@lateos/npm-scan 0.18.2 → 1.0.0

package/backend/detectors/megalodon/d4-publisher-drift.js

@@ -1,124 +1,124 @@
-import { MegalodonSignal } from './types.js';
-
-export async function scan(registryMeta, velocityResult) {
-  const evidence = [];
-  const versions = registryMeta?.versions || {};
-  const timeMap = registryMeta?.time || {};
-
-  const filteredTimes = {};
-  for (const [v, t] of Object.entries(timeMap)) {
-    if (v === 'created' || v === 'modified') continue;
-    if (t) filteredTimes[v] = t;
-  }
-
-  const sortedVersions = Object.entries(filteredTimes)
-    .filter(([, t]) => t && !Number.isNaN(new Date(t).getTime()))
-    .sort((a, b) => new Date(a[1]).getTime() - new Date(b[1]).getTime())
-    .map(([v]) => v);
-
-  if (sortedVersions.length === 0) return [];
-
-  if (velocityResult?.triggered) {
-    const windowStartISO = velocityResult.windowStartISO;
-    const allInWindow = velocityResult._allVersions || [];
-
-    const priorPublishers = new Set();
-    for (const v of sortedVersions) {
-      if (new Date(filteredTimes[v]).getTime() >= new Date(windowStartISO).getTime()) break;
-      const user = versions[v]?._npmUser?.name;
-      if (user) priorPublishers.add(user);
-    }
-
-    if (priorPublishers.size === 0 && allInWindow.length > 0) {
-      const firstUser = versions[allInWindow[0]]?._npmUser?.name;
-      if (firstUser) priorPublishers.add(firstUser);
-    }
-
-    const suspiciousPublishers = [];
-    const affectedVersions = [];
-    for (const v of allInWindow) {
-      const user = versions[v]?._npmUser?.name;
-      if (user && !priorPublishers.has(user)) {
-        if (!suspiciousPublishers.includes(user)) suspiciousPublishers.push(user);
-        if (!affectedVersions.includes(v)) affectedVersions.push(v);
-      }
-    }
-
-    if (suspiciousPublishers.length > 0) {
-      const detail = `Drift detected: known publishers [${[...priorPublishers].join(', ')}], new publisher(s) [${suspiciousPublishers.join(', ')}] in versions [${affectedVersions.join(', ')}]`;
-
-      const firstSuspiciousVer = allInWindow.find(v => affectedVersions.includes(v));
-      let ageNote = '';
-      if (firstSuspiciousVer && suspiciousPublishers[0]) {
-        ageNote = await checkAccountAge(suspiciousPublishers[0], filteredTimes[firstSuspiciousVer]);
-      }
-
-      evidence.push({
-        signal: MegalodonSignal.PUBLISHER_DRIFT,
-        file: 'registry.npmjs.org',
-        excerpt: `publisher drift: ${suspiciousPublishers.join(', ')}`,
-        detail: detail + (ageNote ? ' | ' + ageNote : ''),
-        _severityHint: 'HIGH',
-      });
-    }
-  } else {
-    if (sortedVersions.length < 4) return [];
-
-    const last3 = sortedVersions.slice(-3);
-    const prior = sortedVersions.slice(0, -3);
-
-    const priorPublishers = new Set();
-    for (const v of prior) {
-      const user = versions[v]?._npmUser?.name;
-      if (user) priorPublishers.add(user);
-    }
-
-    const suspiciousPublishers = [];
-    const affectedVersions = [];
-    for (const v of last3) {
-      const user = versions[v]?._npmUser?.name;
-      if (user && !priorPublishers.has(user)) {
-        if (!suspiciousPublishers.includes(user)) suspiciousPublishers.push(user);
