@flagrix/scanner-core 0.1.0

package/dist/pdf/pdf-scanner.js

@@ -0,0 +1,148 @@
+/**
+ * PDF Scanner
+ *
+ * Client-side PDF analysis without external APIs.
+ * Analyzes raw PDF bytes for suspicious patterns:
+ * - Embedded JavaScript / auto-actions
+ * - Embedded files/attachments
+ * - Suspicious URL patterns
+ * - Obfuscated content
+ * - Social engineering markers
+ *
+ * Does NOT use pdf.js DOM parsing — works in service worker context
+ * by analyzing the raw PDF byte structure directly.
+ */
+const DANGEROUS_PDF_PATTERNS = [
+    { pattern: /\/JavaScript\s/i, type: "EMBEDDED_JS", severity: "critical", description: "PDF contains embedded JavaScript" },
+    { pattern: /\/JS\s*\(/i, type: "EMBEDDED_JS", severity: "critical", description: "PDF contains JavaScript action" },
+    { pattern: /\/OpenAction/i, type: "AUTO_ACTION", severity: "high", description: "PDF has auto-open action (runs on open)" },
+    { pattern: /\/AA\s/i, type: "AUTO_ACTION", severity: "high", description: "PDF has additional automatic actions" },
+    { pattern: /\/Launch/i, type: "LAUNCH_ACTION", severity: "critical", description: "PDF contains Launch action (can execute programs)" },
+    { pattern: /\/SubmitForm/i, type: "FORM_SUBMIT", severity: "high", description: "PDF submits form data to external server" },
+    { pattern: /\/ImportData/i, type: "IMPORT_DATA", severity: "high", description: "PDF imports external data" },
+    { pattern: /\/EmbeddedFile/i, type: "EMBEDDED_FILE", severity: "high", description: "PDF contains embedded files" },
+    { pattern: /\/Filespec/i, type: "EMBEDDED_FILE", severity: "medium", description: "PDF references file attachments" },
+    { pattern: /\/AcroForm/i, type: "INTERACTIVE_FORM", severity: "low", description: "PDF contains interactive form fields" },
+    { pattern: /\/RichMedia/i, type: "RICH_MEDIA", severity: "medium", description: "PDF contains rich media (Flash/multimedia)" },
+    { pattern: /\/XFA/i, type: "XFA_FORM", severity: "high", description: "PDF uses XFA forms (common exploit vector)" },
+    { pattern: /app\.launchURL/i, type: "URL_LAUNCH", severity: "critical", description: "PDF launches external URL via JavaScript" },
+    { pattern: /this\.exportDataObject/i, type: "DATA_EXPORT", severity: "high", description: "PDF exports data objects" },
+    { pattern: /eval\s*\(/i, type: "JS_EVAL", severity: "critical", description: "PDF contains eval() JavaScript execution" },
+    { pattern: /unescape\s*\(/i, type: "JS_OBFUSCATION", severity: "high", description: "PDF uses unescape() (common obfuscation)" },
+];
+const SUSPICIOUS_URLS = [
+    /bit\.ly/i,
+    /tinyurl\.com/i,
+    /goo\.gl/i,
+    /is\.gd/i,
+    /ngrok\.io/i,
+    /raw\.githubusercontent\.com.*\.(exe|bat|ps1|sh)/i,
+    /pastebin\.com\/raw/i,
+    /transfer\.sh/i,
+    /discord\.gg/i,
+];
+const MALWARE_TOOLS = /msfvenom|metasploit|cobaltstrike|veil-evasion|empire|set\s*toolkit/i;
+export async function scanPdfFromUrl(url) {
+    const response = await fetch(url);
+    if (!response.ok) {
+        throw new Error(`Failed to fetch PDF: ${response.status}`);
+    }
+    const arrayBuffer = await response.arrayBuffer();
+    return scanPdfBytes(new Uint8Array(arrayBuffer));
+}
+export function scanPdfBytes(bytes) {
+    const findings = [];
+    const rawText = new TextDecoder("latin1").decode(bytes);
+    if (!rawText.startsWith("%PDF")) {
+        findings.push({
+            severity: "high",
+            type: "INVALID_PDF",
+            description: "File does not have a valid PDF header",
+        });
+    }
+    let hasJavaScript = false;
