@7nsane/zift 2.0.0 → 2.2.0

package/README.md

@@ -1,5 +1,9 @@
 # 🛡️ Zift (v2.0.0)
 
+[![npm version](https://img.shields.io/npm/v/@7nsane/zift.svg?style=flat-square)](https://www.npmjs.com/package/@7nsane/zift)
+[![License](https://img.shields.io/npm/l/@7nsane/zift.svg?style=flat-square)](https://www.npmjs.com/package/@7nsane/zift)
+[![Build Status](https://img.shields.io/badge/CI-passing-brightgreen?style=flat-square)](https://github.com/7nsane/zift)
+
 **The Deterministic Pre-install Security Gate for JavaScript Projects.** By using deterministic AST analysis and lightweight variable propagation, Zift identifies potential credential exfiltration, malicious persistence, and obfuscated execution with extreme precision.
 
 ## Installation

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@7nsane/zift",
-  "version": "2.0.0",
+  "version": "2.2.0",
   "description": "A high-performance, deterministic security scanner for npm packages.",
   "main": "src/scanner.js",
   "bin": {

package/src/collector.js

@@ -12,16 +12,23 @@ class ASTCollector {
     collect(code, filePath) {
         const facts = {
             ENV_READ: [],
+            MASS_ENV_ACCESS: [],
             FILE_READ_SENSITIVE: [],
             NETWORK_SINK: [],
+            DNS_SINK: [],
+            RAW_SOCKET_SINK: [],
             DYNAMIC_EXECUTION: [],
+            DYNAMIC_REQUIRE: [],
             OBFUSCATION: [],
             FILE_WRITE_STARTUP: [],
             SHELL_EXECUTION: [],
-            ENCODER_USE: []
+            ENCODER_USE: [],
+            REMOTE_FETCH_SIGNAL: [],
+            PIPE_TO_SHELL_SIGNAL: []
         };
         const flows = [];
         const sourceCode = code;
+        let envAccessCount = 0;
 
         let ast;
         try {
@@ -60,16 +67,16 @@ class ASTCollector {
                 }
 
                 if (calleeCode === 'require' && node.arguments.length > 0 && node.arguments[0].type !== 'Literal') {
-                    facts.DYNAMIC_EXECUTION.push({
+                    facts.DYNAMIC_REQUIRE.push({
                         file: filePath,
                         line: node.loc.start.line,
-                        type: 'dynamic_require',
                         variable: sourceCode.substring(node.arguments[0].start, node.arguments[0].end)
                     });
                 }
 
-                if (this.isNetworkSink(calleeCode)) {
-                    facts.NETWORK_SINK.push({
+                const netType = this.getNetworkType(calleeCode);
+                if (netType) {
+                    facts[netType].push({
                         file: filePath,
                         line: node.loc.start.line,
                         callee: calleeCode
@@ -82,6 +89,19 @@ class ASTCollector {
                         line: node.loc.start.line,
                         callee: calleeCode
                     });
+
+                    // Signal Analysis: Dropper Patterns
+                    node.arguments.forEach(arg => {
+                        if (arg.type === 'Literal' && typeof arg.value === 'string') {
+                            const val = arg.value.toLowerCase();
+                            if ((val.includes('curl') || val.includes('wget') || val.includes('fetch')) && (val.includes('http') || val.includes('//'))) {
+                                facts.REMOTE_FETCH_SIGNAL.push({ file: filePath, line: node.loc.start.line, context: val });
+                            }
+                            if (val.includes('| sh') || val.includes('| bash') || val.includes('| cmd') || val.includes('| pwsh')) {
+                                facts.PIPE_TO_SHELL_SIGNAL.push({ file: filePath, line: node.loc.start.line, context: val });
+                            }
+                        }
+                    });
                 }
 
                 if (this.isEncoder(calleeCode)) {
@@ -100,9 +120,16 @@ class ASTCollector {
                     });
                 }
 
