vuln-scan 0.1.3 → 0.1.4

package/cli.js

@@ -1,28 +1,44 @@
 #!/usr/bin/env node
 
 import { setDefaultResultOrder } from 'node:dns';
-
+import { createRequire } from 'node:module';
 import chalk from 'chalk';
 import ora from 'ora';
 import Table from 'cli-table3';
 
 import { scanProject } from './src/core.js';
 
+const require = createRequire(import.meta.url);
+const { version: CLI_VERSION } = require('./package.json');
+
+function brandingLine() {
+  return `${chalk.bold('vuln-scan')}${chalk.gray(' - ')}${chalk.cyan('Debasis')}`;
+}
+
 function printHelp() {
+  const valueLine = chalk.gray(`v${CLI_VERSION}`);
+  const features = chalk.cyan('Fast | Secure | Protect');
+  const tagline = chalk.gray('Scan Dependencies - Stay Safe - Fix Quickly');
+
   const text = `
-${chalk.bold('vuln-scan')}
+${features}
+${tagline}
+
+${chalk.bold('vuln-scan')} ${valueLine}
 
 Scans a project's lockfile (npm/pnpm/yarn) for known vulnerabilities using the OSV.dev API.
 
+Made by Debasis (https://github.com/DebaA17)
+
 Usage:
   npx vuln-scan
+  pnpm dlx vuln-scan
   vuln-scan
 
 Options:
   --json     Output machine-readable JSON
   --help     Show this help
 `;
-  // eslint-disable-next-line no-console
   console.log(text.trim());
 }
 
@@ -41,13 +57,25 @@ function severityColor(sev) {
   }
 }
 
+// Compare two semantic versions (returns true if v1 < v2)
+function isVulnerable(installedVersion, fixedVersion) {
+  const installedParts = installedVersion.split('.').map(Number);
+  const fixedParts = fixedVersion.split('.').map(Number);
+
+  for (let i = 0; i < Math.max(installedParts.length, fixedParts.length); i++) {
+    const installed = installedParts[i] || 0;
+    const fixed = fixedParts[i] || 0;
+    if (installed < fixed) return true;
+    if (installed > fixed) return false;
+  }
+  return false; // versions are equal → not vulnerable
+}
+
 async function main() {
-  // Some environments have broken/blocked IPv6 routes. Node's fetch (undici) may try IPv6 first
-  // and time out even when IPv4 works (e.g., curl succeeds). Prefer IPv4 DNS results first.
   try {
     setDefaultResultOrder('ipv4first');
   } catch {
-    // Older Node versions may not support this; best-effort.
+    // Older Node versions may not support this
   }
 
   const args = new Set(process.argv.slice(2));
@@ -58,31 +86,34 @@ async function main() {
 
   const jsonOutput = args.has('--json');
 
-  const spinner = ora({ text: 'Scanning dependencies…', spinner: 'dots' }).start();
+  const spinner = ora({ text: 'Scanning dependencies...', spinner: 'dots' }).start();
 
   try {
     const result = await scanProject({
       cwd: process.cwd(),
       onProgress: ({ processed, total }) => {
-        spinner.text = `Scanning dependencies… ${processed}/${total}`;
+        spinner.text = `Scanning dependencies... ${processed}/${total}`;
       }
     });
 
     spinner.stop();
 
+    // Filter vulnerabilities: only show if installed version < fixed version
+    const activeVulns = result.vulnerabilities.filter(v => {
+      if (!v.fixed) return true; // no fixed info, assume still vulnerable
+      return isVulnerable(v.version, v.fixed);
+    });
+
     if (jsonOutput) {
-      // Keep stdout clean for piping/automation.
-      // eslint-disable-next-line no-console
-      console.log(JSON.stringify(result, null, 2));
-      // eslint-disable-next-line no-console
+      console.log(JSON.stringify({ ...result, vulnerabilities: activeVulns }, null, 2));
+      console.error(brandingLine());
       console.error(chalk.green('Scan complete!'));
       return;
     }
 
-    if (result.vulnerabilities.length === 0) {
-      // eslint-disable-next-line no-console
+    if (activeVulns.length === 0) {
       console.log(chalk.green(`No known vulnerabilities found in ${result.dependencyCount} dependencies.`));
-      // eslint-disable-next-line no-console
+      console.log(brandingLine());
       console.log(chalk.green('Scan complete!'));
       return;
     }
@@ -90,33 +121,25 @@ async function main() {
     const table = new Table({
       head: ['Package', 'CVE ID', 'Severity', 'Summary'],
       wordWrap: true,
-      colWidths: [
-        28,
-        18,
-        10,
-        70
-      ]
+      colWidths: [28, 18, 10, 70]
     });
 
-    for (const v of result.vulnerabilities) {
+    for (const v of activeVulns) {
       const pkg = `${v.package}@${v.version}`;
       const cve = v.cve || v.id;
       const summary = v.summary + (v.fixed ? ` (Fix: ${v.fixed})` : '');
-
       table.push([pkg, cve, severityColor(v.severity), summary]);
     }
 
-    // eslint-disable-next-line no-console
     console.log(table.toString());
-    // eslint-disable-next-line no-console
+    console.log(brandingLine());
     console.log(chalk.green('Scan complete!'));
   } catch (err) {
     spinner.stop();
     const message = err instanceof Error ? err.message : String(err);
-    // eslint-disable-next-line no-console
     console.error(chalk.red(`Error: ${message}`));
     process.exitCode = 1;
   }
 }
 
-await main();
+await main();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vuln-scan",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "description": "Node.js CLI to scan dependency lockfiles for vulnerabilities using OSV.dev",
   "type": "module",
   "bin": {

package/src/core.js

@@ -18,11 +18,24 @@ const OSV_QUERY_URL = 'https://api.osv.dev/v1/query';
 export async function scanProject({ cwd, onProgress }) {
   const projectPackageJsonPath = path.join(cwd, 'package.json');
   const hasPackageJson = await exists(projectPackageJsonPath);
-  if (!hasPackageJson) {
-    throw new Error('Missing package.json in the current directory.');
+
+  let detected;
+  try {
+    detected = await detectPackageManager(cwd);
+  } catch {
+    if (hasPackageJson) {
+      throw new Error(
+        'No supported lockfile found (package-lock.json, pnpm-lock.yaml, yarn.lock). ' +
+          'Run your package manager install command to generate a lockfile, then re-run vuln-scan.'
+      );
+    }
+    throw new Error(
+      'Nothing to scan: no package.json or supported lockfile found (package-lock.json, pnpm-lock.yaml, yarn.lock). '
+        + 'Run vuln-scan from a project directory.'
+    );
   }
 
-  const { packageManager, lockfilePath } = await detectPackageManager(cwd);
+  const { packageManager, lockfilePath } = detected;
 
   const dependencies = await readDependenciesFromLockfile({
     packageManager,