Merge pull request #1 from comsysto/add-support-for-yarn-and-pnpm

add-support-for-yarn-and-pnpm

Author: s-teichner

README.md

@@ -1,6 +1,7 @@
 # dependency-vulnerability-scanner
 
 This repository provides scripts to quickly check if a repository uses certain vulnerable dependencies.
+Supported package managers: npm, pnpm, yarn
 
 ## How to use
 
@@ -38,20 +39,40 @@ curl -O https://github.com/comsysto/dependency-vulnerability-scanner/releases/la
 Example output:
 
 ```bash
-Starting dependency scan...
-Found 1 package-lock.json files
-Checking ucp-test... (100% complete)
+Dependency Vulnerability Scanner
+=================================
+
+📦 Scanning NPM packages (package-lock.json)...
+Found 19 package-lock.json files:
+  - test-project/package-lock.json
 
 Scan complete. Found 1 occurrences:
-ucp-test/package-lock.json - uses: ["zuper-stream@2.0.9"]
+test-project/package-lock.json - uses: ["zuper-stream@2.0.9"]
+
+✅ Scan complete!
+Total matches found:
+ - 1 in NPM projects
+ - 0 in Yarn projects
+ - 0 in PNPM projects
+```
+
+## How to test locally
+
+Build the binary and move it to some root folder that contains node projects:
+
+```bash
+cd node/src
+go build -o scanner && cp ./scanner ~/your-workspace
+cd ~/your-workspace
+./scanner
 ```
 
 ## How to add new affected dependencies
 
 1. Check if you can find a list of vulnerable packages in a structured way,
    e.g. https://github.com/wiz-sec-public/wiz-research-iocs/blob/main/reports/shai-hulud-2-packages.csv
 2. Use `utils/extract-versions.sh` to extract the affected versions from the CSV file
-3. Add the strings to `var deps` in main.go, following the existing format
+3. Add the strings to `dependencies.go`, following the existing format
 
 ## How to build new versions
 

node/src/build/scan-darwin-arm64

@@ -0,0 +1,25 @@
+package main
+
+// Constants
+const (
+	NodeModulesPrefix = "node_modules/"
+	NodeModulesDir    = "node_modules"
+)
+
+// Config holds the scanner configuration
+type Config struct {
+	RootPath        string
+	ExcludedDirs    []string
+	VerboseOutput   bool
+	ShowProgressBar bool
+}
+
+// DefaultConfig returns the default configuration
+func DefaultConfig() *Config {
+	return &Config{
+		RootPath:        ".",
+		ExcludedDirs:    []string{NodeModulesDir},
+		VerboseOutput:   true,
+		ShowProgressBar: true,
+	}
+}