+                if (this.isStartupFileWrite(calleeCode, node, sourceCode)) {
+                    facts.FILE_WRITE_STARTUP.push({
+                        file: filePath,
+                        line: node.loc.start.line,
+                        path: node.arguments[0] ? sourceCode.substring(node.arguments[0].start, node.arguments[0].end) : 'unknown'
+                    });
+                }
+
                 node.arguments.forEach((arg, index) => {
                     const argCode = sourceCode.substring(arg.start, arg.end);
-                    // Improved check: Does the expression contain any variable we know is tainted?
                     const isArgTainted = argCode.includes('process.env') || flows.some(f => {
                         const regex = new RegExp(`\\b${f.toVar}\\b`);
                         return regex.test(argCode);
@@ -129,11 +156,16 @@ class ASTCollector {
                     const whitelist = ['NODE_ENV', 'TIMING', 'DEBUG', 'VERBOSE', 'CI', 'APPDATA', 'HOME', 'USERPROFILE', 'PATH', 'PWD'];
                     if (whitelist.includes(property)) return;
 
+                    envAccessCount++;
                     facts.ENV_READ.push({
                         file: filePath,
                         line: node.loc.start.line,
                         variable: property ? `process.env.${property}` : 'process.env'
                     });
+
+                    if (envAccessCount > 5) {
+                        facts.MASS_ENV_ACCESS.push({ file: filePath, line: node.loc.start.line, count: envAccessCount });
+                    }
                 }
             },
             VariableDeclarator: (node) => {
@@ -183,20 +215,21 @@ class ASTCollector {
         return { facts, flows };
     }
 
-    isNetworkSink(calleeCode) {
-        const methodSinks = [
-            'http.request', 'https.request', 'http.get', 'https.get',
-            'net.connect', 'dns.lookup', 'dns.resolve', 'dns.resolve4', 'dns.resolve6',
-            'fetch', 'axios', 'request'
-        ];
-        // Improved matching for require('https').get patterns
-        return methodSinks.some(sink => {
+    getNetworkType(calleeCode) {
+        const dnsSinks = ['dns.lookup', 'dns.resolve', 'dns.resolve4', 'dns.resolve6'];
+        const rawSocketSinks = ['net.connect', 'net.createConnection'];
+        const networkSinks = ['http.request', 'https.request', 'http.get', 'https.get', 'fetch', 'axios', 'request'];
+
+        if (dnsSinks.some(sink => calleeCode === sink || calleeCode.endsWith('.' + sink))) return 'DNS_SINK';
+        if (rawSocketSinks.some(sink => calleeCode === sink || calleeCode.endsWith('.' + sink))) return 'RAW_SOCKET_SINK';
+        if (networkSinks.some(sink => {
             if (calleeCode === sink) return true;
             if (calleeCode.endsWith('.' + sink)) return true;
-            // Catch cases like require('https').get
             if (sink.includes('.') && calleeCode.endsWith(sink.split('.')[1]) && calleeCode.includes(sink.split('.')[0])) return true;
             return false;
-        }) && !calleeCode.includes('IdleCallback');
+        })) return 'NETWORK_SINK';
+
+        return null;
     }
 
     isShellSink(calleeCode) {
@@ -210,7 +243,7 @@ class ASTCollector {
     }
 
     isEncoder(calleeCode) {
-        const encoders = ['Buffer.from', 'btoa', 'atob'];
+        const encoders = ['Buffer.from', 'btoa', 'atob', 'zlib.deflate', 'zlib.gzip', 'crypto.createCipheriv'];
         return encoders.some(enc => calleeCode === enc || calleeCode.endsWith('.' + enc));
     }
 
@@ -235,12 +268,24 @@ class ASTCollector {
 
         if (node.arguments.length > 0 && node.arguments[0].type === 'Literal') {
             const pathValue = String(node.arguments[0].value);
-            const sensitive = ['.ssh', '.env', 'shadow', 'passwd', 'credentials', 'token'];
+            const sensitive = ['.ssh', '.env', 'shadow', 'passwd', 'credentials', 'token', '_netrc', 'aws_access_key'];
             return sensitive.some((s) => pathValue.toLowerCase().includes(s));
         }
         return false;
     }
 
+    isStartupFileWrite(calleeCode, node, sourceCode) {
+        if (!calleeCode.includes('fs.writeFile') && !calleeCode.includes('fs.writeFileSync') &&
+            !calleeCode.includes('fs.appendFile')) return false;
+
+        if (node.arguments.length > 0 && node.arguments[0].type === 'Literal') {
+            const pathValue = String(node.arguments[0].value);
+            const startup = ['package.json', '.npmrc', '.bashrc', '.zshrc', 'crontab', 'init.d', 'systemd'];
+            return startup.some((s) => pathValue.toLowerCase().includes(s));
+        }
+        return false;
+    }
+
     getSourceCode(node) {
         return this.sourceCode.substring(node.start, node.end);
     }

package/src/engine.js

@@ -6,7 +6,7 @@ class SafetyEngine {
     }
 
     evaluate(packageFacts, lifecycleFiles) {
-        const findings = [];
+        let findings = [];
 