+    let hasAutoActions = false;
+    let hasEmbeddedFiles = false;
+    for (const check of DANGEROUS_PDF_PATTERNS) {
+        if (check.pattern.test(rawText)) {
+            findings.push({
+                severity: check.severity,
+                type: check.type,
+                description: check.description,
+            });
+            if (check.type === "EMBEDDED_JS" || check.type === "JS_EVAL" || check.type === "JS_OBFUSCATION") {
+                hasJavaScript = true;
+            }
+            if (check.type === "AUTO_ACTION" || check.type === "LAUNCH_ACTION") {
+                hasAutoActions = true;
+            }
+            if (check.type === "EMBEDDED_FILE") {
+                hasEmbeddedFiles = true;
+            }
+        }
+    }
+    const urlMatches = rawText.match(/https?:\/\/[^\s)<>"]+/gi) || [];
+    const suspiciousUrlSet = new Set();
+    for (const url of urlMatches) {
+        for (const pattern of SUSPICIOUS_URLS) {
+            if (pattern.test(url)) {
+                suspiciousUrlSet.add(url.substring(0, 100));
+            }
+        }
+        if (/\.(exe|bat|cmd|ps1|sh|msi|dll|scr|vbs|wsf)(\?|$)/i.test(url)) {
+            findings.push({
+                severity: "critical",
+                type: "EXECUTABLE_LINK",
+                description: `Link to executable: ${url.substring(0, 100)}`,
+            });
+        }
+    }
+    for (const url of suspiciousUrlSet) {
+        findings.push({
+            severity: "high",
+            type: "SUSPICIOUS_URL",
+            description: `Suspicious shortened/redirect URL: ${url}`,
+        });
+    }
+    const producerMatch = rawText.match(/\/Producer\s*\(([^)]+)\)/i);
+    const creatorMatch = rawText.match(/\/Creator\s*\(([^)]+)\)/i);
+    const toolString = (producerMatch?.[1] || "") + (creatorMatch?.[1] || "");
+    if (MALWARE_TOOLS.test(toolString)) {
+        findings.push({
+            severity: "critical",
+            type: "MALWARE_TOOL",
+            description: `PDF created with known exploit framework: ${toolString.substring(0, 80)}`,
+        });
+    }
+    const streamCount = (rawText.match(/stream\r?\n/g) || []).length;
+    const encodedStreams = (rawText.match(/\/Filter\s*\[?\s*\/[A-Z]/g) || []).length;
+    if (streamCount > 5 && encodedStreams > streamCount * 0.8) {
+        findings.push({
+            severity: "medium",
+            type: "HEAVY_ENCODING",
+            description: `Heavily encoded: ${encodedStreams}/${streamCount} streams use filters`,
+        });
+    }
+    const pageCountMatch = rawText.match(/\/Count\s+(\d+)/i);
+    const pageCount = pageCountMatch ? parseInt(pageCountMatch[1], 10) : 0;
+    const criticalCount = findings.filter((f) => f.severity === "critical").length;
+    const highCount = findings.filter((f) => f.severity === "high").length;
+    const mediumCount = findings.filter((f) => f.severity === "medium").length;
+    const riskScore = Math.min(1, criticalCount * 0.35 + highCount * 0.15 + mediumCount * 0.05);
+    const riskLevel = riskScore >= 0.6 ? "high" : riskScore >= 0.3 ? "medium" : "low";
+    return {
+        riskScore,
+        riskLevel,
+        findings,
+        metadata: {
+            pageCount,
+            hasJavaScript,
+            hasEmbeddedFiles,
+            hasAutoActions,
+            fileSize: bytes.length,
+        },
+        safeToOpen: riskLevel === "low",
+        disclaimer: "Risk assessment only. Not a definitive malware determination. Always verify documents from unknown sources.",
+    };
+}
+//# sourceMappingURL=pdf-scanner.js.map

