@lateos/npm-scan 0.18.3 → 1.1.0

package/backend/detectors/tier1-typosquat.js

@@ -3,38 +3,54 @@ import { KNOWN_REPUTABLE_PACKAGES } from '../policy.js';
 
 const require = createRequire(import.meta.url);
 const TOP_PACKAGES = require('../../src/config/top-5000.json');
-const TOP_SET = new Set(TOP_PACKAGES);
+const _TOP_SET = new Set(TOP_PACKAGES);
 
 function levenshtein(a, b) {
-  if (Math.abs(a.length - b.length) > 2) return 3;
-  const m = a.length, n = b.length;
-  if (m === 0) return n;
-  if (n === 0) return m;
+  if (Math.abs(a.length - b.length) > 2) {
+    return 3;
+  }
+  const m = a.length,
+    n = b.length;
+  if (m === 0) {
+    return n;
+  }
+  if (n === 0) {
+    return m;
+  }
   let prev = new Int32Array(n + 1);
   let curr = new Int32Array(n + 1);
-  for (let j = 0; j <= n; j++) prev[j] = j;
+  for (let j = 0; j <= n; j++) {
+    prev[j] = j;
+  }
   for (let i = 1; i <= m; i++) {
     curr[0] = i;
     let rowMin = curr[0];
     for (let j = 1; j <= n; j++) {
       const cost = a[i - 1] === b[j - 1] ? 0 : 1;
-      curr[j] = Math.min(
-        prev[j] + 1,
-        curr[j - 1] + 1,
-        prev[j - 1] + cost
-      );
-      if (curr[j] < rowMin) rowMin = curr[j];
+      curr[j] = Math.min(prev[j] + 1, curr[j - 1] + 1, prev[j - 1] + cost);
+      if (curr[j] < rowMin) {
+        rowMin = curr[j];
+      }
     }
-    if (rowMin > 2) return 3;
-    const tmp = prev; prev = curr; curr = tmp;
+    if (rowMin > 2) {
+      return 3;
+    }
+    const tmp = prev;
+    prev = curr;
+    curr = tmp;
   }
   return prev[n];
 }
 
 function jaroWinkler(a, b) {
-  if (a === b) return 1;
-  const m = a.length, n = b.length;
-  if (m === 0 || n === 0) return 0;
+  if (a === b) {
+    return 1;
+  }
+  const m = a.length,
+    n = b.length;
+  if (m === 0 || n === 0) {
+    return 0;
+  }
   const matchDist = Math.floor(Math.max(m, n) / 2) - 1;
   const aMatch = new Array(m).fill(false);
   const bMatch = new Array(n).fill(false);
@@ -43,36 +59,53 @@ function jaroWinkler(a, b) {
     const start = Math.max(0, i - matchDist);
     const end = Math.min(n, i + matchDist + 1);
     for (let j = start; j < end; j++) {
-      if (bMatch[j] || a[i] !== b[j]) continue;
+      if (bMatch[j] || a[i] !== b[j]) {
+        continue;
+      }
       aMatch[i] = true;
       bMatch[j] = true;
       matches++;
       break;
     }
   }
-  if (matches === 0) return 0;
-  let t = 0, k = 0;
+  if (matches === 0) {
+    return 0;
+  }
+  let t = 0,
+    k = 0;
   for (let i = 0; i < m; i++) {
-    if (!aMatch[i]) continue;
-    while (!bMatch[k]) k++;
-    if (a[i] !== b[k]) t++;
+    if (!aMatch[i]) {
+      continue;
+    }
+    while (!bMatch[k]) {
+      k++;
+    }
+    if (a[i] !== b[k]) {
+      t++;
+    }
     k++;
   }
   const jaro = (matches / m + matches / n + (matches - t / 2) / matches) / 3;
   let prefix = 0;
   const limit = Math.min(4, m, n);
   for (let i = 0; i < limit; i++) {
-    if (a[i] === b[i]) prefix++;
-    else break;
+    if (a[i] === b[i]) {
+      prefix++;
+    } else {
+      break;
+    }
   }
   return jaro + prefix * 0.1 * (1 - jaro);
 }
 
