@involvex/bun-scanner 1.0.0 → 2.0.1

package/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "@involvex/bun-scanner",
-	"description": "Bun security scanner ",
-	"version": "1.0.0",
+	"description": "Enhanced Bun security scanner with real-time vulnerability detection, automated dependency auditing, and AI-driven anomaly detection",
+	"version": "2.0.1",
 	"author": "involvex",
 	"license": "MIT",
 	"exports": {
@@ -15,11 +15,27 @@
 	"keywords": [
 		"bun",
 		"security",
-		"provider"
+		"scanner",
+		"vulnerability",
+		"dependency",
+		"audit",
+		"threat",
+		"detection"
 	],
+	"scripts": {
+		"test": "bun test",
+		"prebuild": "bunx prettier . --write && tsc --noEmit",
+		"build": "bun build src/index.ts --outdir dist"
+	},
 	"devDependencies": {
 		"@types/bun": "^1.3.5",
 		"prettier": "^3.7.4",
 		"typescript": "^5.9.3"
+	},
+	"dependencies": {
+		"zod": "^3.22.4",
+		"axios": "^1.6.2",
+		"lodash": "^4.17.21",
+		"semver": "^7.5.4"
 	}
 }

package/scanner.test.ts

@@ -1,34 +1,24 @@
 import {expect, test} from 'bun:test';
 import {scanner} from './src/index.ts';
 
-/////////////////////////////////////////////////////////////////////////////////////
-//  This test file is mostly just here to get you up and running quickly. It's
-//  likely you'd want to improve or remove this, and add more coverage for your
-//  own code.
-/////////////////////////////////////////////////////////////////////////////////////
-
 test('Scanner should warn about known malicious packages', async () => {
 	const advisories = await scanner.scan({
 		packages: [
 			{
 				name: 'event-stream',
-				version: '3.3.6', // This was a known incident in 2018 - https://blog.npmjs.org/post/180565383195/details-about-the-event-stream-incident
+				version: '3.3.6',
 				requestedRange: '^3.3.0',
 				tarball: 'https://registry.npmjs.org/event-stream/-/event-stream-3.3.6.tgz',
+				license: 'MIT',
 			},
 		],
 	});
 
 	expect(advisories.length).toBeGreaterThan(0);
-	const advisory = advisories[0]!;
-	expect(advisory).toBeDefined();
 
-	expect(advisory).toMatchObject({
-		level: 'fatal',
-		package: 'event-stream',
-		url: expect.any(String),
-		description: expect.any(String),
-	});
+	const eventStreamAdvisory = advisories.find(a => a.package === 'event-stream');
+	expect(eventStreamAdvisory).toBeDefined();
+	expect(eventStreamAdvisory?.level).toBe('fatal');
 });
 
 test('There should be no advisories if no packages are being installed', async () => {
@@ -36,80 +26,153 @@ test('There should be no advisories if no packages are being installed', async (
 	expect(advisories.length).toBe(0);
 });
 
-test('Safe packages should return no advisories', async () => {
+test('Should handle packages without specified licenses', async () => {
 	const advisories = await scanner.scan({
 		packages: [
 			{
-				name: 'lodash',
-				version: '4.17.21',
-				requestedRange: '^4.17.0',
-				tarball: 'https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz',
+				name: 'unlicensed-package',
+				version: '1.0.0',
+				requestedRange: '^1.0.0',
+				tarball: 'https://registry.npmjs.org/unlicensed-package/-/unlicensed-package-1.0.0.tgz',
 			},
 		],
 	});
-	expect(advisories.length).toBe(0);
+
+	const licenseAdvisory = advisories.find(a =>
+		a.description?.includes('Package has no specified license'),
+	);
+
+	expect(licenseAdvisory).toBeDefined();
+	expect(licenseAdvisory?.level).toBe('warn');
 });
 
