1515
1616logger = logging .getLogger (__name__ )
1717
18+
19+ class AuditParseError (Exception ):
20+ """Raised when npm audit returns output that cannot be parsed reliably."""
21+
22+
1823# Folder paths to exclude from npm package scanning
1924# Add folder paths here that should be skipped during package.json discovery
2025# Paths should be relative to the repository root (e.g., "deps/v8/tools/turbolizer")
@@ -161,7 +166,7 @@ def run_npm_audit(self, package_dir: Path) -> Optional[Dict]:
161166 return audit_data
162167 except json .JSONDecodeError as e :
163168 logger .error (f"Failed to parse npm audit JSON output in { package_dir } : { e } " )
164- return None
169+ raise AuditParseError ( "npm audit returned malformed JSON" ) from e
165170 else :
166171 logger .warning (
167172 f"npm audit returned no output in { package_dir } (exit { result .returncode } ): "
@@ -172,6 +177,8 @@ def run_npm_audit(self, package_dir: Path) -> Optional[Dict]:
172177 except subprocess .TimeoutExpired :
173178 logger .error (f"npm audit timed out in { package_dir } " )
174179 return None
180+ except AuditParseError :
181+ raise
175182 except Exception as e :
176183 logger .error (f"Error running npm audit in { package_dir } : { e } " )
177184 return None
@@ -361,6 +368,10 @@ def check_npm_vulnerabilities(self, vulnerability_class) -> List:
361368 continue
362369 all_vulnerabilities .extend (vulnerabilities )
363370
371+ except AuditParseError as e :
372+ logger .warning (f"Skipping vulnerability parsing for { package_dir } : { e } " )
373+ self .failed_packages .append (f"{ package_dir } : npm audit parse failed" )
374+ continue
364375 except Exception as e :
365376 logger .exception (f"Error processing { package_json } : { e } " )
366377 self .failed_packages .append (f"{ package_dir } : unexpected error: { e } " )
0 commit comments