-function soundex(s) {
-  if (!s) return '';
+function _soundex(s) {
+  if (!s) {
+    return '';
+  }
   s = s.toLowerCase();
   const first = s[0];
-  const rest = s.slice(1)
+  const rest = s
+    .slice(1)
     .replace(/[aeiouyhw]/g, '')
     .replace(/[bfpv]/g, '1')
     .replace(/[cgjkqsxz]/g, '2')
@@ -85,15 +118,22 @@ function soundex(s) {
 }
 
 function homoglyphScore(a, b) {
-  if (a.length !== b.length) return 0;
-  const map = { '0': 'o', '1': 'l', '3': 'e', '4': 'a', '5': 's', '6': 'g', '7': 't', '8': 'b', '@': 'a' };
+  if (a.length !== b.length) {
+    return 0;
+  }
+  const map = { 0: 'o', 1: 'l', 3: 'e', 4: 'a', 5: 's', 6: 'g', 7: 't', 8: 'b', '@': 'a' };
   let swaps = 0;
   for (let i = 0; i < a.length; i++) {
-    if (a[i] === b[i]) continue;
+    if (a[i] === b[i]) {
+      continue;
+    }
     const na = map[a[i]] || a[i];
     const nb = map[b[i]] || b[i];
-    if (na === b[i] || a[i] === nb || na === nb) swaps++;
-    else return 0;
+    if (na === b[i] || a[i] === nb || na === nb) {
+      swaps++;
+    } else {
+      return 0;
+    }
   }
   return swaps > 0 ? 1 - swaps / a.length : 0;
 }
@@ -119,34 +159,52 @@ function computeConfidence(dist, phonetic, homoglyph, registryMeta) {
   if (registryMeta) {
     const age = registryMeta.age || 0;
     const downloads = registryMeta.weeklyDownloads || 0;
-    if (age < 30) score += 15;
-    if (downloads < 1000) score += 10;
-    if (age > 365 && downloads > 100000) score -= 30;
+    if (age < 30) {
+      score += 15;
+    }
+    if (downloads < 1000) {
+      score += 10;
+    }
+    if (age > 365 && downloads > 100000) {
+      score -= 30;
+    }
   }
   score = Math.max(50, Math.min(100, score));
   return { subtype, score };
 }
 
 function severityLabel(score) {
-  if (score >= 80) return 'high';
-  if (score >= 60) return 'medium';
+  if (score >= 80) {
+    return 'high';
+  }
+  if (score >= 60) {
+    return 'medium';
+  }
   return 'low';
 }
 
 function confidenceLabel(score) {
-  if (score >= 80) return 'HIGH';
-  if (score >= 60) return 'MEDIUM';
+  if (score >= 80) {
+    return 'HIGH';
+  }
+  if (score >= 60) {
+    return 'MEDIUM';
+  }
   return 'LOW';
 }
 
 export const name = 'tier1-typosquat';
 
-export async function scan(pkgJson, jsFiles, registryMeta, allFiles) {
+export async function scan(pkgJson, jsFiles, registryMeta, _allFiles) {
   const findings = [];
   const pkgName = pkgJson?.name;
-  if (!pkgName) return findings;
+  if (!pkgName) {
+    return findings;
+  }
 
-  if (KNOWN_REPUTABLE_PACKAGES.has(pkgName)) return findings;
+  if (KNOWN_REPUTABLE_PACKAGES.has(pkgName)) {
+    return findings;
+  }
 
   const namesToCheck = [];
   let scopedName = null;
@@ -167,27 +225,48 @@ export async function scan(pkgJson, jsFiles, registryMeta, allFiles) {
   for (const checkName of namesToCheck) {
     for (const target of TOP_PACKAGES) {
       if (checkName === target) {
-        if (pkgName.startsWith('@') && checkName === scopedName && !KNOWN_REPUTABLE_PACKAGES.has(scopedName)) {
+        if (
+          pkgName.startsWith('@') &&
+          checkName === scopedName &&
+          !KNOWN_REPUTABLE_PACKAGES.has(scopedName)
+        ) {
           let score = 80;
           if (registryMeta) {
-            if ((registryMeta.age || 0) < 30) score += 15;
-            if ((registryMeta.weeklyDownloads || 0) < 1000) score += 10;
+            if ((registryMeta.age || 0) < 30) {
+              score += 15;
+            }
+            if ((registryMeta.weeklyDownloads || 0) < 1000) {
+              score += 10;
+            }
           }
           score = Math.max(50, Math.min(100, score));
           if (score > bestScore) {
             bestScore = score;
-            best = { target, dist: 0, phonetic: 1, homoglyph: 0, subtype: 'edit_distance_1', isScopeSquat: true };
+            best = {
+              target,
+              dist: 0,
+              phonetic: 1,
+              homoglyph: 0,
+              subtype: 'edit_distance_1',
+              isScopeSquat: true,
+            };
           }
         }
         continue;
       }
-      if (Math.abs(checkName.length - target.length) > 2) continue;
+      if (Math.abs(checkName.length - target.length) > 2) {
+        continue;
+      }
       const dist = levenshtein(checkName, target);
-      if (dist > 2) continue;
+      if (dist > 2) {
+        continue;
+      }
       const phonetic = jaroWinkler(checkName, target);
       const homoglyph = homoglyphScore(checkName, target);
       const conf = computeConfidence(dist, phonetic, homoglyph, registryMeta);
-      if (!conf || conf.score <= bestScore) continue;
+      if (!conf || conf.score <= bestScore) {
+        continue;
+      }
       bestScore = conf.score;
       best = { target, dist, phonetic, homoglyph, subtype: conf.subtype, isScopeSquat: false };
     }

