fix: correctly handle native package dependencies size and counts

server/utils/dependency-analysis.ts

@@ -325,13 +325,28 @@ export const analyzeDependencyTree = defineCachedFunction(
     })
 
     // Aggregate total counts
-    const totalCounts = { total: 0, critical: 0, high: 0, moderate: 0, low: 0 }
-    for (const pkg of vulnerablePackages) {
-      totalCounts.total += pkg.counts.total
-      totalCounts.critical += pkg.counts.critical
-      totalCounts.high += pkg.counts.high
-      totalCounts.moderate += pkg.counts.moderate
-      totalCounts.low += pkg.counts.low
+    // Count how many native optional packages were included, to exclude them from the total
+    let nativeOptionalCount = 0
+    for (const pkg of resolved.values()) {
+      if (pkg.optional && pkg.isNative) {
+        nativeOptionalCount++
+      }
+    }
+
+    const result: VulnerabilityTreeResult = {
+      package: name,
+      version,
+      vulnerablePackages,
+      deprecatedPackages,
+      totalCounts: {
+        total: vulnerablePackages.reduce((sum, pkg) => sum + pkg.counts.total, 0),
+        critical: vulnerablePackages.reduce((sum, pkg) => sum + pkg.counts.critical, 0),
+        high: vulnerablePackages.reduce((sum, pkg) => sum + pkg.counts.high, 0),
+        moderate: vulnerablePackages.reduce((sum, pkg) => sum + pkg.counts.moderate, 0),
+        low: vulnerablePackages.reduce((sum, pkg) => sum + pkg.counts.low, 0),
+      },
+      totalPackages: resolved.size - nativeOptionalCount,
+      failedQueries,
     }
 
     // Log if batch query failed entirely
@@ -342,15 +357,7 @@ export const analyzeDependencyTree = defineCachedFunction(
       )
     }
 
-    return {
-      package: name,
-      version,
-      vulnerablePackages,
-      deprecatedPackages,
-      totalPackages: packages.length,
-      failedQueries,
-      totalCounts,
-    }
+    return result
   },
   {
     maxAge: 60 * 60,

server/utils/dependency-resolver.ts

@@ -100,6 +100,7 @@ export interface ResolvedPackage {
   size: number
   tarballUrl: string
   optional: boolean
+  isNative?: boolean
   /** Depth level (only when trackDepth is enabled) */
   depth?: DependencyDepth
   /** Dependency path from root (only when trackDepth is enabled) */
@@ -122,13 +123,17 @@ export async function resolveDependencyTree(
 
   // Process level by level for correct depth tracking
   // Each entry includes the path of package names leading to this dependency
-  let currentLevel = new Map<string, { range: string; optional: boolean; path: string[] }>([
-    [rootName, { range: rootVersion, optional: false, path: [] }],
-  ])
+  let currentLevel = new Map<
+    string,
+    { range: string; optional: boolean; isNativeParent?: boolean; path: string[] }
+  >([[rootName, { range: rootVersion, optional: false, isNativeParent: false, path: [] }]])
   let level = 0
 
   while (currentLevel.size > 0) {
-    const nextLevel = new Map<string, { range: string; optional: boolean; path: string[] }>()
+    const nextLevel = new Map<
+      string,
+      { range: string; optional: boolean; isNativeParent?: boolean; path: string[] }
+    >()
 
     // Mark all packages in current level as seen before processing
     for (const name of currentLevel.keys()) {
@@ -139,7 +144,7 @@ export async function resolveDependencyTree(
     const entries = [...currentLevel.entries()]
     await mapWithConcurrency(
       entries,
-      async ([name, { range, optional, path }]) => {
+      async ([name, { range, optional: parentOptional, isNativeParent, path }]) => {
         const packument = await fetchPackument(name)
         if (!packument) return
 
@@ -156,11 +161,30 @@ export async function resolveDependencyTree(
         const tarballUrl = versionData.dist?.tarball ?? ''
         const key = `${name}@${version}`
 
+        const libc = (versionData as { libc?: unknown }).libc
+        const selfIsNative = !!(
+          (versionData.os && Array.isArray(versionData.os) && versionData.os.length > 0) ||
+          (versionData.cpu && Array.isArray(versionData.cpu) && versionData.cpu.length > 0) ||
+          (Array.isArray(libc) && libc.length > 0) ||
+          name.includes('-wasm32-') ||
+          name.endsWith('-wasm32') ||
+          name.includes('wasm32-wasi')
+        )
+        const isNative = selfIsNative || isNativeParent
+        const optional = parentOptional
+
         // Build path for this package (path to parent + this package with version)
         const currentPath = [...path, `${name}@${version}`]
 
         if (!resolved.has(key)) {
-          const pkg: ResolvedPackage = { name, version, size, tarballUrl, optional }
+          const pkg: ResolvedPackage = {
+            name,
+            version,
+            size,
+            tarballUrl,
+            optional,
+            isNative: isNative || undefined,
+          }
           if (options.trackDepth) {
             pkg.depth = level === 0 ? 'root' : level === 1 ? 'direct' : 'transitive'
             pkg.path = currentPath
@@ -175,7 +199,13 @@ export async function resolveDependencyTree(
         if (versionData.dependencies) {
           for (const [depName, depRange] of Object.entries(versionData.dependencies)) {
             if (!seen.has(depName) && !nextLevel.has(depName)) {
-              nextLevel.set(depName, { range: depRange, optional: false, path: currentPath })
+              // Inherit optional and isNative flags from parent if they are truthy
+              nextLevel.set(depName, {
+                range: depRange,
+                optional: optional,
+                isNativeParent: isNative,
+                path: currentPath,
+              })
             }
           }
         }
@@ -184,7 +214,12 @@ export async function resolveDependencyTree(
         if (versionData.optionalDependencies) {
           for (const [depName, depRange] of Object.entries(versionData.optionalDependencies)) {
             if (!seen.has(depName) && !nextLevel.has(depName)) {
-              nextLevel.set(depName, { range: depRange, optional: true, path: currentPath })
+              nextLevel.set(depName, {
+                range: depRange,
+                optional: true,
+                isNativeParent: isNative,
+                path: currentPath,
+              })
             }
           }
         }

server/utils/install-size.ts

@@ -29,9 +29,13 @@ export const calculateInstallSize = defineCachedFunction(
         size: dep.size,
         tarballUrl: dep.tarballUrl,
         optional: dep.optional || undefined,
+        isNative: dep.isNative || undefined,
       })
-      totalSize += dep.size
-      dependencyCount++
+      // Do not count optional native packages as actual dependencies
+      if (!(dep.optional && dep.isNative)) {
+        totalSize += dep.size
+        dependencyCount++
+      }
     }
 
     // Sort by size descending

shared/types/install-size.ts

@@ -5,6 +5,8 @@ export interface DependencySize {
   tarballUrl: string
   /** True if this is an optional dependency */
   optional?: boolean
+  /** True if this is a native package (os/cpu specific) */
+  isNative?: boolean
 }
 
 export interface InstallSizeResult {