@kevinrabun/judges 1.0.0

package/dist/evaluators/data-security.js

@@ -0,0 +1,286 @@
+import { getLineNumbers } from "./shared.js";
+export function analyzeDataSecurity(code, language) {
+    const findings = [];
+    let ruleNum = 1;
+    const prefix = "DATA";
+    // Hardcoded secrets (multi-language)
+    const secretPatterns = [
+        { pattern: /(?:password|passwd|pwd)\s*[:=]\s*["'][^"']+["']/gi, name: "password" },
+        { pattern: /(?:api[_-]?key|apikey)\s*[:=]\s*["'][^"']+["']/gi, name: "API key" },
+        { pattern: /(?:secret|token)\s*[:=]\s*["'][^"']+["']/gi, name: "secret/token" },
+        { pattern: /(?:connection[_-]?string)\s*[:=]\s*["'][^"']+["']/gi, name: "connection string" },
+        { pattern: /(?:private[_-]?key)\s*[:=]\s*["'][^"']+["']/gi, name: "private key" },
+        { pattern: /-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----/gi, name: "embedded private key" },
+        { pattern: /(?:aws_access_key_id|aws_secret_access_key)\s*[:=]\s*["'][^"']+["']/gi, name: "AWS credential" },
+        { pattern: /AKIA[0-9A-Z]{16}/g, name: "AWS access key ID" },
+        { pattern: /(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9_]{36,}/g, name: "GitHub token" },
+        { pattern: /xox[bprs]-[0-9a-zA-Z-]{10,}/g, name: "Slack token" },
+        { pattern: /sk-[a-zA-Z0-9]{20,}/g, name: "OpenAI/Stripe secret key" },
+        { pattern: /(?:SG\.)[a-zA-Z0-9_-]{22}\.[a-zA-Z0-9_-]{43}/g, name: "SendGrid API key" },
+        { pattern: /(?:bearer|authorization)\s*[:=]\s*["'][^"']{20,}["']/gi, name: "hardcoded auth token" },
+        { pattern: /(?:AZURE|MICROSOFT)_[A-Z_]*(?:KEY|SECRET|TOKEN|CONNECTION)\s*[:=]\s*["'][^"']+["']/gi, name: "Azure credential" },
+        { pattern: /(?:DATABASE_URL|MONGO_URI|REDIS_URL)\s*[:=]\s*["'][^"']+["']/gi, name: "database connection URL" },
+    ];
+    for (const sp of secretPatterns) {
+        const lines = getLineNumbers(code, sp.pattern);
+        if (lines.length > 0) {
+            findings.push({
+                ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+                severity: "critical",
+                title: `Hardcoded ${sp.name} detected`,
+                description: `A ${sp.name} appears to be hardcoded in the source code. This is a severe data security risk as it can be extracted from version control, build artifacts, or decompiled binaries.`,
+                lineNumbers: lines,
+                recommendation: `Move the ${sp.name} to a secrets manager (e.g., Azure Key Vault, AWS Secrets Manager, HashiCorp Vault) or at minimum to environment variables. Never commit secrets to source control.`,
+                reference: "OWASP: Hardcoded Credentials — CWE-798",
+            });
+        }
+    }
+    // Console/print logging of sensitive data (multi-language)
+    const logSensitivePatterns = /(?:console\.\w+|print|println|printf|log\.\w+|logger\.\w+|logging\.\w+|System\.out|System\.err|fmt\.Print|puts|echo)\s*\(.*(?:password|secret|token|key|credential|ssn|credit.?card|cvv|pin_code)/gi;
+    const logLines = getLineNumbers(code, logSensitivePatterns);
+    if (logLines.length > 0) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "high",
+            title: "Sensitive data may be logged",
+            description: "Log output appears to include sensitive data fields such as passwords, tokens, or PII. This can lead to credential exposure in log aggregation systems.",
+            lineNumbers: logLines,
+            recommendation: "Remove sensitive data from log statements. Use structured logging with redaction filters to automatically mask sensitive fields.",
+            reference: "OWASP Logging Cheat Sheet — CWE-532",
+        });
+    }
+    // Weak hashing (multi-language)
+    const weakHashPatterns = /(?:md5|sha1|MD5|SHA1)\s*\(|MessageDigest\.getInstance\s*\(\s*["'](?:MD5|SHA-?1)["']\)|hashlib\.(?:md5|sha1)|Digest::(?:MD5|SHA1)|crypto\.createHash\s*\(\s*["'](?:md5|sha1)["']\)|MD5\.Create|SHA1\.Create/gi;
+    const weakHashLines = getLineNumbers(code, weakHashPatterns);
+    if (weakHashLines.length > 0) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "high",
+            title: "Weak hashing algorithm used",
+            description: "MD5 or SHA1 is used, which are cryptographically broken for security purposes. They should not be used for password hashing, data integrity verification, or any security-sensitive context.",
+            lineNumbers: weakHashLines,
+            recommendation: "Use SHA-256/SHA-512 for integrity checks, or bcrypt/scrypt/argon2 for password hashing.",
+            reference: "NIST SP 800-131A — CWE-328",
+        });
+    }
+    // SQL injection risk (multi-language)
+    const sqlInjectionPatterns = /(?:query|execute|exec|cursor\.execute|raw|rawQuery|createQuery)\s*\(\s*[`"'].*\$\{|(?:query|execute|exec|cursor\.execute)\s*\(\s*.*\+\s*(?:req\.|request\.|params\.|query\.|body\.|args\.|kwargs)|(?:query|execute|exec)\s*\(\s*f["']|\.format\s*\(.*(?:req\.|request\.|input)|String\.format\s*\(\s*["'](?:SELECT|INSERT|UPDATE|DELETE)/gi;
+    const sqlLines = getLineNumbers(code, sqlInjectionPatterns);
+    if (sqlLines.length > 0) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "critical",
+            title: "Potential SQL injection via string concatenation",
