@kairosinternational/watchman 0.1.0

package/dist/scanners/dependency-integrity/patterns/known-typosquats.js

@@ -0,0 +1,38 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SUBSTITUTION_PAIRS = exports.KNOWN_TYPOSQUATS = void 0;
+// Well-documented typosquat packages from public advisories
+exports.KNOWN_TYPOSQUATS = [
+    { malicious: 'crossenv', legitimate: 'cross-env', technique: 'typosquat' },
+    { malicious: 'cross-env.js', legitimate: 'cross-env', technique: 'combosquat' },
+    { malicious: 'event-stream', legitimate: 'event-stream', technique: 'starjack' },
+    { malicious: 'flatmap-stream', legitimate: 'flatmap-stream', technique: 'starjack' },
+    { malicious: 'babelcli', legitimate: '@babel/cli', technique: 'scope-confusion' },
+    { malicious: 'eslint-scope', legitimate: 'eslint-scope', technique: 'starjack' },
+    { malicious: 'getcookies', legitimate: 'get-cookies', technique: 'typosquat' },
+    { malicious: 'http-proxy.js', legitimate: 'http-proxy', technique: 'combosquat' },
+    { malicious: 'mongose', legitimate: 'mongoose', technique: 'typosquat' },
+    { malicious: 'mssql.js', legitimate: 'mssql', technique: 'combosquat' },
+    { malicious: 'node-fabric', legitimate: 'fabric', technique: 'combosquat' },
+    { malicious: 'node-opencv', legitimate: 'opencv', technique: 'combosquat' },
+    { malicious: 'nodefabric', legitimate: 'fabric', technique: 'typosquat' },
+    { malicious: 'nodemailer-js', legitimate: 'nodemailer', technique: 'combosquat' },
+    { malicious: 'noderequest', legitimate: 'request', technique: 'combosquat' },
+    { malicious: 'nodesass', legitimate: 'node-sass', technique: 'typosquat' },
+    { malicious: 'proxy.js', legitimate: 'proxy', technique: 'combosquat' },
+    { malicious: 'shadowsock', legitimate: 'shadowsocks', technique: 'typosquat' },
+    { malicious: 'smb', legitimate: 'smb2', technique: 'typosquat' },
+    { malicious: 'sqliter', legitimate: 'sqlite3', technique: 'typosquat' },
+    { malicious: 'tkinter', legitimate: 'tkinter', technique: 'scope-confusion' },
+];
+// Common character substitution patterns for fuzzy detection
+exports.SUBSTITUTION_PAIRS = [
+    ['0', 'o'],
+    ['1', 'l'],
+    ['rn', 'm'],
+    ['-', ''],
+    ['_', '-'],
+    ['.js', ''],
+    ['node-', ''],
+];
+//# sourceMappingURL=known-typosquats.js.map

package/dist/scanners/dependency-integrity/patterns/known-typosquats.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"known-typosquats.js","sourceRoot":"","sources":["../../../../src/scanners/dependency-integrity/patterns/known-typosquats.ts"],"names":[],"mappings":";;;AAMA,4DAA4D;AAC/C,QAAA,gBAAgB,GAAqB;IAChD,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,EAAE;IAC1E,EAAE,SAAS,EAAE,cAAc,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,YAAY,EAAE;IAC/E,EAAE,SAAS,EAAE,cAAc,EAAE,UAAU,EAAE,cAAc,EAAE,SAAS,EAAE,UAAU,EAAE;IAChF,EAAE,SAAS,EAAE,gBAAgB,EAAE,UAAU,EAAE,gBAAgB,EAAE,SAAS,EAAE,UAAU,EAAE;IACpF,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,iBAAiB,EAAE;IACjF,EAAE,SAAS,EAAE,cAAc,EAAE,UAAU,EAAE,cAAc,EAAE,SAAS,EAAE,UAAU,EAAE;IAChF,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE;IAC9E,EAAE,SAAS,EAAE,eAAe,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE;IACjF,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE;IACxE,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE;IACvE,EAAE,SAAS,EAAE,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE;IAC3E,EAAE,SAAS,EAAE,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE;IAC3E,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE;IACzE,EAAE,SAAS,EAAE,eAAe,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE;IACjF,EAAE,SAAS,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE;IAC5E,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,EAAE;IAC1E,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE;IACvE,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE;IAC9E,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE;IAChE,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE;IACvE,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,iBAAiB,EAAE;CAC9E,CAAC;AAEF,6DAA6D;AAChD,QAAA,kBAAkB,GAAuB;IACpD,CAAC,GAAG,EAAE,GAAG,CAAC;IACV,CAAC,GAAG,EAAE,GAAG,CAAC;IACV,CAAC,IAAI,EAAE,GAAG,CAAC;IACX,CAAC,GAAG,EAAE,EAAE,CAAC;IACT,CAAC,GAAG,EAAE,GAAG,CAAC;IACV,CAAC,KAAK,EAAE,EAAE,CAAC;IACX,CAAC,OAAO,EAAE,EAAE,CAAC;CACd,CAAC"}

package/dist/scanners/dependency-integrity/rules/hash-validation.rule.d.ts

@@ -0,0 +1,3 @@
+import type { Rule } from '../../../types/index.js';
+export declare const hashValidationRule: Rule;
+//# sourceMappingURL=hash-validation.rule.d.ts.map

package/dist/scanners/dependency-integrity/rules/hash-validation.rule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hash-validation.rule.d.ts","sourceRoot":"","sources":["../../../../src/scanners/dependency-integrity/rules/hash-validation.rule.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,IAAI,EAAe,MAAM,yBAAyB,CAAC;AASjE,eAAO,MAAM,kBAAkB,EAAE,IA4DhC,CAAC"}