         // Process each rule
         for (const rule of RULES) {
@@ -16,6 +16,9 @@ class SafetyEngine {
             }
         }
 
+        // Sort by score (desc) and then by priority (desc)
+        findings.sort((a, b) => (b.score - a.score) || (b.priority - a.priority));
+
         return findings;
     }
 
@@ -29,12 +32,9 @@ class SafetyEngine {
         for (const req of rule.requires) {
             let matchedFacts = facts[req] || [];
 
-            // Special case for dynamic require (which shares DYNAMIC_EXECUTION fact type)
-            if (rule.alias === 'DYNAMIC_REQUIRE_DEPENDENCY') {
-                matchedFacts = matchedFacts.filter(f => f.type === 'dynamic_require');
-            } else if (req === 'DYNAMIC_EXECUTION') {
-                matchedFacts = matchedFacts.filter(f => f.type !== 'dynamic_require');
-            }
+            // Specialist Rule: Startup Mod (ZFT-012) requires specific file paths (now explicit in definitions but engine may still help)
+            // But per review, we should aim for explicit facts.
+            // ZFT-012 now just requires FILE_WRITE_STARTUP. Simple.
 
             if (matchedFacts.length === 0) return null; // Rule not matched
             triggers.push(...matchedFacts.map(f => ({ ...f, type: req })));
@@ -51,10 +51,10 @@ class SafetyEngine {
             }
         }
 
-        // Apply Lifecycle Multiplier (2.0x for V2)
-        const isInLifecycle = triggers.some(t => lifecycleFiles.has(t.file));
+        // Check for Lifecycle Context Fact (Virtual or Actual)
+        const isInLifecycle = triggers.some(t => lifecycleFiles.has(t.file)) || (facts['LIFECYCLE_CONTEXT'] && facts['LIFECYCLE_CONTEXT'].length > 0);
         if (isInLifecycle) {
-            multiplier = 2.0;
+            multiplier *= 2.0;
         }
 
         // Encoder Multiplier (1.5x)
@@ -64,18 +64,18 @@ class SafetyEngine {
         }
 
         // Cluster Bonus: Source + Sink
-        const hasSource = triggers.some(t => t.type.includes('READ'));
-        const hasSink = triggers.some(t => t.type.includes('SINK') || t.type === 'DYNAMIC_EXECUTION' || t.type === 'SHELL_EXECUTION');
+        const hasSource = triggers.some(t => t.type.includes('READ') || t.type.includes('ACCESS'));
+        const hasSink = triggers.some(t => t.type.includes('SINK') || t.type === 'DYNAMIC_EXECUTION' || t.type === 'SHELL_EXECUTION' || t.type === 'DYNAMIC_REQUIRE');
         if (hasSource && hasSink) {
             baseScore += 40;
         }
 
         let finalScore = baseScore * multiplier;
 
-        // Severe Cluster: ENV_READ + (NETWORK_SINK | SHELL_EXECUTION) + lifecycleContext = Critical (100)
-        const isEnvRead = triggers.some(t => t.type === 'ENV_READ');
-        const isDangerousSink = triggers.some(t => t.type === 'NETWORK_SINK' || t.type === 'SHELL_EXECUTION');
-        if (isEnvRead && isDangerousSink && isInLifecycle) {
+        // Severe Cluster: SENSITIVE_READ + Dangerous Sink + lifecycleContext = Critical (100)
+        const isSensitiveRead = triggers.some(t => t.type === 'ENV_READ' || t.type === 'FILE_READ_SENSITIVE');
+        const isDangerousSink = triggers.some(t => t.type === 'NETWORK_SINK' || t.type === 'DNS_SINK' || t.type === 'RAW_SOCKET_SINK' || t.type === 'SHELL_EXECUTION');
+        if (isSensitiveRead && isDangerousSink && isInLifecycle) {
             finalScore = 100;
         }
 
