supply-scan 1.0.2 → 1.1.0

package/dist/index.js

@@ -2,14 +2,71 @@
 
 // src/index.ts
 import { fileURLToPath } from "url";
-import { dirname, join as join4 } from "path";
+import { dirname, join as join5 } from "path";
+
+// src/args.ts
+import { resolve } from "path";
+function parseArgs(argv) {
+  const opts = {
+    rules: [],
+    all: false,
+    list: false,
+    path: null,
+    ci: false,
+    help: false,
+    version: false
+  };
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    switch (arg) {
+      case "--all":
+      case "-a":
+        opts.all = true;
+        break;
+      case "--list":
+      case "-l":
+        opts.list = true;
+        break;
+      case "--ci":
+        opts.ci = true;
+        opts.all = true;
+        break;
+      case "--help":
+      case "-h":
+        opts.help = true;
+        break;
+      case "--version":
+      case "-v":
+        opts.version = true;
+        break;
+      case "--rule":
+      case "-r":
+        if (i + 1 < argv.length) {
+          opts.rules.push(argv[++i]);
+        }
+        break;
+      case "--path":
+      case "-p":
+        if (i + 1 < argv.length) {
+          opts.path = resolve(argv[++i]);
+        }
+        break;
+    }
+  }
+  return opts;
+}
+
+// src/rules.ts
+import { readdirSync as readdirSync2 } from "fs";
+import { join as join2 } from "path";
 
 // src/utils.ts
 import { readFileSync, readdirSync, existsSync, statSync } from "fs";
-import { join, resolve } from "path";
+import { join } from "path";
 import { platform, homedir } from "os";
-import { execSync } from "child_process";
-import { createInterface } from "readline";
+function escapeRegex(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
 function getOS() {
   return platform();
 }
@@ -45,6 +102,15 @@ function expandPath(p) {
   }
   return result2;
 }
+var SKIP_DIRS = /* @__PURE__ */ new Set([
+  "node_modules",
+  ".git",
+  "bower_components",
+  ".cache",
+  ".Trash",
+  "Library",
+  ".npm"
+]);
 function findProjects(baseDirs, maxDepth = 8) {
   const projects = /* @__PURE__ */ new Set();
   function walk(dir, depth) {
@@ -58,16 +124,7 @@ function findProjects(baseDirs, maxDepth = 8) {
           }
           continue;
         }
-        const skip = [
-          "node_modules",
-          ".git",
-          "bower_components",
-          ".cache",
-          ".Trash",
-          "Library",
-          ".npm"
-        ];
-        if (skip.includes(entry.name)) continue;
+        if (SKIP_DIRS.has(entry.name)) continue;
         walk(join(dir, entry.name), depth + 1);
       }
     } catch {
@@ -108,14 +165,54 @@ function getCommonProjectDirs() {
   ];
   return candidates.map((d) => join(home, d)).filter((d) => existsSync(d));
 }
+function fileExists(path) {
+  try {
+    return statSync(path).isFile();
+  } catch {
+    return false;
+  }
+}
+function dirExists(path) {
+  try {
+    return statSync(path).isDirectory();
+  } catch {
+    return false;
+  }
+}
+
+// src/rules.ts
+function decodeB64(s) {
+  return Buffer.from(s, "base64").toString("utf-8");
+}
+function decodeArray(arr) {
+  return arr?.map(decodeB64);
+}
+function decodeRecord(rec) {
+  if (!rec) return void 0;
+  const result2 = {};
+  for (const [key, vals] of Object.entries(rec)) {
+    result2[key] = vals.map(decodeB64);
+  }
+  return result2;
+}
+function decodeRule(rule) {
+  if (!rule.encoded || !rule.ioc) return rule;
+  const ioc = rule.ioc;
+  ioc.domains = decodeArray(ioc.domains);
+  ioc.ips = decodeArray(ioc.ips);
+  ioc.processes = decodeArray(ioc.processes);
+  ioc.strings = decodeArray(ioc.strings);
+  ioc.files = decodeRecord(ioc.files);
+  return rule;
+}
 function loadRules(rulesDir) {
   const rules = [];
   try {
-    const files = readdirSync(rulesDir).filter((f) => f.endsWith(".json"));
+    const files = readdirSync2(rulesDir).filter((f) => f.endsWith(".json"));
     for (const file of files) {
-      const rule = readJSON(join(rulesDir, file));
+      const rule = readJSON(join2(rulesDir, file));
       if (rule && rule.id && rule.packages) {
-        rules.push(rule);
+        rules.push(decodeRule(rule));
       }
     }
   } catch {
@@ -123,62 +220,9 @@ function loadRules(rulesDir) {
   rules.sort((a, b) => b.date.localeCompare(a.date));
   return rules;
 }
-function parseArgs(argv) {
-  const opts = {
-    rules: [],
-    all: false,
-    list: false,
-    path: null,
-    ci: false,
-    help: false,
-    version: false
-  };
-  for (let i = 0; i < argv.length; i++) {
-    const arg = argv[i];
-    switch (arg) {
-      case "--all":
-      case "-a":
-        opts.all = true;
-        break;
-      case "--list":
-      case "-l":
-        opts.list = true;
-        break;
-      case "--ci":
-        opts.ci = true;
-        opts.all = true;
-        break;
-      case "--help":
-      case "-h":
-        opts.help = true;
-        break;
-      case "--version":
-      case "-v":
-        opts.version = true;
-        break;
-      case "--rule":
-      case "-r":
-        if (i + 1 < argv.length) {
-          opts.rules.push(argv[++i]);
-        }
-        break;
-      case "--path":
-      case "-p":
-        if (i + 1 < argv.length) {
-          opts.path = resolve(argv[++i]);
-        }
-        break;
-    }
-  }
-  return opts;
-}
-function runCommand(cmd) {
-  try {
-    return execSync(cmd, { encoding: "utf-8", timeout: 1e4, stdio: ["pipe", "pipe", "pipe"] }).trim();
-  } catch {
-    return "";
-  }
-}
+
+// src/prompt.ts
+import { createInterface } from "readline";
 function prompt(question) {
   const rl = createInterface({
     input: process.stdin,
@@ -191,221 +235,378 @@ function prompt(question) {
     });
   });
 }
-function fileExists(path) {
-  try {
-    return statSync(path).isFile();
-  } catch {
-    return false;
-  }
-}
-function dirExists(path) {
-  try {
-    return statSync(path).isDirectory();
-  } catch {
-    return false;
-  }
-}
 
 // src/ui.ts
+var isTTY = !!process.stdout.isTTY;
+var noColor = !!process.env.NO_COLOR || process.env.TERM === "dumb";
+var hasTruecolor = isTTY && !noColor && (process.env.COLORTERM === "truecolor" || process.env.COLORTERM === "24bit" || !!process.env.WT_SESSION || process.env.TERM_PROGRAM === "vscode" || process.env.TERM_PROGRAM === "iTerm.app");