package/dist/scanners/dependency-integrity/rules/hash-validation.rule.js

@@ -0,0 +1,64 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.hashValidationRule = void 0;
+const promises_1 = require("node:fs/promises");
+const node_path_1 = require("node:path");
+exports.hashValidationRule = {
+    id: 'hash-validation',
+    name: 'Lockfile Hash Validation',
+    description: 'Verifies that lockfile entries have integrity hashes and use secure algorithms',
+    async run(ctx) {
+        const lockfiles = ctx.files.filter((f) => (0, node_path_1.basename)(f) === 'package-lock.json');
+        for (const file of lockfiles) {
+            let content;
+            try {
+                content = await (0, promises_1.readFile)(file, 'utf-8');
+            }
+            catch {
+                continue;
+            }
+            let parsed;
+            try {
+                parsed = JSON.parse(content);
+            }
+            catch {
+                ctx.addFinding({
+                    rule: 'hash-validation',
+                    severity: 'high',
+                    message: 'Lockfile is not valid JSON — may have been tampered with',
+                    location: { file },
+                });
+                continue;
+            }
+            const packages = parsed.packages;
+            if (!packages)
+                continue;
+            for (const [name, dep] of Object.entries(packages)) {
+                if (!name || name === '')
+                    continue; // root package
+                if (!dep.integrity) {
+                    ctx.addFinding({
+                        rule: 'hash-validation',
+                        severity: 'high',
+                        message: `Package "${name}" has no integrity hash in lockfile`,
+                        location: { file },
+                        suggestion: 'Run npm install to regenerate the lockfile with integrity hashes.',
+                        metadata: { package: name, version: dep.version },
+                    });
+                    continue;
+                }
+                if (dep.integrity.startsWith('sha1-')) {
+                    ctx.addFinding({
+                        rule: 'hash-validation',
+                        severity: 'medium',
+                        message: `Package "${name}" uses weak SHA-1 integrity hash`,
+                        location: { file },
+                        suggestion: 'Regenerate lockfile to use SHA-512 integrity hashes.',
+                        metadata: { package: name, version: dep.version },
+                    });
+                }
+            }
+        }
+    },
+};
+//# sourceMappingURL=hash-validation.rule.js.map

package/dist/scanners/dependency-integrity/rules/hash-validation.rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hash-validation.rule.js","sourceRoot":"","sources":["../../../../src/scanners/dependency-integrity/rules/hash-validation.rule.ts"],"names":[],"mappings":";;;AAAA,+CAA4C;AAC5C,yCAAqC;AAUxB,QAAA,kBAAkB,GAAS;IACtC,EAAE,EAAE,iBAAiB;IACrB,IAAI,EAAE,0BAA0B;IAChC,WAAW,EAAE,gFAAgF;IAE7F,KAAK,CAAC,GAAG,CAAC,GAAgB;QACxB,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,oBAAQ,EAAC,CAAC,CAAC,KAAK,mBAAmB,CAAC,CAAC;QAE/E,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,IAAI,OAAe,CAAC;YACpB,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,IAAA,mBAAQ,EAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC1C,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YAED,IAAI,MAAqD,CAAC;YAC1D,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC/B,CAAC;YAAC,MAAM,CAAC;gBACP,GAAG,CAAC,UAAU,CAAC;oBACb,IAAI,EAAE,iBAAiB;oBACvB,QAAQ,EAAE,MAAM;oBAChB,OAAO,EAAE,0DAA0D;oBACnE,QAAQ,EAAE,EAAE,IAAI,EAAE;iBACnB,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;YACjC,IAAI,CAAC,QAAQ;gBAAE,SAAS;YAExB,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACnD,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,EAAE;oBAAE,SAAS,CAAC,eAAe;gBAEnD,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;oBACnB,GAAG,CAAC,UAAU,CAAC;wBACb,IAAI,EAAE,iBAAiB;wBACvB,QAAQ,EAAE,MAAM;wBAChB,OAAO,EAAE,YAAY,IAAI,qCAAqC;wBAC9D,QAAQ,EAAE,EAAE,IAAI,EAAE;wBAClB,UAAU,EAAE,mEAAmE;wBAC/E,QAAQ,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE;qBAClD,CAAC,CAAC;oBACH,SAAS;gBACX,CAAC;gBAED,IAAI,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;oBACtC,GAAG,CAAC,UAAU,CAAC;wBACb,IAAI,EAAE,iBAAiB;wBACvB,QAAQ,EAAE,QAAQ;wBAClB,OAAO,EAAE,YAAY,IAAI,kCAAkC;wBAC3D,QAAQ,EAAE,EAAE,IAAI,EAAE;wBAClB,UAAU,EAAE,sDAAsD;wBAClE,QAAQ,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE;qBAClD,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;CACF,CAAC"}

package/dist/scanners/dependency-integrity/rules/transitive-drift.rule.d.ts

@@ -0,0 +1,3 @@
+import type { Rule } from '../../../types/index.js';
+export declare const transitiveDriftRule: Rule;
+//# sourceMappingURL=transitive-drift.rule.d.ts.map

package/dist/scanners/dependency-integrity/rules/transitive-drift.rule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transitive-drift.rule.d.ts","sourceRoot":"","sources":["../../../../src/scanners/dependency-integrity/rules/transitive-drift.rule.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,IAAI,EAAe,MAAM,yBAAyB,CAAC;AAEjE,eAAO,MAAM,mBAAmB,EAAE,IAkEjC,CAAC"}

