manifest:any}[]} manifests root + workspace package.json files — yarn.lock
+ *   doesn't record which deps are dev, so roots come from the manifests.
+ */
+export function parseYarnLock(text, manifests) {
+  const berry = /^__metadata:/m.test(text);
+  const entries = berry ? parseBerry(text) : parseClassic(text);
+  const g = new DepGraph('npm', 'yarn.lock');
+
+  const lookup = (name, range) =>
+    entries.get(`${name}@${range}`) ?? entries.get(`${name}@npm:${range}`) ?? null;
+
+  const unique = new Set(entries.values());
+  for (const e of unique) {
+    if (!e.version) continue;
+    e.key = e.local ? null : g.addNode(e.name, e.version);
+  }
+  for (const e of unique) {
+    if (!e.key) continue;
+    for (const [dep, range] of Object.entries({ ...e.optionalDependencies, ...e.dependencies })) {
+      const target = lookup(dep, range);
+      if (target?.key) g.addEdge(e.key, target.key);
+    }
+  }
+  for (const { dir, manifest } of manifests) {
+    const add = (deps, dev) => {
+      for (const [name, range] of Object.entries(deps ?? {})) {
+        const target = lookup(name, range) ?? [...unique].find((e) => e.name === name && e.key);
+        if (target?.key) g.addRoot(name, target.key, { dev, workspace: dir });
+      }
+    };
+    add(manifest.dependencies, false);
+    add(manifest.optionalDependencies, false);
+    add(manifest.devDependencies, true);
+  }
+  return g.annotate();
+}

package/src/deps/osv.js

@@ -0,0 +1,106 @@
+import { fetchJson, mapLimit } from '../util/http.js';
+import { cacheGet, cacheSet } from '../util/cache.js';
+import { compareVersions } from '../util/semver.js';
+import { cvssScore, levelFromScore, scoreFromLabel } from './cvss.js';
+
+const OSV = 'https://api.osv.dev/v1';
+const BATCH = 500;
+
+/**
+ * Look up every package against OSV.dev (which aggregates GitHub Advisories, npm, PyPA, Packagist, …).
+ * @param {{name:string, version:string, ecosystem:string}[]} pkgs
+ * @returns {Promise<Map<string, any[]>>} "ecosystem:name@version" → full OSV records
+ */
+export async function queryOsv(pkgs, { onProgress } = {}) {
+  const idsByPkg = new Map();
+  const wanted = new Map(); // id → modified
+
+  for (let i = 0; i < pkgs.length; i += BATCH) {
+    const chunk = pkgs.slice(i, i + BATCH);
+    const res = await fetchJson(`${OSV}/querybatch`, {
+      method: 'POST',
+      body: { queries: chunk.map((p) => ({ package: { name: p.name, ecosystem: p.ecosystem }, version: p.version })) },
+    });
+    await Promise.all(
+      (res.results ?? []).map(async (r, j) => {
+        let vulns = r.vulns ?? [];
+        // A package with a very long advisory history gets paginated; follow it.