+var hasColor = isTTY && !noColor;
 var ESC = "\x1B";
+function fg(r, g, b) {
+  if (hasTruecolor) return `${ESC}[38;2;${r};${g};${b}m`;
+  if (hasColor) return `${ESC}[36m`;
+  return "";
+}
+function bg(r, g, b) {
+  if (hasTruecolor) return `${ESC}[48;2;${r};${g};${b}m`;
+  if (hasColor) return `${ESC}[44m`;
+  return "";
+}
 var c = {
-  red: `${ESC}[1;31m`,
-  green: `${ESC}[1;32m`,
-  yellow: `${ESC}[1;33m`,
-  cyan: `${ESC}[1;36m`,
-  white: `${ESC}[1;37m`,
-  dim: `${ESC}[2m`,
-  bold: `${ESC}[1m`,
-  reset: `${ESC}[0m`,
-  bgRed: `${ESC}[41m`,
-  bgGreen: `${ESC}[42m`,
-  bgYellow: `${ESC}[43m`,
-  bgBlue: `${ESC}[44m`
+  red: hasColor ? `${ESC}[1;31m` : "",
+  green: hasColor ? `${ESC}[1;32m` : "",
+  yellow: hasColor ? `${ESC}[1;33m` : "",
+  cyan: hasColor ? `${ESC}[1;36m` : "",
+  white: hasColor ? `${ESC}[1;37m` : "",
+  dim: hasColor ? `${ESC}[2m` : "",
+  bold: hasColor ? `${ESC}[1m` : "",
+  reset: hasColor ? `${ESC}[0m` : "",
+  bgRed: hasColor ? `${ESC}[41m` : "",
+  bgGreen: hasColor ? `${ESC}[42m` : "",
+  bgYellow: hasColor ? `${ESC}[43m` : "",
+  bgBlue: hasColor ? `${ESC}[44m` : "",
+  reverse: hasColor ? `${ESC}[7m` : ""
 };
-var sym = {
-  pass: "\u2705",
-  fail: "\u{1F6A8}",
-  warn: "\u26A0\uFE0F ",
-  info: "\u{1F4A1}",
-  scan: "\u{1F50D}",
-  shield: "\u{1F6E1}\uFE0F ",
-  skull: "\u{1F480}",
-  clean: "\u2728",
-  gear: "\u2699\uFE0F ",
-  pkg: "\u{1F4E6}",
-  lock: "\u{1F512}",
-  globe: "\u{1F310}",
-  folder: "\u{1F4C1}"
-};
-function banner(ruleCount) {
-  const w = process.stdout.write.bind(process.stdout);
-  w("\n");
-  w(`${c.cyan}   ___ _   _ ___ ___ _   _   _    ___  ___   _   _  _ ${c.reset}
-`);
-  w(`${c.cyan}  / __| | | | _ \\ _ \\ | | | | |  / __|/ __| /_\\ | \\| |${c.reset}
-`);
-  w(`${c.cyan}  \\__ \\ |_| |  _/  _/ |_| |_| |_| (__| (__ / _ \\| .\` |${c.reset}
-`);
-  w(`${c.cyan}  |___/\\___/|_| |_|  \\__, |_____|\\___|\\___|_/ \\_\\_|\\_|${c.reset}
-`);
-  w(`${c.cyan}                      |___/        ${c.dim}v1.0.0${c.reset}
-`);
-  w("\n");
-  w(`  ${c.white}Universal npm Supply Chain Attack Scanner${c.reset}
-`);
-  w(`  ${c.dim}Detects ${ruleCount} known attacks | Zero dependencies${c.reset}
-`);
-  w("\n");
-  divider();
+function termW() {
+  return process.stdout.columns || 80;
+}
+var W = () => Math.min(termW(), 70);
+function line(char = "\u2500") {
+  return `${c.dim}${char.repeat(W())}${c.reset}`;
 }
-function divider() {
-  console.log(`${c.dim}${"\u2500".repeat(60)}${c.reset}`);
+function severityBadge(sev) {
+  const label = sev.toUpperCase();
+  if (!hasColor) return `[${label}]`;
+  const colors = {
+    critical: [220, 38, 38],
+    high: [234, 179, 8],
+    medium: [59, 130, 246],
+    low: [107, 114, 128]
+  };
+  const col = colors[sev] || [107, 114, 128];
+  return `${bg(col[0], col[1], col[2])}${c.white} ${label} ${c.reset}`;
+}
+function badge(type) {
+  if (!hasColor) return `[${type.toUpperCase()}]`;
+  const badges = {
+    pass: `${bg(34, 197, 94)}${c.white} PASS ${c.reset}`,
+    fail: `${bg(239, 68, 68)}${c.white} FAIL ${c.reset}`,
+    warn: `${bg(234, 179, 8)}${ESC}[30m WARN ${c.reset}`,
+    info: `${bg(107, 114, 128)}${c.white} INFO ${c.reset}`
+  };
+  return badges[type];
+}
+function banner(ruleCount, version = "0.0.0") {
+  const art = [
+    "  \u250C\u2500\u2510\u252C \u252C\u250C\u2500\u2510\u250C\u2500\u2510\u252C  \u252C \u252C  \u250C\u2500\u2510\u250C\u2500\u2510\u250C\u2500\u2510\u250C\u2510\u250C",
+    "  \u2514\u2500\u2510\u2502 \u2502\u251C\u2500\u2518\u251C\u2500\u2518\u2502  \u2514\u252C\u2518  \u2514\u2500\u2510\u2502  \u251C\u2500\u2524\u2502\u2502\u2502",
+    "  \u2514\u2500\u2518\u2514\u2500\u2518\u2534  \u2534  \u2534\u2500\u2518 \u2534   \u2514\u2500\u2518\u2514\u2500\u2518\u2534 \u2534\u2518\u2514\u2518"
+  ];
+  const vBadge = `${bg(59, 130, 246)}${c.white} v${version} ${c.reset}`;
+  console.log("");
+  for (let i = 0; i < art.length; i++) {
+    const t = art.length > 1 ? i / (art.length - 1) : 0;
+    const r = Math.round(0 + 120 * t);
+    const g = Math.round(200 - 120 * t);
+    const b = Math.round(255);
+    console.log(`${fg(r, g, b)}${art[i]}${c.reset}`);
+  }
+  console.log("");
+  console.log(`  ${c.white}Universal npm Supply Chain Attack Scanner${c.reset}  ${vBadge}`);
+  console.log(`  ${c.dim}Detects ${ruleCount} known attacks \xB7 Zero dependencies${c.reset}`);
+  console.log("");
+  console.log(line());
 }
 function sectionHeader(num, total, title, icon) {
+  const w = W();
+  const step = `${bg(59, 130, 246)}${c.white} ${num}/${total} ${c.reset}`;
+  const text = ` ${icon}  ${step} ${c.white}${c.bold}${title}${c.reset} `;
+  const textLen = 4 + 4 + title.length + 4;
+  const fill = Math.max(w - textLen - 2, 0);
   console.log("");
-  console.log(`${c.bgBlue}${c.white}${c.bold}  ${icon}  CHECK ${num}/${total}  \u2502  ${title}  ${c.reset}`);
-  divider();
+  console.log(`${c.dim}\u2500\u2500${c.reset}${text}${c.dim}${"\u2500".repeat(fill)}${c.reset}`);
 }
 function result(type, msg) {
-  const icons = {
-    pass: sym.pass,
-    fail: sym.fail,
-    warn: sym.warn,
-    info: sym.info
-  };
-  const colors = {
-    pass: c.green,
-    fail: `${c.red}${c.bold}`,
-    warn: c.yellow,
-    info: c.dim
-  };
-  console.log(`   ${icons[type]} ${colors[type]}${msg}${c.reset}`);
+  const color = type === "fail" ? c.red : type === "warn" ? c.yellow : type === "pass" ? c.green : c.dim;
+  console.log(`   ${badge(type)} ${color}${msg}${c.reset}`);
 }
 function resultDetail(msg) {
-  console.log(`      ${c.red}\u2192 ${msg}${c.reset}`);
+  console.log(`          ${c.dim}\u21B3${c.reset} ${c.red}${msg}${c.reset}`);
+}
+function hideCursor() {
+  if (isTTY) process.stdout.write(`${ESC}[?25l`);
 }
-var SPIN_FRAMES = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
-var spinnerTimer = null;
-var spinnerFrame = 0;
+function showCursor() {
+  if (isTTY) process.stdout.write(`${ESC}[?25h`);
+}
+function teardownStdin(listener) {
+  if (process.stdin.isTTY) process.stdin.setRawMode(false);
+  process.stdin.pause();
+  process.stdin.removeListener("data", listener);
