/** * Dependency Vulnerability Assessor * Detects npm/yarn/pnpm dependency vulnerabilities via package manager audits * * Implements Issue #193: Add npm/yarn dependency vulnerability detection module * * Checks: * - Detects package manager from lock file (package-lock.json, yarn.lock, pnpm-lock.yaml) * - Runs audit command: npm audit --json / yarn audit --json / pnpm audit --json * - Parses vulnerability counts by severity * - Calculates score penalty based on severity weights * * Severity Scoring (from Issue #193): * - critical: -10 points * - high: -5 points * - moderate: -2 points * - low: -1 point * * Context Requirements: * - sourceCodePath: Required - directory to run audit in * * Note: This module requires shell execution and is opt-in only. */ import { BaseAssessor } from "./BaseAssessor.js"; import { AssessmentContext } from "../AssessmentOrchestrator.js"; import type { DependencyVulnerabilityAssessment } from "../../../lib/assessmentTypes.js"; export declare class DependencyVulnerabilityAssessor extends BaseAssessor { /** * Run dependency vulnerability assessment */ assess(context: AssessmentContext): Promise; /** * Detect package manager from lock file in the source directory */ private detectPackageManager; /** * Run the package manager audit command */ private runAudit; /** * Get the audit command for a package manager */ private getAuditCommand; /** * Parse audit results from JSON output */ private parseAuditResults; /** * Parse npm audit --json output */ private parseNpmAudit; /** * Parse yarn audit --json output (newline-delimited JSON) */ private parseYarnAudit; /** * Parse pnpm audit --json output */ private parsePnpmAudit; /** * Normalize severity string to VulnerabilitySeverity type */ private normalizeSeverity; /** * Calculate score penalty based on vulnerability counts */ private calculateScorePenalty; /** * Determine assessment status based on vulnerability counts */ private determineVulnerabilityStatus; /** * Generate human-readable explanation */ private generateExplanation; /** * Generate actionable recommendations */ private generateRecommendations; /** * Create a skipped result with explanation */ private createSkippedResult; /** * Create an error result when audit fails */ private createErrorResult; } //# sourceMappingURL=DependencyVulnerabilityAssessor.d.ts.map