+        for (let token = r.next_page_token; token; ) {
+          const p = chunk[j];
+          const more = await fetchJson(`${OSV}/query`, {
+            method: 'POST',
+            body: { package: { name: p.name, ecosystem: p.ecosystem }, version: p.version, page_token: token },
+          });
+          vulns = vulns.concat(more.vulns ?? []);
+          token = more.next_page_token;
+        }
+        if (!vulns.length) return;
+        idsByPkg.set(pkgId(chunk[j]), vulns.map((v) => v.id));
+        for (const v of vulns) wanted.set(v.id, v.modified ?? '');
+      }),
+    );
+    onProgress?.(Math.min(i + BATCH, pkgs.length), pkgs.length);
+  }
+
+  const details = new Map();
+  await mapLimit([...wanted], 12, async ([id, modified]) => {
+    const cached = cacheGet('osv', id);
+    if (cached && (!modified || cached.modified === modified)) return details.set(id, cached);
+    const full = await fetchJson(`${OSV}/vulns/${encodeURIComponent(id)}`);
+    cacheSet('osv', id, full);
+    details.set(id, full);
+  });
+
+  const out = new Map();
+  for (const [key, ids] of idsByPkg) out.set(key, ids.map((id) => details.get(id)).filter(Boolean));
+  return out;
+}
+
+export const pkgId = (p) => `${p.ecosystem}:${p.name}@${p.version}`;
+
+/** Flatten an OSV record into what the report needs, for one affected package/version. */
+export function normalizeVuln(v, pkg) {
+  const sev = (v.severity ?? []).find((s) => s.type === 'CVSS_V3') ?? (v.severity ?? [])[0];
+  const cvss = sev ? cvssScore(sev.score) : null;
+  const affected = (v.affected ?? []).filter(
+    (a) => a.package?.name === pkg.name && a.package?.ecosystem?.toLowerCase() === pkg.ecosystem.toLowerCase(),
+  );
+  const label = v.database_specific?.severity ?? affected.find((a) => a.ecosystem_specific?.severity)?.ecosystem_specific.severity;
+  const malicious = v.id.startsWith('MAL-');
+  const score = malicious ? 10 : (cvss?.score ?? scoreFromLabel(label) ?? 5);
+
+  return {
+    id: v.id,
+    aliases: v.aliases ?? [],
+    summary: v.summary || firstLine(v.details) || v.id,
+    details: (v.details ?? '').slice(0, 4000),
+    published: v.published,
+    modified: v.modified,
+    url: `https://osv.dev/vulnerability/${v.id}`,
+    references: (v.references ?? []).slice(0, 6).map((r) => r.url),
+    cwes: v.database_specific?.cwe_ids ?? [],
+    cvss: cvss && { vector: sev.score, version: cvss.version, score: cvss.score, metrics: cvss.metrics },
+    severityScore: score,
+    severity: levelFromScore(score),
+    fixedIn: fixedVersion(affected, pkg.version),
+    malicious,
+  };
+}
+
+/** Prefer the fix of the range that actually contains `current` (e.g. a 13.x backport over 15.x). */
+function fixedVersion(affected, current) {
+  const later = [];
+  for (const range of affected.flatMap((a) => a.ranges ?? [])) {
+    let introduced = null;
+    for (const e of range.events ?? []) {
+      if (e.introduced !== undefined) introduced = e.introduced;
+      if (e.fixed === undefined) continue;
+      const inRange = (introduced === '0' || introduced === null || compareVersions(current, introduced) >= 0) && compareVersions(current, e.fixed) < 0;
+      if (inRange) return e.fixed;
+      if (compareVersions(e.fixed, current) > 0) later.push(e.fixed);
+    }
+  }
+  return later.sort(compareVersions)[0] ?? null;
+}
+
+const firstLine = (s) => (s ?? '').split('\n').find((l) => l.trim())?.slice(0, 160);

package/src/project.js

@@ -0,0 +1,102 @@
+import fs from 'node:fs';
+import path from 'node:path';
+
+export function readJson(file) {
+  try {
+    return JSON.parse(fs.readFileSync(file, 'utf8'));
+  } catch {
+    return null;
+  }
+}
+
+/** Expand package.json "workspaces" globs (supports "dir", "dir/*" and "dir/**"). */
+export function findWorkspaces(root, manifest) {
+  const patterns = Array.isArray(manifest?.workspaces) ? manifest.workspaces : (manifest?.workspaces?.packages ?? []);
+  const dirs = new Set();
+  for (const pattern of patterns) {