+            description: "SQL queries appear to be constructed using string interpolation or concatenation with user input, which can lead to SQL injection attacks and data breaches.",
+            lineNumbers: sqlLines,
+            recommendation: "Use parameterized queries or prepared statements. Never concatenate user input into SQL strings directly.",
+            reference: "OWASP SQL Injection — CWE-89",
+        });
+    }
+    // No encryption in HTTP calls
+    const httpPatterns = /['"]http:\/\/(?!localhost|127\.0\.0\.1|0\.0\.0\.0)/gi;
+    const httpLines = getLineNumbers(code, httpPatterns);
+    if (httpLines.length > 0) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "medium",
+            title: "Unencrypted HTTP connection",
+            description: "Non-localhost HTTP URLs are used instead of HTTPS, meaning data is transmitted in plaintext and vulnerable to interception.",
+            lineNumbers: httpLines,
+            recommendation: "Use HTTPS for all non-local connections to ensure data in transit is encrypted with TLS.",
+            reference: "OWASP Transport Layer Protection — CWE-319",
+        });
+    }
+    // Unsafe deserialization (multi-language)
+    const deserializationPatterns = /pickle\.loads?|yaml\.load\s*\([^)]*(?!\s*Loader)|Marshal\.load|JSON\.parse\s*\(\s*(?:req|request|body|input)|ObjectInputStream|readObject\s*\(|BinaryFormatter\.Deserialize|unserialize\s*\(/gi;
+    const deserLines = getLineNumbers(code, deserializationPatterns);
+    if (deserLines.length > 0) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "critical",
+            title: "Unsafe deserialization detected",
+            description: "Deserializing untrusted data (pickle, YAML, Java ObjectInputStream, PHP unserialize, .NET BinaryFormatter) can lead to remote code execution.",
+            lineNumbers: deserLines,
+            recommendation: "Never deserialize untrusted data. Use safe alternatives: yaml.safe_load(), JSON instead of pickle, whitelist-based deserialization. Validate and sanitize all input before deserialization.",
+            reference: "OWASP Deserialization — CWE-502",
+        });
+    }
+    // Cookie without security flags
+    const cookieNoFlagLines = getLineNumbers(code, /(?:res\.cookie|setCookie|set_cookie|SetCookie)\s*\(/gi);
+    if (cookieNoFlagLines.length > 0) {
+        const hasSecure = /secure\s*:\s*true|Secure/gi.test(code);
+        const hasHttpOnly = /httpOnly\s*:\s*true|HttpOnly/gi.test(code);
+        if (!hasSecure || !hasHttpOnly) {
+            findings.push({
+                ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+                severity: "high",
+                title: "Cookie may lack security flags",
+                description: "Cookies are set without explicit Secure, HttpOnly, or SameSite flags, making them vulnerable to interception and XSS-based theft.",
+                lineNumbers: cookieNoFlagLines,
+                recommendation: "Set Secure, HttpOnly, and SameSite=Strict (or Lax) flags on all cookies. Use __Host- prefix for sensitive cookies.",
+                reference: "OWASP Session Management — CWE-614",
+            });
+        }
+    }
+    // JWT without verification
+    const jwtNoVerifyPatterns = /jwt\.decode\s*\(|jose\.decode\s*\(|JWT\.decode\s*\(/gi;
+    const jwtNoVerifyLines = getLineNumbers(code, jwtNoVerifyPatterns);
+    if (jwtNoVerifyLines.length > 0) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "critical",
+            title: "JWT decoded without signature verification",
+            description: "JWT tokens are decoded without verifying the signature, allowing attackers to forge tokens with arbitrary claims.",
+            lineNumbers: jwtNoVerifyLines,
+            recommendation: "Always use jwt.verify() instead of jwt.decode(). Validate the signature, issuer, audience, and expiration claims.",
+            reference: "OWASP JWT Security — CWE-345",
+        });
+    }
+    // File upload without validation
+    const fileUploadPatterns = /multer|upload|formidable|busboy|multipart|FileUpload|MultipartFile/gi;
+    const fileUploadLines = getLineNumbers(code, fileUploadPatterns);
+    if (fileUploadLines.length > 0) {
+        const hasValidation = /mime|mimetype|content-type|extension|allowedTypes|fileFilter|accept|maxSize|fileSizeLimit/gi.test(code);
+        if (!hasValidation) {
+            findings.push({
+                ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+                severity: "high",
+                title: "File upload without type/size validation",
+                description: "File uploads are accepted without visible MIME type, extension, or size validation, allowing malicious file uploads.",
+                lineNumbers: fileUploadLines,
+                recommendation: "Validate file type (MIME + extension + magic bytes), enforce size limits, scan for malware, and store uploads outside the webroot.",
+                reference: "OWASP Unrestricted File Upload — CWE-434",
+            });
+        }
+    }
+    // Cleartext password storage
+    const cleartextPwPatterns = /password\s*[:=]\s*(?:req\.|request\.|body\.|input\.|params\.).*(?:save|insert|create|update|store|set)/gi;
+    const cleartextLines = getLineNumbers(code, cleartextPwPatterns);
+    if (cleartextLines.length > 0) {
+        const hasHashing = /bcrypt|argon2|scrypt|pbkdf2|hashPassword|hash_password|PasswordHasher/gi.test(code);
