embedded arborist.js file & common func for pkg extracting

cmd/ecosystems/npm.go

@@ -2,11 +2,11 @@ package ecosystems
 
 import (
 	"context"
+	_ "embed"
 	"fmt"
 	"net/http"
 	"os"
 	"os/exec"
-	"path/filepath"
 	"strings"
 
 	"buf.build/gen/go/safedep/api/grpc/go/safedep/services/malysis/v1/malysisv1grpc"
@@ -14,7 +14,8 @@ import (
 	packagev1 "buf.build/gen/go/safedep/api/protocolbuffers/go/safedep/messages/package/v1"
 	malysisv1 "buf.build/gen/go/safedep/api/protocolbuffers/go/safedep/services/malysis/v1"
 	drygrpc "github.com/safedep/dry/adapters/grpc"
-	"github.com/safedep/dry/crypto"
+	"github.com/safedep/dry/log"
+	"github.com/safedep/pmg/common"
 	"github.com/spf13/cobra"
 	"google.golang.org/grpc"
 )
@@ -24,6 +25,9 @@ var (
 	action      string
 )
 
+//go:embed tree/arborist.js
+var arboristJs string
+
 func NewNpmCommand() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "npm",
@@ -40,30 +44,20 @@ func NewNpmCommand() *cobra.Command {
 	return cmd
 }
 
-func wrapNpm() {
-	// Create a file with random name which will contain the dependency tree
-	randomFileName, err := crypto.RandomString(12, "abcdefghijklmnopqrstuvwxyz0123456789")
+func wrapNpm() error {
+	data, err := common.RunPkgExtractor(common.ExtractorOptions{
+		ScriptType:    "js",
+		Interpreter:   "node",
+		PackageName:   packageName,
+		ScriptContent: arboristJs,
+		Args:          []string{},
+	})
+
 	if err != nil {
-		fmt.Fprintf(os.Stderr, "Failed to generate random string: %v\n", err)
-		os.Exit(1)
-	}
-	outputFile := filepath.Join(os.TempDir(), randomFileName+".txt")
-
-	// Fetch the dependency tree using arborist
-	cmd := exec.Command("node", "pkg/tree/arborist.js", packageName, outputFile).Run()
-	if cmd != nil {
-		fmt.Println("Error while getting dependency tree: ", cmd.Error())
-		return
+		return err
 	}
 
-	// Get the extracted packages
-	data, err := os.ReadFile(outputFile)
-	if err != nil {
-		fmt.Println("Error while reading dependency tree: ", err)
-		return
-	}
-
-	lines := strings.SplitSeq(string(data), "\n")
+	lines := strings.SplitSeq(data, "\n")
 	for line := range lines {
 		line = strings.TrimSpace(line)
 		if line == "" || !strings.Contains(line, "@") {
@@ -72,7 +66,7 @@ func wrapNpm() {
 
 		parts := strings.SplitN(line, "@", 2)
 		if len(parts) != 2 {
-			fmt.Println("Invalid package line:", line)
+			log.Debugf("Invalid package line:", line)
 			continue
 		}
 
@@ -83,7 +77,7 @@ func wrapNpm() {
 		tenantId := os.Getenv("SAFEDEP_TENANT_ID")
 
 		if tok == "" || tenantId == "" {
-			panic("SAFEDEP_API_KEY and SAFEDEP_TENANT_ID must be set")
+			return fmt.Errorf("SAFEDEP_API_KEY and SAFEDEP_TENANT_ID must be set")
 		}
 
 		headers := http.Header{}
@@ -106,21 +100,24 @@ func wrapNpm() {
 
 		resp, err := client.AnalyzePackage(context.Background(), req)
 		if err != nil {
-			fmt.Printf("Failed to analyze %s@%s: %v\n", name, version, err)
+			log.Debugf("Failed to analyze %s@%s: %v\n", name, version, err)
 			continue
 		}
-		fmt.Printf("Submitted %s@%s | Analysis ID: %s\n", name, version, resp.GetAnalysisId())
+		log.Debugf("Submitted %s@%s | Analysis ID: %s\n", name, version, resp.GetAnalysisId())
 
 		analysisReportReq := &malysisv1.GetAnalysisReportRequest{
 			AnalysisId: resp.GetAnalysisId(),
 		}
 
 		reportResp, err := client.GetAnalysisReport(context.Background(), analysisReportReq)
-		_ = reportResp.GetReport()
+		report := reportResp.GetReport()
+
+		log.Debugf("Report: ", report.GetWarnings())
 
 	}
 
 	// Get the npm PATH (using exec.LookPath)
+	_, err = exec.LookPath("npm")
 
 	// Check if any vulnerable package exists?
 	// If yes - Confirm with user to continue or not

cmd/ecosystems/tree/arborist.js

@@ -0,0 +1,60 @@
+const Arborist = require("@npmcli/arborist");
+const fs = require("fs");
+
+async function getDependencyTree(packageName) {
+  const arb = new Arborist({
+    registry: "https://registry.npmjs.org",
+    token: "",
+    authToken: "",
+  });
+  try {
+    const idealTree = await arb.buildIdealTree({
+      add: [packageName],
+    });
+    const packageNames = [];
+    idealTree.children.forEach((node) => {
+      packageNames.push(`${node.name}@${node.version}`);
+    });
+    return packageNames;
+  } catch (error) {
+    console.error(`Failed to fetch dependency tree for ${packageName}:`, error);
+    return [];
+  }
+}
+
+/**
+ * Write dependency list to a file
+ * @param {string[]} packages - List of package dependencies
+ * @param {string} filename - Output filename
+ */
+function writeToFile(packages, filename) {
+  try {
+    fs.writeFileSync(filename, packages.join("\n"), "utf8");
+    console.log(`Dependencies written to ${filename}`);
+  } catch (error) {
+    console.error(`Failed to write to file ${filename}:`, error);
+    process.exit(1);
+  }
+}
+
+const packageArg = process.argv[2];
+const outputFile = process.argv[3];
+
+if (!packageArg) {
+  console.error("Please provide a package name as an argument");
+  process.exit(1);
+}
+
+if (!outputFile) {
+  console.error("Please provide an output filename as the second argument");
+  process.exit(1);
+}
+
+getDependencyTree(packageArg)
+  .then((packages) => {
+    writeToFile(packages, outputFile);
+  })
+  .catch((err) => {
+    console.error("Error:", err);
+    process.exit(1);
+  });