@7nsane/zift 2.1.0 → 2.2.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@7nsane/zift",
-  "version": "2.1.0",
+  "version": "2.2.1",
   "description": "A high-performance, deterministic security scanner for npm packages.",
   "main": "src/scanner.js",
   "bin": {

package/src/collector.js

@@ -12,16 +12,23 @@ class ASTCollector {
     collect(code, filePath) {
         const facts = {
             ENV_READ: [],
+            MASS_ENV_ACCESS: [],
             FILE_READ_SENSITIVE: [],
             NETWORK_SINK: [],
+            DNS_SINK: [],
+            RAW_SOCKET_SINK: [],
             DYNAMIC_EXECUTION: [],
+            DYNAMIC_REQUIRE: [],
             OBFUSCATION: [],
             FILE_WRITE_STARTUP: [],
             SHELL_EXECUTION: [],
-            ENCODER_USE: []
+            ENCODER_USE: [],
+            REMOTE_FETCH_SIGNAL: [],
+            PIPE_TO_SHELL_SIGNAL: []
         };
         const flows = [];
         const sourceCode = code;
+        let envAccessCount = 0;
 
         let ast;
         try {
@@ -60,16 +67,16 @@ class ASTCollector {
                 }
 
                 if (calleeCode === 'require' && node.arguments.length > 0 && node.arguments[0].type !== 'Literal') {
-                    facts.DYNAMIC_EXECUTION.push({
+                    facts.DYNAMIC_REQUIRE.push({
                         file: filePath,
                         line: node.loc.start.line,
-                        type: 'dynamic_require',
                         variable: sourceCode.substring(node.arguments[0].start, node.arguments[0].end)
                     });
                 }
 
-                if (this.isNetworkSink(calleeCode)) {
-                    facts.NETWORK_SINK.push({
+                const netType = this.getNetworkType(calleeCode);
+                if (netType) {
+                    facts[netType].push({
                         file: filePath,
                         line: node.loc.start.line,
                         callee: calleeCode
@@ -82,6 +89,19 @@ class ASTCollector {
                         line: node.loc.start.line,
                         callee: calleeCode
                     });
+
+                    // Signal Analysis: Dropper Patterns
+                    node.arguments.forEach(arg => {
+                        if (arg.type === 'Literal' && typeof arg.value === 'string') {
+                            const val = arg.value.toLowerCase();
+                            if ((val.includes('curl') || val.includes('wget') || val.includes('fetch')) && (val.includes('http') || val.includes('//'))) {
+                                facts.REMOTE_FETCH_SIGNAL.push({ file: filePath, line: node.loc.start.line, context: val });
+                            }
+                            if (val.includes('| sh') || val.includes('| bash') || val.includes('| cmd') || val.includes('| pwsh')) {
+                                facts.PIPE_TO_SHELL_SIGNAL.push({ file: filePath, line: node.loc.start.line, context: val });
+                            }
+                        }
+                    });
                 }
 
                 if (this.isEncoder(calleeCode)) {
@@ -110,7 +130,6 @@ class ASTCollector {
 
                 node.arguments.forEach((arg, index) => {
                     const argCode = sourceCode.substring(arg.start, arg.end);
-                    // Improved check: Does the expression contain any variable we know is tainted?
                     const isArgTainted = argCode.includes('process.env') || flows.some(f => {
                         const regex = new RegExp(`\\b${f.toVar}\\b`);
                         return regex.test(argCode);
@@ -137,11 +156,16 @@ class ASTCollector {
                     const whitelist = ['NODE_ENV', 'TIMING', 'DEBUG', 'VERBOSE', 'CI', 'APPDATA', 'HOME', 'USERPROFILE', 'PATH', 'PWD'];
                     if (whitelist.includes(property)) return;
 