+        if (!hasHashing) {
+            findings.push({
+                ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+                severity: "critical",
+                title: "Password may be stored in cleartext",
+                description: "User passwords appear to be stored without hashing. If the database is compromised, all passwords are exposed.",
+                lineNumbers: cleartextLines,
+                recommendation: "Hash passwords using bcrypt, argon2, or scrypt with a unique salt per password. Never store passwords in plaintext or with reversible encryption.",
+                reference: "OWASP Password Storage — CWE-256",
+            });
+        }
+    }
+    // CORS with credentials and wildcard
+    const corsCredLines = getLineNumbers(code, /credentials\s*:\s*true|Access-Control-Allow-Credentials/gi);
+    const corsWildcard = /Access-Control-Allow-Origin.*\*|origin\s*:\s*['"]?\*/gi.test(code);
+    if (corsCredLines.length > 0 && corsWildcard) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "critical",
+            title: "CORS with credentials and wildcard origin",
+            description: "Using Access-Control-Allow-Credentials with a wildcard origin allows any website to make authenticated requests to your API.",
+            lineNumbers: corsCredLines,
+            recommendation: "Never combine credentials: true with origin: '*'. Whitelist specific trusted origins.",
+            reference: "OWASP CORS — CWE-942",
+        });
+    }
+    // Missing CSRF protection
+    const formPostLines = getLineNumbers(code, /app\.post\s*\(|router\.post\s*\(|@PostMapping|@RequestMapping.*POST|\.post\s*\(/gi);
+    const hasCsrf = /csrf|xsrf|_token|csrfToken|antiforgery|AntiForgery|@csrf/gi.test(code);
+    if (formPostLines.length > 2 && !hasCsrf) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "high",
+            title: "No CSRF protection detected",
+            description: "POST endpoints exist but no CSRF tokens or protection middleware is visible, making the application vulnerable to cross-site request forgery.",
+            lineNumbers: formPostLines.slice(0, 5),
+            recommendation: "Implement CSRF protection using tokens (csurf, django.middleware.csrf, @csrf_exempt annotations) or SameSite cookies.",
+            reference: "OWASP CSRF — CWE-352",
+        });
+    }
+    // Exposing stack traces to clients
+    const stackTracePatterns = /(?:res\.(?:json|send)|response\.(?:json|send))\s*\(.*(?:stack|stackTrace|err\.message|error\.message)|traceback\.format_exc/gi;
+    const stackLines = getLineNumbers(code, stackTracePatterns);
+    if (stackLines.length > 0) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "medium",
+            title: "Stack traces exposed to clients",
+            description: "Error stack traces sent in API responses reveal internal implementation details, file paths, and library versions to attackers.",
+            lineNumbers: stackLines,
+            recommendation: "Return generic error messages to clients. Log detailed errors server-side only. Use different error handlers for development vs production.",
+            reference: "OWASP Error Handling — CWE-209",
+        });
+    }
+    // Hardcoded encryption keys / IVs
+    const encKeyPatterns = /(?:encryption[_-]?key|aes[_-]?key|iv|initialization[_-]?vector|nonce)\s*[:=]\s*["'][^"']+["']|(?:Buffer\.from|new\s+Uint8Array)\s*\(.*(?:key|iv)/gi;
+    const encKeyLines = getLineNumbers(code, encKeyPatterns);
+    if (encKeyLines.length > 0) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "critical",
+            title: "Hardcoded encryption key or IV",
+            description: "Encryption keys and initialization vectors are hardcoded, making encrypted data trivially decryptable by anyone with access to the code.",
+            lineNumbers: encKeyLines,
+            recommendation: "Generate encryption keys securely at runtime or load from a key management service. IVs/nonces must be random and unique per encryption operation.",
+            reference: "CWE-321: Use of Hard-coded Cryptographic Key",
+        });
+    }
+    // Insecure random number generation for security
+    const insecureRandPatterns = /Math\.random\s*\(\)|random\.random\s*\(|rand\s*\(|Random\(\)|new\s+Random\b/gi;
+    const insecureRandLines = getLineNumbers(code, insecureRandPatterns);
+    if (insecureRandLines.length > 0) {
+        const nearSecurity = code.split("\n").some((line, i) => {
+            if (insecureRandPatterns.test(line)) {
+                const context = code.split("\n").slice(Math.max(0, i - 3), i + 3).join("\n");
+                return /token|secret|password|key|nonce|salt|session|csrf|otp|verification/i.test(context);
+            }
+            return false;
+        });
+        if (nearSecurity) {
+            findings.push({
+                ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+                severity: "high",
+                title: "Insecure random for security context",
+                description: "Math.random() or similar non-cryptographic PRNGs are used in a security-sensitive context (token generation, etc.). These are predictable.",
+                lineNumbers: insecureRandLines,
+                recommendation: "Use crypto.randomBytes() (Node.js), secrets.token_hex() (Python), SecureRandom (Java/Ruby), or crypto.getRandomValues() (browser).",