+    if (pattern.startsWith('!')) continue;
+    let current = [''];
+    for (const seg of pattern.replace(/\/$/, '').split('/')) {
+      const next = [];
+      for (const base of current) {
+        if (seg === '*' || seg === '**') {
+          for (const d of safeReaddir(path.join(root, base))) {
+            if (d.isDirectory() && d.name !== 'node_modules' && !d.name.startsWith('.')) next.push(path.join(base, d.name));
+          }
+        } else next.push(path.join(base, seg));
+      }
+      current = next;
+    }
+    for (const d of current) if (fs.existsSync(path.join(root, d, 'package.json'))) dirs.add(d);
+  }
+  return [...dirs].map((dir) => ({ dir, manifest: readJson(path.join(root, dir, 'package.json')) ?? {} }));
+}
+
+function safeReaddir(dir) {
+  try {
+    return fs.readdirSync(dir, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+}
+
+/** What kind of app is this? Drives how code is classified as browser vs server. */
+export function detectFramework(deps) {
+  const has = (n) => deps.has(n);
+  if (has('next')) return 'next';
+  if (has('nuxt')) return 'nuxt';
+  if (has('@remix-run/react') || has('@remix-run/node')) return 'remix';
+  if (has('@sveltejs/kit')) return 'sveltekit';
+  if (has('astro')) return 'astro';
+  if (has('react-scripts')) return 'cra';
+  if (has('vite') && (has('react') || has('vue') || has('svelte'))) return 'vite-spa';
+  if (['express', 'fastify', 'koa', '@nestjs/core', '@hapi/hapi', 'hono'].some(has)) return 'node-server';
+  if (has('react') || has('vue')) return 'spa';
+  return deps.size ? 'node' : 'unknown';
+}
+
+/** Non-JS projects: everything runs server-side, but name the stack for the report. */
+function detectBackend(root) {
+  const composer = readJson(path.join(root, 'composer.json'));
+  if (composer) {
+    const req = { ...composer.require, ...composer['require-dev'] };
+    if (req['laravel/framework']) return 'laravel';
+    if (Object.keys(req).some((n) => n.startsWith('symfony/'))) return 'symfony';
+    return 'php';
+  }
+  let py = '';
+  for (const f of ['pyproject.toml', 'requirements.txt', 'Pipfile']) {
+    try {
+      py += fs.readFileSync(path.join(root, f), 'utf8').toLowerCase();
+    } catch {}
+  }
+  if (py) {
+    if (/\bdjango\b/.test(py)) return 'django';
+    if (/\bfastapi\b/.test(py)) return 'fastapi';
+    if (/\bflask\b/.test(py)) return 'flask';
+    return 'python';
+  }
+  return 'unknown';
+}
+
+export function loadProject(root) {
+  root = path.resolve(root);
+  const manifest = readJson(path.join(root, 'package.json'));
+  const workspaces = manifest ? findWorkspaces(root, manifest) : [];
+  const manifests = manifest ? [{ dir: '.', manifest }, ...workspaces] : [];
+  const deps = new Set();
+  for (const { manifest: m } of manifests) {
+    for (const k of ['dependencies', 'devDependencies', 'optionalDependencies', 'peerDependencies']) {
+      for (const n of Object.keys(m[k] ?? {})) deps.add(n);
+    }
+  }
+  let framework = detectFramework(deps);
+  if (framework === 'unknown') framework = detectBackend(root);
+  return {
+    root,
+    name: manifest?.name ?? readJson(path.join(root, 'composer.json'))?.name ?? path.basename(root),
+    manifest,
+    manifests,
+    framework,
+  };
+}

package/src/report/sarif.js

@@ -0,0 +1,58 @@
+// SARIF 2.1.0 — consumed by GitHub code scanning, GitLab, Azure DevOps, VS Code SARIF viewer.
+
+const LEVEL = { critical: 'error', high: 'error', medium: 'warning', low: 'note', none: 'note' };
+
+export function toSarif(report) {
+  const rules = new Map();
+  const results = [];
+
+  for (const f of report.findings) {
+    const ruleId = f.kind === 'dependency' ? f.advisory.id : f.ruleId;
+    const helpUri = f.kind === 'dependency' ? f.advisory.url : f.cwe ? `https://cwe.mitre.org/data/definitions/${f.cwe.replace('CWE-', '')}.html` : undefined;
+    const prev = rules.get(ruleId);
+    // GitHub reads `security-severity` (0–10) to bucket alerts; use the contextual risk score.
