embedded arborist.js file & common func for pkg extracting

cmd/ecosystems/npm.go

@@ -2,11 +2,11 @@ package ecosystems
 
 import (
 	"context"
+	_ "embed"
 	"fmt"
 	"net/http"
 	"os"
 	"os/exec"
-	"path/filepath"
 	"strings"
 
 	"buf.build/gen/go/safedep/api/grpc/go/safedep/services/malysis/v1/malysisv1grpc"
@@ -14,7 +14,8 @@ import (
 	packagev1 "buf.build/gen/go/safedep/api/protocolbuffers/go/safedep/messages/package/v1"
 	malysisv1 "buf.build/gen/go/safedep/api/protocolbuffers/go/safedep/services/malysis/v1"
 	drygrpc "github.com/safedep/dry/adapters/grpc"
-	"github.com/safedep/dry/crypto"
+	"github.com/safedep/dry/log"
+	"github.com/safedep/pmg/common"
 	"github.com/spf13/cobra"
 	"google.golang.org/grpc"
 )
@@ -24,6 +25,9 @@ var (
 	action      string
 )
 
+//go:embed tree/arborist.js
+var arboristJs string
+
 func NewNpmCommand() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "npm",
@@ -40,30 +44,20 @@ func NewNpmCommand() *cobra.Command {
 	return cmd
 }
 
-func wrapNpm() {
-	// Create a file with random name which will contain the dependency tree
-	randomFileName, err := crypto.RandomString(12, "abcdefghijklmnopqrstuvwxyz0123456789")
+func wrapNpm() error {
+	data, err := common.RunPkgExtractor(common.ExtractorOptions{
+		ScriptType:    "js",
+		Interpreter:   "node",
+		PackageName:   packageName,
+		ScriptContent: arboristJs,
+		Args:          []string{},
+	})
+
 	if err != nil {
-		fmt.Fprintf(os.Stderr, "Failed to generate random string: %v\n", err)
-		os.Exit(1)
-	}
-	outputFile := filepath.Join(os.TempDir(), randomFileName+".txt")
-
-	// Fetch the dependency tree using arborist
-	cmd := exec.Command("node", "pkg/tree/arborist.js", packageName, outputFile).Run()
-	if cmd != nil {
-		fmt.Println("Error while getting dependency tree: ", cmd.Error())
-		return
+		return err
 	}
 
-	// Get the extracted packages
-	data, err := os.ReadFile(outputFile)
-	if err != nil {
-		fmt.Println("Error while reading dependency tree: ", err)
-		return
-	}
-
-	lines := strings.SplitSeq(string(data), "\n")
+	lines := strings.SplitSeq(data, "\n")
 	for line := range lines {
 		line = strings.TrimSpace(line)
 		if line == "" || !strings.Contains(line, "@") {
@@ -72,7 +66,7 @@ func wrapNpm() {
 
 		parts := strings.SplitN(line, "@", 2)
 		if len(parts) != 2 {
-			fmt.Println("Invalid package line:", line)
+			log.Debugf("Invalid package line:", line)
 			continue
 		}
 
@@ -83,7 +77,7 @@ func wrapNpm() {
 		tenantId := os.Getenv("SAFEDEP_TENANT_ID")
 
 		if tok == "" || tenantId == "" {
-			panic("SAFEDEP_API_KEY and SAFEDEP_TENANT_ID must be set")
+			return fmt.Errorf("SAFEDEP_API_KEY and SAFEDEP_TENANT_ID must be set")
 		}
 
 		headers := http.Header{}
@@ -106,21 +100,24 @@ func wrapNpm() {
 
 		resp, err := client.AnalyzePackage(context.Background(), req)
 		if err != nil {
-			fmt.Printf("Failed to analyze %s@%s: %v\n", name, version, err)
+			log.Debugf("Failed to analyze %s@%s: %v\n", name, version, err)
 			continue
 		}
-		fmt.Printf("Submitted %s@%s | Analysis ID: %s\n", name, version, resp.GetAnalysisId())
+		log.Debugf("Submitted %s@%s | Analysis ID: %s\n", name, version, resp.GetAnalysisId())
 
 		analysisReportReq := &malysisv1.GetAnalysisReportRequest{
 			AnalysisId: resp.GetAnalysisId(),
 		}
 
 		reportResp, err := client.GetAnalysisReport(context.Background(), analysisReportReq)
-		_ = reportResp.GetReport()
+		report := reportResp.GetReport()
+
+		log.Debugf("Report: ", report.GetWarnings())
 