package/dist/scanners/dependency-integrity/rules/transitive-drift.rule.js

@@ -0,0 +1,69 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.transitiveDriftRule = void 0;
+const promises_1 = require("node:fs/promises");
+const node_path_1 = require("node:path");
+exports.transitiveDriftRule = {
+    id: 'transitive-drift',
+    name: 'Transitive Dependency Drift',
+    description: 'Detects when package.json and lockfile are out of sync, indicating potential supply chain risk',
+    async run(ctx) {
+        const packageFiles = ctx.files.filter((f) => (0, node_path_1.basename)(f) === 'package.json');
+        for (const pkgFile of packageFiles) {
+            const dir = (0, node_path_1.dirname)(pkgFile);
+            const lockFile = (0, node_path_1.join)(dir, 'package-lock.json');
+            // Check if lockfile exists
+            try {
+                await (0, promises_1.access)(lockFile);
+            }
+            catch {
+                ctx.addFinding({
+                    rule: 'transitive-drift',
+                    severity: 'medium',
+                    message: 'No lockfile found alongside package.json',
+                    location: { file: pkgFile },
+                    suggestion: 'Run npm install to generate a lockfile. Lockfiles pin transitive dependencies.',
+                });
+                continue;
+            }
+            let pkgContent;
+            let lockContent;
+            try {
+                pkgContent = await (0, promises_1.readFile)(pkgFile, 'utf-8');
+                lockContent = await (0, promises_1.readFile)(lockFile, 'utf-8');
+            }
+            catch {
+                continue;
+            }
+            let pkg;
+            let lock;
+            try {
+                pkg = JSON.parse(pkgContent);
+                lock = JSON.parse(lockContent);
+            }
+            catch {
+                continue;
+            }
+            if (!lock.packages)
+                continue;
+            const declared = {
+                ...pkg.dependencies,
+                ...pkg.devDependencies,
+            };
+            for (const [name, range] of Object.entries(declared)) {
+                const lockEntry = lock.packages[`node_modules/${name}`];
+                if (!lockEntry) {
+                    ctx.addFinding({
+                        rule: 'transitive-drift',
+                        severity: 'high',
+                        message: `Package "${name}" declared in package.json but missing from lockfile`,
+                        location: { file: pkgFile },
+                        suggestion: 'Run npm install to sync the lockfile. Drift creates supply chain risk.',
+                        metadata: { package: name, declaredRange: range },
+                    });
+                }
+            }
+        }
+    },
+};
+//# sourceMappingURL=transitive-drift.rule.js.map

package/dist/scanners/dependency-integrity/rules/transitive-drift.rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transitive-drift.rule.js","sourceRoot":"","sources":["../../../../src/scanners/dependency-integrity/rules/transitive-drift.rule.ts"],"names":[],"mappings":";;;AAAA,+CAAoD;AACpD,yCAAoD;AAGvC,QAAA,mBAAmB,GAAS;IACvC,EAAE,EAAE,kBAAkB;IACtB,IAAI,EAAE,6BAA6B;IACnC,WAAW,EAAE,gGAAgG;IAE7G,KAAK,CAAC,GAAG,CAAC,GAAgB;QACxB,MAAM,YAAY,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,oBAAQ,EAAC,CAAC,CAAC,KAAK,cAAc,CAAC,CAAC;QAE7E,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;YACnC,MAAM,GAAG,GAAG,IAAA,mBAAO,EAAC,OAAO,CAAC,CAAC;YAC7B,MAAM,QAAQ,GAAG,IAAA,gBAAI,EAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;YAEhD,2BAA2B;YAC3B,IAAI,CAAC;gBACH,MAAM,IAAA,iBAAM,EAAC,QAAQ,CAAC,CAAC;YACzB,CAAC;YAAC,MAAM,CAAC;gBACP,GAAG,CAAC,UAAU,CAAC;oBACb,IAAI,EAAE,kBAAkB;oBACxB,QAAQ,EAAE,QAAQ;oBAClB,OAAO,EAAE,0CAA0C;oBACnD,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;oBAC3B,UAAU,EAAE,gFAAgF;iBAC7F,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YAED,IAAI,UAAkB,CAAC;YACvB,IAAI,WAAmB,CAAC;YACxB,IAAI,CAAC;gBACH,UAAU,GAAG,MAAM,IAAA,mBAAQ,EAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBAC9C,WAAW,GAAG,MAAM,IAAA,mBAAQ,EAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAClD,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YAED,IAAI,GAAwF,CAAC;YAC7F,IAAI,IAAyD,CAAC;YAC9D,IAAI,CAAC;gBACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;gBAC7B,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YACjC,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,QAAQ;gBAAE,SAAS;YAE7B,MAAM,QAAQ,GAAG;gBACf,GAAG,GAAG,CAAC,YAAY;gBACnB,GAAG,GAAG,CAAC,eAAe;aACvB,CAAC;YAEF,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACrD,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC;gBACxD,IAAI,CAAC,SAAS,EAAE,CAAC;oBACf,GAAG,CAAC,UAAU,CAAC;wBACb,IAAI,EAAE,kBAAkB;wBACxB,QAAQ,EAAE,MAAM;wBAChB,OAAO,EAAE,YAAY,IAAI,sDAAsD;wBAC/E,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;wBAC3B,UAAU,EAAE,wEAAwE;wBACpF,QAAQ,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE;qBAClD,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;CACF,CAAC"}

package/dist/scanners/dependency-integrity/rules/typosquat-check.rule.d.ts

@@ -0,0 +1,3 @@
+import type { Rule } from '../../../types/index.js';
+export declare const typosquatCheckRule: Rule;
+//# sourceMappingURL=typosquat-check.rule.d.ts.map

package/dist/scanners/dependency-integrity/rules/typosquat-check.rule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"typosquat-check.rule.d.ts","sourceRoot":"","sources":["../../../../src/scanners/dependency-integrity/rules/typosquat-check.rule.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,IAAI,EAAe,MAAM,yBAAyB,CAAC;AAmCjE,eAAO,MAAM,kBAAkB,EAAE,IA8DhC,CAAC"}