+                reference: "CWE-330: Use of Insufficiently Random Values",
+            });
+        }
+    }
+    // Path traversal risk
+    const pathTraversalPatterns = /(?:readFile|writeFile|readdir|open|fopen|file_get_contents|include|require)\s*\(.*(?:req\.|request\.|params\.|query\.|body\.|input\.|args)/gi;
+    const pathTravLines = getLineNumbers(code, pathTraversalPatterns);
+    if (pathTravLines.length > 0) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "critical",
+            title: "Potential path traversal via user input",
+            description: "File operations use user-controlled input without apparent sanitization, allowing attackers to read/write arbitrary files using ../ sequences.",
+            lineNumbers: pathTravLines,
+            recommendation: "Validate and sanitize file paths. Use path.resolve() + startsWith() checks, or a whitelist of allowed paths. Never pass user input directly to file operations.",
+            reference: "OWASP Path Traversal — CWE-22",
+        });
+    }
+    // Missing encryption at rest
+    const dbWritePatterns = /\.(?:save|create|insert|insertMany|insertOne|put|store)\s*\(/gi;
+    const dbWriteLines = getLineNumbers(code, dbWritePatterns);
+    const hasEncryption = /encrypt|cipher|aes|AES|crypto\.createCipher|DataProtect|ProtectedData/gi.test(code);
+    if (dbWriteLines.length > 3 && !hasEncryption) {
+        const hasSensitiveData = /(?:ssn|social_security|credit.?card|password|health|medical|financial|bank)/gi.test(code);
+        if (hasSensitiveData) {
+            findings.push({
+                ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+                severity: "high",
+                title: "Sensitive data stored without encryption",
+                description: "Code stores sensitive data (medical, financial, SSN) without visible encryption-at-rest. If the database is compromised, data is exposed in plaintext.",
+                lineNumbers: dbWriteLines.slice(0, 5),
+                recommendation: "Use field-level encryption for sensitive data, database-level TDE (Transparent Data Encryption), or application-level encryption before storage.",
+                reference: "OWASP Cryptographic Storage — CWE-311",
+            });
+        }
+    }
+    return findings;
+}
+//# sourceMappingURL=data-security.js.map

package/dist/evaluators/data-security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"data-security.js","sourceRoot":"","sources":["../../src/evaluators/data-security.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7C,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,QAAgB;IAChE,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,MAAM,MAAM,GAAG,MAAM,CAAC;IAEtB,qCAAqC;IACrC,MAAM,cAAc,GAAG;QACrB,EAAE,OAAO,EAAE,mDAAmD,EAAE,IAAI,EAAE,UAAU,EAAE;QAClF,EAAE,OAAO,EAAE,kDAAkD,EAAE,IAAI,EAAE,SAAS,EAAE;QAChF,EAAE,OAAO,EAAE,4CAA4C,EAAE,IAAI,EAAE,cAAc,EAAE;QAC/E,EAAE,OAAO,EAAE,qDAAqD,EAAE,IAAI,EAAE,mBAAmB,EAAE;QAC7F,EAAE,OAAO,EAAE,+CAA+C,EAAE,IAAI,EAAE,aAAa,EAAE;QACjF,EAAE,OAAO,EAAE,0DAA0D,EAAE,IAAI,EAAE,sBAAsB,EAAE;QACrG,EAAE,OAAO,EAAE,uEAAuE,EAAE,IAAI,EAAE,gBAAgB,EAAE;QAC5G,EAAE,OAAO,EAAE,mBAAmB,EAAE,IAAI,EAAE,mBAAmB,EAAE;QAC3D,EAAE,OAAO,EAAE,4CAA4C,EAAE,IAAI,EAAE,cAAc,EAAE;QAC/E,EAAE,OAAO,EAAE,8BAA8B,EAAE,IAAI,EAAE,aAAa,EAAE;QAChE,EAAE,OAAO,EAAE,sBAAsB,EAAE,IAAI,EAAE,0BAA0B,EAAE;QACrE,EAAE,OAAO,EAAE,+CAA+C,EAAE,IAAI,EAAE,kBAAkB,EAAE;QACtF,EAAE,OAAO,EAAE,wDAAwD,EAAE,IAAI,EAAE,sBAAsB,EAAE;QACnG,EAAE,OAAO,EAAE,sFAAsF,EAAE,IAAI,EAAE,kBAAkB,EAAE;QAC7H,EAAE,OAAO,EAAE,gEAAgE,EAAE,IAAI,EAAE,yBAAyB,EAAE;KAC/G,CAAC;IAEF,KAAK,MAAM,EAAE,IAAI,cAAc,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC;QAC/C,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;gBACzD,QAAQ,EAAE,UAAU;gBACpB,KAAK,EAAE,aAAa,EAAE,CAAC,IAAI,WAAW;gBACtC,WAAW,EAAE,KAAK,EAAE,CAAC,IAAI,wKAAwK;gBACjM,WAAW,EAAE,KAAK;gBAClB,cAAc,EAAE,YAAY,EAAE,CAAC,IAAI,qKAAqK;gBACxM,SAAS,EAAE,wCAAwC;aACpD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,2DAA2D;IAC3D,MAAM,oBAAoB,GAAG,qMAAqM,CAAC;IACnO,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC;IAC5D,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,8BAA8B;YACrC,WAAW,EAAE,yJAAyJ;YACtK,WAAW,EAAE,QAAQ;YACrB,cAAc,EAAE,kIAAkI;YAClJ,SAAS,EAAE,qCAAqC;SACjD,CAAC,CAAC;IACL,CAAC;IAED,gCAAgC;IAChC,MAAM,gBAAgB,GAAG,8MAA8M,CAAC;IACxO,MAAM,aAAa,GAAG,cAAc,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;IAC7D,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,6BAA6B;YACpC,WAAW,EAAE,8LAA8L;YAC3M,WAAW,EAAE,aAAa;YAC1B,cAAc,EAAE,yFAAyF;YACzG,SAAS,EAAE,4BAA4B;SACxC,CAAC,CAAC;IACL,CAAC;IAED,sCAAsC;IACtC,MAAM,oBAAoB,GAAG,4UAA4U,CAAC;IAC1W,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC;IAC5D,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,UAAU;YACpB,KAAK,EAAE,kDAAkD;YACzD,WAAW,EAAE,8JAA8J;YAC3K,WAAW,EAAE,QAAQ;YACrB,cAAc,EAAE,2GAA2G;YAC3H,SAAS,EAAE,8BAA8B;SAC1C,CAAC,CAAC;IACL,CAAC;IAED,8BAA8B;IAC9B,MAAM,YAAY,GAAG,sDAAsD,CAAC;IAC5E,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IACrD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,6BAA6B;YACpC,WAAW,EAAE,6HAA6H;YAC1I,WAAW,EAAE,SAAS;YACtB,cAAc,EAAE,0FAA0F;YAC1G,SAAS,EAAE,4CAA4C;SACxD,CAAC,CAAC;IACL,CAAC;IAED,0CAA0C;IAC1C,MAAM,uBAAuB,GAAG,gMAAgM,CAAC;IACjO,MAAM,UAAU,GAAG,cAAc,CAAC,IAAI,EAAE,uBAAuB,CAAC,CAAC;IACjE,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