 	}
 
 	// Get the npm PATH (using exec.LookPath)
+	_, err = exec.LookPath("npm")
 
 	// Check if any vulnerable package exists?
 	// If yes - Confirm with user to continue or not

common/extractor.go

@@ -0,0 +1,68 @@
+package common
+
+import (
+	"bytes"
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+
+	"github.com/safedep/dry/crypto"
+)
+
+// ExtractorOptions holds configuration for running an extractor script
+type ExtractorOptions struct {
+	ScriptContent string   // The script content
+	ScriptType    string   // File extension like "js", "py", etc.
+	Interpreter   string   // What interpreter to use (e.g., "node", "python")
+	PackageName   string   // Name of the package to analyze
+	Args          []string // Additional arguments to pass to the script
+}
+
+// RunExtractor extracts an embedded script to a temp file and executes it
+func RunPkgExtractor(opts ExtractorOptions) (string, error) {
+	interpreterPath, err := exec.LookPath(opts.Interpreter)
+	if err != nil {
+		return "", fmt.Errorf("interpreter '%s' not found in PATH: %s",
+			opts.Interpreter, err.Error())
+	}
+
+	// Create a temporary file for the embedded script
+	scriptFile, err := os.CreateTemp("", fmt.Sprintf("registry-extractor-*.%s", opts.ScriptType))
+	if err != nil {
+		return "", fmt.Errorf("failed to create temporary script file: %s", err.Error())
+	}
+	defer os.Remove(scriptFile.Name())
+
+	// Write the embedded script to the temporary file
+	if _, err = scriptFile.WriteString(opts.ScriptContent); err != nil {
+		return "", fmt.Errorf("failed to write script to temporary file: %s", err.Error())
+	}
+
+	if err = scriptFile.Close(); err != nil {
+		return "", fmt.Errorf("failed to close temporary script file: %s", err.Error())
+	}
+
+	// Create a file with random name which will contain the output
+	randomFileName, err := crypto.RandomString(12, "abcdefghijklmnopqrstuvwxyz0123456789")
+	if err != nil {
+		return "", fmt.Errorf("failed to generate random string: %s", err.Error())
+	}
+	outputFile := filepath.Join(os.TempDir(), randomFileName+".txt")
+
+	// Build the command with all arguments
+	cmdArgs := append([]string{scriptFile.Name(), opts.PackageName, outputFile}, opts.Args...)
+	cmd := exec.Command(interpreterPath, cmdArgs...)
+
+	// Capture both stdout and stderr
+	var stdout, stderr bytes.Buffer
+	cmd.Stdout = &stdout
+	cmd.Stderr = &stderr
+
+	if err := cmd.Run(); err != nil {
+		return "", fmt.Errorf("error running extractor: %s\nStderr: %s",
+			err.Error(), stderr.String())
+	}
+
+	return outputFile, nil
+}

go.mod

@@ -18,6 +18,7 @@ require (
 	github.com/google/go-querystring v1.1.0 // indirect
 	github.com/grpc-ecosystem/go-grpc-middleware v1.4.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
+	github.com/joho/godotenv v1.5.1 // indirect
 	github.com/spf13/pflag v1.0.6 // indirect
 	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.57.0 // indirect
 	go.opentelemetry.io/otel v1.32.0 // indirect

go.sum

@@ -46,6 +46,8 @@ github.com/grpc-ecosystem/go-grpc-middleware v1.4.0 h1:UH//fgunKIs4JdUbpDl1VZCDa
 github.com/grpc-ecosystem/go-grpc-middleware v1.4.0/go.mod h1:g5qyo/la0ALbONm6Vbp88Yd8NsDy6rZz+RcrMPxvld8=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
+github.com/joho/godotenv v1.5.1 h1:7eLL/+HRGLY0ldzfGMeQkb7vMd0as4CfYvUVzLqw0N0=
+github.com/joho/godotenv v1.5.1/go.mod h1:f4LDr5Voq0i2e/R5DDNOoa2zzDfwtkZa6DnEwAbqwq4=
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
 github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=

main.go

@@ -2,13 +2,20 @@ package main
 
 import (
 	"fmt"
+	"log"
 	"os"
 
+	"github.com/joho/godotenv"
 	"github.com/safedep/pmg/cmd/ecosystems"
 	"github.com/spf13/cobra"
 )
 
 func main() {
+	err := godotenv.Load(".env")
+	if err != nil {
+		log.Println("No .env file found or failed to load")
+	}
+
 	cmd := &cobra.Command{
 		Use:              "pmg",
 		TraverseChildren: true,