+  showCursor();
+}
+var FRAMES = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
+var SPIN_COLORS = FRAMES.map((_, i) => {
+  const r = Math.round(80 + 40 * Math.sin(i * 0.6));
+  const g = Math.round(180 + 20 * Math.cos(i * 0.6));
+  return fg(r, g, 255);
+});
+var spinTimer = null;
+var spinIdx = 0;
 function spinnerStart(msg) {
-  spinnerFrame = 0;
-  spinnerTimer = setInterval(() => {
-    const frame = SPIN_FRAMES[spinnerFrame % SPIN_FRAMES.length];
-    process.stdout.write(`\r   ${c.cyan}${frame}${c.reset} ${c.dim}${msg}${c.reset}`);
-    spinnerFrame++;
+  spinIdx = 0;
+  hideCursor();
+  spinTimer = setInterval(() => {
+    const i = spinIdx % FRAMES.length;
+    process.stdout.write(`\r${ESC}[2K   ${SPIN_COLORS[i]}${FRAMES[i]}${c.reset} ${c.dim}${msg}${c.reset}`);
+    spinIdx++;
   }, 80);
 }
 function spinnerStop() {
-  if (spinnerTimer) {
-    clearInterval(spinnerTimer);
-    spinnerTimer = null;
-    process.stdout.write("\r\x1B[K");
+  if (spinTimer) {
+    clearInterval(spinTimer);
+    spinTimer = null;
+    process.stdout.write(`\r${ESC}[2K`);
+    showCursor();
   }
 }
-var severityColors = {
-  critical: c.red,
-  high: c.yellow,
-  medium: c.cyan,
-  low: c.dim
-};
+function info(msg) {
+  console.log(`   ${c.dim}${msg}${c.reset}`);
+}
+function success(msg) {
+  console.log(`   ${c.green}\u2713${c.reset} ${msg}`);
+}
 function printRuleList(rules) {
   console.log("");
-  console.log(`  ${c.white}Available attack rules (${rules.length}):${c.reset}`);
+  console.log(`  ${c.white}${c.bold}Available rules (${rules.length}):${c.reset}`);
   console.log("");
   for (const rule of rules) {
-    const sc = severityColors[rule.severity] || c.dim;
     const pkgCount = Object.keys(rule.packages.compromised).length + Object.keys(rule.packages.malicious).length;
-    console.log(
-      `   ${c.dim}\u2022${c.reset} ${c.white}${rule.id.padEnd(25)}${c.reset} ${sc}${rule.severity.padEnd(10)}${c.reset} ${c.dim}${rule.date}${c.reset}  ${c.dim}(${pkgCount} pkgs)${c.reset}`
-    );
-    console.log(`     ${c.dim}${rule.description}${c.reset}`);
+    console.log(`   ${severityBadge(rule.severity)} ${c.white}${rule.id}${c.reset} ${c.dim}\xB7 ${rule.date} \xB7 ${pkgCount} pkgs${c.reset}`);
+    console.log(`      ${c.dim}${rule.description}${c.reset}`);
   }
   console.log("");
 }
 function printSummary(summary) {
   console.log("");
-  console.log(`${c.cyan}${"\u2550".repeat(60)}${c.reset}`);
-  console.log(`  ${sym.shield} ${c.white}${c.bold}SCAN COMPLETE${c.reset}`);
-  console.log(`${c.cyan}${"\u2550".repeat(60)}${c.reset}`);
+  console.log(line("\u2550"));
+  console.log("");
+  console.log(`   ${c.dim}Projects scanned${c.reset}  ${c.white}${c.bold}${summary.projectsScanned}${c.reset}`);
+  console.log(`   ${c.dim}Rules checked${c.reset}     ${c.white}${c.bold}${summary.rulesChecked}${c.reset}`);
   console.log("");
-  console.log(`   ${c.dim}Projects scanned:${c.reset}  ${c.white}${summary.projectsScanned}${c.reset}`);
-  console.log(`   ${c.dim}Rules checked:${c.reset}     ${c.white}${summary.rulesChecked}${c.reset}`);
-  console.log(`   ${c.dim}Total checks:${c.reset}      ${c.white}${summary.totalChecks}${c.reset}`);
-  console.log(`   ${c.green}Passed:${c.reset}            ${c.green}${summary.passed}${c.reset}`);
-  console.log(`   ${c.yellow}Warnings:${c.reset}          ${c.yellow}${summary.warnings}${c.reset}`);
-  console.log(`   ${c.red}Failed:${c.reset}            ${c.red}${summary.failed}${c.reset}`);
+  console.log(`   ${badge("pass")} ${c.green}${summary.passed}${c.reset}    ${badge("warn")} ${c.yellow}${summary.warnings}${c.reset}    ${badge("fail")} ${c.red}${summary.failed}${c.reset}`);
   console.log("");
-  divider();
   if (summary.failed > 0) {
+    console.log(`   ${bg(220, 38, 38)}${c.white}${c.bold} \u26D4 COMPROMISE DETECTED \u26D4 ${c.reset}`);
     console.log("");
-    console.log(`   ${c.bgRed}${c.white}${c.bold}  \u26D4  COMPROMISE DETECTED  \u26D4  ${c.reset}`);
-    console.log("");
-    console.log(`   ${c.red}${c.bold}Immediate Actions Required:${c.reset}`);
-    console.log("");
+    console.log(`   ${c.red}${c.bold}Immediate Actions:${c.reset}`);
     console.log(`   ${c.red}1.${c.reset} Disconnect from the network`);
-    console.log(`   ${c.red}2.${c.reset} Rotate ALL credentials, tokens, API keys, SSH keys`);
-    console.log(`   ${c.red}3.${c.reset} Remove compromised packages: ${c.white}npm install <pkg>@latest${c.reset}`);
-    console.log(`   ${c.red}4.${c.reset} Clean npm cache: ${c.white}npm cache clean --force${c.reset}`);
-    console.log(`   ${c.red}5.${c.reset} Review system for backdoors and persistence mechanisms`);
-    console.log(`   ${c.red}6.${c.reset} Consider full system wipe if RAT/worm was executed`);
-    console.log("");
+    console.log(`   ${c.red}2.${c.reset} Rotate ALL credentials, tokens, API keys`);
+    console.log(`   ${c.red}3.${c.reset} ${c.white}npm install <pkg>@latest${c.reset} for compromised packages`);
+    console.log(`   ${c.red}4.${c.reset} ${c.white}npm cache clean --force${c.reset}`);
+    console.log(`   ${c.red}5.${c.reset} Review system for backdoors and persistence`);
     if (summary.compromisedProjects.length > 0) {
-      console.log(`   ${c.red}${c.bold}Compromised Projects:${c.reset}`);
-      for (const proj of summary.compromisedProjects) {
-        console.log(`      ${c.red}${sym.skull} ${proj}${c.reset}`);
-      }
       console.log("");
+      console.log(`   ${c.red}${c.bold}Compromised:${c.reset}`);
+      for (const p of summary.compromisedProjects) {
+        console.log(`   ${c.red}  \u2192 ${p}${c.reset}`);
+      }
     }
-    const failedByRule = /* @__PURE__ */ new Map();
+    const byRule = /* @__PURE__ */ new Map();
     for (const r of summary.results.filter((r2) => r2.type === "fail")) {
-      const arr = failedByRule.get(r.rule) || [];
+      const arr = byRule.get(r.rule) || [];
       arr.push(r);
-      failedByRule.set(r.rule, arr);
+      byRule.set(r.rule, arr);
     }
-    for (const [rule, results] of failedByRule) {
+    for (const [rule, results] of byRule) {
+      console.log("");
       console.log(`   ${c.red}${c.bold}${rule}:${c.reset}`);