package/dist/pdf/pdf-scanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pdf-scanner.js","sourceRoot":"","sources":["../../src/pdf/pdf-scanner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAuBH,MAAM,sBAAsB,GAKvB;IACH,EAAE,OAAO,EAAE,iBAAiB,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,kCAAkC,EAAE;IAC1H,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,gCAAgC,EAAE;IACnH,EAAE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,yCAAyC,EAAE;IAC3H,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,sCAAsC,EAAE;IAClH,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,mDAAmD,EAAE;IACvI,EAAE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,0CAA0C,EAAE;IAC5H,EAAE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,2BAA2B,EAAE;IAC7G,EAAE,OAAO,EAAE,iBAAiB,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,6BAA6B,EAAE;IACnH,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,iCAAiC,EAAE;IACrH,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,sCAAsC,EAAE;IAC1H,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,4CAA4C,EAAE;IAC9H,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,4CAA4C,EAAE;IACpH,EAAE,OAAO,EAAE,iBAAiB,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,0CAA0C,EAAE;IACjI,EAAE,OAAO,EAAE,yBAAyB,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,0BAA0B,EAAE;IACtH,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,0CAA0C,EAAE;IACzH,EAAE,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,0CAA0C,EAAE;CACjI,CAAA;AAED,MAAM,eAAe,GAAa;IAChC,UAAU;IACV,eAAe;IACf,UAAU;IACV,SAAS;IACT,YAAY;IACZ,kDAAkD;IAClD,qBAAqB;IACrB,eAAe;IACf,cAAc;CACf,CAAA;AAED,MAAM,aAAa,GAAG,qEAAqE,CAAA;AAE3F,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAW;IAC9C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAA;IACjC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,wBAAwB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;IAC5D,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAA;IAChD,OAAO,YAAY,CAAC,IAAI,UAAU,CAAC,WAAW,CAAC,CAAC,CAAA;AAClD,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,KAAiB;IAC5C,MAAM,QAAQ,GAAiB,EAAE,CAAA;IACjC,MAAM,OAAO,GAAG,IAAI,WAAW,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAEvD,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAChC,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,aAAa;YACnB,WAAW,EAAE,uCAAuC;SACrD,CAAC,CAAA;IACJ,CAAC;IAED,IAAI,aAAa,GAAG,KAAK,CAAA;IACzB,IAAI,cAAc,GAAG,KAAK,CAAA;IAC1B,IAAI,gBAAgB,GAAG,KAAK,CAAA;IAE5B,KAAK,MAAM,KAAK,IAAI,sBAAsB,EAAE,CAAC;QAC3C,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAChC,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,WAAW,EAAE,KAAK,CAAC,WAAW;aAC/B,CAAC,CAAA;YAEF,IAAI,KAAK,CAAC,IAAI,KAAK,aAAa,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;gBAChG,aAAa,GAAG,IAAI,CAAA;YACtB,CAAC;YACD,IAAI,KAAK,CAAC,IAAI,KAAK,aAAa,IAAI,KAAK,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;gBACnE,cAAc,GAAG,IAAI,CAAA;YACvB,CAAC;YACD,IAAI,KAAK,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;gBACnC,gBAAgB,GAAG,IAAI,CAAA;YACzB,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,yBAAyB,CAAC,IAAI,EAAE,CAAA;IACjE,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAA;IAE1C,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;YACtC,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtB,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAA;YAC7C,CAAC;QACH,CAAC;QACD,IAAI,mDAAmD,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAClE,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,UAAU;gBACpB,IAAI,EAAE,iBAAiB;gBACvB,WAAW,EAAE,uBAAuB,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;aAC5D,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,gBAAgB,EAAE,CAAC;QACnC,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,gBAAgB;YACtB,WAAW,EAAE,sCAAsC,GAAG,EAAE;SACzD,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,OAAO,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAA;IAChE,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAA;IAC9D,MAAM,UAAU,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;IAEzE,IAAI,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACnC,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,UAAU;YACpB,IAAI,EAAE,cAAc;YACpB,WAAW,EAAE,6CAA6C,UAAU,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE;SACxF,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAA;IAChE,MAAM,cAAc,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,2BAA2B,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAA;IAEhF,IAAI,WAAW,GAAG,CAAC,IAAI,cAAc,GAAG,WAAW,GAAG,GAAG,EAAE,CAAC;QAC1D,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,QAAQ;YAClB,IAAI,EAAE,gBAAgB;YACtB,WAAW,EAAE,oBAAoB,cAAc,IAAI,WAAW,sBAAsB;SACrF,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,cAAc,GAAG,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAA;IACxD,MAAM,SAAS,GAAG,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAEvE,MAAM,aAAa,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,MAAM,CAAA;IAC9E,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,MAAM,CAAA;IACtE,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,MAAM,CAAA;IAE1E,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,aAAa,GAAG,IAAI,GAAG,SAAS,GAAG,IAAI,GAAG,WAAW,GAAG,IAAI,CAAC,CAAA;IAC3F,MAAM,SAAS,GACb,SAAS,IAAI,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,IAAI,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAA;IAEjE,OAAO;QACL,SAAS;QACT,SAAS;QACT,QAAQ;QACR,QAAQ,EAAE;YACR,SAAS;YACT,aAAa;YACb,gBAAgB;YAChB,cAAc;YACd,QAAQ,EAAE,KAAK,CAAC,MAAM;SACvB;QACD,UAAU,EAAE,SAAS,KAAK,KAAK;QAC/B,UAAU,EACR,6GAA6G;KAChH,CAAA;AACH,CAAC"}