-test('Should handle multiple packages with mixed security status', async () => {
+test('Should handle scoped packages correctly', async () => {
 	const advisories = await scanner.scan({
 		packages: [
 			{
-				name: 'event-stream',
-				version: '3.3.6', // malicious
-				requestedRange: '^3.3.0',
-				tarball: 'https://registry.npmjs.org/event-stream/-/event-stream-3.3.6.tgz',
+				name: '@types/node',
+				version: '20.0.0',
+				requestedRange: '^20.0.0',
+				tarball: 'https://registry.npmjs.org/@types/node/-/node-20.0.0.tgz',
+				license: 'MIT',
+			},
+		],
+	});
+
+	const licenseAdvisories = advisories.filter(a =>
+		a.description?.includes('Package has no specified license'),
+	);
+
+	expect(licenseAdvisories.length).toBe(0);
+});
+
+test('Should detect vulnerabilities in lodash versions before 4.17.21', async () => {
+	const advisories = await scanner.scan({
+		packages: [
+			{
+				name: 'lodash',
+				version: '4.17.20',
+				requestedRange: '^4.17.0',
+				tarball: 'https://registry.npmjs.org/lodash/-/lodash-4.17.20.tgz',
+				license: 'MIT',
 			},
+		],
+	});
+
+	const lodashAdvisory = advisories.find(a => a.package === 'lodash');
+	expect(lodashAdvisory).toBeDefined();
+	expect(lodashAdvisory?.level).toBe('warn');
+});
+
+test('Should not detect vulnerabilities in lodash 4.17.21 or later', async () => {
+	const advisories = await scanner.scan({
+		packages: [
 			{
 				name: 'lodash',
-				version: '4.17.21', // safe
+				version: '4.17.21',
 				requestedRange: '^4.17.0',
 				tarball: 'https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz',
+				license: 'MIT',
 			},
 		],
 	});
 
-	expect(advisories.length).toBe(1);
-	expect(advisories[0]?.package).toBe('event-stream');
+	const lodashAdvisory = advisories.find(a => a.package === 'lodash');
+	expect(lodashAdvisory).toBeUndefined();
 });
 
-test('Should differentiate between versions of the same package', async () => {
-	const maliciousVersion = await scanner.scan({
+test('Should prioritize critical vulnerabilities first', async () => {
+	const advisories = await scanner.scan({
 		packages: [
 			{
 				name: 'event-stream',
-				version: '3.3.6', // malicious version
-				requestedRange: '3.3.6',
+				version: '3.3.6',
+				requestedRange: '^3.3.0',
 				tarball: 'https://registry.npmjs.org/event-stream/-/event-stream-3.3.6.tgz',
+				license: 'MIT',
+			},
+			{
+				name: 'lodash',
+				version: '4.17.20',
+				requestedRange: '^4.17.0',
+				tarball: 'https://registry.npmjs.org/lodash/-/lodash-4.17.20.tgz',
+				license: 'MIT',
 			},
 		],
 	});
 
-	const safeVersion = await scanner.scan({
+	expect(advisories.length).toBeGreaterThan(1);
+	expect(advisories[0]?.level).toBe('fatal');
+	expect(advisories[0]?.package).toBe('event-stream');
+	expect(advisories[1]?.level).toBe('warn');
+	expect(advisories[1]?.package).toBe('lodash');
+});
+
+test('Should return advisories with detailed information', async () => {
+	const advisories = await scanner.scan({
 		packages: [
 			{
 				name: 'event-stream',
-				version: '4.0.0', // safe version
-				requestedRange: '4.0.0',
-				tarball: 'https://registry.npmjs.org/event-stream/-/event-stream-4.0.0.tgz',
+				version: '3.3.6',
+				requestedRange: '^3.3.0',
+				tarball: 'https://registry.npmjs.org/event-stream/-/event-stream-3.3.6.tgz',
+				license: 'MIT',
 			},
 		],
 	});
 
-	expect(maliciousVersion.length).toBeGreaterThan(0);
-	expect(safeVersion.length).toBe(0);
+	const advisory = advisories[0];
+	expect(advisory).toBeDefined();
+	expect(advisory?.package).toBe('event-stream');
+	expect(advisory?.description).toBeDefined();
+	expect(advisory?.url).toBeDefined();
 });
 
-test('Should handle scoped packages correctly', async () => {
+test('Should handle multiple packages with mixed security status', async () => {
 	const advisories = await scanner.scan({
 		packages: [
 			{
-				name: '@types/node',
-				version: '20.0.0',
-				requestedRange: '^20.0.0',
-				tarball: 'https://registry.npmjs.org/@types/node/-/node-20.0.0.tgz',
+				name: 'event-stream',
+				version: '3.3.6',
+				requestedRange: '^3.3.0',
+				tarball: 'https://registry.npmjs.org/event-stream/-/event-stream-3.3.6.tgz',
+				license: 'MIT',
+			},
+			{
+				name: 'lodash',
+				version: '4.17.21',
+				requestedRange: '^4.17.0',
+				tarball: 'https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz',
+				license: 'MIT',
 			},
 		],
 	});
 
-	expect(advisories.length).toBe(0);
+	expect(advisories.length).toBeGreaterThan(0);
+
+	const eventStreamAdvisory = advisories.find(a => a.package === 'event-stream');
+	expect(eventStreamAdvisory).toBeDefined();
+
+	const lodashAdvisory = advisories.find(a => a.package === 'lodash');
+	expect(lodashAdvisory).toBeUndefined();
 });