       for (const r of results) {
-        console.log(`      ${c.red}\u2192 ${r.message}${c.reset}`);
-        if (r.details) console.log(`        ${c.dim}${r.details}${c.reset}`);
+        console.log(`     ${c.red}\u2192 ${r.message}${c.reset}`);
+        if (r.details) console.log(`       ${c.dim}${r.details}${c.reset}`);
       }
-      console.log("");
     }
   } else if (summary.warnings > 0) {
+    console.log(`   ${bg(234, 179, 8)}${ESC}[30m${c.bold} \u26A0 WARNINGS \u2014 REVIEW RECOMMENDED \u26A0 ${c.reset}`);
     console.log("");
-    console.log(`   ${c.bgYellow}${c.white}${c.bold}  \u26A0  WARNINGS FOUND \u2014 REVIEW RECOMMENDED  \u26A0  ${c.reset}`);
-    console.log("");
-    console.log(`   ${c.yellow}Some items need manual review. Check the warnings above.${c.reset}`);
-    console.log("");
+    console.log(`   ${c.yellow}Some items need manual review.${c.reset}`);
   } else {
+    console.log(`   ${bg(34, 197, 94)}${c.white}${c.bold} \u2713 ALL CLEAR ${c.reset}`);
     console.log("");
-    console.log(`   ${c.bgGreen}${c.white}${c.bold}  ${sym.clean} ALL CLEAR \u2014 NO COMPROMISE DETECTED ${sym.clean}  ${c.reset}`);
-    console.log("");
-    console.log(`   ${c.green}Your system appears clean from all known supply chain attacks.${c.reset}`);
+    console.log(`   ${c.green}No supply chain compromises detected.${c.reset}`);
     console.log("");
-    console.log(`   ${c.dim}Prevention tips:${c.reset}`);
-    console.log(`   ${c.cyan}\u203A${c.reset} Use lockfiles and verify package integrity`);
+    console.log(`   ${c.dim}Tips:${c.reset}`);
+    console.log(`   ${c.cyan}\u203A${c.reset} Use lockfiles and verify integrity`);
     console.log(`   ${c.cyan}\u203A${c.reset} Pin dependencies to exact versions`);
-    console.log(`   ${c.cyan}\u203A${c.reset} Enable npm audit in your CI/CD pipeline`);
-    console.log(`   ${c.cyan}\u203A${c.reset} Monitor for SLSA provenance on critical packages`);
-    console.log("");
+    console.log(`   ${c.cyan}\u203A${c.reset} Enable npm audit in CI/CD`);
+    console.log(`   ${c.cyan}\u203A${c.reset} Monitor SLSA provenance on critical packages`);
   }
-  divider();
   console.log("");
-  console.log(`   ${c.dim}Scan completed at ${(/* @__PURE__ */ new Date()).toISOString()}${c.reset}`);
+  console.log(line("\u2550"));
+  console.log(`   ${c.dim}${(/* @__PURE__ */ new Date()).toISOString()}${c.reset}`);
   console.log(`   ${c.dim}https://github.com/AsyrafHussin/supply-scan${c.reset}`);
   console.log("");
 }
+async function interactiveMultiSelect(opts) {
+  if (!process.stdin.isTTY) return opts.items.map((i) => i.value);
+  const items = opts.items;
+  const hasAll = !!opts.allOption;
+  const totalRows = hasAll ? items.length + 1 : items.length;
+  let cursor = 0;
+  const selected = /* @__PURE__ */ new Set();
+  let allSelected = true;
+  const headerLines = 3;
+  const totalLines = headerLines + totalRows;
+  function render(initial = false) {
+    if (!initial) process.stdout.write(`${ESC}[${totalLines}A`);
+    process.stdout.write(`${ESC}[2K
+`);
+    process.stdout.write(`${ESC}[2K  ${c.white}${c.bold}${opts.message}${c.reset}
+`);
+    process.stdout.write(`${ESC}[2K  ${c.dim}\u2191\u2193 navigate \xB7 space toggle \xB7 enter confirm${c.reset}
+`);
+    if (hasAll) {
+      const active = cursor === 0;
+      const icon = allSelected ? `${c.green}\u25C9${c.reset}` : `${c.dim}\u25CB${c.reset}`;
+      const ptr = active ? `${c.cyan}\u276F${c.reset}` : " ";
+      const lbl = active ? `${c.green}${c.bold}${opts.allOption.label}${c.reset}` : `${c.dim}${opts.allOption.label}${c.reset}`;
+      process.stdout.write(`${ESC}[2K  ${ptr} ${icon} ${lbl}
+`);
+    }
+    for (let i = 0; i < items.length; i++) {
+      const idx = hasAll ? i + 1 : i;
+      const active = cursor === idx;
+      const sel = allSelected || selected.has(i);
+      const icon = sel ? `${c.green}\u25C9${c.reset}` : `${c.dim}\u25CB${c.reset}`;
+      const ptr = active ? `${c.cyan}\u276F${c.reset}` : " ";
+      const hint = items[i].hint ? `  ${c.dim}${items[i].hint}${c.reset}` : "";
+      const lbl = active ? `${c.white}${items[i].label}${c.reset}` : `${c.dim}${items[i].label}${c.reset}`;
+      process.stdout.write(`${ESC}[2K  ${ptr} ${icon} ${lbl}${hint}
+`);
+    }
+  }
+  return new Promise((resolve2) => {
+    hideCursor();
+    render(true);
+    process.stdin.setRawMode(true);
+    process.stdin.resume();
+    const maxCursor = hasAll ? items.length : items.length - 1;
+    const onData = (data) => {
+      const key = data.toString();
+      if (key === "\x1B[A") {
+        cursor = cursor <= 0 ? maxCursor : cursor - 1;
+        render();
+      } else if (key === "\x1B[B") {
+        cursor = cursor >= maxCursor ? 0 : cursor + 1;
+        render();
+      } else if (key === " ") {
+        if (hasAll && cursor === 0) {
+          allSelected = !allSelected;
+          selected.clear();
+        } else {
+          const ii = hasAll ? cursor - 1 : cursor;
+          allSelected = false;
+          if (selected.has(ii)) selected.delete(ii);
+          else selected.add(ii);
+          if (selected.size === items.length) {
+            allSelected = true;
+            selected.clear();
+          }
+        }
+        render();
+      } else if (key === "\r") {
+        teardownStdin(onData);
+        if (allSelected || selected.size === 0) {
+          resolve2(items.map((i) => i.value));
+        } else {
+          resolve2([...selected].map((i) => items[i].value));
+        }
+      } else if (key === "") {
+        teardownStdin(onData);
+        process.exit(130);
+      }
+    };
+    process.stdin.on("data", onData);
+  });
+}
+async function interactiveSingleSelect(opts) {
+  if (!process.stdin.isTTY) return opts.items[0].value;
+  const items = opts.items;
+  let cursor = 0;
+  const headerLines = 3;
+  const totalLines = headerLines + items.length;
+  function render(initial = false) {
+    if (!initial) process.stdout.write(`${ESC}[${totalLines}A`);
+    process.stdout.write(`${ESC}[2K
+`);
+    process.stdout.write(`${ESC}[2K  ${c.white}${c.bold}${opts.message}${c.reset}
+`);
+    process.stdout.write(`${ESC}[2K  ${c.dim}\u2191\u2193 navigate \xB7 enter select${c.reset}
