@7nsane/zift 2.0.0 → 2.1.0

package/README.md

@@ -1,5 +1,9 @@
 # 🛡️ Zift (v2.0.0)
 
+[![npm version](https://img.shields.io/npm/v/@7nsane/zift.svg?style=flat-square)](https://www.npmjs.com/package/@7nsane/zift)
+[![License](https://img.shields.io/npm/l/@7nsane/zift.svg?style=flat-square)](https://www.npmjs.com/package/@7nsane/zift)
+[![Build Status](https://img.shields.io/badge/CI-passing-brightgreen?style=flat-square)](https://github.com/7nsane/zift)
+
 **The Deterministic Pre-install Security Gate for JavaScript Projects.** By using deterministic AST analysis and lightweight variable propagation, Zift identifies potential credential exfiltration, malicious persistence, and obfuscated execution with extreme precision.
 
 ## Installation

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@7nsane/zift",
-  "version": "2.0.0",
+  "version": "2.1.0",
   "description": "A high-performance, deterministic security scanner for npm packages.",
   "main": "src/scanner.js",
   "bin": {

package/src/collector.js

@@ -100,6 +100,14 @@ class ASTCollector {
                     });
                 }
 
+                if (this.isStartupFileWrite(calleeCode, node, sourceCode)) {
+                    facts.FILE_WRITE_STARTUP.push({
+                        file: filePath,
+                        line: node.loc.start.line,
+                        path: node.arguments[0] ? sourceCode.substring(node.arguments[0].start, node.arguments[0].end) : 'unknown'
+                    });
+                }
+
                 node.arguments.forEach((arg, index) => {
                     const argCode = sourceCode.substring(arg.start, arg.end);
                     // Improved check: Does the expression contain any variable we know is tainted?
@@ -186,7 +194,7 @@ class ASTCollector {
     isNetworkSink(calleeCode) {
         const methodSinks = [
             'http.request', 'https.request', 'http.get', 'https.get',
-            'net.connect', 'dns.lookup', 'dns.resolve', 'dns.resolve4', 'dns.resolve6',
+            'net.connect', 'net.createConnection', 'dns.lookup', 'dns.resolve', 'dns.resolve4', 'dns.resolve6',
             'fetch', 'axios', 'request'
         ];
         // Improved matching for require('https').get patterns
@@ -210,7 +218,7 @@ class ASTCollector {
     }
 
     isEncoder(calleeCode) {
-        const encoders = ['Buffer.from', 'btoa', 'atob'];
+        const encoders = ['Buffer.from', 'btoa', 'atob', 'zlib.deflate', 'zlib.gzip', 'crypto.createCipheriv'];
         return encoders.some(enc => calleeCode === enc || calleeCode.endsWith('.' + enc));
     }
 
@@ -235,12 +243,24 @@ class ASTCollector {
 
         if (node.arguments.length > 0 && node.arguments[0].type === 'Literal') {
             const pathValue = String(node.arguments[0].value);
-            const sensitive = ['.ssh', '.env', 'shadow', 'passwd', 'credentials', 'token'];
+            const sensitive = ['.ssh', '.env', 'shadow', 'passwd', 'credentials', 'token', '_netrc', 'aws_access_key'];
             return sensitive.some((s) => pathValue.toLowerCase().includes(s));
         }
         return false;
     }
 
+    isStartupFileWrite(calleeCode, node, sourceCode) {
+        if (!calleeCode.includes('fs.writeFile') && !calleeCode.includes('fs.writeFileSync') &&
+            !calleeCode.includes('fs.appendFile')) return false;
+
+        if (node.arguments.length > 0 && node.arguments[0].type === 'Literal') {
+            const pathValue = String(node.arguments[0].value);
+            const startup = ['package.json', '.npmrc', '.bashrc', '.zshrc', 'crontab', 'init.d', 'systemd'];
+            return startup.some((s) => pathValue.toLowerCase().includes(s));
+        }
+        return false;
+    }
+
     getSourceCode(node) {
         return this.sourceCode.substring(node.start, node.end);
     }