+                    envAccessCount++;
                     facts.ENV_READ.push({
                         file: filePath,
                         line: node.loc.start.line,
                         variable: property ? `process.env.${property}` : 'process.env'
                     });
+
+                    if (envAccessCount > 5) {
+                        facts.MASS_ENV_ACCESS.push({ file: filePath, line: node.loc.start.line, count: envAccessCount });
+                    }
                 }
             },
             VariableDeclarator: (node) => {
@@ -191,20 +215,21 @@ class ASTCollector {
         return { facts, flows };
     }
 
-    isNetworkSink(calleeCode) {
-        const methodSinks = [
-            'http.request', 'https.request', 'http.get', 'https.get',
-            'net.connect', 'net.createConnection', 'dns.lookup', 'dns.resolve', 'dns.resolve4', 'dns.resolve6',
-            'fetch', 'axios', 'request'
-        ];
-        // Improved matching for require('https').get patterns
-        return methodSinks.some(sink => {
+    getNetworkType(calleeCode) {
+        const dnsSinks = ['dns.lookup', 'dns.resolve', 'dns.resolve4', 'dns.resolve6'];
+        const rawSocketSinks = ['net.connect', 'net.createConnection'];
+        const networkSinks = ['http.request', 'https.request', 'http.get', 'https.get', 'fetch', 'axios', 'request'];
+
+        if (dnsSinks.some(sink => calleeCode === sink || calleeCode.endsWith('.' + sink))) return 'DNS_SINK';
+        if (rawSocketSinks.some(sink => calleeCode === sink || calleeCode.endsWith('.' + sink))) return 'RAW_SOCKET_SINK';
+        if (networkSinks.some(sink => {
             if (calleeCode === sink) return true;
             if (calleeCode.endsWith('.' + sink)) return true;
-            // Catch cases like require('https').get
             if (sink.includes('.') && calleeCode.endsWith(sink.split('.')[1]) && calleeCode.includes(sink.split('.')[0])) return true;
             return false;
-        }) && !calleeCode.includes('IdleCallback');
+        })) return 'NETWORK_SINK';
+
+        return null;
     }
 
     isShellSink(calleeCode) {

package/src/engine.js

@@ -6,7 +6,7 @@ class SafetyEngine {
     }
 
     evaluate(packageFacts, lifecycleFiles) {
-        const findings = [];
+        let findings = [];
 
         // Process each rule
         for (const rule of RULES) {
@@ -16,6 +16,9 @@ class SafetyEngine {
             }
         }
 
+        // Sort by score (desc) and then by priority (desc)
+        findings.sort((a, b) => (b.score - a.score) || (b.priority - a.priority));
+
         return findings;
     }
 
@@ -29,34 +32,11 @@ class SafetyEngine {
         for (const req of rule.requires) {
             let matchedFacts = facts[req] || [];
 
-            // Special case for dynamic require (which shares DYNAMIC_EXECUTION fact type)
-            if (rule.alias === 'DYNAMIC_REQUIRE_DEPENDENCY') {
-                matchedFacts = matchedFacts.filter(f => f.type === 'dynamic_require');
-            } else if (req === 'DYNAMIC_EXECUTION') {
-                matchedFacts = matchedFacts.filter(f => f.type !== 'dynamic_require');
-            }
+            // Specialist Rule: Startup Mod (ZFT-012) requires specific file paths (now explicit in definitions but engine may still help)
+            // But per review, we should aim for explicit facts.
+            // ZFT-012 now just requires FILE_WRITE_STARTUP. Simple.
 