package/dist/scanners/dependency-integrity/rules/typosquat-check.rule.js

@@ -0,0 +1,94 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.typosquatCheckRule = void 0;
+const promises_1 = require("node:fs/promises");
+const node_path_1 = require("node:path");
+const known_typosquats_js_1 = require("../patterns/known-typosquats.js");
+function normalize(name) {
+    let n = name.toLowerCase();
+    for (const [from, to] of known_typosquats_js_1.SUBSTITUTION_PAIRS) {
+        n = n.replaceAll(from, to);
+    }
+    return n;
+}
+function levenshtein(a, b) {
+    const m = a.length;
+    const n = b.length;
+    const dp = Array.from({ length: m + 1 }, (_, i) => Array.from({ length: n + 1 }, (_, j) => (i === 0 ? j : j === 0 ? i : 0)));
+    for (let i = 1; i <= m; i++) {
+        for (let j = 1; j <= n; j++) {
+            dp[i][j] = a[i - 1] === b[j - 1]
+                ? dp[i - 1][j - 1]
+                : 1 + Math.min(dp[i - 1][j], dp[i][j - 1], dp[i - 1][j - 1]);
+        }
+    }
+    return dp[m][n];
+}
+// Top npm packages to check typosquat distance against
+const POPULAR_PACKAGES = [
+    'react', 'express', 'lodash', 'axios', 'next', 'typescript',
+    'webpack', 'babel', 'eslint', 'prettier', 'jest', 'vitest',
+    'mongoose', 'sequelize', 'prisma', 'stripe', 'nodemailer',
+    'dotenv', 'cors', 'bcrypt', 'jsonwebtoken', 'chalk',
+];
+exports.typosquatCheckRule = {
+    id: 'typosquat-check',
+    name: 'Typosquat Detection',
+    description: 'Checks dependencies against known typosquats and fuzzy-matches popular package names',
+    async run(ctx) {
+        const packageFiles = ctx.files.filter((f) => (0, node_path_1.basename)(f) === 'package.json');
+        for (const file of packageFiles) {
+            let content;
+            try {
+                content = await (0, promises_1.readFile)(file, 'utf-8');
+            }
+            catch {
+                continue;
+            }
+            let parsed;
+            try {
+                parsed = JSON.parse(content);
+            }
+            catch {
+                continue;
+            }
+            const allDeps = [
+                ...Object.keys(parsed.dependencies ?? {}),
+                ...Object.keys(parsed.devDependencies ?? {}),
+            ];
+            for (const dep of allDeps) {
+                // Check known typosquats
+                const knownMatch = known_typosquats_js_1.KNOWN_TYPOSQUATS.find((t) => t.malicious === dep);
+                if (knownMatch) {
+                    ctx.addFinding({
+                        rule: 'typosquat-check',
+                        severity: 'critical',
+                        message: `Known malicious package "${dep}" (typosquat of "${knownMatch.legitimate}")`,
+                        location: { file },
+                        suggestion: `Replace with the legitimate package: ${knownMatch.legitimate}`,
+                        metadata: { technique: knownMatch.technique },
+                    });
+                    continue;
+                }
+                // Fuzzy match against popular packages
+                const normalized = normalize(dep);
+                for (const popular of POPULAR_PACKAGES) {
+                    if (dep === popular)
+                        continue;
+                    const dist = levenshtein(normalized, normalize(popular));
+                    if (dist === 1) {
+                        ctx.addFinding({
+                            rule: 'typosquat-check',
+                            severity: 'high',
+                            message: `Package "${dep}" is 1 edit away from popular package "${popular}" — possible typosquat`,
+                            location: { file },
+                            suggestion: `Verify this is the intended package, not a typosquat of "${popular}".`,
+                            metadata: { distance: dist, target: popular },
+                        });
+                    }
+                }
+            }
+        }
+    },
+};
+//# sourceMappingURL=typosquat-check.rule.js.map

package/dist/scanners/dependency-integrity/rules/typosquat-check.rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"typosquat-check.rule.js","sourceRoot":"","sources":["../../../../src/scanners/dependency-integrity/rules/typosquat-check.rule.ts"],"names":[],"mappings":";;;AAAA,+CAA4C;AAC5C,yCAAqC;AAErC,yEAAuF;AAEvF,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,wCAAkB,EAAE,CAAC;QAC5C,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,WAAW,CAAC,CAAS,EAAE,CAAS;IACvC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IACnB,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IACnB,MAAM,EAAE,GAAe,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAC5D,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CACzE,CAAC;IACF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC5B,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;gBAC9B,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;gBAClB,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IACD,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,uDAAuD;AACvD,MAAM,gBAAgB,GAAG;IACvB,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY;IAC3D,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ;IAC1D,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY;IACzD,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO;CACpD,CAAC;AAEW,QAAA,kBAAkB,GAAS;IACtC,EAAE,EAAE,iBAAiB;IACrB,IAAI,EAAE,qBAAqB;IAC3B,WAAW,EAAE,sFAAsF;IAEnG,KAAK,CAAC,GAAG,CAAC,GAAgB;QACxB,MAAM,YAAY,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,oBAAQ,EAAC,CAAC,CAAC,KAAK,cAAc,CAAC,CAAC;QAE7E,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;YAChC,IAAI,OAAe,CAAC;YACpB,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,IAAA,mBAAQ,EAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC1C,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YAED,IAAI,MAA2F,CAAC;YAChG,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC/B,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YAED,MAAM,OAAO,GAAG;gBACd,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC;gBACzC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,IAAI,EAAE,CAAC;aAC7C,CAAC;YAEF,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;gBAC1B,yBAAyB;gBACzB,MAAM,UAAU,GAAG,sCAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,GAAG,CAAC,CAAC;gBACrE,IAAI,UAAU,EAAE,CAAC;oBACf,GAAG,CAAC,UAAU,CAAC;wBACb,IAAI,EAAE,iBAAiB;wBACvB,QAAQ,EAAE,UAAU;wBACpB,OAAO,EAAE,4BAA4B,GAAG,oBAAoB,UAAU,CAAC,UAAU,IAAI;wBACrF,QAAQ,EAAE,EAAE,IAAI,EAAE;wBAClB,UAAU,EAAE,wCAAwC,UAAU,CAAC,UAAU,EAAE;wBAC3E,QAAQ,EAAE,EAAE,SAAS,EAAE,UAAU,CAAC,SAAS,EAAE;qBAC9C,CAAC,CAAC;oBACH,SAAS;gBACX,CAAC;gBAED,uCAAuC;gBACvC,MAAM,UAAU,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;gBAClC,KAAK,MAAM,OAAO,IAAI,gBAAgB,EAAE,CAAC;oBACvC,IAAI,GAAG,KAAK,OAAO;wBAAE,SAAS;oBAC9B,MAAM,IAAI,GAAG,WAAW,CAAC,UAAU,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;oBACzD,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;wBACf,GAAG,CAAC,UAAU,CAAC;4BACb,IAAI,EAAE,iBAAiB;4BACvB,QAAQ,EAAE,MAAM;4BAChB,OAAO,EAAE,YAAY,GAAG,0CAA0C,OAAO,wBAAwB;4BACjG,QAAQ,EAAE,EAAE,IAAI,EAAE;4BAClB,UAAU,EAAE,4DAA4D,OAAO,IAAI;4BACnF,QAAQ,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;yBAC9C,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;CACF,CAAC"}