,UAAU;YACpB,KAAK,EAAE,iCAAiC;YACxC,WAAW,EAAE,+IAA+I;YAC5J,WAAW,EAAE,UAAU;YACvB,cAAc,EAAE,6LAA6L;YAC7M,SAAS,EAAE,iCAAiC;SAC7C,CAAC,CAAC;IACL,CAAC;IAED,gCAAgC;IAChC,MAAM,iBAAiB,GAAG,cAAc,CAAC,IAAI,EAAE,uDAAuD,CAAC,CAAC;IACxG,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,MAAM,SAAS,GAAG,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1D,MAAM,WAAW,GAAG,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChE,IAAI,CAAC,SAAS,IAAI,CAAC,WAAW,EAAE,CAAC;YAC/B,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;gBACzD,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,gCAAgC;gBACvC,WAAW,EAAE,mIAAmI;gBAChJ,WAAW,EAAE,iBAAiB;gBAC9B,cAAc,EAAE,oHAAoH;gBACpI,SAAS,EAAE,oCAAoC;aAChD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,2BAA2B;IAC3B,MAAM,mBAAmB,GAAG,uDAAuD,CAAC;IACpF,MAAM,gBAAgB,GAAG,cAAc,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;IACnE,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,UAAU;YACpB,KAAK,EAAE,4CAA4C;YACnD,WAAW,EAAE,mHAAmH;YAChI,WAAW,EAAE,gBAAgB;YAC7B,cAAc,EAAE,mHAAmH;YACnI,SAAS,EAAE,8BAA8B;SAC1C,CAAC,CAAC;IACL,CAAC;IAED,iCAAiC;IACjC,MAAM,kBAAkB,GAAG,sEAAsE,CAAC;IAClG,MAAM,eAAe,GAAG,cAAc,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;IACjE,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,MAAM,aAAa,GAAG,6FAA6F,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/H,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;gBACzD,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,0CAA0C;gBACjD,WAAW,EAAE,sHAAsH;gBACnI,WAAW,EAAE,eAAe;gBAC5B,cAAc,EAAE,oIAAoI;gBACpJ,SAAS,EAAE,0CAA0C;aACtD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,6BAA6B;IAC7B,MAAM,mBAAmB,GAAG,0GAA0G,CAAC;IACvI,MAAM,cAAc,GAAG,cAAc,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;IACjE,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,MAAM,UAAU,GAAG,yEAAyE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxG,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;gBACzD,QAAQ,EAAE,UAAU;gBACpB,KAAK,EAAE,qCAAqC;gBAC5C,WAAW,EAAE,gHAAgH;gBAC7H,WAAW,EAAE,cAAc;gBAC3B,cAAc,EAAE,mJAAmJ;gBACnK,SAAS,EAAE,kCAAkC;aAC9C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,qCAAqC;IACrC,MAAM,aAAa,GAAG,cAAc,CAAC,IAAI,EAAE,2DAA2D,CAAC,CAAC;IACxG,MAAM,YAAY,GAAG,wDAAwD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzF,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,IAAI,YAAY,EAAE,CAAC;QAC7C,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,UAAU;YACpB,KAAK,EAAE,2CAA2C;YAClD,WAAW,EAAE,8HAA8H;YAC3I,WAAW,EAAE,aAAa;YAC1B,cAAc,EAAE,uFAAuF;YACvG,SAAS,EAAE,sBAAsB;SAClC,CAAC,CAAC;IACL,CAAC;IAED,0BAA0B;IAC1B,MAAM,aAAa,GAAG,cAAc,CAAC,IAAI,EAAE,mFAAmF,CAAC,CAAC;IAChI,MAAM,OAAO,GAAG,4DAA4D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxF,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QACzC,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,6BAA6B;YACpC,WAAW,EAAE,+IAA+I;YAC5J,WAAW,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;YACtC,cAAc,EAAE,uHAAuH;YACvI,SAAS,EAAE,sBAAsB;SAClC,CAAC,CAAC;IACL,CAAC;IAED,mCAAmC;IACnC,MAAM,kBAAkB,GAAG,+HAA+H,CAAC;IAC3J,MAAM,UAAU,GAAG,cAAc,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;IAC5D,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,iCAAiC;YACxC,WAAW,EAAE,iIAAiI;YAC9I,WAAW,EAAE,UAAU;YACvB,cAAc,EAAE,6IAA6I;YAC7J,SAAS,EAAE,gCAAgC;SAC5C,CAAC,CAAC;IACL,CAAC;IAED,kCAAkC;IAClC,MAAM,cAAc,GAAG,oJAAoJ,CAAC;IAC5K,MAAM,WAAW,GAAG,cAAc,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IACzD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,UAAU;YACpB,KAAK,EAAE,gCAAgC;YACvC,WAAW,EAAE,0IAA0I;YACvJ,WAAW,EAAE,WAAW;YACxB,cAAc,EAAE,oJAAoJ;YACpK,SAAS,EAAE,8CAA8C;SAC1D,CAAC,CAAC;IACL,CAAC;IAED,iDAAiD;IACjD,MAAM,oBAAoB,GAAG,+EAA+E,CAAC;IAC7G,MAAM,iBAAiB,GAAG,cAAc,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC;IACrE,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;YACrD,IAAI,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC7E,OAAO,qEAAqE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC7F,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC,CAAC,CAAC;QACH,IAAI,YAAY,EAAE,CAAC;YACjB,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;gBACzD,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,sCAAsC;gBAC7C,WAAW,EAAE,4IAA4I;gBACzJ,WAAW,EAAE,iBAAiB;gBAC9B,cAAc,EAAE,oIAAoI;gBACpJ,SAAS,EAAE,8CAA8C;aAC1D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,sBAAsB;IACtB,MAAM,qBAAqB,GAAG,8IAA8I,CAAC;IAC7K,MAAM,aAAa,GAAG,cAAc,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC;IAClE,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,UAAU;YACpB,KAAK,EAAE,yCAAyC;YAChD,WAAW,EAAE,gJAAgJ;YAC7J,WAAW,EAAE,aAAa;YAC1B,cAAc,EAAE,iKAAiK;YACjL,SAAS,EAAE,+BAA+B;SAC3C,CAAC,CAAC;IACL,CAAC;IAED,6BAA6B;IAC7B,MAAM,eAAe,GAAG,gEAAgE,CAAC;IACzF,MAAM,YAAY,GAAG,cAAc,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;IAC3D,MAAM,aAAa,GAAG,yEAAyE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3G,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;QAC9C,MAAM,gBAAgB,GAAG,+EAA+E,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpH,IAAI,gBAAgB,EAAE,CAAC;YACrB,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;gBACzD,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,0CAA0C;gBACjD,WAAW,EAAE,wJAAwJ;gBACrK,WAAW,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;gBACrC,cAAc,EAAE,kJAAkJ;gBAClK,SAAS,EAAE,uCAAuC;aACnD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/evaluators/dependency-health.d.ts