             if (matchedFacts.length === 0) return null; // Rule not matched
-
-            // Specialist Rule: DNS Exfiltration (ZFT-007) requires a DNS-specific sink
-            if (rule.alias === 'DNS_EXFILTRATION' && req === 'NETWORK_SINK') {
-                matchedFacts = matchedFacts.filter(f => f.callee && f.callee.includes('dns'));
-                if (matchedFacts.length === 0) return null;
-            }
-
-            // Specialist Rule: Raw Socket Tunnel (ZFT-011) requires net.connect or similar
-            if (rule.alias === 'RAW_SOCKET_TUNNEL' && req === 'NETWORK_SINK') {
-                matchedFacts = matchedFacts.filter(f => f.callee && (f.callee.includes('net.connect') || f.callee.includes('net.createConnection')));
-                if (matchedFacts.length === 0) return null;
-            }
-
-            // Specialist Rule: Startup Mod (ZFT-012) requires specific file paths
-            if (rule.alias === 'STARTUP_SCRIPT_MOD' && req === 'FILE_WRITE_STARTUP') {
-                const startupFiles = ['package.json', '.npmrc', '.bashrc', '.zshrc'];
-                matchedFacts = matchedFacts.filter(f => f.path && startupFiles.some(s => f.path.includes(s)));
-                if (matchedFacts.length === 0) return null;
-            }
-
             triggers.push(...matchedFacts.map(f => ({ ...f, type: req })));
         }
 
@@ -71,10 +51,10 @@ class SafetyEngine {
             }
         }
 
-        // Apply Lifecycle Multiplier (2.0x for V2)
-        const isInLifecycle = triggers.some(t => lifecycleFiles.has(t.file));
+        // Check for Lifecycle Context Fact (Virtual or Actual)
+        const isInLifecycle = triggers.some(t => lifecycleFiles.has(t.file)) || (facts['LIFECYCLE_CONTEXT'] && facts['LIFECYCLE_CONTEXT'].length > 0);
         if (isInLifecycle) {
-            multiplier = 2.0;
+            multiplier *= 2.0;
         }
 
         // Encoder Multiplier (1.5x)
@@ -84,18 +64,18 @@ class SafetyEngine {
         }
 
         // Cluster Bonus: Source + Sink
-        const hasSource = triggers.some(t => t.type.includes('READ'));
-        const hasSink = triggers.some(t => t.type.includes('SINK') || t.type === 'DYNAMIC_EXECUTION' || t.type === 'SHELL_EXECUTION');
+        const hasSource = triggers.some(t => t.type.includes('READ') || t.type.includes('ACCESS'));
+        const hasSink = triggers.some(t => t.type.includes('SINK') || t.type === 'DYNAMIC_EXECUTION' || t.type === 'SHELL_EXECUTION' || t.type === 'DYNAMIC_REQUIRE');
         if (hasSource && hasSink) {
             baseScore += 40;
         }
 
         let finalScore = baseScore * multiplier;
 
-        // Severe Cluster: ENV_READ + (NETWORK_SINK | SHELL_EXECUTION) + lifecycleContext = Critical (100)
-        const isEnvRead = triggers.some(t => t.type === 'ENV_READ');
-        const isDangerousSink = triggers.some(t => t.type === 'NETWORK_SINK' || t.type === 'SHELL_EXECUTION');
-        if (isEnvRead && isDangerousSink && isInLifecycle) {
+        // Severe Cluster: SENSITIVE_READ + Dangerous Sink + lifecycleContext = Critical (100)
+        const isSensitiveRead = triggers.some(t => t.type === 'ENV_READ' || t.type === 'FILE_READ_SENSITIVE');
+        const isDangerousSink = triggers.some(t => t.type === 'NETWORK_SINK' || t.type === 'DNS_SINK' || t.type === 'RAW_SOCKET_SINK' || t.type === 'SHELL_EXECUTION');
+        if (isSensitiveRead && isDangerousSink && isInLifecycle) {
             finalScore = 100;
         }
 