package/dist/scanners/dependency-integrity/scanner.d.ts

@@ -0,0 +1,3 @@
+import type { Scanner } from '../../types/index.js';
+export declare const dependencyIntegrityScanner: Scanner;
+//# sourceMappingURL=scanner.d.ts.map

package/dist/scanners/dependency-integrity/scanner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanner.d.ts","sourceRoot":"","sources":["../../../src/scanners/dependency-integrity/scanner.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAqB,MAAM,sBAAsB,CAAC;AAWvE,eAAO,MAAM,0BAA0B,EAAE,OAaxC,CAAC"}

package/dist/scanners/dependency-integrity/scanner.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.dependencyIntegrityScanner = void 0;
+const hash_validation_rule_js_1 = require("./rules/hash-validation.rule.js");
+const typosquat_check_rule_js_1 = require("./rules/typosquat-check.rule.js");
+const transitive_drift_rule_js_1 = require("./rules/transitive-drift.rule.js");
+const rules = [
+    hash_validation_rule_js_1.hashValidationRule,
+    typosquat_check_rule_js_1.typosquatCheckRule,
+    transitive_drift_rule_js_1.transitiveDriftRule,
+];
+exports.dependencyIntegrityScanner = {
+    id: 'dependency-integrity',
+    name: 'Dependency Integrity',
+    description: 'Validates dependency hashes, detects typosquatting, and flags transitive drift',
+    rules,
+    async scan(ctx) {
+        for (const rule of rules) {
+            const ruleConfig = ctx.scannerConfig.rules?.[rule.id];
+            if (ruleConfig?.enabled === false)
+                continue;
+            await rule.run(ctx);
+        }
+    },
+};
+//# sourceMappingURL=scanner.js.map

package/dist/scanners/dependency-integrity/scanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanner.js","sourceRoot":"","sources":["../../../src/scanners/dependency-integrity/scanner.ts"],"names":[],"mappings":";;;AACA,6EAAqE;AACrE,6EAAqE;AACrE,+EAAuE;AAEvE,MAAM,KAAK,GAAW;IACpB,4CAAkB;IAClB,4CAAkB;IAClB,8CAAmB;CACpB,CAAC;AAEW,QAAA,0BAA0B,GAAY;IACjD,EAAE,EAAE,sBAAsB;IAC1B,IAAI,EAAE,sBAAsB;IAC5B,WAAW,EAAE,gFAAgF;IAC7F,KAAK;IAEL,KAAK,CAAC,IAAI,CAAC,GAAgB;QACzB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,UAAU,GAAG,GAAG,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACtD,IAAI,UAAU,EAAE,OAAO,KAAK,KAAK;gBAAE,SAAS;YAC5C,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;CACF,CAAC"}

package/dist/scanners/runtime-monitor/index.d.ts

@@ -0,0 +1,2 @@
+export { runtimeMonitorScanner } from './scanner.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/scanners/runtime-monitor/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/scanners/runtime-monitor/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC"}

package/dist/scanners/runtime-monitor/index.js

@@ -0,0 +1,6 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runtimeMonitorScanner = void 0;
+var scanner_js_1 = require("./scanner.js");
+Object.defineProperty(exports, "runtimeMonitorScanner", { enumerable: true, get: function () { return scanner_js_1.runtimeMonitorScanner; } });
+//# sourceMappingURL=index.js.map

package/dist/scanners/runtime-monitor/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/scanners/runtime-monitor/index.ts"],"names":[],"mappings":";;;AAAA,2CAAqD;AAA5C,mHAAA,qBAAqB,OAAA"}

package/dist/scanners/runtime-monitor/patterns/known-bad-destinations.d.ts

@@ -0,0 +1,8 @@
+export interface BadDestination {
+    pattern: RegExp;
+    label: string;
+    category: 'c2' | 'exfiltration' | 'cryptominer' | 'suspicious';
+}
+export declare const KNOWN_BAD_DESTINATIONS: BadDestination[];
+export declare const SUSPICIOUS_PORTS: Set<number>;
+//# sourceMappingURL=known-bad-destinations.d.ts.map

package/dist/scanners/runtime-monitor/patterns/known-bad-destinations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"known-bad-destinations.d.ts","sourceRoot":"","sources":["../../../../src/scanners/runtime-monitor/patterns/known-bad-destinations.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,IAAI,GAAG,cAAc,GAAG,aAAa,GAAG,YAAY,CAAC;CAChE;AAGD,eAAO,MAAM,sBAAsB,EAAE,cAAc,EAoClD,CAAC;AAGF,eAAO,MAAM,gBAAgB,aAQ3B,CAAC"}

