=== exit code
0
=== end of exit code

=== stdout - plain
{
  "errors": [],
  "paths": {
    "scanned": [
      "targets/dependency_aware/awscli/Pipfile.lock",
      "targets/dependency_aware/awscli/awscli_vuln.py"
    ]
  },
  "results": [
    {
      "check_id": "rules.dependency_aware.unconditional-depends-on-only",
      "end": {
        "col": 1,
        "line": 29,
        "offset": 0
      },
      "extra": {
        "engine_kind": "OSS",
        "fingerprint": "0x42",
        "lines": "requires login",
        "message": "this version of awscli is subject to a directory traversal vulnerability in the s3 module 2",
        "metadata": {},
        "sca_info": {
          "dependency_match": {
            "dependency_pattern": {
              "ecosystem": "pypi",
              "package": "awscli",
              "semver_range": "== 1.11.82"
            },
            "found_dependency": {
              "allowed_hashes": {
                "sha256": [
                  "149e90d6d8ac20db7a955ad60cf0e6881a3f20d37096140088356da6c716b0b1",
                  "ef6aaac3ca6cd92904cdd0d83f629a15f18053ec84e6432106f7a4d04ae4f5fb"
                ]
              },
              "ecosystem": "pypi",
              "line_number": 29,
              "lockfile_path": "targets/dependency_aware/awscli/Pipfile.lock",
              "package": "awscli",
              "transitivity": "unknown",
              "version": "1.11.82"
            },
            "lockfile": "targets/dependency_aware/awscli/Pipfile.lock"
          },
          "reachability_rule": false,
          "reachable": false,
          "sca_finding_schema": 20220913
        },
        "severity": "WARNING"
      },
      "path": "targets/dependency_aware/awscli/Pipfile.lock",
      "start": {
        "col": 1,
        "line": 29,
        "offset": 0
      }
    },
    {
      "check_id": "rules.dependency_aware.vulnerable-awscli-apr-2017-wrong-pattern",
      "end": {
        "col": 1,
        "line": 29,
        "offset": 0
      },
      "extra": {
        "engine_kind": "OSS",
        "fingerprint": "0x42",
        "lines": "requires login",
        "message": "this version of awscli is subject to a directory traversal vulnerability in the s3 module 1",
        "metadata": {},
        "sca_info": {
          "dependency_match": {
            "dependency_pattern": {
              "ecosystem": "pypi",
              "package": "awscli",
              "semver_range": "== 1.11.82"
            },
            "found_dependency": {
              "allowed_hashes": {
                "sha256": [
                  "149e90d6d8ac20db7a955ad60cf0e6881a3f20d37096140088356da6c716b0b1",
                  "ef6aaac3ca6cd92904cdd0d83f629a15f18053ec84e6432106f7a4d04ae4f5fb"
                ]
              },
              "ecosystem": "pypi",
              "line_number": 29,
              "lockfile_path": "targets/dependency_aware/awscli/Pipfile.lock",
              "package": "awscli",
              "transitivity": "unknown",
              "version": "1.11.82"
            },
            "lockfile": "targets/dependency_aware/awscli/Pipfile.lock"
          },
          "reachability_rule": true,
          "reachable": false,
          "sca_finding_schema": 20220913
        },
        "severity": "WARNING"
      },
      "path": "targets/dependency_aware/awscli/Pipfile.lock",
      "start": {
        "col": 1,
        "line": 29,
        "offset": 0
      }
    },
    {
      "check_id": "rules.dependency_aware.version-ge",
      "end": {
        "col": 43,
        "line": 21,
        "offset": 537
      },
      "extra": {
        "engine_kind": "OSS",
        "fingerprint": "0x42",
        "lines": "requires login",
        "message": "this version of awscli is subject to a directory traversal vulnerability in the s3 module 3",
        "metadata": {},
        "sca_info": {
          "dependency_match": {
            "dependency_pattern": {
              "ecosystem": "pypi",
              "package": "awscli",
              "semver_range": ">= 0.0.1"
            },
            "found_dependency": {
              "allowed_hashes": {
                "sha256": [
                  "149e90d6d8ac20db7a955ad60cf0e6881a3f20d37096140088356da6c716b0b1",
                  "ef6aaac3ca6cd92904cdd0d83f629a15f18053ec84e6432106f7a4d04ae4f5fb"
                ]
              },
              "ecosystem": "pypi",
              "line_number": 29,
              "lockfile_path": "targets/dependency_aware/awscli/Pipfile.lock",
              "package": "awscli",
              "transitivity": "unknown",
              "version": "1.11.82"
            },
            "lockfile": "targets/dependency_aware/awscli/Pipfile.lock"
          },
          "reachability_rule": true,
          "reachable": true,