package/dist/rules/rule-matcher.d.ts

@@ -0,0 +1,3 @@
+import type { GitHubFinding, YaraRule } from "../types/index.js";
+export declare function isTestFile(filePath: string): boolean;
+export declare function applyYaraRules(content: string, rules: YaraRule[], filePath: string): GitHubFinding[];

package/dist/rules/rule-matcher.js

@@ -0,0 +1,51 @@
+import { collectEvidence } from "../utils/evidence.js";
+// Test file patterns — skip or reduce severity for these paths
+const TEST_FILE_PATTERNS = [
+    /__tests__\//i,
+    /\/test\//i,
+    /\/tests\//i,
+    /\/spec\//i,
+    /\.test\.[jt]sx?$/i,
+    /\.spec\.[jt]sx?$/i,
+    /_test\.[jt]sx?$/i,
+    /\.mock\.[jt]sx?$/i,
+    /fixtures?\//i,
+    /cypress\.config\.[jt]sx?$/i,
+    /jest\.config\.[jt]sx?$/i,
+    /vitest\.config\.[jt]sx?$/i,
+    /playwright\.config\.[jt]sx?$/i,
+    /\/cypress\//i,
+    /\/e2e\//i,
+];
+export function isTestFile(filePath) {
+    return TEST_FILE_PATTERNS.some((pattern) => pattern.test(filePath));
+}
+export function applyYaraRules(content, rules, filePath) {
+    const findings = [];
+    const isTest = isTestFile(filePath);
+    for (const rule of rules) {
+        try {
+            const regex = new RegExp(rule.pattern, "gi");
+            const matches = content.match(regex);
+            if (matches && matches.length > 0) {
+                // Skip test files for non-critical patterns (reduce false positives)
+                if (isTest && rule.severity !== "critical") {
+                    continue;
+                }
+                findings.push({
+                    severity: rule.severity,
+                    type: "MALWARE_SIGNATURE",
+                    file: filePath,
+                    pattern: rule.id,
+                    description: rule.description,
+                    evidence: collectEvidence(content, regex),
+                });
+            }
+        }
+        catch {
+            // Invalid regex, skip
+        }
+    }
+    return findings;
+}
+//# sourceMappingURL=rule-matcher.js.map

package/dist/rules/rule-matcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rule-matcher.js","sourceRoot":"","sources":["../../src/rules/rule-matcher.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAEtD,+DAA+D;AAC/D,MAAM,kBAAkB,GAAG;IACzB,cAAc;IACd,WAAW;IACX,YAAY;IACZ,WAAW;IACX,mBAAmB;IACnB,mBAAmB;IACnB,kBAAkB;IAClB,mBAAmB;IACnB,cAAc;IACd,4BAA4B;IAC5B,yBAAyB;IACzB,2BAA2B;IAC3B,+BAA+B;IAC/B,cAAc;IACd,UAAU;CACX,CAAA;AAED,MAAM,UAAU,UAAU,CAAC,QAAgB;IACzC,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAA;AACrE,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,OAAe,EACf,KAAiB,EACjB,QAAgB;IAEhB,MAAM,QAAQ,GAAoB,EAAE,CAAA;IACpC,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAA;IAEnC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAC5C,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;YACpC,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAClC,qEAAqE;gBACrE,IAAI,MAAM,IAAI,IAAI,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;oBAC3C,SAAQ;gBACV,CAAC;gBAED,QAAQ,CAAC,IAAI,CAAC;oBACZ,QAAQ,EAAE,IAAI,CAAC,QAAqC;oBACpD,IAAI,EAAE,mBAAmB;oBACzB,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,IAAI,CAAC,EAAE;oBAChB,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,QAAQ,EAAE,eAAe,CAAC,OAAO,EAAE,KAAK,CAAC;iBAC1C,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,sBAAsB;QACxB,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAA;AACjB,CAAC"}