package/dist/scanners/runtime-monitor/patterns/known-bad-destinations.js

@@ -0,0 +1,52 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SUSPICIOUS_PORTS = exports.KNOWN_BAD_DESTINATIONS = void 0;
+// Patterns for known malicious or suspicious network destinations
+exports.KNOWN_BAD_DESTINATIONS = [
+    {
+        pattern: /ngrok\.io/i,
+        label: 'ngrok-tunnel',
+        category: 'suspicious',
+    },
+    {
+        pattern: /requestbin\.com|pipedream\.net|webhook\.site|hookbin\.com/i,
+        label: 'request-catcher',
+        category: 'exfiltration',
+    },
+    {
+        pattern: /pastebin\.com\/api|ghostbin\.com|hastebin\.com/i,
+        label: 'paste-service',
+        category: 'exfiltration',
+    },
+    {
+        pattern: /coinhive\.min\.js|coin-hive|cryptonight\.wasm/i,
+        label: 'cryptominer',
+        category: 'cryptominer',
+    },
+    {
+        pattern: /raw\.githubusercontent\.com\/[^/]+\/[^/]+\/[^/]+\/.*\.(sh|ps1|bat|exe)/i,
+        label: 'github-raw-script',
+        category: 'suspicious',
+    },
+    {
+        pattern: /\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}:\d{4,5}\b/,
+        label: 'raw-ip-with-port',
+        category: 'suspicious',
+    },
+    {
+        pattern: /(?:transfer\.sh|file\.io|0x0\.st)\/\w+/i,
+        label: 'ephemeral-file-host',
+        category: 'exfiltration',
+    },
+];
+// Suspicious outbound ports
+exports.SUSPICIOUS_PORTS = new Set([
+    4444, // Metasploit default
+    5555, // Common reverse shell
+    6666, // IRC / backdoor
+    8888, // Alternative HTTP / C2
+    9001, // Tor
+    9050, // Tor SOCKS
+    31337, // Back Orifice
+]);
+//# sourceMappingURL=known-bad-destinations.js.map

package/dist/scanners/runtime-monitor/patterns/known-bad-destinations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"known-bad-destinations.js","sourceRoot":"","sources":["../../../../src/scanners/runtime-monitor/patterns/known-bad-destinations.ts"],"names":[],"mappings":";;;AAMA,kEAAkE;AACrD,QAAA,sBAAsB,GAAqB;IACtD;QACE,OAAO,EAAE,YAAY;QACrB,KAAK,EAAE,cAAc;QACrB,QAAQ,EAAE,YAAY;KACvB;IACD;QACE,OAAO,EAAE,4DAA4D;QACrE,KAAK,EAAE,iBAAiB;QACxB,QAAQ,EAAE,cAAc;KACzB;IACD;QACE,OAAO,EAAE,iDAAiD;QAC1D,KAAK,EAAE,eAAe;QACtB,QAAQ,EAAE,cAAc;KACzB;IACD;QACE,OAAO,EAAE,gDAAgD;QACzD,KAAK,EAAE,aAAa;QACpB,QAAQ,EAAE,aAAa;KACxB;IACD;QACE,OAAO,EAAE,yEAAyE;QAClF,KAAK,EAAE,mBAAmB;QAC1B,QAAQ,EAAE,YAAY;KACvB;IACD;QACE,OAAO,EAAE,gDAAgD;QACzD,KAAK,EAAE,kBAAkB;QACzB,QAAQ,EAAE,YAAY;KACvB;IACD;QACE,OAAO,EAAE,yCAAyC;QAClD,KAAK,EAAE,qBAAqB;QAC5B,QAAQ,EAAE,cAAc;KACzB;CACF,CAAC;AAEF,4BAA4B;AACf,QAAA,gBAAgB,GAAG,IAAI,GAAG,CAAC;IACtC,IAAI,EAAG,qBAAqB;IAC5B,IAAI,EAAG,uBAAuB;IAC9B,IAAI,EAAG,iBAAiB;IACxB,IAAI,EAAG,wBAAwB;IAC/B,IAAI,EAAG,MAAM;IACb,IAAI,EAAG,YAAY;IACnB,KAAK,EAAE,eAAe;CACvB,CAAC,CAAC"}

package/dist/scanners/runtime-monitor/rules/filesystem-access.rule.d.ts

@@ -0,0 +1,3 @@
+import type { Rule } from '../../../types/index.js';
+export declare const filesystemAccessRule: Rule;
+//# sourceMappingURL=filesystem-access.rule.d.ts.map

package/dist/scanners/runtime-monitor/rules/filesystem-access.rule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"filesystem-access.rule.d.ts","sourceRoot":"","sources":["../../../../src/scanners/runtime-monitor/rules/filesystem-access.rule.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAe,MAAM,yBAAyB,CAAC;AAsBjE,eAAO,MAAM,oBAAoB,EAAE,IAkDlC,CAAC"}