+    if (!prev || Number(prev.properties['security-severity']) < f.riskScore) {
+      rules.set(ruleId, {
+        id: ruleId,
+        name: ruleId.replace(/[^A-Za-z0-9]+/g, '_'),
+        shortDescription: { text: f.title.slice(0, 200) },
+        fullDescription: { text: (f.kind === 'dependency' ? f.advisory.details || f.title : f.title).slice(0, 1000) },
+        helpUri,
+        help: { text: f.fix ?? '' },
+        properties: {
+          'security-severity': f.riskScore.toFixed(1),
+          tags: ['security', f.kind, ...(f.cwe ? [f.cwe] : f.advisory?.cwes ?? [])],
+        },
+      });
+    }
+
+    const where =
+      f.kind === 'dependency'
+        ? { uri: f.package.lockfile.split(',')[0].trim(), line: 1 }
+        : { uri: f.location.file, line: f.location.line };
+    const text =
+      f.kind === 'dependency'
+        ? `${f.package.name}@${f.package.version}: ${f.title}. ${f.fix}${f.package.path.length > 1 ? ` (via ${f.package.path.join(' > ')})` : ''}`
+        : `${f.title}. ${f.fix}`;
+
+    results.push({
+      ruleId,
+      level: LEVEL[f.risk],
+      message: { text: [text, ...(f.reasons ?? []).map((r) => `• ${r}`)].join('\n') },
+      locations: [{ physicalLocation: { artifactLocation: { uri: where.uri }, region: { startLine: where.line } } }],
+      partialFingerprints: { iamsecure: f.id },
+      properties: { riskScore: f.riskScore, severityScore: f.severityScore, exposure: f.exposure?.context, aiVerdict: f.ai?.verdict },
+    });
+  }
+
+  return {
+    $schema: 'https://json.schemastore.org/sarif-2.1.0.json',
+    version: '2.1.0',
+    runs: [
+      {
+        tool: { driver: { name: 'iamsecure', version: report.tool.version, informationUri: 'https://github.com/Ravindrabisht12/iamsecure', rules: [...rules.values()] } },
+        results,
+      },
+    ],
+  };
+}

package/src/report/terminal.js

@@ -0,0 +1,253 @@
+import { sortFindings } from '../scan.js';
+
+const useColor = (process.stdout.isTTY || !!process.env.FORCE_COLOR) && !process.env.NO_COLOR;
+const wrapAnsi = (code) => (s) => (useColor ? `\x1b[${code}m${s}\x1b[0m` : String(s));
+export const c = {
+  bold: wrapAnsi('1'),
+  dim: wrapAnsi('2'),
+  italic: wrapAnsi('3'),
+  red: wrapAnsi('31'),
+  green: wrapAnsi('32'),
+  yellow: wrapAnsi('33'),
+  blue: wrapAnsi('34'),
+  magenta: wrapAnsi('35'),
+  cyan: wrapAnsi('36'),
+  gray: wrapAnsi('90'),
+  orange: wrapAnsi('38;5;208'),
+  bgRed: wrapAnsi('41;97;1'),
+};
+
+const LEVELS = ['critical', 'high', 'medium', 'low'];
+const TONE = {
+  critical: (s) => c.red(c.bold(s)),
+  high: c.orange,
+  medium: c.yellow,
+  low: c.blue,
+  ok: c.green,
+  none: c.gray,
+  muted: c.gray,
+};
+const dot = (tone) => TONE[tone]('●');
+const EXPOSURE_TONE = { server: 'critical', universal: 'critical', client: 'medium', build: 'low', unused: 'muted', unknown: 'muted' };
+const EXPOSURE_WORD = { server: 'server', universal: 'server + browser', client: 'browser only', build: 'build/test only', unused: 'not imported', unknown: 'unknown' };
+const KIND_WORD = { dependency: 'Dependency', code: 'Code', secret: 'Secret' };
+
+// ── layout helpers (ANSI-aware) ──────────────────────────────────────────────
+const ANSI = /\x1b\[[0-9;]*m/g;