+`);
+    for (let i = 0; i < items.length; i++) {
+      const active = cursor === i;
+      const ptr = active ? `${c.cyan}\u276F${c.reset}` : " ";
+      const hint = items[i].hint ? `  ${c.dim}${items[i].hint}${c.reset}` : "";
+      const lbl = active ? `${c.white}${c.bold}${items[i].label}${c.reset}` : `${c.dim}${items[i].label}${c.reset}`;
+      process.stdout.write(`${ESC}[2K  ${ptr}  ${lbl}${hint}
+`);
+    }
+  }
+  return new Promise((resolve2) => {
+    hideCursor();
+    render(true);
+    process.stdin.setRawMode(true);
+    process.stdin.resume();
+    const onData = (data) => {
+      const key = data.toString();
+      if (key === "\x1B[A") {
+        cursor = cursor <= 0 ? items.length - 1 : cursor - 1;
+        render();
+      } else if (key === "\x1B[B") {
+        cursor = cursor >= items.length - 1 ? 0 : cursor + 1;
+        render();
+      } else if (key === "\r") {
+        teardownStdin(onData);
+        resolve2(items[cursor].value);
+      } else if (key === "") {
+        teardownStdin(onData);
+        process.exit(130);
+      }
+    };
+    process.stdin.on("data", onData);
+  });
+}
 
 // src/checks/packages.ts
-import { join as join2 } from "path";
-import { readFileSync as readFileSync2 } from "fs";
+import { join as join3 } from "path";
+import { readFileSync as readFileSync2, readdirSync as readdirSync3 } from "fs";
+var regexCache = /* @__PURE__ */ new Map();
+function getMaliciousPkgRegex(pkg) {
+  let re = regexCache.get(pkg);
+  if (!re) {
+    re = new RegExp(`["'/]${escapeRegex(pkg)}["'/@:]`);
+    regexCache.set(pkg, re);
+  }
+  return re;
+}
 function checkPackages(rules, projectDirs) {
   const results = [];
+  for (const rule of rules) {
+    for (const pkg of Object.keys(rule.packages.malicious)) {
+      getMaliciousPkgRegex(pkg);
+    }
+  }
   for (const dir of projectDirs) {
     const lockfileCache = readLockfiles(dir);
+    const versionCache = /* @__PURE__ */ new Map();
     for (const rule of rules) {
       for (const [pkg, badVersions] of Object.entries(rule.packages.compromised)) {
-        const version = getPkgVersion(join2(dir, "node_modules", pkg, "package.json"));
+        const pkgJsonPath = join3(dir, "node_modules", pkg, "package.json");
+        let version = versionCache.get(pkgJsonPath);
+        if (version === void 0) {
+          version = getPkgVersion(pkgJsonPath);
+          versionCache.set(pkgJsonPath, version);
+        }
         if (version && isVersionCompromised(version, badVersions)) {
           results.push({
             type: "fail",
@@ -417,9 +618,14 @@ function checkPackages(rules, projectDirs) {
         }
       }
       for (const [pkg] of Object.entries(rule.packages.malicious)) {
-        const pkgDir = join2(dir, "node_modules", pkg);
+        const pkgDir = join3(dir, "node_modules", pkg);
         if (dirExists(pkgDir)) {
-          const version = getPkgVersion(join2(pkgDir, "package.json"));
+          const pkgJsonPath = join3(pkgDir, "package.json");
+          let version = versionCache.get(pkgJsonPath);
+          if (version === void 0) {
+            version = getPkgVersion(pkgJsonPath);
+            versionCache.set(pkgJsonPath, version);
+          }
           results.push({
             type: "fail",
             rule: rule.id,
@@ -434,21 +640,20 @@ function checkPackages(rules, projectDirs) {
   }
   return results;
 }
+var LOCKFILE_NAMES = ["package-lock.json", "yarn.lock", "pnpm-lock.yaml", "bun.lock", "bun.lockb"];
 function readLockfiles(dir) {
   const cache = /* @__PURE__ */ new Map();
-  const lockfiles = [
-    "package-lock.json",
-    "yarn.lock",
-    "pnpm-lock.yaml",
-    "bun.lock",
-    // bun text-based lockfile (bun v1.2+)
-    "bun.lockb"
-    // bun binary lockfile (older bun)
-  ];
-  for (const name of lockfiles) {
+  let dirEntries;
+  try {
+    dirEntries = new Set(readdirSync3(dir));
+  } catch {
+    return cache;
+  }
+  for (const name of LOCKFILE_NAMES) {
+    if (!dirEntries.has(name)) continue;
     try {
       const encoding = name === "bun.lockb" ? "latin1" : "utf-8";
-      cache.set(name, readFileSync2(join2(dir, name), encoding));
+      cache.set(name, readFileSync2(join3(dir, name), encoding));
     } catch {
     }
   }
@@ -457,7 +662,7 @@ function readLockfiles(dir) {
 function checkLockfilesForRule(lockfileCache, dir, rule, results) {
   for (const [lockfile, content] of lockfileCache) {
     for (const pkg of Object.keys(rule.packages.malicious)) {
-      if (content.includes(pkg)) {
+      if (getMaliciousPkgRegex(pkg).test(content)) {
         results.push({
           type: "fail",
           rule: rule.id,
@@ -471,11 +676,8 @@ function checkLockfilesForRule(lockfileCache, dir, rule, results) {
       for (const ver of versions) {
         const tied = [
           `"${pkg}": "${ver}"`,
-          // package-lock.json / bun.lock
           `${pkg}@${ver}`,
-          // yarn.lock / pnpm-lock.yaml
           `"${pkg}","${ver}"`
-          // bun.lockb binary format
         ];
         if (tied.some((p) => content.includes(p))) {
           results.push({
@@ -516,47 +718,70 @@ function checkFiles(rules) {
 
 // src/checks/network.ts
 import { readFileSync as readFileSync3 } from "fs";
+
+// src/shell.ts
+import { execSync, execFileSync } from "child_process";
+var TIMEOUT = 1e4;
+function runCommand(cmd) {
+  try {
+    return execSync(cmd, { encoding: "utf-8", timeout: TIMEOUT, stdio: ["pipe", "pipe", "pipe"] }).trim();
+  } catch {
+    return "";
+  }
+}
+function runSafe(cmd, args) {
+  try {
+    return execFileSync(cmd, args, { encoding: "utf-8", timeout: TIMEOUT, stdio: ["pipe", "pipe", "pipe"] }).trim();
+  } catch {
+    return "";
+  }
+}
+
+// src/checks/network.ts
 function checkNetwork(rules) {
   const results = [];
   const os = getOS();
-  const allIPs = /* @__PURE__ */ new Set();
-  const allDomains = /* @__PURE__ */ new Set();
-  const ruleByIOC = /* @__PURE__ */ new Map();
+  const rulesByIP = /* @__PURE__ */ new Map();
+  const rulesByDomain = /* @__PURE__ */ new Map();
   for (const rule of rules) {
     for (const ip of rule.ioc.ips ?? []) {
-      allIPs.add(ip);