@@ -83,6 +83,7 @@ class SafetyEngine {
             id: rule.id,
             alias: rule.alias,
             name: rule.name,
+            priority: rule.priority || 1,
             score: Math.min(finalScore, 100),
             triggers: triggers,
             description: rule.description,

package/src/rules/definitions.js

@@ -5,6 +5,7 @@ const RULES = [
         name: 'Environment Variable Exfiltration',
         requires: ['ENV_READ', 'NETWORK_SINK'],
         optional: ['OBFUSCATION'],
+        priority: 1,
         baseScore: 40,
         description: 'Detection of environment variables being read and sent over the network.'
     },
@@ -13,6 +14,7 @@ const RULES = [
         alias: 'SENSITIVE_FILE_EXFILTRATION',
         name: 'Sensitive File Exfiltration',
         requires: ['FILE_READ_SENSITIVE', 'NETWORK_SINK'],
+        priority: 1,
         baseScore: 50,
         description: 'Detection of sensitive files (e.g., .ssh, .env) being read and sent over the network.'
     },
@@ -21,6 +23,7 @@ const RULES = [
         alias: 'PERSISTENCE_ATTEMPT',
         name: 'Persistence Attempt',
         requires: ['FILE_WRITE_STARTUP'],
+        priority: 2,
         baseScore: 60,
         description: 'Detection of attempts to write to system startup directories.'
     },
@@ -29,6 +32,7 @@ const RULES = [
         alias: 'OBFUSCATED_EXECUTION',
         name: 'Obfuscated Execution',
         requires: ['OBFUSCATION', 'DYNAMIC_EXECUTION'],
+        priority: 2,
         baseScore: 40,
         description: 'Detection of high-entropy strings being executed via eval or Function constructor.'
     },
@@ -38,6 +42,7 @@ const RULES = [
         name: 'Shell Command Execution',
         requires: ['SHELL_EXECUTION'],
         optional: ['ENV_READ', 'FILE_READ_SENSITIVE'],
+        priority: 1,
         baseScore: 50,
         description: 'Detection of shell command execution (child_process).'
     },
@@ -45,17 +50,75 @@ const RULES = [
         id: 'ZFT-006',
         alias: 'DYNAMIC_REQUIRE_DEPENDENCY',
         name: 'Dynamic Require Dependency',
-        requires: ['DYNAMIC_EXECUTION'], // Will check if type === 'dynamic_require' in engine
+        requires: ['DYNAMIC_REQUIRE'],
+        priority: 1,
         baseScore: 30,
         description: 'Detection of dynamic require calls where the dependency name is a variable.'
+    },
+    {
+        id: 'ZFT-007',
+        alias: 'DNS_EXFILTRATION',
+        name: 'DNS-Based Exfiltration',
+        requires: ['ENV_READ', 'DNS_SINK'],
+        priority: 2,
+        baseScore: 45,
+        description: 'Stealthy environment variable exfiltration via DNS lookups.'
+    },
+    {
+        id: 'ZFT-008',
+        alias: 'SUSPICIOUS_COLLECTION',
+        name: 'Suspicious Information Collection',
+        requires: ['MASS_ENV_ACCESS'],
+        optional: ['FILE_READ_SENSITIVE'],
+        priority: 1,
+        baseScore: 20,
+        description: 'Massive environment reading without immediate network activity (potential harvesting).'
+    },
+    {
+        id: 'ZFT-009',
+        alias: 'REMOTE_DROPPER_PATTERN',
+        name: 'Remote Script Dropper',
+        requires: ['SHELL_EXECUTION', 'REMOTE_FETCH_SIGNAL'],
+        optional: ['OBFUSCATION', 'PIPE_TO_SHELL_SIGNAL'],
+        priority: 3,
+        baseScore: 55,
+        description: 'Detection of remote script download and execution (curl | sh) patterns.'
+    },
+    {
+        id: 'ZFT-010',
+        alias: 'ENCODED_EXFILTRATION',
+        name: 'Encoded Data Exfiltration',
+        requires: ['ENV_READ', 'NETWORK_SINK', 'ENCODER_USE'],
+        priority: 3,
+        baseScore: 70,
+        description: 'Sensitive data encoded before transmission to evade detection.'
+    },
+    {
+        id: 'ZFT-011',
+        alias: 'RAW_SOCKET_TUNNEL',
+        name: 'Raw Socket Tunneling',
+        requires: ['RAW_SOCKET_SINK'],
+        priority: 2,
+        baseScore: 45,
+        description: 'Use of raw network sockets instead of http/dns, often used for reverse shells.'
+    },
+    {
+        id: 'ZFT-012',
+        alias: 'STARTUP_SCRIPT_MOD',
+        name: 'Startup Script Modification',
+        requires: ['FILE_WRITE_STARTUP'],
+        priority: 2,
+        baseScore: 60,
+        description: 'Detection of attempts to modify package.json scripts or npm configuration.'
     }
 ];
 