+const vlen = (s) => String(s).replace(ANSI, '').length;
+const pad = (s, n) => s + ' '.repeat(Math.max(0, n - vlen(s)));
+const center = (s, n) => {
+  const left = Math.floor((n - vlen(s)) / 2);
+  return pad(' '.repeat(Math.max(0, left)) + s, n);
+};
+
+/** Word-wrap plain text to `width`, hard-breaking words that don't fit. */
+function wrap(text, width) {
+  const out = [];
+  for (const para of String(text).split('\n')) {
+    let line = '';
+    for (let word of para.split(/\s+/).filter(Boolean)) {
+      while (word.length > width) {
+        if (line) out.push(line), (line = '');
+        out.push(word.slice(0, width));
+        word = word.slice(width);
+      }
+      if (!line) line = word;
+      else if (line.length + 1 + word.length <= width) line += ' ' + word;
+      else out.push(line), (line = word);
+    }
+    out.push(line);
+  }
+  return out;
+}
+
+/** Wrap, then style every line (styles must not span lines). */
+const block = (text, width, style = (s) => s, firstPrefix = '', restPrefix = firstPrefix) =>
+  wrap(text, width - vlen(firstPrefix)).map((l, i) => (i ? restPrefix : firstPrefix) + style(l));
+
+const ellipsisStart = (s, n) => (s.length <= n ? s : '…' + s.slice(-(n - 1)));
+const ellipsisEnd = (s, n) => (s.length <= n ? s : s.slice(0, n - 1) + '…');
+
+/** Lay two columns side by side; falls back to stacked when the terminal is narrow. */
+function columns(left, right, leftWidth, total, indent = '  ') {
+  if (total < 88) return [...left.map((l) => indent + l), ...right.map((r) => indent + '  ' + r)];
+  const rows = Math.max(left.length, right.length);
+  const out = [];
+  for (let i = 0; i < rows; i++) out.push(indent + pad(left[i] ?? '', leftWidth) + '   ' + (right[i] ?? ''));
+  return out;
+}
+
+// ── sections ─────────────────────────────────────────────────────────────────
+function counters(summary) {
+  const top = [];
+  const mid = [];
+  const lab = [];
+  const bot = [];
+  for (const l of LEVELS) {
+    const n = summary.byRisk[l];
+    const tone = n ? l : 'muted';
+    top.push(c.gray('╭──────────╮'));
+    mid.push(c.gray('│') + center(`${dot(tone)} ${n ? c.bold(n) : c.gray(n)}`, 10) + c.gray('│'));
+    lab.push(c.gray('│') + center(n ? c.bold(l.toUpperCase()) : c.gray(l.toUpperCase()), 10) + c.gray('│'));
+    bot.push(c.gray('╰──────────╯'));
+  }
+  return [top, mid, lab, bot].map((r) => '  ' + r.join(' '));
+}
+
+function overall(summary) {
+  const r = summary.byRisk;
+  if (r.critical) return { tone: 'critical', icon: '✖', label: 'ACTION REQUIRED', detail: `${r.critical} critical` };
+  if (r.high) return { tone: 'high', icon: '▲', label: 'ATTENTION', detail: `${r.high} high` };
+  if (summary.total) return { tone: 'medium', icon: '●', label: 'MONITOR', detail: 'minor issues' };
+  return { tone: 'ok', icon: '✔', label: 'ALL CLEAR', detail: 'no issues' };
+}
+
+function groupLine(name, list) {
+  if (!list.length) return `${dot('ok')} ${c.bold(name)} – ${c.green('Clear')}`;
+  const worst = LEVELS.find((l) => list.some((f) => f.risk === l)) ?? 'muted';
+  const counts = LEVELS.map((l) => [l, list.filter((f) => f.risk === l).length]).filter(([, n]) => n);
+  return `${dot(worst)} ${c.bold(name)} – ${counts.map(([l, n]) => `${n} ${l}`).join(', ')}`;