-      ruleByIOC.set(ip, rule.id);
+      const arr = rulesByIP.get(ip) || [];
+      arr.push(rule.id);
+      rulesByIP.set(ip, arr);
     }
     for (const domain of rule.ioc.domains ?? []) {
-      allDomains.add(domain);
-      ruleByIOC.set(domain, rule.id);
+      const arr = rulesByDomain.get(domain) || [];
+      arr.push(rule.id);
+      rulesByDomain.set(domain, arr);
     }
   }
-  if (allIPs.size === 0 && allDomains.size === 0) return results;
-  const connections = getActiveConnections(os);
-  for (const ip of allIPs) {
-    if (connections.includes(ip)) {
+  if (rulesByIP.size === 0 && rulesByDomain.size === 0) return results;
+  const connectionLines = getActiveConnections(os).split("\n");
+  for (const [ip, ruleIds] of rulesByIP) {
+    const pattern = new RegExp(`(?:^|[\\s:])${escapeRegex(ip)}(?:[\\s:]|$)`);
+    if (connectionLines.some((line2) => pattern.test(line2))) {
       results.push({
         type: "fail",
-        rule: ruleByIOC.get(ip) || "unknown",
+        rule: ruleIds[0],
         check: "network",
         message: `Active connection to C2 IP: ${ip}`,
-        details: "Disconnect from network immediately!"
+        details: `Rules: ${ruleIds.join(", ")} \u2014 Disconnect from network immediately!`
       });
     }
   }
-  for (const domain of allDomains) {
-    if (connections.includes(domain)) {
+  for (const [domain, ruleIds] of rulesByDomain) {
+    const pattern = new RegExp(`(?:^|[\\s:])${escapeRegex(domain)}(?:[\\s:.]|$)`);
+    if (connectionLines.some((line2) => pattern.test(line2))) {
       results.push({
         type: "fail",
-        rule: ruleByIOC.get(domain) || "unknown",
+        rule: ruleIds[0],
         check: "network",
         message: `Active connection to C2 domain: ${domain}`,
-        details: "Disconnect from network immediately!"
+        details: `Rules: ${ruleIds.join(", ")} \u2014 Disconnect from network immediately!`
       });
     }
   }
-  checkHostsFile(allIPs, allDomains, ruleByIOC, results);
+  checkHostsFile(os, rulesByIP, rulesByDomain, results);
   return results;
 }
 function getActiveConnections(os) {
@@ -567,26 +792,29 @@ function getActiveConnections(os) {
   }
   return "";
 }
-function checkHostsFile(ips, domains, ruleByIOC, results) {
+function checkHostsFile(os, ips, domains, results) {
+  const hostsPath = os === "win32" ? "C:\\Windows\\System32\\drivers\\etc\\hosts" : "/etc/hosts";
   try {
-    const hosts = readFileSync3("/etc/hosts", "utf-8");
-    for (const ip of ips) {
-      if (hosts.includes(ip)) {
+    const hostsLines = readFileSync3(hostsPath, "utf-8").split("\n");
+    for (const [ip, ruleIds] of ips) {
+      const pattern = new RegExp(`(?:^|\\s)${escapeRegex(ip)}(?:\\s|$)`);
+      if (hostsLines.some((line2) => pattern.test(line2))) {
         results.push({
           type: "warn",
-          rule: ruleByIOC.get(ip) || "unknown",
+          rule: ruleIds[0],
           check: "network",
-          message: `C2 IP ${ip} found in /etc/hosts`
+          message: `C2 IP ${ip} found in hosts file`
         });
       }
     }
-    for (const domain of domains) {
-      if (hosts.includes(domain)) {
+    for (const [domain, ruleIds] of domains) {
+      const pattern = new RegExp(`(?:^|\\s)${escapeRegex(domain)}(?:\\s|$)`);
+      if (hostsLines.some((line2) => pattern.test(line2))) {
         results.push({
           type: "warn",
-          rule: ruleByIOC.get(domain) || "unknown",
+          rule: ruleIds[0],
           check: "network",
-          message: `C2 domain ${domain} found in /etc/hosts`
+          message: `C2 domain ${domain} found in hosts file`
         });
       }
     }
@@ -598,23 +826,26 @@ function checkHostsFile(ips, domains, ruleByIOC, results) {
 function checkProcesses(rules) {
   const results = [];
   const os = getOS();
-  const processPatterns = /* @__PURE__ */ new Map();
+  const rulesByProcess = /* @__PURE__ */ new Map();
   for (const rule of rules) {
     for (const proc of rule.ioc.processes ?? []) {
-      processPatterns.set(proc, rule.id);
+      const arr = rulesByProcess.get(proc) || [];
+      arr.push(rule.id);
+      rulesByProcess.set(proc, arr);
     }
   }
-  if (processPatterns.size === 0) return results;
-  const processList = getProcessList(os);
-  if (!processList) return results;
-  for (const [pattern, ruleId] of processPatterns) {
-    if (processList.includes(pattern)) {
+  if (rulesByProcess.size === 0) return results;
+  const processLines = getProcessList(os).split("\n");
+  if (processLines.length === 0) return results;
+  for (const [pattern, ruleIds] of rulesByProcess) {
+    const regex = new RegExp(`(?:^|[\\s/])${escapeRegex(pattern)}(?:\\s|$)`);
+    if (processLines.some((line2) => regex.test(line2))) {
       results.push({
         type: "fail",
-        rule: ruleId,
+        rule: ruleIds[0],
         check: "processes",
         message: `Suspicious process running: ${pattern}`,
-        details: "This may indicate an active compromise"
+        details: `Rules: ${ruleIds.join(", ")} \u2014 May indicate active compromise`
       });
     }
   }
@@ -652,12 +883,10 @@ function checkMacOSPersistence(rules, results) {
   const existingDirs = launchDirs.filter(dirExists);
   if (existingDirs.length === 0 || searchStrings.size === 0) return;
   const pattern = Array.from(searchStrings.keys()).join("|");
-  const hits = runCommand(
-    `grep -rlE "${pattern}" ${existingDirs.map((d) => `"${d}"`).join(" ")} 2>/dev/null`
-  );
+  const hits = runSafe("grep", ["-rlE", pattern, ...existingDirs]);
   if (hits) {
     for (const file of hits.split("\n").filter(Boolean)) {
-      const content = runCommand(`cat "${file}" 2>/dev/null`);
+      const content = runSafe("cat", [file]);
       let matchedRule = "unknown";
       for (const [s, ruleId] of searchStrings) {
         if (content.includes(s)) {
@@ -677,12 +906,12 @@ function checkMacOSPersistence(rules, results) {
 }
 
 // src/checks/cache.ts
-import { join as join3 } from "path";
+import { join as join4 } from "path";
 import { homedir as homedir2 } from "os";
 function detectCaches() {
   const home = homedir2();
   const caches = [];
-  const npmCache = runCommand("npm config get cache") || join3(home, ".npm");
