{"_id":"z-audit","_rev":"3-82cd24b390b2eee60039637aaf95c520","name":"z-audit","dist-tags":{"latest":"1.0.2"},"versions":{"1.0.0":{"name":"z-audit","version":"1.0.0","keywords":["audit","security","npm","yarn","pnpm","dependency","vulnerabilities","supply-chain","cli","monorepo","审计","安全","审计工具"],"author":{"name":"zhongyi"},"license":"MIT","_id":"z-audit@1.0.0","maintainers":[{"name":"zhongyi2002","email":"timecoderzcy@icloud.com"}],"bin":{"zudit":"dist/cli/main.js"},"dist":{"shasum":"3676b74145a8e3a4c6fd6e614574cc555766c05a","tarball":"https://registry.npmjs.org/z-audit/-/z-audit-1.0.0.tgz","fileCount":190,"integrity":"sha512-KK+HD/4CxtjI6hxZLLgVpCYsGeh0aAhYLNJFHarPSrTNqQyhW2vCt5LeIQHYSbc0+L5SZu1J9+M9ioFg3ualFw==","signatures":[{"sig":"MEUCIQD422fNK8CX099F2wcce5hYD1sKb8fJnsW8bS3v6cifxQIgIZo8JVluzs046vdnrHVgdG8RI6mcQiIL+ABA991STjA=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":360813},"main":"./dist/index.js","type":"module","types":"./dist/index.d.ts","engines":{"node":">=18"},"exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.js"}},"gitHead":"9aa97fb50b35e2cfa18a601e1a34f2aebaa1b2b1","scripts":{"test":"vitest run","build":"tsc","clean":"rm -rf dist","zudit":"tsx src/cli/main.ts","prebuild":"npm run clean","try:audit":"tsx scripts/try-audit.ts","test:watch":"vitest"},"_npmUser":{"name":"zhongyi2002","email":"timecoderzcy@icloud.com"},"_npmVersion":"10.8.2","description":"CLI and library to audit npm, pnpm, and Yarn projects—local paths, remote Git (GitHub, GitLab, Gogs, etc.), or npm packages—with standardized JSON and HTML reports.","directories":{},"_nodeVersion":"18.20.8","dependencies":{"zod":"^4.3.6","yaml":"^2.8.3","undici":"^6.25.0","fast-glob":"^3.3.3"},"_hasShrinkwrap":false,"devDependencies":{"tsx":"^4.19.0","vitest":"^3.0.0","typescript":"^5.7.0","@types/node":"^22.10.0"},"_npmOperationalInternal":{"tmp":"tmp/z-audit_1.0.0_1776348512159_0.8597838551001038","host":"s3://npm-registry-packages-npm-production"}},"1.0.1":{"name":"z-audit","version":"1.0.1","keywords":["audit","security","npm","yarn","pnpm","dependency","vulnerabilities","supply-chain","cli","monorepo","审计","安全","审计工具"],"author":{"name":"zhongyi"},"license":"MIT","_id":"z-audit@1.0.1","maintainers":[{"name":"zhongyi2002","email":"timecoderzcy@icloud.com"}],"bin":{"zudit":"dist/cli/main.js"},"dist":{"shasum":"9fc972af31e894fe5787e248802e8e2807ec9380","tarball":"https://registry.npmjs.org/z-audit/-/z-audit-1.0.1.tgz","fileCount":191,"integrity":"sha512-4JEYP1tdPo/TCot8VO78Y6CYmCUQ2otOQj5fGklopg8zrIqv+qsePK9in5Lqysipqu0DEMuCECo4ibvQ1eotzA==","signatures":[{"sig":"MEYCIQDCcf0hCf8ViUkWz06IGx7SyEBUPc8bNrYoeI2cyRkrbwIhAJfVmVW46vJIxIAT53eKfbYfSgsC+a16YtoS4aC0ZMdB","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":365087},"main":"./dist/index.js","type":"module","types":"./dist/index.d.ts","engines":{"node":">=18"},"exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.js"}},"gitHead":"9aa97fb50b35e2cfa18a601e1a34f2aebaa1b2b1","scripts":{"test":"vitest run","build":"tsc","clean":"rm -rf dist","zudit":"tsx src/cli/main.ts","prebuild":"npm run clean","try:audit":"tsx scripts/try-audit.ts","test:watch":"vitest"},"_npmUser":{"name":"zhongyi2002","email":"timecoderzcy@icloud.com"},"_npmVersion":"10.8.2","description":"CLI and library to audit npm, pnpm, and Yarn