 const CATEGORIES = {
-    SOURCES: ['ENV_READ', 'FILE_READ_SENSITIVE'],
-    SINKS: ['NETWORK_SINK', 'DYNAMIC_EXECUTION', 'SHELL_EXECUTION'],
-    SIGNALS: ['OBFUSCATION', 'ENCODER_USE'],
-    PERSISTENCE: ['FILE_WRITE_STARTUP']
+    SOURCES: ['ENV_READ', 'FILE_READ_SENSITIVE', 'MASS_ENV_ACCESS'],
+    SINKS: ['NETWORK_SINK', 'DNS_SINK', 'RAW_SOCKET_SINK', 'DYNAMIC_EXECUTION', 'SHELL_EXECUTION', 'DYNAMIC_REQUIRE'],
+    SIGNALS: ['OBFUSCATION', 'ENCODER_USE', 'REMOTE_FETCH_SIGNAL', 'PIPE_TO_SHELL_SIGNAL'],
+    PERSISTENCE: ['FILE_WRITE_STARTUP'],
+    CONTEXT: ['LIFECYCLE_CONTEXT']
 };
 
 module.exports = { RULES, CATEGORIES };

package/src/scanner.js

@@ -27,13 +27,20 @@ class PackageScanner {
         let allFacts = {
             facts: {
                 ENV_READ: [],
+                MASS_ENV_ACCESS: [],
                 FILE_READ_SENSITIVE: [],
                 NETWORK_SINK: [],
+                DNS_SINK: [],
+                RAW_SOCKET_SINK: [],
                 DYNAMIC_EXECUTION: [],
+                DYNAMIC_REQUIRE: [],
                 OBFUSCATION: [],
                 FILE_WRITE_STARTUP: [],
                 SHELL_EXECUTION: [],
-                ENCODER_USE: []
+                ENCODER_USE: [],
+                REMOTE_FETCH_SIGNAL: [],
+                PIPE_TO_SHELL_SIGNAL: [],
+                LIFECYCLE_CONTEXT: []
             },
             flows: []
         };
@@ -78,6 +85,11 @@ class PackageScanner {
                 }
 
                 // Merge facts (Synchronized)
+                if (lifecycleFiles.has(file)) {
+                    facts.LIFECYCLE_CONTEXT = facts.LIFECYCLE_CONTEXT || [];
+                    facts.LIFECYCLE_CONTEXT.push({ file, reason: 'Lifecycle script context detected' });
+                }
+
                 for (const category in facts) {
                     if (allFacts.facts[category]) {
                         allFacts.facts[category].push(...facts[category]);

package/v22_output.txt

@@ -0,0 +1,12 @@
+🛡️ Verifying Zift v2.2.0 Deterministic Architecture...
+📊 Audit Results:
+- [Priority: 1, Score: 100] ZFT-005: Shell Command Execution
+- [Priority: 1, Score: 80] ZFT-001: Environment Variable Exfiltration
+
+🔍 Structural Verification:
+- DNS Exfil detected: false
+- Env Exfil detected: true
+- Remote Dropper detected: false
+- Mass Env Access detected: false
+- Dynamic Require detected: false
+❌ v2.2.0 Verification incomplete. Some rules did not trigger as expected.

package/v22_output_fixed.txt

@@ -0,0 +1,16 @@
+🛡️ Verifying Zift v2.2.0 Deterministic Architecture...
+📊 Audit Results:
+- [Priority: 1, Score: 100] ZFT-005: Shell Command Execution
+- [Priority: 2, Score: 85] ZFT-007: DNS-Based Exfiltration
+- [Priority: 1, Score: 80] ZFT-001: Environment Variable Exfiltration
+- [Priority: 3, Score: 75] ZFT-009: Remote Script Dropper
+- [Priority: 1, Score: 30] ZFT-006: Dynamic Require Dependency
+- [Priority: 1, Score: 20] ZFT-008: Suspicious Information Collection
+
+🔍 Structural Verification:
+- DNS Exfil detected: true
+- Env Exfil detected: true
+- Remote Dropper detected: true
+- Mass Env Access detected: true
+- Dynamic Require detected: true
+✅ v2.2.0 Architecture Verified Successfully!