+  const npmCache = runCommand("npm config get cache") || join4(home, ".npm");
   if (dirExists(npmCache)) {
     caches.push({ name: "npm", dir: npmCache, cleanCmd: "npm cache clean --force" });
   }
@@ -694,11 +923,11 @@ function detectCaches() {
   if (yarnCache && dirExists(yarnCache)) {
     caches.push({ name: "yarn", dir: yarnCache, cleanCmd: "yarn cache clean" });
   }
-  const yarnBerryCache = join3(process.cwd(), ".yarn", "cache");
+  const yarnBerryCache = join4(process.cwd(), ".yarn", "cache");
   if (dirExists(yarnBerryCache)) {
     caches.push({ name: "yarn-berry", dir: yarnBerryCache, cleanCmd: "yarn cache clean --all" });
   }
-  const bunCache = join3(home, ".bun", "install", "cache");
+  const bunCache = join4(home, ".bun", "install", "cache");
   if (dirExists(bunCache)) {
     caches.push({ name: "bun", dir: bunCache, cleanCmd: "bun pm cache rm" });
   }
@@ -726,48 +955,40 @@ function checkCache(rules) {
   }
   return results;
 }
-function scanCacheDir(cache, maliciousPkgs, compromisedTarballs, results) {
-  if (maliciousPkgs.size > 0) {
-    const nameArgs = Array.from(maliciousPkgs.keys()).map((n) => `-name "${n}"`).join(" -o ");
-    const found = runCommand(
-      `find "${cache.dir}" -maxdepth 4 -type d \\( ${nameArgs} \\) 2>/dev/null`
-    );
-    if (found) {
-      for (const line of found.split("\n").filter(Boolean)) {
-        const name = line.split("/").pop() || "";
-        const ruleId = maliciousPkgs.get(name);
-        if (ruleId) {
-          results.push({
-            type: "fail",
-            rule: ruleId,
-            check: "cache",
-            message: `Malicious package "${name}" found in ${cache.name} cache`,
-            details: `Run: ${cache.cleanCmd}`
-          });
-        }
-      }
+function findInCache(cacheDir, names, type) {
+  const hits = /* @__PURE__ */ new Map();
+  if (names.size === 0) return hits;
+  const nameExprs = Array.from(names.keys()).flatMap(
+    (n, i) => i === 0 ? ["-name", n] : ["-o", "-name", n]
+  );
+  const found = runSafe("find", [cacheDir, "-maxdepth", "4", "-type", type, "(", ...nameExprs, ")"]);
+  if (found) {
+    for (const line2 of found.split("\n").filter(Boolean)) {
+      const name = line2.split("/").pop() || "";
+      const ruleId = names.get(name);
+      if (ruleId) hits.set(name, ruleId);
     }
   }
-  if (compromisedTarballs.size > 0) {
-    const nameArgs = Array.from(compromisedTarballs.keys()).map((n) => `-name "${n}"`).join(" -o ");
-    const found = runCommand(
-      `find "${cache.dir}" -maxdepth 4 -type f \\( ${nameArgs} \\) 2>/dev/null`
-    );
-    if (found) {
-      for (const line of found.split("\n").filter(Boolean)) {
-        const name = line.split("/").pop() || "";
-        const ruleId = compromisedTarballs.get(name);
-        if (ruleId) {
-          results.push({
-            type: "warn",
-            rule: ruleId,
-            check: "cache",
-            message: `Compromised tarball ${name} in ${cache.name} cache`,
-            details: `Run: ${cache.cleanCmd}`
-          });
-        }
-      }
-    }
+  return hits;
+}
+function scanCacheDir(cache, maliciousPkgs, compromisedTarballs, results) {
+  for (const [name, ruleId] of findInCache(cache.dir, maliciousPkgs, "d")) {
+    results.push({
+      type: "fail",
+      rule: ruleId,
+      check: "cache",
+      message: `Malicious package "${name}" found in ${cache.name} cache`,
+      details: `Run: ${cache.cleanCmd}`
+    });
+  }
+  for (const [name, ruleId] of findInCache(cache.dir, compromisedTarballs, "f")) {
+    results.push({
+      type: "warn",
+      rule: ruleId,
+      check: "cache",
+      message: `Compromised tarball ${name} in ${cache.name} cache`,
+      details: `Run: ${cache.cleanCmd}`
+    });
   }
 }
 
@@ -830,19 +1051,27 @@ function displayResults(results, passMessage) {
 }
 function buildSummary(results, projectsScanned, rulesChecked, totalChecks) {
   const compromisedProjects = /* @__PURE__ */ new Set();
+  let failCount = 0;
+  let warnCount = 0;
+  let passCount = 0;
   for (const r of results) {
-    if (r.type === "fail" && r.details) {
-      const match = r.details.match(/— (.+)$/);
-      if (match) compromisedProjects.add(match[1]);
+    if (r.type === "fail") {
+      failCount++;
+      if (r.details) {
+        const match = r.details.match(/— (.+)$/);
+        if (match) compromisedProjects.add(match[1]);
+      }
+    } else if (r.type === "warn") {
+      warnCount++;
+    } else if (r.type === "pass") {
+      passCount++;
     }
   }
-  const failCount = results.filter((r) => r.type === "fail").length;
-  const warnCount = results.filter((r) => r.type === "warn").length;
   return {
     projectsScanned,
     rulesChecked,
     totalChecks: results.length || totalChecks,
-    passed: results.length === 0 ? totalChecks : results.length - failCount - warnCount,
+    passed: results.length === 0 ? totalChecks : passCount,
     failed: failCount,
     warnings: warnCount,
     results,
@@ -853,8 +1082,9 @@ function buildSummary(results, projectsScanned, rulesChecked, totalChecks) {
 // src/index.ts
 var __filename = fileURLToPath(import.meta.url);
 var __dirname = dirname(__filename);
-var RULES_DIR = join4(__dirname, "..", "rules");
-var VERSION = "1.0.0";
+var RULES_DIR = join5(__dirname, "..", "rules");
+var PKG_JSON_PATH = join5(__dirname, "..", "package.json");
+var VERSION = readJSON(PKG_JSON_PATH)?.version ?? "0.0.0";
 var HELP_TEXT = `
 ${c.white}supply-scan${c.reset} \u2014 Universal npm supply chain attack scanner
 
@@ -888,53 +1118,49 @@ async function run(argv) {
   const opts = parseArgs(argv);
   if (opts.version) {
     console.log(VERSION);
-    process.exit(0);
+    return 0;
   }
   if (opts.help) {
     console.log(HELP_TEXT);
-    process.exit(0);
+    return 0;
   }
   const allRules = loadRules(RULES_DIR);
   if (allRules.length === 0) {
     console.error(`${c.red}No rules found in ${RULES_DIR}${c.reset}`);
-    process.exit(1);
+    return 1;
   }
   if (opts.list) {
-    banner(allRules.length);
+    banner(allRules.length, VERSION);
     printRuleList(allRules);
-    process.exit(0);
+    return 0;
   }