@@ -103,6 +83,7 @@ class SafetyEngine {
             id: rule.id,
             alias: rule.alias,
             name: rule.name,
+            priority: rule.priority || 1,
             score: Math.min(finalScore, 100),
             triggers: triggers,
             description: rule.description,

package/src/rules/definitions.js

@@ -5,6 +5,7 @@ const RULES = [
         name: 'Environment Variable Exfiltration',
         requires: ['ENV_READ', 'NETWORK_SINK'],
         optional: ['OBFUSCATION'],
+        priority: 1,
         baseScore: 40,
         description: 'Detection of environment variables being read and sent over the network.'
     },
@@ -13,6 +14,7 @@ const RULES = [
         alias: 'SENSITIVE_FILE_EXFILTRATION',
         name: 'Sensitive File Exfiltration',
         requires: ['FILE_READ_SENSITIVE', 'NETWORK_SINK'],
+        priority: 1,
         baseScore: 50,
         description: 'Detection of sensitive files (e.g., .ssh, .env) being read and sent over the network.'
     },
@@ -21,6 +23,7 @@ const RULES = [
         alias: 'PERSISTENCE_ATTEMPT',
         name: 'Persistence Attempt',
         requires: ['FILE_WRITE_STARTUP'],
+        priority: 2,
         baseScore: 60,
         description: 'Detection of attempts to write to system startup directories.'
     },
@@ -29,6 +32,7 @@ const RULES = [
         alias: 'OBFUSCATED_EXECUTION',
         name: 'Obfuscated Execution',
         requires: ['OBFUSCATION', 'DYNAMIC_EXECUTION'],
+        priority: 2,
         baseScore: 40,
         description: 'Detection of high-entropy strings being executed via eval or Function constructor.'
     },
@@ -38,6 +42,7 @@ const RULES = [
         name: 'Shell Command Execution',
         requires: ['SHELL_EXECUTION'],
         optional: ['ENV_READ', 'FILE_READ_SENSITIVE'],
+        priority: 1,
         baseScore: 50,
         description: 'Detection of shell command execution (child_process).'
     },
@@ -45,7 +50,8 @@ const RULES = [
         id: 'ZFT-006',
         alias: 'DYNAMIC_REQUIRE_DEPENDENCY',
         name: 'Dynamic Require Dependency',
-        requires: ['DYNAMIC_EXECUTION'],
+        requires: ['DYNAMIC_REQUIRE'],
+        priority: 1,
         baseScore: 30,
         description: 'Detection of dynamic require calls where the dependency name is a variable.'
     },
@@ -53,7 +59,8 @@ const RULES = [
         id: 'ZFT-007',
         alias: 'DNS_EXFILTRATION',
         name: 'DNS-Based Exfiltration',
-        requires: ['ENV_READ', 'NETWORK_SINK'], // Engine will check for dns.resolve in callee
+        requires: ['ENV_READ', 'DNS_SINK'],
+        priority: 2,
         baseScore: 45,
         description: 'Stealthy environment variable exfiltration via DNS lookups.'
     },
@@ -61,33 +68,37 @@ const RULES = [
         id: 'ZFT-008',
         alias: 'SUSPICIOUS_COLLECTION',
         name: 'Suspicious Information Collection',
-        requires: ['ENV_READ'],
+        requires: ['MASS_ENV_ACCESS'],
         optional: ['FILE_READ_SENSITIVE'],
+        priority: 1,
         baseScore: 20,
-        description: 'Massive environment or file reading without immediate network activity (potential harvesting).'
+        description: 'Massive environment reading without immediate network activity (potential harvesting).'
     },
     {
         id: 'ZFT-009',
         alias: 'REMOTE_DROPPER_PATTERN',
         name: 'Remote Script Dropper',
-        requires: ['SHELL_EXECUTION'],
-        optional: ['OBFUSCATION'],
+        requires: ['SHELL_EXECUTION', 'REMOTE_FETCH_SIGNAL'],
+        optional: ['OBFUSCATION', 'PIPE_TO_SHELL_SIGNAL'],
+        priority: 3,
         baseScore: 55,
         description: 'Detection of remote script download and execution (curl | sh) patterns.'
     },
     {
         id: 'ZFT-010',
-        alias: 'ENCRYPTED_EXFILTRATION',
-        name: 'Encrypted Data Exfiltration',
-        requires: ['ENCODER_USE', 'NETWORK_SINK'],
-        baseScore: 50,
-        description: 'Data being encoded/encrypted before being sent over the network.'
+        alias: 'ENCODED_EXFILTRATION',
+        name: 'Encoded Data Exfiltration',
+        requires: ['ENV_READ', 'NETWORK_SINK', 'ENCODER_USE'],
+        priority: 3,
+        baseScore: 70,
+        description: 'Sensitive data encoded before transmission to evade detection.'
     },
     {
         id: 'ZFT-011',
         alias: 'RAW_SOCKET_TUNNEL',
         name: 'Raw Socket Tunneling',
-        requires: ['NETWORK_SINK'], // Engine will check for net.connect/net.createConnection
+        requires: ['RAW_SOCKET_SINK'],
+        priority: 2,
         baseScore: 45,
         description: 'Use of raw network sockets instead of http/dns, often used for reverse shells.'
     },
@@ -95,17 +106,19 @@ const RULES = [
         id: 'ZFT-012',
         alias: 'STARTUP_SCRIPT_MOD',
         name: 'Startup Script Modification',
-        requires: ['FILE_WRITE_STARTUP'], // Will check for package.json or .npmrc
+        requires: ['FILE_WRITE_STARTUP'],
+        priority: 2,
         baseScore: 60,
         description: 'Detection of attempts to modify package.json scripts or npm configuration.'
     }
 ];
 
