npm package: @kubbisec/aspm
Description: KubbiSec ASPM — Application Security Posture Management CLI
Latest version: 1.0.13

# @kubbisec/aspm

Official **KubbiSec ASPM** CLI — upload security findings, coverage, and SBOM data, and manage projects from the terminal.

**ASPM** (Application Security Posture Management) centralizes scans, coverage gates, and reporting so teams can track risk in one place.

## Features

- **Authentication** — session-based login aligned with the KubbiSec web app.
- **Scan ingestion** — push reports from common scanners into a project.
- **Coverage** — upload LCOV or Clover for test coverage tracking and gates.
- **Local tooling** — parse and validate reports without sending data (dry run).
- **Native binaries** — per-platform executables via `optionalDependencies` (no `postinstall` scripts; works with `npm install --ignore-scripts`).

## Requirements

- **Node.js** 18 or newer.
- A **KubbiSec** account and API access (URL, API key, organization/project identifiers as required by your tenant).

## Installation

```bash
npm install -g @kubbisec/aspm
```

## Quick start

```bash
# Authenticate (follow the prompts or use your org’s SSO flow if configured)
aspm login

# Upload a vulnerability / scan report
aspm scan report.json -s trivy -p <project-id>

# Upload coverage
aspm coverage lcov.info -p <project-id>

# Parse locally without uploading
aspm parse report.json -s trivy

# Open the dashboard (browser)
aspm dashboard

# List projects
aspm projects
```

Run `aspm --help` for subcommands and global options.

## Supported scanners

| Scanner  | Use case              | Typical format |
|----------|-----------------------|----------------|
| Trivy    | Container / deps      | JSON           |
| Sonar    | SAST                  | JSON           |
| Nmap     | Network               | XML            |
| Skipfish | Web                   | JSON           |
| OSV      | Dependency advisories | JSON           |
| Gitleaks | Secrets               | JSON           |
| Syft     | SBOM                  | JSON           |

Exact flags and file expectations may vary by version; use `aspm scan --help` and your KubbiSec project settings.

## Coverage formats

- **LCOV** — e.g. `lcov.info` (Jest, Vitest, Istanbul, and similar).
- **Clover** — e.g. `clover.xml` (Vitest, PHPUnit, OpenClover, and similar).

## Configuration

CLI configuration is stored at:

`~/.kubbisec/config.json`

You can override defaults with environment variables (typical):

| Variable            | Purpose              |
|---------------------|----------------------|
| `KUBBISEC_API_URL`  | API base URL         |
| `KUBBISEC_API_KEY`  | API key / token      |
| `KUBBISEC_ORG_ID`   | Organization ID      |
| `KUBBISEC_PROJECT`  | Default project ID   |

## Supported platforms

Installing `@kubbisec/aspm` selects the matching binary:

| OS      | Architecture | npm package                     |
|---------|--------------|---------------------------------|
| Linux   | x64          | `@kubbisec/aspm-linux-x64`      |
| Linux   | arm64        | `@kubbisec/aspm-linux-arm64`    |
| macOS   | arm64        | `@kubbisec/aspm-darwin-arm64`   |
| Windows | x64          | `@kubbisec/aspm-win32-x64`      |

## License

MIT — see `LICENSE` in this package.

## Trademarks

**KubbiSec** and related marks are property of their respective owners. This package is distributed for use with the KubbiSec ASPM platform.