@@ -0,0 +1,3 @@
+import { Finding } from "../types.js";
+export declare function analyzeDependencyHealth(code: string, language: string): Finding[];
+//# sourceMappingURL=dependency-health.d.ts.map

package/dist/evaluators/dependency-health.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dependency-health.d.ts","sourceRoot":"","sources":["../../src/evaluators/dependency-health.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAGtC,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,EAAE,CA8MjF"}

package/dist/evaluators/dependency-health.js

@@ -0,0 +1,197 @@
+export function analyzeDependencyHealth(code, language) {
+    const findings = [];
+    const lines = code.split("\n");
+    const prefix = "DEPS";
+    let ruleNum = 1;
+    // Detect wildcard version ranges
+    const wildcardLines = [];
+    lines.forEach((line, i) => {
+        if (/["']\s*\*\s*["']|["']\s*latest\s*["']/i.test(line) && /["']\w+["']\s*:/i.test(line)) {
+            wildcardLines.push(i + 1);
+        }
+    });
+    if (wildcardLines.length > 0) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "critical",
+            title: "Wildcard or 'latest' dependency version",
+            description: "Using '*' or 'latest' for dependency versions means any version can be installed, including ones with breaking changes or vulnerabilities.",
+            lineNumbers: wildcardLines,
+            recommendation: "Pin dependencies to specific versions or use caret (^) ranges at minimum. Use a lockfile (package-lock.json, yarn.lock).",
+            reference: "Dependency Management Best Practices",
+        });
+    }
+    // Detect importing from deprecated or risky packages
+    const riskyPkgLines = [];
+    const riskyPackages = /require\s*\(\s*["'](request|moment|underscore|bower|left-pad|event-stream)["']\)|from\s+["'](request|moment|underscore|bower|left-pad|event-stream)["']/i;
+    lines.forEach((line, i) => {
+        if (riskyPkgLines.length < 10 && riskyPackages.test(line)) {
+            riskyPkgLines.push(i + 1);
+        }
+    });
+    if (riskyPkgLines.length > 0) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "medium",
+            title: "Deprecated or unmaintained package import",
+            description: "Importing from packages that are deprecated, unmaintained, or have known supply chain issues.",
+            lineNumbers: riskyPkgLines,
+            recommendation: "Replace deprecated packages: moment->date-fns/luxon, request->node-fetch/axios, underscore->lodash-es or native methods.",
+            reference: "npm deprecation notices / package health scores",
+        });
+    }
+    // Detect excessive dependencies for simple tasks
+    const importLines = [];
+    lines.forEach((line, i) => {
+        if (/^import\s|^const\s.*=\s*require\s*\(/i.test(line.trim())) {
+            importLines.push(i + 1);
+        }
+    });
+    if (importLines.length > 20 && lines.length < 100) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "medium",
+            title: "High import-to-code ratio",
+            description: `File has ${importLines.length} imports but only ${lines.length} lines. This suggests over-reliance on external packages for simple tasks.`,
+            lineNumbers: importLines.slice(0, 5),
+            recommendation: "Evaluate whether all dependencies are necessary. Consider implementing simple utilities natively to reduce the dependency tree.",
+            reference: "Dependency Minimization / Supply Chain Security",
+        });
+    }
+    // Detect relative import depth issues
+    const deepImportLines = [];
+    lines.forEach((line, i) => {
+        if (/from\s+["']\.\.\/.+\.\.\/.+\.\.\//i.test(line) || /require\s*\(\s*["']\.\.\/.+\.\.\/.+\.\.\//i.test(line)) {
+            deepImportLines.push(i + 1);
+        }
+    });
+    if (deepImportLines.length > 0) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "low",
+            title: "Deeply nested relative imports",
+            description: "Imports with many '../' levels are fragile and hard to read. They break easily when files are moved.",
+            lineNumbers: deepImportLines,
+            recommendation: "Configure path aliases (tsconfig paths, webpack aliases, babel module resolver) for cleaner imports.",
+            reference: "TypeScript Path Mapping / Module Resolution",
+        });
+    }
+    // Detect multiple packages for same purpose (e.g., multiple HTTP clients)
+    const httpClients = new Set();
+    const httpClientLines = [];
+    lines.forEach((line, i) => {
+        const clients = ["axios", "node-fetch", "got", "request", "superagent", "undici"];
+        for (const client of clients) {
+            if (new RegExp(`["']${client}["']`).test(line)) {
+                httpClients.add(client);
+                httpClientLines.push(i + 1);
+            }
+        }
+    });
+    if (httpClients.size > 1) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "medium",
+            title: "Multiple HTTP client libraries detected",
+            description: `Found ${httpClients.size} different HTTP client libraries (${[...httpClients].join(", ")}). This inflates bundle size and creates inconsistency.`,
+            lineNumbers: httpClientLines,
+            recommendation: "Standardize on a single HTTP client library across the project. Wrap it in an abstraction if needed.",