 const CATEGORIES = {
-    SOURCES: ['ENV_READ', 'FILE_READ_SENSITIVE'],
-    SINKS: ['NETWORK_SINK', 'DYNAMIC_EXECUTION', 'SHELL_EXECUTION'],
-    SIGNALS: ['OBFUSCATION', 'ENCODER_USE'],
-    PERSISTENCE: ['FILE_WRITE_STARTUP']
+    SOURCES: ['ENV_READ', 'FILE_READ_SENSITIVE', 'MASS_ENV_ACCESS'],
+    SINKS: ['NETWORK_SINK', 'DNS_SINK', 'RAW_SOCKET_SINK', 'DYNAMIC_EXECUTION', 'SHELL_EXECUTION', 'DYNAMIC_REQUIRE'],
+    SIGNALS: ['OBFUSCATION', 'ENCODER_USE', 'REMOTE_FETCH_SIGNAL', 'PIPE_TO_SHELL_SIGNAL'],
+    PERSISTENCE: ['FILE_WRITE_STARTUP'],
+    CONTEXT: ['LIFECYCLE_CONTEXT']
 };
 
 module.exports = { RULES, CATEGORIES };

package/src/scanner.js

@@ -27,13 +27,20 @@ class PackageScanner {
         let allFacts = {
             facts: {
                 ENV_READ: [],
+                MASS_ENV_ACCESS: [],
                 FILE_READ_SENSITIVE: [],
                 NETWORK_SINK: [],
+                DNS_SINK: [],
+                RAW_SOCKET_SINK: [],
                 DYNAMIC_EXECUTION: [],
+                DYNAMIC_REQUIRE: [],
                 OBFUSCATION: [],
                 FILE_WRITE_STARTUP: [],
                 SHELL_EXECUTION: [],
-                ENCODER_USE: []
+                ENCODER_USE: [],
+                REMOTE_FETCH_SIGNAL: [],
+                PIPE_TO_SHELL_SIGNAL: [],
+                LIFECYCLE_CONTEXT: []
             },
             flows: []
         };
@@ -78,6 +85,11 @@ class PackageScanner {
                 }
 
                 // Merge facts (Synchronized)
+                if (lifecycleFiles.has(file)) {
+                    facts.LIFECYCLE_CONTEXT = facts.LIFECYCLE_CONTEXT || [];
+                    facts.LIFECYCLE_CONTEXT.push({ file, reason: 'Lifecycle script context detected' });
+                }
+
                 for (const category in facts) {
                     if (allFacts.facts[category]) {
                         allFacts.facts[category].push(...facts[category]);