projects—local paths, remote Git (GitHub, GitLab, Gogs, etc.), or npm packages—with standardized JSON and HTML reports.","directories":{},"_nodeVersion":"18.20.8","dependencies":{"zod":"^4.3.6","yaml":"^2.8.3","undici":"^6.25.0","fast-glob":"^3.3.3"},"_hasShrinkwrap":false,"devDependencies":{"tsx":"^4.19.0","vitest":"^3.0.0","typescript":"^5.7.0","@types/node":"^22.10.0"},"_npmOperationalInternal":{"tmp":"tmp/z-audit_1.0.1_1776348919828_0.6417550269757031","host":"s3://npm-registry-packages-npm-production"}},"1.0.2":{"name":"z-audit","version":"1.0.2","description":"CLI and library to audit npm, pnpm, and Yarn projects—local paths, remote Git (GitHub, GitLab, Gogs, etc.), or npm packages—with standardized JSON and HTML reports.","author":{"name":"zhongyi"},"license":"MIT","keywords":["audit","security","npm","yarn","pnpm","dependency","vulnerabilities","supply-chain","cli","monorepo","审计","安全","审计工具"],"type":"module","main":"./dist/index.js","types":"./dist/index.d.ts","bin":{"zudit":"dist/cli/main.js"},"exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.js"}},"scripts":{"build":"tsc","clean":"rm -rf dist","prebuild":"npm run clean","test":"vitest run","test:watch":"vitest","try:audit":"tsx scripts/try-audit.ts","zudit":"tsx src/cli/main.ts"},"engines":{"node":">=18"},"devDependencies":{"@types/node":"^22.10.0","tsx":"^4.19.0","typescript":"^5.7.0","vitest":"^3.0.0"},"dependencies":{"fast-glob":"^3.3.3","undici":"^6.25.0","yaml":"^2.8.3","zod":"^4.3.6"},"_id":"z-audit@1.0.2","gitHead":"0695de818f2ebdf5beae3b125af9bb2c94ca3057","_nodeVersion":"18.20.8","_npmVersion":"10.8.2","dist":{"integrity":"sha512-UnIjt4IRF9XyJl9wNflqHjQ22Hn3X6f4d3ddGpYrlnZa6HbnmzcNUQi49deUTKmvPcfjKvELJuPT2HgKbqVsDA==","shasum":"aad4a5b483e24893de4fab211e5b8ecf76152d20","tarball":"https://registry.npmjs.org/z-audit/-/z-audit-1.0.2.tgz","fileCount":193,"unpackedSize":380854,"signatures":[{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEUCIAulbEI3KdCs6V9Svfqe3YIvR7veCNXqPCJJNUuUqnJxAiEAqE6Ga8ihBOj5ICxQJfkIpvRr2eU4Xl584VLjidaOMpU="}]},"_npmUser":{"name":"zhongyi2002","email":"timecoderzcy@icloud.com"},"directories":{},"maintainers":[{"name":"zhongyi2002","email":"timecoderzcy@icloud.com"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/z-audit_1.0.2_1776760661081_0.6216080009420764"},"_hasShrinkwrap":false}},"time":{"created":"2026-04-16T14:08:32.062Z","modified":"2026-04-21T08:37:41.331Z","1.0.0":"2026-04-16T14:08:32.301Z","1.0.1":"2026-04-16T14:15:19.984Z","1.0.2":"2026-04-21T08:37:41.224Z"},"author":{"name":"zhongyi"},"license":"MIT","keywords":["audit","security","npm","yarn","pnpm","dependency","vulnerabilities","supply-chain","cli","monorepo","审计","安全","审计工具"],"description":"CLI and library to audit npm, pnpm, and Yarn projects—local paths, remote Git (GitHub, GitLab, Gogs, etc.), or npm packages—with standardized JSON and HTML reports.","maintainers":[{"name":"zhongyi2002","email":"timecoderzcy@icloud.com"}],"readme":"# zudit\n\n**[English](README.md)** | 简体中文\n\n面向 **npm**、**pnpm**、**Yarn** 的依赖审计流水线：可对**本地路径**、**远程 Git 仓库**（GitHub、GitLab、Gogs、Bitbucket、Azure DevOps 等）或 registry 上的 **npm 包**执行审计。默认在 `.zudit/` 下生成原始 `audit.json`、规范化 `standard.json` 以及 **HTML** 报告。