-        if (!affectedVersions.includes(v)) affectedVersions.push(v);
-      }
-    }
-
-    if (suspiciousPublishers.length > 0) {
-      const detail = `Drift (fallback): known publishers [${[...priorPublishers].join(', ')}], new publisher(s) [${suspiciousPublishers.join(', ')}] in last 3 versions [${affectedVersions.join(', ')}]`;
-
-      let ageNote = '';
-      if (suspiciousPublishers[0] && affectedVersions[0]) {
-        ageNote = await checkAccountAge(suspiciousPublishers[0], filteredTimes[affectedVersions[0]]);
-      }
-
-      evidence.push({
-        signal: MegalodonSignal.PUBLISHER_DRIFT,
-        file: 'registry.npmjs.org',
-        excerpt: `publisher drift: ${suspiciousPublishers.join(', ')}`,
-        detail: detail + (ageNote ? ' | ' + ageNote : ''),
-        _severityHint: 'MEDIUM',
-      });
-    }
-  }
-
-  return evidence;
-}
-
-async function checkAccountAge(npmUser, firstSuspiciousTime) {
-  try {
-    const url = `https://registry.npmjs.org/-/user/org.couchdb.user/${encodeURIComponent(npmUser)}`;
-    const res = await fetch(url);
-    if (!res.ok) return '';
-    const data = await res.json();
-    const created = data?.date;
-    if (!created) return '';
-    const createdDate = new Date(created).getTime();
-    const firstPub = new Date(firstSuspiciousTime).getTime();
-    const daysDiff = (firstPub - createdDate) / (1000 * 60 * 60 * 24);
-    if (!Number.isNaN(daysDiff) && daysDiff >= 0 && daysDiff <= 30) {
-      return `Publisher account created ${Math.round(daysDiff)} days before first suspicious publish`;
-    }
-  } catch {
-  }
-  return '';
-}
+import { MegalodonSignal } from './types.js';
+
+export async function scan(registryMeta, velocityResult) {
+  const evidence = [];
+  const versions = registryMeta?.versions || {};
+  const timeMap = registryMeta?.time || {};
+
+  const filteredTimes = {};
+  for (const [v, t] of Object.entries(timeMap)) {
+    if (v === 'created' || v === 'modified') continue;
+    if (t) filteredTimes[v] = t;
+  }
+
+  const sortedVersions = Object.entries(filteredTimes)
+    .filter(([, t]) => t && !Number.isNaN(new Date(t).getTime()))
+    .sort((a, b) => new Date(a[1]).getTime() - new Date(b[1]).getTime())
+    .map(([v]) => v);
+
+  if (sortedVersions.length === 0) return [];
+
+  if (velocityResult?.triggered) {
+    const windowStartISO = velocityResult.windowStartISO;
+    const allInWindow = velocityResult._allVersions || [];
+
+    const priorPublishers = new Set();
+    for (const v of sortedVersions) {
+      if (new Date(filteredTimes[v]).getTime() >= new Date(windowStartISO).getTime()) break;
+      const user = versions[v]?._npmUser?.name;
+      if (user) priorPublishers.add(user);
+    }
+
+    if (priorPublishers.size === 0 && allInWindow.length > 0) {
+      const firstUser = versions[allInWindow[0]]?._npmUser?.name;
+      if (firstUser) priorPublishers.add(firstUser);
+    }
+
+    const suspiciousPublishers = [];
+    const affectedVersions = [];
+    for (const v of allInWindow) {
+      const user = versions[v]?._npmUser?.name;
+      if (user && !priorPublishers.has(user)) {