package/src/engine.js

@@ -37,6 +37,26 @@ class SafetyEngine {
             }
 
             if (matchedFacts.length === 0) return null; // Rule not matched
+
+            // Specialist Rule: DNS Exfiltration (ZFT-007) requires a DNS-specific sink
+            if (rule.alias === 'DNS_EXFILTRATION' && req === 'NETWORK_SINK') {
+                matchedFacts = matchedFacts.filter(f => f.callee && f.callee.includes('dns'));
+                if (matchedFacts.length === 0) return null;
+            }
+
+            // Specialist Rule: Raw Socket Tunnel (ZFT-011) requires net.connect or similar
+            if (rule.alias === 'RAW_SOCKET_TUNNEL' && req === 'NETWORK_SINK') {
+                matchedFacts = matchedFacts.filter(f => f.callee && (f.callee.includes('net.connect') || f.callee.includes('net.createConnection')));
+                if (matchedFacts.length === 0) return null;
+            }
+
+            // Specialist Rule: Startup Mod (ZFT-012) requires specific file paths
+            if (rule.alias === 'STARTUP_SCRIPT_MOD' && req === 'FILE_WRITE_STARTUP') {
+                const startupFiles = ['package.json', '.npmrc', '.bashrc', '.zshrc'];
+                matchedFacts = matchedFacts.filter(f => f.path && startupFiles.some(s => f.path.includes(s)));
+                if (matchedFacts.length === 0) return null;
+            }
+
             triggers.push(...matchedFacts.map(f => ({ ...f, type: req })));
         }
 

package/src/rules/definitions.js

@@ -45,9 +45,59 @@ const RULES = [
         id: 'ZFT-006',
         alias: 'DYNAMIC_REQUIRE_DEPENDENCY',
         name: 'Dynamic Require Dependency',
-        requires: ['DYNAMIC_EXECUTION'], // Will check if type === 'dynamic_require' in engine
+        requires: ['DYNAMIC_EXECUTION'],
         baseScore: 30,
         description: 'Detection of dynamic require calls where the dependency name is a variable.'
+    },
+    {
+        id: 'ZFT-007',
+        alias: 'DNS_EXFILTRATION',
+        name: 'DNS-Based Exfiltration',
+        requires: ['ENV_READ', 'NETWORK_SINK'], // Engine will check for dns.resolve in callee
+        baseScore: 45,
+        description: 'Stealthy environment variable exfiltration via DNS lookups.'
+    },
+    {
+        id: 'ZFT-008',
+        alias: 'SUSPICIOUS_COLLECTION',
+        name: 'Suspicious Information Collection',
+        requires: ['ENV_READ'],
+        optional: ['FILE_READ_SENSITIVE'],
+        baseScore: 20,
+        description: 'Massive environment or file reading without immediate network activity (potential harvesting).'
+    },
+    {
+        id: 'ZFT-009',
+        alias: 'REMOTE_DROPPER_PATTERN',
+        name: 'Remote Script Dropper',
+        requires: ['SHELL_EXECUTION'],
+        optional: ['OBFUSCATION'],
+        baseScore: 55,
+        description: 'Detection of remote script download and execution (curl | sh) patterns.'
+    },
+    {
+        id: 'ZFT-010',
+        alias: 'ENCRYPTED_EXFILTRATION',
+        name: 'Encrypted Data Exfiltration',
+        requires: ['ENCODER_USE', 'NETWORK_SINK'],
+        baseScore: 50,
+        description: 'Data being encoded/encrypted before being sent over the network.'
+    },
+    {
+        id: 'ZFT-011',
+        alias: 'RAW_SOCKET_TUNNEL',
+        name: 'Raw Socket Tunneling',
+        requires: ['NETWORK_SINK'], // Engine will check for net.connect/net.createConnection
+        baseScore: 45,
+        description: 'Use of raw network sockets instead of http/dns, often used for reverse shells.'
+    },
+    {
+        id: 'ZFT-012',
+        alias: 'STARTUP_SCRIPT_MOD',
+        name: 'Startup Script Modification',
+        requires: ['FILE_WRITE_STARTUP'], // Will check for package.json or .npmrc
+        baseScore: 60,
+        description: 'Detection of attempts to modify package.json scripts or npm configuration.'
     }
 ];