          "sca_finding_schema": 20220913
        },
        "severity": "WARNING",
        "validation_state": "NO_VALIDATOR"
      },
      "path": "targets/dependency_aware/awscli/awscli_vuln.py",
      "start": {
        "col": 25,
        "line": 21,
        "offset": 519
      }
    },
    {
      "check_id": "rules.dependency_aware.version-leq",
      "end": {
        "col": 43,
        "line": 21,
        "offset": 537
      },
      "extra": {
        "engine_kind": "OSS",
        "fingerprint": "0x42",
        "lines": "requires login",
        "message": "this version of awscli is subject to a directory traversal vulnerability in the s3 module 1",
        "metadata": {},
        "sca_info": {
          "dependency_match": {
            "dependency_pattern": {
              "ecosystem": "pypi",
              "package": "awscli",
              "semver_range": "<= 1.11.82"
            },
            "found_dependency": {
              "allowed_hashes": {
                "sha256": [
                  "149e90d6d8ac20db7a955ad60cf0e6881a3f20d37096140088356da6c716b0b1",
                  "ef6aaac3ca6cd92904cdd0d83f629a15f18053ec84e6432106f7a4d04ae4f5fb"
                ]
              },
              "ecosystem": "pypi",
              "line_number": 29,
              "lockfile_path": "targets/dependency_aware/awscli/Pipfile.lock",
              "package": "awscli",
              "transitivity": "unknown",
              "version": "1.11.82"
            },
            "lockfile": "targets/dependency_aware/awscli/Pipfile.lock"
          },
          "reachability_rule": true,
          "reachable": true,
          "sca_finding_schema": 20220913
        },
        "severity": "WARNING",
        "validation_state": "NO_VALIDATOR"
      },
      "path": "targets/dependency_aware/awscli/awscli_vuln.py",
      "start": {
        "col": 25,
        "line": 21,
        "offset": 519
      }
    },
    {
      "check_id": "rules.dependency_aware.vulnerable-awscli-apr-2017",
      "end": {
        "col": 43,
        "line": 21,
        "offset": 537
      },
      "extra": {
        "engine_kind": "OSS",
        "fingerprint": "0x42",
        "lines": "requires login",
        "message": "this version of awscli is subject to a directory traversal vulnerability in the s3 module 1",
        "metadata": {},
        "sca_info": {
          "dependency_match": {
            "dependency_pattern": {
              "ecosystem": "pypi",
              "package": "awscli",
              "semver_range": "== 1.11.82"
            },
            "found_dependency": {
              "allowed_hashes": {
                "sha256": [
                  "149e90d6d8ac20db7a955ad60cf0e6881a3f20d37096140088356da6c716b0b1",
                  "ef6aaac3ca6cd92904cdd0d83f629a15f18053ec84e6432106f7a4d04ae4f5fb"
                ]
              },
              "ecosystem": "pypi",
              "line_number": 29,
              "lockfile_path": "targets/dependency_aware/awscli/Pipfile.lock",
              "package": "awscli",
              "transitivity": "unknown",
              "version": "1.11.82"
            },
            "lockfile": "targets/dependency_aware/awscli/Pipfile.lock"
          },
          "reachability_rule": true,
          "reachable": true,
          "sca_finding_schema": 20220913
        },
        "severity": "WARNING",
        "validation_state": "NO_VALIDATOR"
      },
      "path": "targets/dependency_aware/awscli/awscli_vuln.py",
      "start": {
        "col": 25,
        "line": 21,
        "offset": 519
      }
    },
    {
      "check_id": "rules.dependency_aware.version-ge",
      "end": {
        "col": 63,
        "line": 24,
        "offset": 670
      },
      "extra": {
        "engine_kind": "OSS",
        "fingerprint": "0x42",
        "lines": "requires login",
        "message": "this version of awscli is subject to a directory traversal vulnerability in the s3 module 3",
        "metadata": {},
        "sca_info": {
          "dependency_match": {
            "dependency_pattern": {
              "ecosystem": "pypi",
              "package": "awscli",
              "semver_range": ">= 0.0.1"
            },
            "found_dependency": {
              "allowed_hashes": {
                "sha256": [
                  "149e90d6d8ac20db7a955ad60cf0e6881a3f20d37096140088356da6c716b0b1",
                  "ef6aaac3ca6cd92904cdd0d83f629a15f18053ec84e6432106f7a4d04ae4f5fb"
                ]
              },
              "ecosystem": "pypi",
              "line_number": 29,
              "lockfile_path": "targets/dependency_aware/awscli/Pipfile.lock",
              "package": "awscli",
              "transitivity": "unknown",
              "version": "1.11.82"
            },