+}
+
+const TRIO = [11, 8, 10, 6];
+
+function latestPanel(report, width) {
+  const s = report.summary;
+  const p = report.stats.packages;
+  const st = overall(s);
+  const leftW = 36;
+  const rightW = width < 88 ? width - 6 : width - leftW - 8;
+  const bar = c.gray('┃ ');
+
+  const left = [
+    `${TONE[st.tone](st.icon)} ${c.bold(st.label)} ${c.gray('–')} ${st.detail}`,
+    c.gray(new Date(report.scannedAt).toLocaleString() + ` · ${(report.durationMs / 1000).toFixed(1)}s`),
+    '',
+    LEVELS.map((l, i) => pad(c.gray(l[0].toUpperCase() + l.slice(1) + ':'), TRIO[i])).join(''),
+    LEVELS.map((l, i) => pad(`${dot(s.byRisk[l] ? l : 'muted')} ${s.byRisk[l]}`, TRIO[i])).join(''),
+    c.gray(`by raw severity: ${LEVELS.map((l) => s.bySeverity[l]).join(' · ')}`),
+  ];
+
+  const kinds = { dependency: [], code: [], secret: [] };
+  for (const f of report.findings) kinds[f.kind].push(f);
+  const prose =
+    `Scanned ${p.total} packages (${p.direct} direct, ${p.transitive} transitive)` +
+    (report.stats.files != null ? ` and ${report.stats.files} source files` : '') +
+    `. Found ${s.total} issue${s.total === 1 ? '' : 's'}: ${kinds.dependency.length} in dependencies, ${kinds.code.length} in your code, ${kinds.secret.length} secret${kinds.secret.length === 1 ? '' : 's'}.` +
+    (s.total ? ` After weighing where each one runs, ${s.byRisk.critical} ${s.byRisk.critical === 1 ? 'is' : 'are'} critical here (raw severity says ${s.bySeverity.critical}).` : '');
+  const right = [
+    ...wrap(prose, rightW),
+    '',
+    groupLine('Dependencies', kinds.dependency),
+    groupLine('Your code', kinds.code),
+    groupLine('Secrets', kinds.secret),
+  ];
+  if (width < 88) return [...left, '', ...right].map((l) => '  ' + bar + l);
+  const rows = Math.max(left.length, right.length);
+  const out = [];
+  for (let i = 0; i < rows; i++) out.push('  ' + bar + pad(left[i] ?? '', leftW) + '  ' + (right[i] ?? ''));
+  return out;
+}
+
+function findingEntry(f, sort, width) {
+  const leftW = 34;
+  const rightW = width < 88 ? width - 6 : Math.max(36, width - leftW - 7);
+  const level = sort === 'severity' ? f.severity : f.risk;
+
+  // Left: label, subject, score trio — like "UPDATE 3 – Identified / time / Up Affected Down".
+  const subject =
+    f.kind === 'dependency' ? ellipsisEnd(`${f.package.name}@${f.package.version}`, leftW - 2) : ellipsisStart(`${f.location.file}:${f.location.line}`, leftW - 2);
+  const ctx = f.exposure?.context ?? 'unknown';
+  const left = [
+    `${TONE[level]('◉')} ${TONE[level](c.bold(level.toUpperCase()))} ${c.gray('–')} ${c.bold(KIND_WORD[f.kind])}`,
+    '  ' + c.cyan(subject),
+    `  ${c.gray('Risk')} ${dot(f.risk)} ${c.bold(f.riskScore.toFixed(1))}   ${c.gray('Sev')} ${dot(f.severity)} ${f.severityScore.toFixed(1)}`,
+    `  ${c.gray('Runs')} ${dot(EXPOSURE_TONE[ctx])} ${EXPOSURE_WORD[ctx]}`,
+  ];
+  const tags = [];
+  if (f.kind === 'dependency') {
+    tags.push(f.package.direct ? 'direct' : 'transitive');
+    if (!f.package.prod) tags.push('dev');
+  } else if (f.tainted) tags.push('user input');
+  if (tags.length) left.push('  ' + c.gray(tags.join(' · ')));
+
+  // Right: what happened, why it ranks here, what to do.