+        if (!suspiciousPublishers.includes(user)) suspiciousPublishers.push(user);
+        if (!affectedVersions.includes(v)) affectedVersions.push(v);
+      }
+    }
+
+    if (suspiciousPublishers.length > 0) {
+      const detail = `Drift detected: known publishers [${[...priorPublishers].join(', ')}], new publisher(s) [${suspiciousPublishers.join(', ')}] in versions [${affectedVersions.join(', ')}]`;
+
+      const firstSuspiciousVer = allInWindow.find(v => affectedVersions.includes(v));
+      let ageNote = '';
+      if (firstSuspiciousVer && suspiciousPublishers[0]) {
+        ageNote = await checkAccountAge(suspiciousPublishers[0], filteredTimes[firstSuspiciousVer]);
+      }
+
+      evidence.push({
+        signal: MegalodonSignal.PUBLISHER_DRIFT,
+        file: 'registry.npmjs.org',
+        excerpt: `publisher drift: ${suspiciousPublishers.join(', ')}`,
+        detail: detail + (ageNote ? ' | ' + ageNote : ''),
+        _severityHint: 'HIGH',
+      });
+    }
+  } else {
+    if (sortedVersions.length < 4) return [];
+
+    const last3 = sortedVersions.slice(-3);
+    const prior = sortedVersions.slice(0, -3);
+
+    const priorPublishers = new Set();
+    for (const v of prior) {
+      const user = versions[v]?._npmUser?.name;
+      if (user) priorPublishers.add(user);
+    }
+
+    const suspiciousPublishers = [];
+    const affectedVersions = [];
+    for (const v of last3) {
+      const user = versions[v]?._npmUser?.name;
+      if (user && !priorPublishers.has(user)) {
+        if (!suspiciousPublishers.includes(user)) suspiciousPublishers.push(user);
+        if (!affectedVersions.includes(v)) affectedVersions.push(v);
+      }
+    }
+
+    if (suspiciousPublishers.length > 0) {
+      const detail = `Drift (fallback): known publishers [${[...priorPublishers].join(', ')}], new publisher(s) [${suspiciousPublishers.join(', ')}] in last 3 versions [${affectedVersions.join(', ')}]`;
+
+      let ageNote = '';
+      if (suspiciousPublishers[0] && affectedVersions[0]) {
+        ageNote = await checkAccountAge(suspiciousPublishers[0], filteredTimes[affectedVersions[0]]);
+      }
+
+      evidence.push({
+        signal: MegalodonSignal.PUBLISHER_DRIFT,
+        file: 'registry.npmjs.org',
+        excerpt: `publisher drift: ${suspiciousPublishers.join(', ')}`,
+        detail: detail + (ageNote ? ' | ' + ageNote : ''),
+        _severityHint: 'MEDIUM',
+      });
+    }
+  }
+
+  return evidence;
+}
+
+async function checkAccountAge(npmUser, firstSuspiciousTime) {
+  try {
+    const url = `https://registry.npmjs.org/-/user/org.couchdb.user/${encodeURIComponent(npmUser)}`;
+    const res = await fetch(url);
+    if (!res.ok) return '';
+    const data = await res.json();
+    const created = data?.date;
+    if (!created) return '';
+    const createdDate = new Date(created).getTime();
+    const firstPub = new Date(firstSuspiciousTime).getTime();
+    const daysDiff = (firstPub - createdDate) / (1000 * 60 * 60 * 24);
+    if (!Number.isNaN(daysDiff) && daysDiff >= 0 && daysDiff <= 30) {
+      return `Publisher account created ${Math.round(daysDiff)} days before first suspicious publish`;
+    }
+  } catch {
+  }
+  return '';
+}