package/dist/types/index.d.ts

@@ -0,0 +1,234 @@
+/**
+ * Core type definitions for @flagrix/scanner-core
+ * Shared across GitHub, LinkedIn, and PDF scanners.
+ */
+export type RiskLevel = "low" | "medium" | "high";
+export interface RiskFactor {
+    factor: string;
+    weight: number;
+    description: string;
+}
+export interface RiskAssessment {
+    riskScore: number;
+    riskLevel: RiskLevel;
+    factors: RiskFactor[];
+    disclaimer: string;
+}
+export interface LinkedInProfileFeatures {
+    profileUrl: string;
+    accountAgeDays: number | null;
+    connectionCount: number | null;
+    followerCount: number | null;
+    hasProfilePhoto: boolean;
+    workHistoryCount: number;
+    educationCount: number;
+    endorsementCount: number;
+    postCount: number;
+    mutualConnections: number;
+    profileCompleteness: number;
+    name: string | null;
+    headline: string | null;
+    location: string | null;
+    isVerified: boolean;
+    isTopVoice: boolean;
+    hasJobPostings: boolean;
+    hasOpenToWork: boolean;
+}
+export interface LinkedInScanResult extends RiskAssessment {
+    profile: LinkedInProfileFeatures;
+    scannedAt: Date;
+}
+export type ScanDepth = "quick" | "standard" | "deep";
+export interface GitHubRepoInfo {
+    owner: string;
+    repo: string;
+    branch: string;
+    url: string;
+}
+export interface GitHubFinding {
+    severity: "critical" | "high" | "medium" | "low" | "info";
+    type: "MALWARE_SIGNATURE" | "OBFUSCATED_CODE" | "SUSPICIOUS_DEPENDENCY" | "POSTINSTALL_SCRIPT" | "TYPOSQUAT_PACKAGE" | "HIDDEN_FILE" | "SUSPICIOUS_URL" | "NON_ENGLISH_COMMENTS" | "SUSPICIOUS_PACKAGE_NAME" | "HARDCODED_SECRETS" | "NETWORK_COMMUNICATION" | "CRYPTO_MINER" | "DATA_EXFILTRATION" | "BACKDOOR" | "SUPPLY_CHAIN_RISK" | "SUSPICIOUS_FILE_ACCESS" | "CODE_INTEGRITY_ISSUE" | "SOCIAL_ENGINEERING";
+    file?: string;
+    line?: number;
+    pattern?: string;
+    package?: string;
+    description: string;
+    files?: string[];
+    codeSnippet?: string;
+    codeExplanation?: string;
+    /** Matched source lines in `file`, for display and `#L<n>` deep links. */
+    evidence?: FindingEvidence[];
+}
+export interface FindingEvidence {
+    /** 1-based line number in the finding's `file`. */
+    line: number;
+    /** The trimmed source line (length-capped). */
+    code: string;
+}
+export interface GitHubScanResult extends RiskAssessment {
+    repo: GitHubRepoInfo;
+    /**
+     * The commit the verdict applies to. Every file read during the scan is
+     * pinned to this SHA, so the assessment can't straddle a push (TOCTOU) —
+     * and consumers should surface it: a verdict is a statement about this
+     * commit, not about whatever the branch points to later.
+     */
+    commitSha?: string;
+    scanSummary: {
+        filesScanned: number;
+        patternsMatched: number;
+        dependenciesChecked: number;
+    };
+    findings: GitHubFinding[];
+    safeToClone: boolean;
+    scannedAt: Date;
+}
+export interface GitHubUserFeatures {
+    username: string;
+    accountAgeDays: number;
+    followers: number;
+    following: number;
+    followerFollowingRatio: number;
+    publicRepos: number;
+    ownedReposCount: number;
+    totalStars: number;
+    repoStarRatio: number;
+    hasProfilePhoto: boolean;
+    isProfileComplete: boolean;
+    hasCompany: boolean;
+    hasBio: boolean;
+    recentEventCount: number;
+    veryRecentEventCount: number;
+    profileUrl: string;
+    scannedAt: string;
+}
+export interface GitHubUserScanResult {
+    username: string;
+    riskLevel: RiskLevel;
+    riskScore: number;
+    riskFactors: RiskFactor[];
+    trustSignals: RiskFactor[];
+    recommendation: string;
+    profileUrl: string;
+    accountAgeDays: number;
+    followers: number;
+    publicRepos: number;
+    scannedAt: string;
+}
+export interface DocumentMetadata {
+    type: string;
+    sizeBytes: number;
+    pages?: number;