+  const right = [];
+  const flags = [];
+  if (f.advisory?.malicious) flags.push(c.bgRed(' MALICIOUS PACKAGE '));
+  if (f.exploit?.kev) flags.push(c.bgRed(' EXPLOITED IN THE WILD '));
+  right.push(...block(f.title, rightW, c.bold));
+  if (flags.length) right.push(flags.join(' '));
+  if (f.kind === 'dependency') {
+    right.push(c.gray(ellipsisEnd(`${f.advisory.id}${f.advisory.aliases.length ? ' · ' + f.advisory.aliases.slice(0, 2).join(', ') : ''}`, rightW)));
+    if (f.package.path.length > 1) right.push(...block(`via ${f.package.path.join(' › ')}`, rightW, c.gray));
+  } else if (f.location?.snippet) {
+    right.push(c.cyan('│ ') + c.cyan(ellipsisEnd(f.location.snippet.trim(), rightW - 2)));
+  }
+  for (const r of f.reasons ?? []) {
+    if (/^AI \(/.test(r)) continue;
+    right.push(...block(r, rightW, c.gray, c.gray('· '), '  '));
+  }
+  if (f.fix) right.push(...block(f.fix, rightW, (s) => s, c.green('Fix: '), '     '));
+  if (f.ai) {
+    right.push(...block(`${f.ai.verdict.replace('_', ' ')} (${Math.round(f.ai.confidence * 100)}%) — ${f.ai.reasoning}`.slice(0, 420), rightW, c.magenta, c.magenta(`AI ${f.ai.provider}: `), '  '));
+  }
+
+  return columns(left, right, leftW, width);
+}
+
+/**
+ * @param {any} report
+ * @param {{sort?: 'risk'|'severity', limit?: number, min?: string}} opts
+ */
+export function printReport(report, { sort = 'risk', limit = 30, min } = {}) {
+  const width = Math.max(60, Math.min(Number(process.env.COLUMNS) || process.stdout.columns || 110, 130));
+  const rule = (ch = '─') => '  ' + c.gray(ch.repeat(width - 4));
+  const out = [''];
+
+  // Header strip + title, like a status page.