package/backend/detectors/megalodon/d5-bot-commit-identity.js

@@ -1,3 +1,3 @@
-export async function scan(registryMeta) {
-  return [];
-}
+export async function scan(registryMeta) {
+  return [];
+}

package/backend/detectors/megalodon/d6-date-anachronism.js

@@ -1,3 +1,3 @@
-export async function scan(pkgJson, registryMeta) {
-  return [];
-}
+export async function scan(pkgJson, registryMeta) {
+  return [];
+}

package/backend/detectors/megalodon/index.js

@@ -1,80 +1,80 @@
-import { MegalodonSignal } from './types.js';
-import { scan as scanD1 } from './d1-workflow-scan.js';
-import { scan as scanD2 } from './d2-credential-harvest.js';
-import { scan as scanD3 } from './d3-publish-velocity.js';
-import { scan as scanD4 } from './d4-publisher-drift.js';
-import { scan as scanD5 } from './d5-bot-commit-identity.js';
-import { scan as scanD6 } from './d6-date-anachronism.js';
-
-const SIGNAL_SEVERITY = {
-  [MegalodonSignal.WORKFLOW_C2_EXFIL]: 5,
-  [MegalodonSignal.WORKFLOW_DECODE_CHAIN]: 4,
-  [MegalodonSignal.PUBLISH_VELOCITY]: 4,
-  [MegalodonSignal.PUBLISHER_DRIFT]: 4,
-  [MegalodonSignal.CREDENTIAL_HARVEST]: 3,
-  [MegalodonSignal.BOT_COMMIT_IDENTITY]: 2,
-  [MegalodonSignal.DATE_ANACHRONISM]: 2,
-};
-
-const SEVERITY_LABELS = ['none', 'low', 'medium', 'high', 'critical', 'critical'];
-
-function resolveSeverity(signals, d4Evidence) {
-  let maxScore = 0;
-  for (const s of signals) {
-    maxScore = Math.max(maxScore, SIGNAL_SEVERITY[s] || 0);
-  }
-
-  const d4Hint = d4Evidence.find(e => e._severityHint);
-  if (d4Hint) {
-    const hintScore = d4Hint._severityHint === 'HIGH' ? 4 : d4Hint._severityHint === 'MEDIUM' ? 3 : 0;
-    maxScore = Math.max(maxScore, hintScore);
-  }
-
-  return SEVERITY_LABELS[maxScore] || 'none';
-}
-
-export async function scanAll(pkgJson, allFiles = [], registryMeta = {}) {
-  const allEvidence = [];
-
-  const d1Ev = await scanD1(allFiles);
-  allEvidence.push(...d1Ev);
-
-  const d2Ev = await scanD2(allFiles);
-  allEvidence.push(...d2Ev);
-
-  const d3Ev = await scanD3(registryMeta);
-  allEvidence.push(...d3Ev);
-
-  const velocityResult = d3Ev.length > 0 ? {
-    triggered: true,
-    windowStartISO: d3Ev[0]._windowStartISO || null,
-    versionsInWindow: d3Ev[0].excerpt || '',
-    _allVersions: d3Ev[0]._allVersions || [],
-  } : { triggered: false, versionsInWindow: [], windowStartISO: null };
-
-  const d4Ev = await scanD4(registryMeta, velocityResult);
-  allEvidence.push(...d4Ev);
-
-  allEvidence.push(...await scanD5(registryMeta));
-  allEvidence.push(...await scanD6(pkgJson, registryMeta));
-
-  const signals = [...new Set(allEvidence.map(e => e.signal).filter(Boolean))];
-
-  if (signals.length === 0) return [];
-
-  const severity = resolveSeverity(signals, d4Ev);
-
-  const cleaned = allEvidence.map(({ _windowStartISO, _allVersions, _severityHint, ...rest }) => rest);
-
-  return [{
-    id: 'MEGALODON',
-    severity,