+            reference: "Dependency Consolidation",
+        });
+    }
+    // Detect too-broad version ranges
+    const broadVersionLines = [];
+    lines.forEach((line, i) => {
+        if (/["']\s*>=?\s*\d/i.test(line) && /["']\w+["']\s*:/i.test(line)) {
+            broadVersionLines.push(i + 1);
+        }
+    });
+    if (broadVersionLines.length > 0) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "medium",
+            title: "Overly broad dependency version range",
+            description: "Using >= version ranges allows major version upgrades that may include breaking changes.",
+            lineNumbers: broadVersionLines,
+            recommendation: "Use caret (^) for minor updates or tilde (~) for patch updates. Avoid >= ranges in production dependencies.",
+            reference: "Semantic Versioning / npm Version Ranges",
+        });
+    }
+    // Detect missing lockfile indicators
+    const isPackageJson = /["']name["']\s*:\s*["']|["']version["']\s*:\s*["']\d/i.test(code);
+    if (isPackageJson) {
+        const hasEngines = /["']engines["']\s*:/i.test(code);
+        if (!hasEngines) {
+            findings.push({
+                ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+                severity: "low",
+                title: "Missing engines field in package.json",
+                description: "No engines field specifying required Node.js version. Different Node versions may have incompatible behavior.",
+                recommendation: "Add an 'engines' field to specify minimum Node.js and npm versions: \"engines\": { \"node\": \">=18.0.0\" }.",
+                reference: "package.json engines field",
+            });
+        }
+    }
+    // Detect importing specific vs barrel imports
+    const barrelImportLines = [];
+    lines.forEach((line, i) => {
+        if (/import\s+\{[^}]{100,}\}\s+from/i.test(line)) {
+            barrelImportLines.push(i + 1);
+        }
+        if (/import\s+\*\s+as\s+\w+\s+from\s+["'](?!.*node_modules)/i.test(line)) {
+            barrelImportLines.push(i + 1);
+        }
+    });
+    if (barrelImportLines.length > 0) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "low",
+            title: "Barrel imports may prevent tree-shaking",
+            description: "Importing everything from a barrel file or using 'import *' can prevent tree-shaking and increase bundle size.",
+            lineNumbers: barrelImportLines,
+            recommendation: "Import directly from specific module files instead of barrel/index files for better tree-shaking.",
+            reference: "Tree Shaking / Module Bundling",
+        });
+    }
+    // Detect dev dependencies in production code paths
+    const devDepLines = [];
+    lines.forEach((line, i) => {
+        if (/require\s*\(\s*["'](?:jest|mocha|chai|sinon|enzyme|@testing-library|nyc|istanbul|prettier|eslint)["']\)/i.test(line)) {
+            // Check if this is not a test file
+            if (!/\.test\.|\.spec\.|__tests__|__mocks__/i.test(code.slice(0, 50))) {
+                devDepLines.push(i + 1);
+            }
+        }
+    });
+    if (devDepLines.length > 0) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "medium",
+            title: "Dev dependency imported in production code",
+            description: "Test/dev dependencies are imported in what appears to be production code, which will fail if devDependencies aren't installed.",
+            lineNumbers: devDepLines,
+            recommendation: "Move test imports to test files. Ensure devDependencies are only used in test/config files.",
+            reference: "npm devDependencies vs dependencies",
+        });
+    }
+    // Detect packages with known supply chain risks
+    const supplyChainLines = [];
+    lines.forEach((line, i) => {
+        if (/postinstall|preinstall|install.*script/i.test(line) && /["']scripts["']/i.test(lines.slice(Math.max(0, i - 5), i).join("\n"))) {
+            supplyChainLines.push(i + 1);
+        }
+    });
+    if (supplyChainLines.length > 0) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "high",
+            title: "Install lifecycle scripts detected",
+            description: "postinstall/preinstall scripts can execute arbitrary code and are a common supply chain attack vector.",
+            lineNumbers: supplyChainLines,
+            recommendation: "Audit install scripts carefully. Use --ignore-scripts flag and allowlists. Consider using npm audit signatures.",
+            reference: "Supply Chain Security / npm install scripts",
+        });
+    }
+    return findings;
+}
+//# sourceMappingURL=dependency-health.js.map