+  out.push(c.gray('━'.repeat(width)));
+  const fw = report.project.framework;
+  const brand = `  ${c.bold('iamsecure')} ${c.gray('v' + report.tool.version)}`;
+  const where = c.gray(ellipsisStart(report.project.root, Math.max(10, width - 30)));
+  out.push(brand + ' '.repeat(Math.max(2, width - vlen(brand) - vlen(where) - 2)) + where);
+  out.push(c.gray('━'.repeat(width)));
+  out.push('');
+  out.push(`  ${c.gray('Projects ›')} ${report.project.name}`);
+  out.push('');
+  out.push(`  ${c.yellow('⚠')}  ${c.bold(`Security Report — ${report.project.name}`)}  ${c.gray(`(${fw})`)}`);
+  out.push('');
+  out.push(...counters(report.summary));
+  out.push('');
+  for (const w of report.warnings) out.push(...block(w, width - 4, c.yellow, '  ' + c.yellow('⚠ '), '    '));
+  if (report.warnings.length) out.push('');
+
+  out.push(`  ${c.gray('Latest scan:')}`);
+  out.push(...latestPanel(report, width));
+  out.push('');
+
+  if (!report.findings.length) {
+    out.push('  ' + c.green('✔ No known vulnerabilities or insecure code patterns found.'), '');
+    console.log(out.join('\n'));
+    return;
+  }
+
+  const field = sort === 'severity' ? 'severity' : 'risk';
+  const order = [...LEVELS, 'none'];
+  let list = sortFindings(report.findings, sort);
+  if (min) list = list.filter((f) => order.indexOf(f[field]) <= order.indexOf(min));
+
+  const heading = sort === 'severity' ? 'Findings — by severity (raw CVSS, high → low):' : 'Findings — worst first (real risk in this codebase):';
+  const hint = sort === 'severity' ? '--sort risk for contextual order' : '--sort severity for raw CVSS order';
+  out.push(`  ${c.gray(heading)}${' '.repeat(Math.max(2, width - 4 - heading.length - hint.length))}${c.gray(hint)}`);
+  out.push(rule());
+  for (const f of list.slice(0, limit)) {
+    out.push(...findingEntry(f, sort, width));
+    out.push(rule());
+  }
+  if (list.length > limit) {
+    out.push(`  ${c.gray('…')} ${c.bold(list.length - limit)} ${c.gray('more — use --limit <n>, --json, or open the dashboard with')} ${c.cyan('--ui')}`);
+  }
+  out.push('');
+  console.log(out.join('\n'));
+}

package/src/risk/exploit.js

@@ -0,0 +1,53 @@
+// Exploit intelligence: is anyone actually exploiting this?
+//  - CISA KEV: catalog of vulnerabilities known to be exploited in the wild.
+//  - FIRST EPSS: probability a CVE gets exploited in the next 30 days.
+
+import { fetchJson } from '../util/http.js';
+import { cacheGet, cacheSet } from '../util/cache.js';
+
+const KEV_URL = 'https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json';
+const EPSS_URL = 'https://api.first.org/data/v1/epss';
+const DAY = 24 * 60 * 60 * 1000;
+
+async function loadKev() {
+  const cached = cacheGet('kev', 'catalog', DAY);
+  if (cached) return new Map(cached);
+  const res = await fetchJson(KEV_URL, { timeout: 45000 });
+  const entries = (res.vulnerabilities ?? []).map((v) => [
+    v.cveID,
+    { dateAdded: v.dateAdded, ransomware: v.knownRansomwareCampaignUse === 'Known', name: v.vulnerabilityName },
+  ]);
+  cacheSet('kev', 'catalog', entries);
+  return new Map(entries);
+}
+
+async function loadEpss(cves) {
+  const out = new Map();
+  const missing = [];
+  for (const cve of cves) {
+    const hit = cacheGet('epss', cve, DAY);
+    if (hit !== undefined) out.set(cve, hit);
+    else missing.push(cve);
+  }
+  for (let i = 0; i < missing.length; i += 80) {
+    const chunk = missing.slice(i, i + 80);
+    const res = await fetchJson(`${EPSS_URL}?cve=${chunk.join(',')}`);
+    const got = new Map((res.data ?? []).map((d) => [d.cve, { epss: Number(d.epss), percentile: Number(d.percentile) }]));
+    for (const cve of chunk) {
+      const v = got.get(cve) ?? null;
+      out.set(cve, v);
+      cacheSet('epss', cve, v);
+    }
+  }
+  return out;
+}
+
+/** @returns {Promise<{kev: Map<string,any>, epss: Map<string,any>, warnings: string[]}>} */
+export async function loadExploitData(cves) {
+  const warnings = [];
+  const [kev, epss] = await Promise.all([
+    loadKev().catch((e) => (warnings.push(`CISA KEV unavailable: ${e.message}`), new Map())),
+    loadEpss(cves).catch((e) => (warnings.push(`EPSS unavailable: ${e.message}`), new Map())),
+  ]);
+  return { kev, epss, warnings };
+}