fix(llm-security): supply-chain gate bypasses — npm/yarn blocklist + pip-audit (#14-#19,#48)

#18 dep-auditor called 'pip audit' (no such subcommand) so Python CVE detection was a permanent silent no-op; now spawns 'pip-audit' with an argv array. #19 it audited the scanner HOST's env with results mislabelled to the target's requirements.txt; now audits the target via -r and skips cleanly when absent.

#14 the offline npm blocklist was skipped for bare/range/tag installs because it used the (null) parsed-spec version; now re-checks the resolved version before the OSV network path. #15 non-hoisted nested lockfile keys derived the wrong package name (leading-only node_modules/ strip); now strips to the last segment. #48 lockfileVersion-1 nested dependency trees are now walked recursively.

#16/#17 the yarn.lock matcher paired two unassociated whole-file substrings with an unanchored pkg@ (false BLOCK of a legit package) and only matched Yarn Classic quoted versions (Berry known-malware allowed); rewritten as a per-entry parser that associates version to its own entry, anchors the name, and matches both Classic and Berry. Suite 1931/0.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Claude-Session: https://claude.ai/code/session_01TcQyMTQfyrsAapaCMPxTtQ

tests/scanners/dep.test.mjs

@@ -9,8 +9,10 @@
 
 import { describe, it, beforeEach } from 'node:test';
 import assert from 'node:assert/strict';
-import { resolve } from 'node:path';
+import { join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
 import { resetCounter } from '../../scanners/lib/output.mjs';
 import { scan } from '../../scanners/dep-auditor.mjs';
 
@@ -129,3 +131,93 @@ describe('dep-auditor integration', () => {
     assert.equal(result.findings[0].id, 'DS-DEP-001');
   });
 });
+
+// ---------------------------------------------------------------------------
+// pip-audit invocation (v7.8.3 #18/#19)
+// The scanner must invoke the real `pip-audit` binary (not the nonexistent
+// `pip audit` subcommand), and it must audit the TARGET's requirements.txt
+// (-r <target>/requirements.txt) — never the scanner host's environment.
+// Both binaries are shimmed on PATH so the tests are deterministic + offline:
+//   pip-audit — records its argv and emits one fixed vulnerability
+//   pip       — emits a "host environment" vulnerability the scanner must
+//               never surface (proves host-env audits are gone)
+// ---------------------------------------------------------------------------
+
+function makePipShims(shimDir, argvLog) {
+  writeFileSync(join(shimDir, 'pip-audit'), [
+    '#!/bin/sh',
+    `echo "$@" > "${argvLog}"`,
+    `echo '{"dependencies":[{"name":"requests","version":"2.0.0","vulns":[{"id":"PYSEC-TEST-0001","fix_versions":["2.31.0"],"description":"shim vulnerability"}]}]}'`,
+    '',
+  ].join('\n'), { mode: 0o755 });
+  writeFileSync(join(shimDir, 'pip'), [
+    '#!/bin/sh',
+    `echo '{"dependencies":[{"name":"host-only-pkg","version":"1.0.0","vulns":[{"id":"PYSEC-HOST-9999","fix_versions":[],"description":"host environment"}]}]}'`,
+    '',
+  ].join('\n'), { mode: 0o755 });
+}
+
+describe('dep-auditor pip-audit invocation', () => {
+  beforeEach(() => {
+    resetCounter();
+  });
+
+  it('invokes pip-audit with -r <target>/requirements.txt (not "pip audit" against the host)', async () => {
+    const shimDir = mkdtempSync(join(tmpdir(), 'llmsec-supply-shim-'));
+    const target = mkdtempSync(join(tmpdir(), 'llmsec-supply-target-'));
+    const argvLog = join(shimDir, 'argv.log');
+    makePipShims(shimDir, argvLog);
+    writeFileSync(join(target, 'requirements.txt'), 'requests==2.0.0\n');
+
+    const oldPath = process.env.PATH;
+    process.env.PATH = `${shimDir}:${oldPath}`;
+    try {
+      const result = await scan(target, { files: [] });
+      assert.equal(result.status, 'ok', `Expected status 'ok', got '${result.status}'`);
+
+      const shimFinding = result.findings.find(f => f.title.includes('PYSEC-TEST-0001'));
+      assert.ok(
+        shimFinding,
+        `Expected a finding from the pip-audit shim (PYSEC-TEST-0001). ` +
+        `Findings: ${result.findings.map(f => f.title).join('; ')}`
+      );
+      const hostFinding = result.findings.find(f => f.title.includes('PYSEC-HOST-9999'));
+      assert.equal(hostFinding, undefined, 'Host-environment audit result must never be surfaced');
+
+      assert.ok(existsSync(argvLog), 'pip-audit shim was never invoked');
+      const argv = readFileSync(argvLog, 'utf8');
+      assert.match(argv, /-r/, `pip-audit must receive -r, got argv: ${argv}`);
+      assert.ok(
+        argv.includes(join(target, 'requirements.txt')),
+        `pip-audit must audit the target requirements.txt, got argv: ${argv}`
+      );
+    } finally {
+      process.env.PATH = oldPath;
+      rmSync(shimDir, { recursive: true, force: true });
+      rmSync(target, { recursive: true, force: true });
+    }
+  });
+
+  it('skips the CVE audit cleanly when the target has pyproject.toml but no requirements.txt', async () => {
+    const shimDir = mkdtempSync(join(tmpdir(), 'llmsec-supply-shim-'));
+    const target = mkdtempSync(join(tmpdir(), 'llmsec-supply-target-'));
+    const argvLog = join(shimDir, 'argv.log');
+    makePipShims(shimDir, argvLog);
+    writeFileSync(join(target, 'pyproject.toml'), '[project]\nname = "sample"\n');
+
+    const oldPath = process.env.PATH;
+    process.env.PATH = `${shimDir}:${oldPath}`;
+    try {
+      const result = await scan(target, { files: [] });
+      assert.equal(result.status, 'ok', `Expected status 'ok', got '${result.status}'`);
+
+      const hostFinding = result.findings.find(f => f.title.includes('PYSEC-HOST-9999'));
+      assert.equal(hostFinding, undefined, 'Without requirements.txt the host env must not be audited');
+      assert.equal(existsSync(argvLog), false, 'pip-audit must not run when requirements.txt is absent');
+    } finally {
+      process.env.PATH = oldPath;
+      rmSync(shimDir, { recursive: true, force: true });
+      rmSync(target, { recursive: true, force: true });
+    }
+  });
+});