-    title: 'Megalodon CI/CD attack campaign',
-    description: `${signals.length} signal(s): ${signals.join(', ')}`,
-    evidence: JSON.stringify({
-      campaign: 'MEGALODON',
-      signals,
-      evidence: cleaned,
-    }),
-  }];
-}
+import { MegalodonSignal } from './types.js';
+import { scan as scanD1 } from './d1-workflow-scan.js';
+import { scan as scanD2 } from './d2-credential-harvest.js';
+import { scan as scanD3 } from './d3-publish-velocity.js';
+import { scan as scanD4 } from './d4-publisher-drift.js';
+import { scan as scanD5 } from './d5-bot-commit-identity.js';
+import { scan as scanD6 } from './d6-date-anachronism.js';
+
+const SIGNAL_SEVERITY = {
+  [MegalodonSignal.WORKFLOW_C2_EXFIL]: 5,
+  [MegalodonSignal.WORKFLOW_DECODE_CHAIN]: 4,
+  [MegalodonSignal.PUBLISH_VELOCITY]: 4,
+  [MegalodonSignal.PUBLISHER_DRIFT]: 4,
+  [MegalodonSignal.CREDENTIAL_HARVEST]: 3,
+  [MegalodonSignal.BOT_COMMIT_IDENTITY]: 2,
+  [MegalodonSignal.DATE_ANACHRONISM]: 2,
+};
+
+const SEVERITY_LABELS = ['none', 'low', 'medium', 'high', 'critical', 'critical'];
+
+function resolveSeverity(signals, d4Evidence) {
+  let maxScore = 0;
+  for (const s of signals) {
+    maxScore = Math.max(maxScore, SIGNAL_SEVERITY[s] || 0);
+  }
+
+  const d4Hint = d4Evidence.find(e => e._severityHint);
+  if (d4Hint) {
+    const hintScore = d4Hint._severityHint === 'HIGH' ? 4 : d4Hint._severityHint === 'MEDIUM' ? 3 : 0;
+    maxScore = Math.max(maxScore, hintScore);
+  }
+
+  return SEVERITY_LABELS[maxScore] || 'none';
+}
+
+export async function scanAll(pkgJson, allFiles = [], registryMeta = {}) {
+  const allEvidence = [];
+
+  const d1Ev = await scanD1(allFiles);
+  allEvidence.push(...d1Ev);
+
+  const d2Ev = await scanD2(allFiles);
+  allEvidence.push(...d2Ev);
+
+  const d3Ev = await scanD3(registryMeta);
+  allEvidence.push(...d3Ev);
+
+  const velocityResult = d3Ev.length > 0 ? {
+    triggered: true,
+    windowStartISO: d3Ev[0]._windowStartISO || null,
+    versionsInWindow: d3Ev[0].excerpt || '',
+    _allVersions: d3Ev[0]._allVersions || [],
+  } : { triggered: false, versionsInWindow: [], windowStartISO: null };
+
+  const d4Ev = await scanD4(registryMeta, velocityResult);
+  allEvidence.push(...d4Ev);
+
+  allEvidence.push(...await scanD5(registryMeta));
+  allEvidence.push(...await scanD6(pkgJson, registryMeta));
+
+  const signals = [...new Set(allEvidence.map(e => e.signal).filter(Boolean))];
+
+  if (signals.length === 0) return [];
+
+  const severity = resolveSeverity(signals, d4Ev);
+
+  const cleaned = allEvidence.map(({ _windowStartISO, _allVersions, _severityHint, ...rest }) => rest);
+
+  return [{
+    id: 'MEGALODON',
+    severity,
+    title: 'Megalodon CI/CD attack campaign',
+    description: `${signals.length} signal(s): ${signals.join(', ')}`,
+    evidence: JSON.stringify({
+      campaign: 'MEGALODON',
+      signals,
+      evidence: cleaned,
+    }),
+  }];
+}