+    hash: string;
+}
+export interface StaticAnalysisResult {
+    hasJavaScript: boolean;
+    hasEmbeddedFiles: boolean;
+    hasLaunchAction: boolean;
+    hasSuspiciousUrls: boolean;
+    suspiciousUrls?: string[];
+}
+export interface VirusTotalResult {
+    detected: boolean;
+    enginesChecked: number;
+    detections: number;
+    scanId?: string;
+}
+export interface DocumentScanResult extends RiskAssessment {
+    metadata: DocumentMetadata;
+    staticAnalysis: StaticAnalysisResult;
+    virusTotal?: VirusTotalResult;
+    safeToOpen: boolean;
+    scannedAt: Date;
+}
+export interface MaliciousPackage {
+    name: string;
+    version?: string;
+    severity: "critical" | "high" | "medium";
+    source: string;
+    description?: string;
+}
+export interface YaraRule {
+    id: string;
+    name: string;
+    pattern: string;
+    description: string;
+    tags: string[];
+    severity: "critical" | "high" | "medium" | "low";
+}
+export interface KnownBadHash {
+    sha256: string;
+    type: "pdf" | "js" | "binary";
+    malwareFamily?: string;
+    source: string;
+}
+export interface SignatureDatabase {
+    version: string;
+    lastUpdated: Date;
+    maliciousPackages: MaliciousPackage[];
+    yaraRules: YaraRule[];
+    knownBadHashes: KnownBadHash[];
+    /** GitHub user-profile scoring ruleset. Optional — falls back to the
+     *  scanner's built-in DEFAULT_USER_PROFILE_RULES when absent. */
+    userProfileRules?: UserProfileRuleset;
+}
+/** Feature fields on GitHubUserFeatures that a profile condition may test. */
+export type ProfileFeatureField = "accountAgeDays" | "followers" | "following" | "followerFollowingRatio" | "ownedReposCount" | "totalStars" | "recentEventCount" | "veryRecentEventCount" | "hasProfilePhoto" | "isProfileComplete";
+export type ProfileOperator = "lt" | "lte" | "gt" | "gte" | "eq";
+export interface ProfileSimpleCondition {
+    field: ProfileFeatureField;
+    operator: ProfileOperator;
+    value: number | boolean;
+}
+/** Compound condition — matches only when every sub-condition matches. */
+export interface ProfileCompoundCondition {
+    all: ProfileSimpleCondition[];
+}
+export type ProfileCondition = ProfileSimpleCondition | ProfileCompoundCondition;
+export interface ProfileRiskRule {
+    id: string;
+    name: string;
+    /** Supports `{fieldName}` tokens, interpolated from the scanned features. */
+    description: string;
+    weight: number;
+    condition: ProfileCondition;
+    /** If the referenced rule id already matched, this rule is skipped. */
+    exclusiveWith?: string;
+}
+export interface ProfileRiskLevels {
+    /** score ≥ this ⇒ at least medium risk */
+    mediumMinScore: number;
+    /** score ≥ this ⇒ high risk */
+    highMinScore: number;
+    recommendations: {
+        low: string;
+        medium: string;
+        high: string;
+    };
+}
+export interface UserProfileRuleset {
+    riskFactors: ProfileRiskRule[];
+    trustSignals: ProfileRiskRule[];
+    riskLevels: ProfileRiskLevels;
+}
+export interface RepoScanOptions {
+    githubToken?: string;
+    signatures: SignatureDatabase;
+}
+export interface UserScanOptions {
+    githubToken?: string;
+    /** Profile-scoring ruleset (typically from the fetched SignatureDatabase).
+     *  Falls back to DEFAULT_USER_PROFILE_RULES when omitted. */
+    userProfileRules?: UserProfileRuleset;
+}
+/**
+ * Score boundaries used by `getRiskLevel` (repo scans) and the LinkedIn profile
+ * scorer: a score below `low` is low risk, below `high` is medium risk, and at
+ * or above `high` is high risk. The GitHub user scanner applies its own tuned
+ * thresholds because profile signals distribute differently from code findings.
+ */
+export declare const RISK_THRESHOLDS: {
+    readonly low: 0.3;
+    readonly high: 0.6;
+};
+export declare const DEFAULT_DISCLAIMER = "Risk assessment only. Not a definitive fraud determination. Always verify through official channels.";