            "lockfile": "targets/dependency_aware/awscli/Pipfile.lock"
          },
          "reachability_rule": true,
          "reachable": true,
          "sca_finding_schema": 20220913
        },
        "severity": "WARNING",
        "validation_state": "NO_VALIDATOR"
      },
      "path": "targets/dependency_aware/awscli/awscli_vuln.py",
      "start": {
        "col": 25,
        "line": 24,
        "offset": 632
      }
    },
    {
      "check_id": "rules.dependency_aware.version-leq",
      "end": {
        "col": 63,
        "line": 24,
        "offset": 670
      },
      "extra": {
        "engine_kind": "OSS",
        "fingerprint": "0x42",
        "lines": "requires login",
        "message": "this version of awscli is subject to a directory traversal vulnerability in the s3 module 1",
        "metadata": {},
        "sca_info": {
          "dependency_match": {
            "dependency_pattern": {
              "ecosystem": "pypi",
              "package": "awscli",
              "semver_range": "<= 1.11.82"
            },
            "found_dependency": {
              "allowed_hashes": {
                "sha256": [
                  "149e90d6d8ac20db7a955ad60cf0e6881a3f20d37096140088356da6c716b0b1",
                  "ef6aaac3ca6cd92904cdd0d83f629a15f18053ec84e6432106f7a4d04ae4f5fb"
                ]
              },
              "ecosystem": "pypi",
              "line_number": 29,
              "lockfile_path": "targets/dependency_aware/awscli/Pipfile.lock",
              "package": "awscli",
              "transitivity": "unknown",
              "version": "1.11.82"
            },
            "lockfile": "targets/dependency_aware/awscli/Pipfile.lock"
          },
          "reachability_rule": true,
          "reachable": true,
          "sca_finding_schema": 20220913
        },
        "severity": "WARNING",
        "validation_state": "NO_VALIDATOR"
      },
      "path": "targets/dependency_aware/awscli/awscli_vuln.py",
      "start": {
        "col": 25,
        "line": 24,
        "offset": 632
      }
    },
    {
      "check_id": "rules.dependency_aware.vulnerable-awscli-apr-2017",
      "end": {
        "col": 63,
        "line": 24,
        "offset": 670
      },
      "extra": {
        "engine_kind": "OSS",
        "fingerprint": "0x42",
        "lines": "requires login",
        "message": "this version of awscli is subject to a directory traversal vulnerability in the s3 module 1",
        "metadata": {},
        "sca_info": {
          "dependency_match": {
            "dependency_pattern": {
              "ecosystem": "pypi",
              "package": "awscli",
              "semver_range": "== 1.11.82"
            },
            "found_dependency": {
              "allowed_hashes": {
                "sha256": [
                  "149e90d6d8ac20db7a955ad60cf0e6881a3f20d37096140088356da6c716b0b1",
                  "ef6aaac3ca6cd92904cdd0d83f629a15f18053ec84e6432106f7a4d04ae4f5fb"
                ]
              },
              "ecosystem": "pypi",
              "line_number": 29,
              "lockfile_path": "targets/dependency_aware/awscli/Pipfile.lock",
              "package": "awscli",
              "transitivity": "unknown",
              "version": "1.11.82"
            },
            "lockfile": "targets/dependency_aware/awscli/Pipfile.lock"
          },
          "reachability_rule": true,
          "reachable": true,
          "sca_finding_schema": 20220913
        },
        "severity": "WARNING",
        "validation_state": "NO_VALIDATOR"
      },
      "path": "targets/dependency_aware/awscli/awscli_vuln.py",
      "start": {
        "col": 25,
        "line": 24,
        "offset": 632
      }
    }
  ],
  "skipped_rules": [],
  "time": "<masked in tests>",
  "version": "0.42"
}
=== end of stdout - plain

=== stderr - plain


┌─────────────┐
│ Scan Status │
└─────────────┘
  Scanning 2 files tracked by git with 0 Code rules, 6 Supply Chain rules:


  CODE RULES
  Nothing to scan.

  SUPPLY CHAIN RULES

  Dependency Sources                             Resolution Method   Ecosystem   Dependencies   Rules
 ─────────────────────────────────────────────────────────────────────────────────────────────────────
  targets/dependency_aware/awscli/Pipfile.lock   Lockfile            Pypi        3                  6


  Analysis   Rules
 ──────────────────
  Unknown        6



┌──────────────┐
│ Scan Summary │
└──────────────┘
✅ Scan completed successfully.
 • Findings: 8 (6 blocking)
 • Rules run: 6
 • Targets scanned: 2
 • Parsed lines: ~100.0%
 • No ignore information available
Ran 6 rules on 2 files: 8 findings.

=== end of stderr - plain

=== stdout - color
<same as above: stdout - plain>
=== end of stdout - color

=== stderr - color
<same as above: stderr - plain>
=== end of stderr - color