   let selectedRules;
   if (opts.rules.length > 0) {
     selectedRules = allRules.filter((r) => opts.rules.includes(r.id));
     if (selectedRules.length === 0) {
       console.error(`${c.red}No matching rules found. Use --list to see available rules.${c.reset}`);
-      process.exit(1);
+      return 1;
     }
   } else if (opts.all || opts.ci) {
     selectedRules = allRules;
   } else {
-    banner(allRules.length);
+    banner(allRules.length, VERSION);
     selectedRules = await interactiveRuleSelection(allRules);
   }
   if (!opts.ci && (opts.all || opts.rules.length > 0)) {
-    banner(selectedRules.length);
+    banner(selectedRules.length, VERSION);
   }
   let projectDirs;
   if (opts.path) {
-    if (!opts.ci) spinnerStart("Searching for npm projects...");
-    projectDirs = findProjects([opts.path]);
-    if (!opts.ci) spinnerStop();
+    projectDirs = discoverProjects([opts.path], opts.ci);
   } else if (opts.ci || opts.all) {
-    if (!opts.ci) spinnerStart("Searching for npm projects...");
-    projectDirs = findProjects([process.cwd()]);
-    if (!opts.ci) spinnerStop();
+    projectDirs = discoverProjects([process.cwd()], opts.ci);
   } else {
     projectDirs = await interactivePathSelection();
   }
   if (!opts.ci) {
-    console.log(`
-   ${c.dim}Scanning ${projectDirs.length} projects with ${selectedRules.length} rules...${c.reset}`);
+    console.log("");
+    info(`Scanning ${projectDirs.length} projects with ${selectedRules.length} rules...`);
   }
   const summary = await scan({
     rules: selectedRules,
@@ -945,55 +1171,70 @@ async function run(argv) {
     printSummary(summary);
   }
   if (summary.failed > 0) {
-    process.exit(1);
+    return 1;
   } else if (summary.warnings > 0) {
-    process.exit(2);
+    return 2;
   } else {
     if (opts.ci) {
       console.log("OK");
     }
-    process.exit(0);
+    return 0;
   }
 }
-async function interactiveRuleSelection(rules) {
-  console.log("");
-  console.log(`   ${c.white}Select attacks to scan:${c.reset}`);
-  console.log("");
-  console.log(`   ${c.cyan}0${c.reset}) ${c.green}All attacks (${rules.length} rules)${c.reset}`);
-  for (let i = 0; i < rules.length; i++) {
-    const r = rules[i];
-    const sc = severityColors[r.severity] || c.dim;
-    console.log(`   ${c.cyan}${i + 1}${c.reset}) ${r.name} ${sc}(${r.severity})${c.reset}`);
+function discoverProjects(dirs, ci) {
+  if (!ci) spinnerStart("Searching for npm projects...");
+  const projects = findProjects(dirs);
+  if (!ci) {
+    spinnerStop();
+    success(`Found ${projects.length} projects`);
   }
+  return projects;
+}
+async function interactiveRuleSelection(rules) {
   console.log("");
-  const answer = await prompt(`   ${c.yellow}Enter numbers separated by commas (default=0): ${c.reset}`);
-  if (!answer || answer === "0") {
-    return rules;
-  }
-  const indices = answer.split(",").map((s) => parseInt(s.trim(), 10) - 1);
-  const selected = indices.filter((i) => i >= 0 && i < rules.length).map((i) => rules[i]);
+  const selected = await interactiveMultiSelect({
+    message: "Select attacks to scan:",
+    items: rules.map((r) => ({
+      label: r.name,
+      value: r,
+      hint: `${r.severity}  ${r.date}`
+    })),
+    allOption: { label: `All attacks (${rules.length} rules)` }
+  });
   return selected.length > 0 ? selected : rules;
 }
 async function interactivePathSelection() {
-  console.log("");
-  console.log(`   ${c.white}Where should I scan?${c.reset}`);
-  console.log("");
-  console.log(`   ${c.cyan}1${c.reset}) Current directory`);
-  console.log(`   ${c.cyan}2${c.reset}) Common project directories`);
-  console.log(`   ${c.cyan}3${c.reset}) Enter a custom path`);
-  console.log("");
-  const choice = await prompt(`   ${c.yellow}Choose (1/2/3, default=1): ${c.reset}`);
+  const choice = await interactiveSingleSelect({
+    message: "Where should I scan?",
+    items: [
+      { label: "Current directory", value: "cwd", hint: process.cwd() },
+      { label: "Common project directories", value: "common", hint: "Desktop, Projects, dev..." },
+      { label: "Entire home directory", value: "home", hint: "(slower)" },
+      { label: "Enter a custom path", value: "custom" }
+    ]
+  });
   let baseDirs;
   switch (choice) {
-    case "2":
+    case "common":
       baseDirs = getCommonProjectDirs();
       if (baseDirs.length === 0) {
-        console.log(`   ${c.dim}No common directories found, scanning current directory...${c.reset}`);
+        info("No common directories found, scanning current directory...");
         baseDirs = [process.cwd()];
+      } else {
+        info(`Scanning ${baseDirs.length} directories:`);
+        for (const d of baseDirs.slice(0, 5)) {
+          console.log(`     ${c.dim}${d}${c.reset}`);
+        }
+        if (baseDirs.length > 5) console.log(`     ${c.dim}...and ${baseDirs.length - 5} more${c.reset}`);
       }
       break;
-    case "3": {
-      const customPath = await prompt(`   ${c.cyan}Enter path: ${c.reset}`);
+    case "home":
+      baseDirs = [process.env.HOME || "/"];
+      info(`Scanning home directory (this may take a while)...`);
+      break;
+    case "custom": {
+      const customPath = await prompt(`
+   ${c.cyan}Enter path:${c.reset} `);
       baseDirs = [customPath.replace(/^~/, process.env.HOME || "")];
       break;
     }
@@ -1004,12 +1245,15 @@ async function interactivePathSelection() {
   spinnerStart("Searching for npm projects...");
   const projects = findProjects(baseDirs);
   spinnerStop();
-  console.log(`   ${c.dim}Found ${projects.length} npm projects${c.reset}`);
+  success(`Found ${projects.length} npm projects`);
   return projects;
 }
-var isCLI = process.argv[1]?.includes("supply-scan") || process.argv[1]?.includes("dist/index");
+var isCLI = process.argv[1]?.endsWith("supply-scan") || process.argv[1]?.endsWith("dist/index.js") || process.argv[1]?.includes("/supply-scan/");
 if (isCLI) {
-  run(process.argv.slice(2));
+  run(process.argv.slice(2)).then((code) => process.exit(code)).catch((err) => {
+    console.error(`${c.red}Error: ${err instanceof Error ? err.message : err}${c.reset}`);
+    process.exit(1);
+  });
 }
 export {
   run