replaced arborist with arborist bundle & common func for analysis

cmd/ecosystems/npm.go

@@ -6,7 +6,6 @@ import (
 	"fmt"
 	"net/http"
 	"os"
-	"os/exec"
 	"strings"
 
 	"buf.build/gen/go/safedep/api/grpc/go/safedep/services/malysis/v1/malysisv1grpc"
@@ -15,7 +14,7 @@ import (
 	malysisv1 "buf.build/gen/go/safedep/api/protocolbuffers/go/safedep/services/malysis/v1"
 	drygrpc "github.com/safedep/dry/adapters/grpc"
 	"github.com/safedep/dry/log"
-	"github.com/safedep/pmg/common"
+	"github.com/safedep/pmg/pkg/common"
 	"github.com/spf13/cobra"
 	"google.golang.org/grpc"
 )
@@ -25,7 +24,7 @@ var (
 	action      string
 )
 
-//go:embed tree/arborist.js
+//go:embed tree/arborist-bundle.js
 var arboristJs string
 
 func NewNpmCommand() *cobra.Command {
@@ -36,7 +35,11 @@ func NewNpmCommand() *cobra.Command {
 			action = args[0]
 			packageName = args[1]
 			if action == "install" {
-				wrapNpm()
+				err := wrapNpm()
+				if err != nil {
+					// TODO
+					log.Fatalf("wrapNpm: ", err.Error())
+				}
 			}
 			return nil
 		},
@@ -45,19 +48,23 @@ func NewNpmCommand() *cobra.Command {
 }
 
 func wrapNpm() error {
-	data, err := common.RunPkgExtractor(common.ExtractorOptions{
-		ScriptType:    "js",
-		Interpreter:   "node",
+	outputFile, err := common.RunPkgExtractor(common.ExtractorOptions{
 		PackageName:   packageName,
 		ScriptContent: arboristJs,
+		Interpreter:   "node",
+		ScriptType:    "js",
 		Args:          []string{},
 	})
-
 	if err != nil {
 		return err
 	}
 
-	lines := strings.SplitSeq(data, "\n")
+	data, err := os.ReadFile(outputFile)
+	if err != nil {
+		return fmt.Errorf("Error while reading package output file: %s", err.Error())
+	}
+
+	lines := strings.SplitSeq(string(data), "\n")
 	for line := range lines {
 		line = strings.TrimSpace(line)
 		if line == "" || !strings.Contains(line, "@") {
@@ -116,13 +123,11 @@ func wrapNpm() error {
 
 	}
 
-	// Get the npm PATH (using exec.LookPath)
-	_, err = exec.LookPath("npm")
-
+	// TODO:
+	// Get the npm PATH
 	// Check if any vulnerable package exists?
 	// If yes - Confirm with user to continue or not
 	// If no - Install the pkg & return
-
-	//  If continue - Install the pkg
-
+	// If continue - Install the pkg
+	return nil
 }

cmd/ecosystems/tree/arborist.js

@@ -1,60 +0,0 @@
-const Arborist = require("@npmcli/arborist");
-const fs = require("fs");
-
-async function getDependencyTree(packageName) {
-  const arb = new Arborist({
-    registry: "https://registry.npmjs.org",
-    token: "",
-    authToken: "",
-  });
-  try {
-    const idealTree = await arb.buildIdealTree({
-      add: [packageName],
-    });
-    const packageNames = [];
-    idealTree.children.forEach((node) => {
-      packageNames.push(`${node.name}@${node.version}`);
-    });
-    return packageNames;
-  } catch (error) {
-    console.error(`Failed to fetch dependency tree for ${packageName}:`, error);
-    return [];
-  }
-}
-
-/**
- * Write dependency list to a file
- * @param {string[]} packages - List of package dependencies
- * @param {string} filename - Output filename
- */
-function writeToFile(packages, filename) {
-  try {
-    fs.writeFileSync(filename, packages.join("\n"), "utf8");
-    console.log(`Dependencies written to ${filename}`);
-  } catch (error) {
-    console.error(`Failed to write to file ${filename}:`, error);
-    process.exit(1);
-  }
-}
-
-const packageArg = process.argv[2];
-const outputFile = process.argv[3];
-
-if (!packageArg) {
-  console.error("Please provide a package name as an argument");
-  process.exit(1);
-}
-
-if (!outputFile) {
-  console.error("Please provide an output filename as the second argument");
-  process.exit(1);
-}
-
-getDependencyTree(packageArg)
-  .then((packages) => {
-    writeToFile(packages, outputFile);
-  })
-  .catch((err) => {
-    console.error("Error:", err);
-    process.exit(1);
-  });