package/backend/detectors/megalodon/types.js

@@ -1,9 +1,9 @@
-export const MegalodonSignal = Object.freeze({
-  WORKFLOW_C2_EXFIL: 'D1_WORKFLOW_C2_EXFIL',
-  WORKFLOW_DECODE_CHAIN: 'D1_WORKFLOW_DECODE_CHAIN',
-  CREDENTIAL_HARVEST: 'D2_CREDENTIAL_HARVEST',
-  PUBLISH_VELOCITY: 'D3_PUBLISH_VELOCITY',
-  PUBLISHER_DRIFT: 'D4_PUBLISHER_DRIFT',
-  BOT_COMMIT_IDENTITY: 'D5_BOT_COMMIT_IDENTITY',
-  DATE_ANACHRONISM: 'D6_DATE_ANACHRONISM',
-});
+export const MegalodonSignal = Object.freeze({
+  WORKFLOW_C2_EXFIL: 'D1_WORKFLOW_C2_EXFIL',
+  WORKFLOW_DECODE_CHAIN: 'D1_WORKFLOW_DECODE_CHAIN',
+  CREDENTIAL_HARVEST: 'D2_CREDENTIAL_HARVEST',
+  PUBLISH_VELOCITY: 'D3_PUBLISH_VELOCITY',
+  PUBLISHER_DRIFT: 'D4_PUBLISHER_DRIFT',
+  BOT_COMMIT_IDENTITY: 'D5_BOT_COMMIT_IDENTITY',
+  DATE_ANACHRONISM: 'D6_DATE_ANACHRONISM',
+});

package/backend/detectors/mini-shai-hulud/d1-burst-publish.js

@@ -1,42 +1,42 @@
-export async function checkBurstPublish(registryMeta, config = {}) {
-  const windowMinutes = config.burstWindowMinutes ?? 30;
-  const threshold = config.burstVersionThreshold ?? 3;
-
-  const times = registryMeta?.time || {};
-  const entries = Object.entries(times)
-    .filter(([v]) => v !== 'created' && v !== 'modified')
-    .filter(([, t]) => t)
-    .map(([v, t]) => [v, new Date(t).getTime()])
-    .filter(([, ts]) => !Number.isNaN(ts))
-    .sort((a, b) => a[1] - b[1]);
-
-  if (entries.length === 0) return { triggered: false };
-
-  const windowMs = windowMinutes * 60 * 1000;
-
-  for (let i = 0; i < entries.length; i++) {
-    const windowStart = entries[i][1];
-    const windowEnd = windowStart + windowMs;
-    const inWindow = [];
-
-    for (let j = i; j < entries.length; j++) {
-      if (entries[j][1] <= windowEnd) {
-        inWindow.push(entries[j][0]);
-      } else {
-        break;
-      }
-    }
-
-    if (inWindow.length >= threshold) {
-      return {
-        triggered: true,
-        windowStart: new Date(windowStart).toISOString(),
-        windowEnd: new Date(windowEnd).toISOString(),
-        versionCount: inWindow.length,
-        versions: inWindow,
-      };
-    }
-  }
-
-  return { triggered: false };
-}
+export async function checkBurstPublish(registryMeta, config = {}) {
+  const windowMinutes = config.burstWindowMinutes ?? 30;
+  const threshold = config.burstVersionThreshold ?? 3;
+
+  const times = registryMeta?.time || {};
+  const entries = Object.entries(times)
+    .filter(([v]) => v !== 'created' && v !== 'modified')
+    .filter(([, t]) => t)
+    .map(([v, t]) => [v, new Date(t).getTime()])
+    .filter(([, ts]) => !Number.isNaN(ts))
+    .sort((a, b) => a[1] - b[1]);
+
+  if (entries.length === 0) return { triggered: false };
+
+  const windowMs = windowMinutes * 60 * 1000;
+
+  for (let i = 0; i < entries.length; i++) {
+    const windowStart = entries[i][1];
+    const windowEnd = windowStart + windowMs;
+    const inWindow = [];
+
+    for (let j = i; j < entries.length; j++) {
+      if (entries[j][1] <= windowEnd) {
+        inWindow.push(entries[j][0]);
+      } else {
+        break;
+      }
+    }
+
+    if (inWindow.length >= threshold) {
+      return {
+        triggered: true,
+        windowStart: new Date(windowStart).toISOString(),
+        windowEnd: new Date(windowEnd).toISOString(),
+        versionCount: inWindow.length,
+        versions: inWindow,
+      };
+    }
+  }
+
+  return { triggered: false };
+}