package/dist/types/index.js

@@ -0,0 +1,17 @@
+/**
+ * Core type definitions for @flagrix/scanner-core
+ * Shared across GitHub, LinkedIn, and PDF scanners.
+ */
+// ─── Constants ───────────────────────────────────────────────────────────────
+/**
+ * Score boundaries used by `getRiskLevel` (repo scans) and the LinkedIn profile
+ * scorer: a score below `low` is low risk, below `high` is medium risk, and at
+ * or above `high` is high risk. The GitHub user scanner applies its own tuned
+ * thresholds because profile signals distribute differently from code findings.
+ */
+export const RISK_THRESHOLDS = {
+    low: 0.3,
+    high: 0.6,
+};
+export const DEFAULT_DISCLAIMER = "Risk assessment only. Not a definitive fraud determination. Always verify through official channels.";
+//# sourceMappingURL=index.js.map

package/dist/types/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/types/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAmSH,gFAAgF;AAEhF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,GAAG,EAAE,GAAG;IACR,IAAI,EAAE,GAAG;CACD,CAAA;AAEV,MAAM,CAAC,MAAM,kBAAkB,GAC7B,sGAAsG,CAAA"}

package/dist/utils/evidence.d.ts

@@ -0,0 +1,8 @@
+import type { FindingEvidence } from "../types/index.js";
+/**
+ * Locate the source lines a pattern matched, with 1-based line numbers, so
+ * findings can show *where* the evidence lives (and consumers can deep-link
+ * `#L<n>`). Best-effort: patterns that only match across line boundaries
+ * yield no evidence — callers keep their `codeSnippet` as the fallback.
+ */
+export declare function collectEvidence(content: string, patterns: RegExp | RegExp[], max?: number): FindingEvidence[];

package/dist/utils/evidence.js

@@ -0,0 +1,28 @@
+const MAX_EVIDENCE_LINES = 3;
+const MAX_LINE_LENGTH = 160;
+/**
+ * Locate the source lines a pattern matched, with 1-based line numbers, so
+ * findings can show *where* the evidence lives (and consumers can deep-link
+ * `#L<n>`). Best-effort: patterns that only match across line boundaries
+ * yield no evidence — callers keep their `codeSnippet` as the fallback.
+ */
+export function collectEvidence(content, patterns, max = MAX_EVIDENCE_LINES) {
+    const list = (Array.isArray(patterns) ? patterns : [patterns]).map(
+    // Fresh non-global copies: per-line .test() with a shared /g regex would
+    // carry lastIndex across calls and silently skip matches.
+    (p) => new RegExp(p.source, p.flags.replace(/g/g, "")));
+    const evidence = [];
+    const lines = content.split("\n");
+    for (let i = 0; i < lines.length && evidence.length < max; i++) {
+        const raw = lines[i];
+        if (!list.some((re) => re.test(raw)))
+            continue;
+        const code = raw.trim();
+        evidence.push({
+            line: i + 1,
+            code: code.length > MAX_LINE_LENGTH ? code.slice(0, MAX_LINE_LENGTH) + "…" : code
+        });
+    }
+    return evidence;
+}
+//# sourceMappingURL=evidence.js.map

package/dist/utils/evidence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evidence.js","sourceRoot":"","sources":["../../src/utils/evidence.ts"],"names":[],"mappings":"AAEA,MAAM,kBAAkB,GAAG,CAAC,CAAA;AAC5B,MAAM,eAAe,GAAG,GAAG,CAAA;AAE3B;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAC7B,OAAe,EACf,QAA2B,EAC3B,GAAG,GAAG,kBAAkB;IAExB,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG;IAChE,yEAAyE;IACzE,0DAA0D;IAC1D,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CACvD,CAAA;IAED,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC/D,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAE,CAAA;QACrB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAAE,SAAQ;QAC9C,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAA;QACvB,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,CAAC,GAAG,CAAC;YACX,IAAI,EAAE,IAAI,CAAC,MAAM,GAAG,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI;SAClF,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC"}