package/dist/scanners/runtime-monitor/rules/filesystem-access.rule.js

@@ -0,0 +1,68 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.filesystemAccessRule = void 0;
+const promises_1 = require("node:fs/promises");
+const CODE_EXTENSIONS = new Set(['.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs']);
+function isCodeFile(file) {
+    const dot = file.lastIndexOf('.');
+    return dot !== -1 && CODE_EXTENSIONS.has(file.slice(dot).toLowerCase());
+}
+const SENSITIVE_PATH_PATTERNS = [
+    { pattern: /(?:\/etc\/passwd|\/etc\/shadow|\/etc\/hosts)/g, label: 'system-file' },
+    { pattern: /(?:\.ssh\/|\.gnupg\/|\.aws\/credentials)/g, label: 'credential-file' },
+    { pattern: /(?:\.env(?:\.local)?|\.env\.production)/g, label: 'env-file' },
+    { pattern: /(?:\/proc\/|\/sys\/)/g, label: 'proc-sys' },
+];
+const FS_WITH_USER_INPUT = [
+    { pattern: /(?:readFile|writeFile|readdir|unlink|rmdir)\s*\(\s*(?:req\.|params\.|query\.|body\.|args\.)/g, label: 'user-input-fs' },
+    { pattern: /(?:createReadStream|createWriteStream)\s*\(\s*(?:req\.|params\.|query\.|body\.)/g, label: 'user-input-stream' },
+    { pattern: /path\.join\s*\([^)]*(?:req\.|params\.|query\.|body\.)/g, label: 'user-input-path-join' },
+];
+exports.filesystemAccessRule = {
+    id: 'filesystem-access',
+    name: 'Filesystem Access Detection',
+    description: 'Flags access to sensitive paths and user-controlled filesystem operations',
+    async run(ctx) {
+        const codeFiles = ctx.files.filter(isCodeFile);
+        for (const file of codeFiles) {
+            let content;
+            try {
+                content = await (0, promises_1.readFile)(file, 'utf-8');
+            }
+            catch {
+                continue;
+            }
+            const lines = content.split('\n');
+            for (let i = 0; i < lines.length; i++) {
+                const line = lines[i];
+                for (const { pattern, label } of SENSITIVE_PATH_PATTERNS) {
+                    pattern.lastIndex = 0;
+                    if (pattern.test(line)) {
+                        ctx.addFinding({
+                            rule: 'filesystem-access',
+                            severity: label === 'credential-file' ? 'high' : 'medium',
+                            message: `Access to sensitive path detected: ${label}`,
+                            location: { file, line: i + 1 },
+                            evidence: line.trim().slice(0, 200),
+                            suggestion: 'Review whether this file access is necessary and properly secured.',
+                        });
+                    }
+                }
+                for (const { pattern, label } of FS_WITH_USER_INPUT) {
+                    pattern.lastIndex = 0;
+                    if (pattern.test(line)) {
+                        ctx.addFinding({
+                            rule: 'filesystem-access',
+                            severity: 'critical',
+                            message: `User input flows into filesystem operation: ${label}`,
+                            location: { file, line: i + 1 },
+                            evidence: line.trim().slice(0, 200),
+                            suggestion: 'CRITICAL: Path traversal vulnerability. Validate and sanitize all user-supplied paths.',
+                        });
+                    }
+                }
+            }
+        }
+    },
+};
+//# sourceMappingURL=filesystem-access.rule.js.map

package/dist/scanners/runtime-monitor/rules/filesystem-access.rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"filesystem-access.rule.js","sourceRoot":"","sources":["../../../../src/scanners/runtime-monitor/rules/filesystem-access.rule.ts"],"names":[],"mappings":";;;AAAA,+CAA4C;AAG5C,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAEhF,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO,GAAG,KAAK,CAAC,CAAC,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,uBAAuB,GAAG;IAC9B,EAAE,OAAO,EAAE,+CAA+C,EAAE,KAAK,EAAE,aAAa,EAAE;IAClF,EAAE,OAAO,EAAE,2CAA2C,EAAE,KAAK,EAAE,iBAAiB,EAAE;IAClF,EAAE,OAAO,EAAE,0CAA0C,EAAE,KAAK,EAAE,UAAU,EAAE;IAC1E,EAAE,OAAO,EAAE,uBAAuB,EAAE,KAAK,EAAE,UAAU,EAAE;CACxD,CAAC;AAEF,MAAM,kBAAkB,GAAG;IACzB,EAAE,OAAO,EAAE,8FAA8F,EAAE,KAAK,EAAE,eAAe,EAAE;IACnI,EAAE,OAAO,EAAE,kFAAkF,EAAE,KAAK,EAAE,mBAAmB,EAAE;IAC3H,EAAE,OAAO,EAAE,wDAAwD,EAAE,KAAK,EAAE,sBAAsB,EAAE;CACrG,CAAC;AAEW,QAAA,oBAAoB,GAAS;IACxC,EAAE,EAAE,mBAAmB;IACvB,IAAI,EAAE,6BAA6B;IACnC,WAAW,EAAE,2EAA2E;IAExF,KAAK,CAAC,GAAG,CAAC,GAAgB;QACxB,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAE/C,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,IAAI,OAAe,CAAC;YACpB,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,IAAA,mBAAQ,EAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC1C,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBAEtB,KAAK,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,uBAAuB,EAAE,CAAC;oBACzD,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;oBACtB,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;wBACvB,GAAG,CAAC,UAAU,CAAC;4BACb,IAAI,EAAE,mBAAmB;4BACzB,QAAQ,EAAE,KAAK,KAAK,iBAAiB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;4BACzD,OAAO,EAAE,sCAAsC,KAAK,EAAE;4BACtD,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE;4BAC/B,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;4BACnC,UAAU,EAAE,oEAAoE;yBACjF,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;gBAED,KAAK,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,kBAAkB,EAAE,CAAC;oBACpD,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;oBACtB,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;wBACvB,GAAG,CAAC,UAAU,CAAC;4BACb,IAAI,EAAE,mBAAmB;4BACzB,QAAQ,EAAE,UAAU;4BACpB,OAAO,EAAE,+CAA+C,KAAK,EAAE;4BAC/D,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE;4BAC/B,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;4BACnC,UAAU,EAAE,wFAAwF;yBACrG,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;CACF,CAAC"}

package/dist/scanners/runtime-monitor/rules/outbound-network.rule.d.ts

@@ -0,0 +1,3 @@
+import type { Rule } from '../../../types/index.js';
+export declare const outboundNetworkRule: Rule;
+//# sourceMappingURL=outbound-network.rule.d.ts.map

package/dist/scanners/runtime-monitor/rules/outbound-network.rule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"outbound-network.rule.d.ts","sourceRoot":"","sources":["../../../../src/scanners/runtime-monitor/rules/outbound-network.rule.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAe,MAAM,yBAAyB,CAAC;AAYjE,eAAO,MAAM,mBAAmB,EAAE,IAqDjC,CAAC"}

