@clear-capabilities/agentic-security-scanner 0.149.0 → 0.149.1

package/dist/agentic-security.mjs.sha256

@@ -1 +1 @@
-080e8743db95f7b28cad5e33fe52383fe37a483d2c8bc0535bef1cfb3f9219e7  agentic-security.mjs
+355c84ce589f5528668e3a998ac7d3881acd362a59e75de241cb84088b7c42e5  agentic-security.mjs

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clear-capabilities/agentic-security-scanner",
-  "version": "0.149.0",
+  "version": "0.149.1",
   "description": "Scanner engine for the agentic-security Claude Code plugin — SAST, SCA (function-level reachability + CISA KEV), secrets, IaC, prompt-injection, MCP/agent-tool audit, auth/authZ deep analysis, attack chains, PoC generation, business logic, toxic-combinations scoring, SBOM, pipeline integrity, compliance attestation, and more.",
   "type": "module",
   "main": "src/index.js",

package/src/engine.js

@@ -8206,11 +8206,12 @@ async function queryOSV(components,allFileContents){
     }
   }
 
-  if(queries.length){
+  const _osvOffline=process.env.AGENTIC_SECURITY_OFFLINE==='1';
+  if(queries.length&&!_osvOffline){
     for(let i=0;i<queries.length;i+=1000){
       const chunkQ=queries.slice(i,i+1000),chunkC=uncached.slice(i,i+1000);
       try{
-        const resp=await fetch('https://api.osv.dev/v1/querybatch',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({queries:chunkQ})});
+        const resp=await fetch('https://api.osv.dev/v1/querybatch',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({queries:chunkQ}),signal:AbortSignal.timeout(8000)});
         const data=await resp.json();
         for(let idx=0;idx<(data.results||[]).length;idx++){
           const{comp,ck}=chunkC[idx];
@@ -8243,8 +8244,9 @@ async function queryOSV(components,allFileContents){
   }
   // Then fetch uncached vulns with bounded concurrency.
   async function _fetchOneVuln(vid){
+    if(_osvOffline)return null;
     try {
-      const resp = await fetch(`https://api.osv.dev/v1/vulns/${vid}`);
+      const resp = await fetch(`https://api.osv.dev/v1/vulns/${vid}`,{signal:AbortSignal.timeout(8000)});
       const d = await resp.json();
       const fixedVersions = new Set();
       const osvVulnFunctions = [];
@@ -8337,7 +8339,7 @@ async function queryRegistries(components){
   for(let i=0;i<npmNames.length;i+=CHUNK){
     await Promise.all(npmNames.slice(i,i+CHUNK).map(async name=>{
       try{
-        const resp=await fetch('https://registry.npmjs.org/'+name);
+        const resp=await fetch('https://registry.npmjs.org/'+name,{signal:AbortSignal.timeout(8000)});
         if(!resp.ok)return;
         const d=await resp.json();
         const latest=d['dist-tags']?.latest||'';const lic=d.license||(latest&&d.versions?.[latest]?.license)||'';infoMap.set('npm:'+name,{latestVersion:latest,license:lic,versions:d.versions||{}});
@@ -8347,7 +8349,7 @@ async function queryRegistries(components){
   for(let i=0;i<pypiNames.length;i+=CHUNK){
     await Promise.all(pypiNames.slice(i,i+CHUNK).map(async name=>{
       try{
-        const resp=await fetch('https://pypi.org/pypi/'+encodeURIComponent(name)+'/json');
+        const resp=await fetch('https://pypi.org/pypi/'+encodeURIComponent(name)+'/json',{signal:AbortSignal.timeout(8000)});
         if(!resp.ok)return;
         const d=await resp.json();
         const info=d.info||{};
@@ -8377,7 +8379,7 @@ async function queryRegistries(components){
   for(let i=0;i<packagistNames.length;i+=CHUNK){
     await Promise.all(packagistNames.slice(i,i+CHUNK).map(async name=>{
       try{
-        const resp=await fetch('https://packagist.org/packages/'+name+'.json');
+        const resp=await fetch('https://packagist.org/packages/'+name+'.json',{signal:AbortSignal.timeout(8000)});
         if(!resp.ok)return;
         const d=await resp.json();
         const pkg=d.package||{};
@@ -8398,7 +8400,7 @@ async function queryRegistries(components){
   for(let i=0;i<cargoNames.length;i+=CHUNK){
     await Promise.all(cargoNames.slice(i,i+CHUNK).map(async name=>{
       try{
-        const resp=await fetch('https://crates.io/api/v1/crates/'+encodeURIComponent(name),{headers:CRATES_UA});
+        const resp=await fetch('https://crates.io/api/v1/crates/'+encodeURIComponent(name),{headers:CRATES_UA,signal:AbortSignal.timeout(8000)});
         if(!resp.ok)return;
         const d=await resp.json();
         const versions={};
@@ -8415,7 +8417,7 @@ async function queryRegistries(components){
   for(let i=0;i<gemNames.length;i+=CHUNK){
     await Promise.all(gemNames.slice(i,i+CHUNK).map(async name=>{
       try{
-        const resp=await fetch('https://rubygems.org/api/v1/versions/'+encodeURIComponent(name)+'.json');
+        const resp=await fetch('https://rubygems.org/api/v1/versions/'+encodeURIComponent(name)+'.json',{signal:AbortSignal.timeout(8000)});
         if(!resp.ok)return;
         const list=await resp.json();
         const versions={};
@@ -8433,7 +8435,7 @@ async function queryRegistries(components){
   for(let i=0;i<pubNames.length;i+=CHUNK){
     await Promise.all(pubNames.slice(i,i+CHUNK).map(async name=>{
       try{
-        const resp=await fetch('https://pub.dev/api/packages/'+encodeURIComponent(name),{headers:{Accept:'application/vnd.pub.v2+json'}});
+        const resp=await fetch('https://pub.dev/api/packages/'+encodeURIComponent(name),{headers:{Accept:'application/vnd.pub.v2+json'},signal:AbortSignal.timeout(8000)});
         if(!resp.ok)return;
         const d=await resp.json();
         const versions={};
@@ -8453,7 +8455,7 @@ async function queryRegistries(components){
     await Promise.all(mavenComps.slice(i,i+CHUNK).map(async c=>{
       try{
         const q=encodeURIComponent(`g:"${c.group}" AND a:"${c.name}"`);
-        const resp=await fetch(`https://search.maven.org/solrsearch/select?q=${q}&rows=1&wt=json`);
+        const resp=await fetch(`https://search.maven.org/solrsearch/select?q=${q}&rows=1&wt=json`,{signal:AbortSignal.timeout(8000)});
         if(!resp.ok)return;
         const d=await resp.json();
         const doc=(d.response?.docs||[])[0];