\n\n**npm 包名：** [`z-audit`](https://www.npmjs.com/package/z-audit) · **命令行：** `zudit`\n\n## 功能概览\n\n- 支持本地单体仓库与单包；在可行时尽量沿用已有 lockfile\n- 远程 Git URL，可选分支/标签、托管方提示，必要时 `git clone`（shallow/full）\n- 通过 `npm:包@版本` 或 `--npm-name` / `--npm-version` 审计 registry 包\n- 统一流水线：工作区 → 分析 → lockfile → `npm audit` / `pnpm audit` / `yarn` 审计 JSON → 报告\n- 可选 `zudit.config.json`（从当前工作目录向上查找）；可用 `zudit init` 生成模板。CLI 参数覆盖配置文件。\n- 配置文件可写 `\"$schema\"` 指向随包发布的 `zudit.config.schema.json`，便于编辑器补全与校验\n- 库接口：`runAuditPipeline` 及更底层模块（见 package `exports`）\n\n## 环境要求\n\n- **Node.js ≥ 18**\n- `PATH` 上可用的包管理器（按需：`npm`、`pnpm`、`yarn`）\n\n## 安装\n\n```bash\nnpm install -g z-audit\n```\n\n或不全局安装，用 `npx`（需显式指定包名与 CLI 名）：\n\n```bash\nnpx -p z-audit zudit --help\n```\n\n（若使用作用域包名，请将 `z-audit` 换成实际发布名，例如 `@scope/z-audit`。）\n\n## 快速开始\n\n```bash\n# 审计当前目录（与 `zudit .` 相同）\nzudit\n\n# 显式指定本地路径\nzudit .\n\n# 在当前目录生成可选的 zudit.config.json\nzudit init\n\n# 远程仓库\nzudit --project https://github.com/org/repo.git --branch main\n\n# 私有仓库 / 依赖 API：建议用环境变量传 token\nexport ZUDIT_TOKEN=…\nzudit --project https://github.com/org/private.git\n\n# 审计 npm registry 上的包\nzudit --npm-name axios --npm-version 1.4.0\n```\n\n## 命令行\n\n```text\nzudit init [选项]\nzudit [选项] [<项目>]\nzudit audit [选项] [<项目>]\n```\n\n| 选项 | 说明 |\n|------|------|\n| `-h`, `--help` | 显示帮助 |\n| `-c`, `--config <path>` | `zudit.config.json` 路径 |\n| `-p`, `--project <path>` | 本地路径、Git URL 或 `npm:包@版本` |\n| `--npm-name`, `--npm-version` | 从 registry 审计包（与普通 `project` 路径互斥） |\n| `--provider <id>` | `github` \\| `gitlab` \\| `gogs` \\| `bitbucket` \\| `azure-devops` \\| `unknown` |\n| `--branch`, `--tag` | 远程引用（解析 package.json / 锁文件） |\n| `--token` | API 令牌（优先使用 `ZUDIT_TOKEN`） |\n| `--locale` | 报告语言，如 `zh-CN`、`en` |\n| `--package-manager` | `npm` \\| `pnpm` \\| `yarn-berry` \\| `yarn-classic` |\n| `--report-root`, `--report-file` | 报告目录与 `audit.json` 文件名 |\n| `--git-clone` | `shallow` \\| `full`（远程 Git 克隆分析） |\n\n**优先级：** CLI 覆盖 `zudit.config.json`。令牌：**`--token` > `ZUDIT_TOKEN` > 配置文件。**\n\n## 配置\n\n可在项目目录树中放置可选的 `zudit.config.json`（除非指定 `--config`，否则从 cwd 向上查找）。若不使用配置文件且未传 `--project`，单独执行 `zudit` 时默认审计**当前目录（`.`）**。\n\n```json\n{\n  \"$schema\": \"./node_modules/z-audit/zudit.config.schema.json\",\n  \"project\": \".\",\n  \"locale\": \"zh-CN\",\n  \"packageManager\": \"npm\",\n  \"analyzeOptions\": {\n    \"packageJsonRef\": { \"source\": \"branch\", \"name\": \"main\" }\n  },\n  \"auditReport\": {\n    \"reportRootDir\": \".zudit\",\n    \"reportFileName\": \"audit.json\"\n  }\n}\n```\n\n勿将密钥提交进仓库；请使用 **`ZUDIT_TOKEN`** 等方式注入令牌。\n\n## 环境变量\n\n| 变量 | 作用 |\n|------|------|\n| `ZUDIT_TOKEN` | 私有远程 / API 鉴权（优先于写进配置） |\n| `ZUDIT_LOCALE` | 未指定 `--locale` 时的默认界面/报告语言 |\n| `ZUDIT_STRICT_ENGINES` | 设为 `1` 时在生成 lockfile 场景下严格校验 `engines` |\n| `LANG` | 语言解析的回退来源 |\n\n在用到 HTTP 客户端的地方，会遵循常见代理变量（`HTTPS_PROXY`、`HTTP_PROXY`、`ALL_PROXY` 等）。\n\n## 编程调用\n\n```ts\nimport { runAuditPipeline } from 'z-audit';\n\nconst result = await runAuditPipeline({\n  project: '.',\n  locale: 'en',\n});\nconsole.log(result.reportPath, result.standardReportPath, result.htmlReportPath);\n```\n\n导入 `runAuditPipeline` 会加载内部 bootstrap（远程处理器等）。当前 `exports` 仅暴露主入口；请从包根路径按上例导入。\n\n## 开发\n\n```bash\ngit clone <你的仓库地址>\ncd <目录>\nnpm install\nnpm run build\nnpm test\n```\n\n从源码运行 CLI：\n\n```bash\nnpm run zudit -- --help\n```\n\n## 许可证\n\nMIT\n","readmeFilename":"README.zh-CN.md"}