[Bug] TypeError crash when OSV API returns 200 OK with missing `results` field

[Kunal241207]

Summary

queryBatch crashes with TypeError: Cannot read properties of undefined (reading 'map')
when the OSV API returns HTTP 200 OK but with a body that has no results field
(e.g. a quota or rate-limit error envelope like {"error": "quota exceeded"}).
The !response.ok guard only checks the HTTP status — a 200 with an unexpected
body shape slips through and hits undefined.map(), aborting the entire scan.

Environment

• OS: any
• Node.js version: >=18
• Package manager: any
• Lockfile type: any
• CVE Lite CLI version: 1.29.0

Command used

cve-lite .

Expected Behaviour

When the OSV API returns a 200 OK with an unexpected JSON body, the scan should recover gracefully or surface a descriptive error — not crash with a raw TypeError pointing at internal source code.

Actual behavior

Error: OSV batch query failed for https://api.osv.dev: Cannot read properties of undefined (reading 'map')

Reproduction

Any OSV-compatible proxy, mirror, or rate-limiting gateway that returns 200 OK with a non-standard body can trigger this. Minimal example:

const source = new OsvAdvisorySource(
  "https://api.osv.dev",
  undefined,
  async () =>
    new Response(JSON.stringify({ error: "quota exceeded" }), { status: 200 }),
);

// throws: Cannot read properties of undefined (reading 'map')
await source.queryBatch([{ name: "lodash", version: "4.17.20", ecosystem: "npm" }]);

Relevant files or output

• osv-advisory-source.ts

   const data = await response.json();
  
   // data.results is undefined — crashes here
   return data.results.map((r: any, i: number) => ({
     package: packages[i].name,
     version: packages[i].version,
     vulnerabilities: r.vulns || [],
   }));

Note: OsvBatchResponse in types.ts already declares results as optional (results?: Array<...>), so the type and the implementation disagree.