package/dist/scanners/runtime-monitor/rules/outbound-network.rule.js

@@ -0,0 +1,62 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.outboundNetworkRule = void 0;
+const promises_1 = require("node:fs/promises");
+const known_bad_destinations_js_1 = require("../patterns/known-bad-destinations.js");
+const CODE_EXTENSIONS = new Set(['.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs']);
+function isCodeFile(file) {
+    const dot = file.lastIndexOf('.');
+    return dot !== -1 && CODE_EXTENSIONS.has(file.slice(dot).toLowerCase());
+}
+const PORT_PATTERN = /:\s*(\d{4,5})\b/g;
+exports.outboundNetworkRule = {
+    id: 'outbound-network',
+    name: 'Outbound Network Detection',
+    description: 'Flags connections to known malicious destinations and suspicious ports',
+    async run(ctx) {
+        const codeFiles = ctx.files.filter(isCodeFile);
+        for (const file of codeFiles) {
+            let content;
+            try {
+                content = await (0, promises_1.readFile)(file, 'utf-8');
+            }
+            catch {
+                continue;
+            }
+            const lines = content.split('\n');
+            for (let i = 0; i < lines.length; i++) {
+                const line = lines[i];
+                // Check known bad destinations
+                for (const dest of known_bad_destinations_js_1.KNOWN_BAD_DESTINATIONS) {
+                    if (dest.pattern.test(line)) {
+                        ctx.addFinding({
+                            rule: 'outbound-network',
+                            severity: dest.category === 'c2' ? 'critical' : dest.category === 'exfiltration' ? 'high' : 'medium',
+                            message: `Connection to suspicious destination: ${dest.label} (${dest.category})`,
+                            location: { file, line: i + 1 },
+                            evidence: line.trim().slice(0, 200),
+                            suggestion: 'Review this network destination. It matches a known suspicious pattern.',
+                        });
+                    }
+                }
+                // Check suspicious ports
+                PORT_PATTERN.lastIndex = 0;
+                let portMatch;
+                while ((portMatch = PORT_PATTERN.exec(line)) !== null) {
+                    const port = parseInt(portMatch[1], 10);
+                    if (known_bad_destinations_js_1.SUSPICIOUS_PORTS.has(port)) {
+                        ctx.addFinding({
+                            rule: 'outbound-network',
+                            severity: 'high',
+                            message: `Connection to suspicious port ${port} — commonly used for ${port === 9001 || port === 9050 ? 'Tor' : 'reverse shells/C2'}`,
+                            location: { file, line: i + 1 },
+                            evidence: line.trim().slice(0, 200),
+                            suggestion: 'This port is associated with malicious tools. Verify this is legitimate.',
+                        });
+                    }
+                }
+            }
+        }
+    },
+};
+//# sourceMappingURL=outbound-network.rule.js.map

package/dist/scanners/runtime-monitor/rules/outbound-network.rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"outbound-network.rule.js","sourceRoot":"","sources":["../../../../src/scanners/runtime-monitor/rules/outbound-network.rule.ts"],"names":[],"mappings":";;;AAAA,+CAA4C;AAE5C,qFAAiG;AAEjG,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAEhF,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO,GAAG,KAAK,CAAC,CAAC,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,YAAY,GAAG,kBAAkB,CAAC;AAE3B,QAAA,mBAAmB,GAAS;IACvC,EAAE,EAAE,kBAAkB;IACtB,IAAI,EAAE,4BAA4B;IAClC,WAAW,EAAE,wEAAwE;IAErF,KAAK,CAAC,GAAG,CAAC,GAAgB;QACxB,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAE/C,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,IAAI,OAAe,CAAC;YACpB,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,IAAA,mBAAQ,EAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC1C,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBAEtB,+BAA+B;gBAC/B,KAAK,MAAM,IAAI,IAAI,kDAAsB,EAAE,CAAC;oBAC1C,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;wBAC5B,GAAG,CAAC,UAAU,CAAC;4BACb,IAAI,EAAE,kBAAkB;4BACxB,QAAQ,EAAE,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,KAAK,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;4BACpG,OAAO,EAAE,yCAAyC,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,QAAQ,GAAG;4BACjF,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE;4BAC/B,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;4BACnC,UAAU,EAAE,yEAAyE;yBACtF,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;gBAED,yBAAyB;gBACzB,YAAY,CAAC,SAAS,GAAG,CAAC,CAAC;gBAC3B,IAAI,SAAiC,CAAC;gBACtC,OAAO,CAAC,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;oBACtD,MAAM,IAAI,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACxC,IAAI,4CAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;wBAC/B,GAAG,CAAC,UAAU,CAAC;4BACb,IAAI,EAAE,kBAAkB;4BACxB,QAAQ,EAAE,MAAM;4BAChB,OAAO,EAAE,iCAAiC,IAAI,wBAAwB,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,mBAAmB,EAAE;4BACpI,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE;4BAC/B,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;4BACnC,UAAU,EAAE,0EAA0E;yBACvF,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;CACF,CAAC"}

package/dist/scanners/runtime-monitor/rules/process-spawn.rule.d.ts

@@ -0,0 +1,3 @@
+import type { Rule } from '../../../types/index.js';
+export declare const processSpawnRule: Rule;
+//# sourceMappingURL=process-spawn.rule.d.ts.map

package/dist/scanners/runtime-monitor/rules/process-spawn.rule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"process-spawn.rule.d.ts","sourceRoot":"","sources":["../../../../src/scanners/runtime-monitor/rules/process-spawn.rule.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAe,MAAM,yBAAyB,CAAC;AAkBjE,eAAO,MAAM,gBAAgB,EAAE,IAsC9B,CAAC"}