package/dist/utils/risk-calculator.d.ts

@@ -0,0 +1,11 @@
+import type { GitHubFinding, RiskLevel } from "../types/index.js";
+export declare function getSeverityWeight(severity: GitHubFinding["severity"]): number;
+export declare function calculateRiskScore(findings: GitHubFinding[]): number;
+/**
+ * A single `critical` finding (code-execution / credential-theft patterns —
+ * see CONTRIBUTING.md) always means "high", regardless of how the additive
+ * score lands. Otherwise a lone keylogger or backdoor in an unlucky
+ * low-file-count repo could average out to "medium" just because nothing
+ * else was flagged alongside it.
+ */
+export declare function getRiskLevel(score: number, findings?: GitHubFinding[]): RiskLevel;

package/dist/utils/risk-calculator.js

@@ -0,0 +1,35 @@
+import { RISK_THRESHOLDS } from "../types/index.js";
+export function getSeverityWeight(severity) {
+    const weights = {
+        critical: 0.4,
+        high: 0.25,
+        medium: 0.15,
+        low: 0.05,
+        info: 0.01,
+    };
+    return weights[severity];
+}
+export function calculateRiskScore(findings) {
+    let score = 0;
+    for (const finding of findings) {
+        score += getSeverityWeight(finding.severity);
+    }
+    return Math.min(1, score);
+}
+/**
+ * A single `critical` finding (code-execution / credential-theft patterns —
+ * see CONTRIBUTING.md) always means "high", regardless of how the additive
+ * score lands. Otherwise a lone keylogger or backdoor in an unlucky
+ * low-file-count repo could average out to "medium" just because nothing
+ * else was flagged alongside it.
+ */
+export function getRiskLevel(score, findings) {
+    if (findings?.some((f) => f.severity === "critical"))
+        return "high";
+    if (score < RISK_THRESHOLDS.low)
+        return "low";
+    if (score < RISK_THRESHOLDS.high)
+        return "medium";
+    return "high";
+}
+//# sourceMappingURL=risk-calculator.js.map

package/dist/utils/risk-calculator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"risk-calculator.js","sourceRoot":"","sources":["../../src/utils/risk-calculator.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAEnD,MAAM,UAAU,iBAAiB,CAAC,QAAmC;IACnE,MAAM,OAAO,GAA8C;QACzD,QAAQ,EAAE,GAAG;QACb,IAAI,EAAE,IAAI;QACV,MAAM,EAAE,IAAI;QACZ,GAAG,EAAE,IAAI;QACT,IAAI,EAAE,IAAI;KACX,CAAA;IACD,OAAO,OAAO,CAAC,QAAQ,CAAC,CAAA;AAC1B,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,QAAyB;IAC1D,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,KAAK,IAAI,iBAAiB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC9C,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;AAC3B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,KAAa,EAAE,QAA0B;IACpE,IAAI,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC;QAAE,OAAO,MAAM,CAAA;IACnE,IAAI,KAAK,GAAG,eAAe,CAAC,GAAG;QAAE,OAAO,KAAK,CAAA;IAC7C,IAAI,KAAK,GAAG,eAAe,CAAC,IAAI;QAAE,OAAO,QAAQ,CAAA;IACjD,OAAO,MAAM,CAAA;AACf,CAAC"}

package/package.json

@@ -0,0 +1,54 @@
+{
+  "name": "@flagrix/scanner-core",
+  "version": "0.1.0",
+  "description": "Core security scanning logic for Flagrix — GitHub repo scanner and user profile scorer",
+  "license": "MIT",
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=18.17"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "keywords": [
+    "security",
+    "malware-detection",
+    "supply-chain-security",
+    "scam-detection",
+    "github",
+    "scanner"
+  ],
+  "homepage": "https://flagrix.io",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/flagrix-io/flagrix-scanner-core.git"
+  },
+  "scripts": {
+    "build": "tsc",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "prepare": "npm run build",
+    "prepublishOnly": "npm run build && npm test"
+  },
+  "dependencies": {
+    "franc-min": "^6.2.0"
+  },
+  "devDependencies": {
+    "@types/node": "^20.0.0",
+    "typescript": "^5.0.0",
+    "vitest": "^1.6.0"
+  }
+}