package/dist/evaluators/dependency-health.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dependency-health.js","sourceRoot":"","sources":["../../src/evaluators/dependency-health.ts"],"names":[],"mappings":"AAGA,MAAM,UAAU,uBAAuB,CAAC,IAAY,EAAE,QAAgB;IACpE,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,MAAM,GAAG,MAAM,CAAC;IACtB,IAAI,OAAO,GAAG,CAAC,CAAC;IAEhB,iCAAiC;IACjC,MAAM,aAAa,GAAa,EAAE,CAAC;IACnC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QACxB,IAAI,wCAAwC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACzF,aAAa,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC,CAAC,CAAC;IACH,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,UAAU;YACpB,KAAK,EAAE,yCAAyC;YAChD,WAAW,EAAE,4IAA4I;YACzJ,WAAW,EAAE,aAAa;YAC1B,cAAc,EAAE,0HAA0H;YAC1I,SAAS,EAAE,sCAAsC;SAClD,CAAC,CAAC;IACL,CAAC;IAED,qDAAqD;IACrD,MAAM,aAAa,GAAa,EAAE,CAAC;IACnC,MAAM,aAAa,GAAG,0JAA0J,CAAC;IACjL,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QACxB,IAAI,aAAa,CAAC,MAAM,GAAG,EAAE,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1D,aAAa,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC,CAAC,CAAC;IACH,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,2CAA2C;YAClD,WAAW,EAAE,+FAA+F;YAC5G,WAAW,EAAE,aAAa;YAC1B,cAAc,EAAE,0HAA0H;YAC1I,SAAS,EAAE,iDAAiD;SAC7D,CAAC,CAAC;IACL,CAAC;IAED,iDAAiD;IACjD,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QACxB,IAAI,uCAAuC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAC9D,WAAW,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC,CAAC,CAAC;IACH,IAAI,WAAW,CAAC,MAAM,GAAG,EAAE,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QAClD,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,2BAA2B;YAClC,WAAW,EAAE,YAAY,WAAW,CAAC,MAAM,qBAAqB,KAAK,CAAC,MAAM,4EAA4E;YACxJ,WAAW,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;YACpC,cAAc,EAAE,iIAAiI;YACjJ,SAAS,EAAE,iDAAiD;SAC7D,CAAC,CAAC;IACL,CAAC;IAED,sCAAsC;IACtC,MAAM,eAAe,GAAa,EAAE,CAAC;IACrC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QACxB,IAAI,oCAAoC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,4CAA4C,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/G,eAAe,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC,CAAC,CAAC;IACH,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,KAAK;YACf,KAAK,EAAE,gCAAgC;YACvC,WAAW,EAAE,sGAAsG;YACnH,WAAW,EAAE,eAAe;YAC5B,cAAc,EAAE,sGAAsG;YACtH,SAAS,EAAE,6CAA6C;SACzD,CAAC,CAAC;IACL,CAAC;IAED,0EAA0E;IAC1E,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,MAAM,eAAe,GAAa,EAAE,CAAC;IACrC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QACxB,MAAM,OAAO,GAAG,CAAC,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;QAClF,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,IAAI,MAAM,CAAC,OAAO,MAAM,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC/C,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBACxB,eAAe,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IACH,IAAI,WAAW,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACzB,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,yCAAyC;YAChD,WAAW,EAAE,SAAS,WAAW,CAAC,IAAI,qCAAqC,CAAC,GAAG,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,yDAAyD;YAC/J,WAAW,EAAE,eAAe;YAC5B,cAAc,EAAE,sGAAsG;YACtH,SAAS,EAAE,0BAA0B;SACtC,CAAC,CAAC;IACL,CAAC;IAED,kCAAkC;IAClC,MAAM,iBAAiB,GAAa,EAAE,CAAC;IACvC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QACxB,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACnE,iBAAiB,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAChC,CAAC;IACH,CAAC,CAAC,CAAC;IACH,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,uCAAuC;YAC9C,WAAW,EAAE,0FAA0F;YACvG,WAAW,EAAE,iBAAiB;YAC9B,cAAc,EAAE,6GAA6G;YAC7H,SAAS,EAAE,0CAA0C;SACtD,CAAC,CAAC;IACL,CAAC;IAED,qCAAqC;IACrC,MAAM,aAAa,GAAG,uDAAuD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzF,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,UAAU,GAAG,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;gBACzD,QAAQ,EAAE,KAAK;gBACf,KAAK,EAAE,uCAAuC;gBAC9C,WAAW,EAAE,+GAA+G;gBAC5H,cAAc,EAAE,8GAA8G;gBAC9H,SAAS,EAAE,4BAA4B;aACxC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,8CAA8C;IAC9C,MAAM,iBAAiB,GAAa,EAAE,CAAC;IACvC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QACxB,IAAI,iCAAiC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACjD,iBAAiB,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAChC,CAAC;QACD,IAAI,yDAAyD,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACzE,iBAAiB,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAChC,CAAC;IACH,CAAC,CAAC,CAAC;IACH,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,KAAK;YACf,KAAK,EAAE,yCAAyC;YAChD,WAAW,EAAE,gHAAgH;YAC7H,WAAW,EAAE,iBAAiB;YAC9B,cAAc,EAAE,mGAAmG;YACnH,SAAS,EAAE,gCAAgC;SAC5C,CAAC,CAAC;IACL,CAAC;IAED,mDAAmD;IACnD,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QACxB,IAAI,0GAA0G,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1H,mCAAmC;YACnC,IAAI,CAAC,wCAAwC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC;gBACtE,WAAW,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IACH,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,4CAA4C;YACnD,WAAW,EAAE,gIAAgI;YAC7I,WAAW,EAAE,WAAW;YACxB,cAAc,EAAE,6FAA6F;YAC7G,SAAS,EAAE,qCAAqC;SACjD,CAAC,CAAC;IACL,CAAC;IAED,gDAAgD;IAChD,MAAM,gBAAgB,GAAa,EAAE,CAAC;IACtC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QACxB,IAAI,yCAAyC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACnI,gBAAgB,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC,CAAC,CAAC;IACH,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,oCAAoC;YAC3C,WAAW,EAAE,wGAAwG;YACrH,WAAW,EAAE,gBAAgB;YAC7B,cAAc,EAAE,iHAAiH;YACjI,SAAS,EAAE,6CAA6C;SACzD,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/evaluators/documentation.d.ts

@@ -0,0 +1,3 @@
+import { Finding } from "../types.js";
+export declare function analyzeDocumentation(code: string, language: string): Finding[];
+//# sourceMappingURL=documentation.d.ts.map

package/dist/evaluators/documentation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"documentation.d.ts","sourceRoot":"","sources":["../../src/evaluators/documentation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAGtC,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,EAAE,CAgO9E"}