package/backend/detectors/tier1-version-anomaly.js

@@ -0,0 +1,223 @@
+import { KNOWN_REPUTABLE_PACKAGES } from '../policy.js';
+
+const SENTINEL_PATTERNS = new Set(['99.99.99', '11.11.11', '10.10.10']);
+
+function parseVersion(v) {
+  if (!v || typeof v !== 'string') {
+    return null;
+  }
+  const parts = v.split('.');
+  if (parts.length !== 3) {
+    return null;
+  }
+  const [major, minor, patch] = parts.map(Number);
+  if (isNaN(major) || isNaN(minor) || isNaN(patch)) {
+    return null;
+  }
+  return { major, minor, patch, full: v };
+}
+
+function versionScore(v) {
+  return v.major * 10000 + v.minor * 100 + v.patch;
+}
+
+function extractVersions(registryMeta) {
+  if (Array.isArray(registryMeta)) {
+    return registryMeta.map((v) => parseVersion(v)).filter(Boolean);
+  }
+  if (registryMeta && typeof registryMeta === 'object') {
+    const versions = registryMeta.versions || registryMeta.time;
+    if (versions && typeof versions === 'object') {
+      return Object.keys(versions)
+        .map((v) => parseVersion(v))
+        .filter(Boolean);
+    }
+  }
+  return [];
+}
+
+function computeStats(scores) {
+  if (scores.length < 2) {
+    return null;
+  }
+  const mean = scores.reduce((s, v) => s + v, 0) / scores.length;
+  const variance = scores.reduce((s, v) => s + (v - mean) ** 2, 0) / scores.length;
+  const stddev = Math.sqrt(variance);
+  return { mean, stddev, max: Math.max(...scores), min: Math.min(...scores) };
+}
+
+export function analyzeAnomaly(packageName, versionStr, versionHistory) {
+  const current = parseVersion(versionStr);
+  if (!current) {
+    return null;
+  }
+
+  const historical = extractVersions(versionHistory);
+  const currentScore = versionScore(current);
+  const isSentinel = SENTINEL_PATTERNS.has(versionStr);
+
+  if (!historical || historical.length < 2) {
+    if (isSentinel) {
+      return {
+        flagged: true,
+        confidenceScore: 60,
+        confidence: 'MEDIUM',
+        zScore: null,
+        baselineMax: 'unknown',
+        baselineMean: 'unknown',
+        reason: `Version ${versionStr} matches known dependency confusion pattern (no registry data to confirm)`,
+        attackPattern: 'SENTINEL_PATTERN_ONLY',
+      };
+    }
+    return null;
+  }
+
+  const scores = historical.map(versionScore).sort((a, b) => a - b);
+  const recentScores = scores.slice(-50);
+  if (recentScores.length < 2) {
+    if (isSentinel) {
+      return {
+        flagged: true,
+        confidenceScore: 60,
+        confidence: 'MEDIUM',
+        zScore: null,
+        baselineMax: 'unknown',
+        baselineMean: 'unknown',
+        reason: `Version ${versionStr} matches known dependency confusion pattern (insufficient history)`,
+        attackPattern: 'SENTINEL_PATTERN_ONLY',
+      };
+    }
+    return null;
+  }
+
+  const stats = computeStats(recentScores);
+  if (!stats) {
+    return null;
+  }
+
+  const zScore = stats.stddev > 0 ? (currentScore - stats.mean) / stats.stddev : 0;
+  const baselineMaxVer = historical.find((v) => versionScore(v) === stats.max)?.full || 'unknown';
+  const baselineMeanVal = (stats.mean / 10000).toFixed(1);
+  const prevMaxMajor = Math.floor(stats.max / 10000);
+  const isNormalMajorBump =
+    current.major === prevMaxMajor + 1 && current.minor === 0 && current.patch === 0;
+  const isReasonableVersion =
+    current.major <= prevMaxMajor + 2 && current.major >= Math.floor(stats.min / 10000);
+  const ratio = stats.max > 0 ? currentScore / stats.max : 0;
+
+  let flagged = false;
+  let confidenceScore = 0;
+  let attackPattern = '';
+  let reason = '';
+
+  if (isSentinel) {
+    flagged = true;
+    confidenceScore = 92;
+    attackPattern = 'DEPENDENCY_CONFUSION_HIGH_VERSION';
+    reason = `Version ${versionStr} matches known dependency confusion sentinel pattern; z-score ${zScore.toFixed(1)} vs baseline mean ${baselineMeanVal}`;
+  } else if (zScore > 10 && !isNormalMajorBump) {
+    flagged = true;
+    confidenceScore = 90;
+    attackPattern = 'Z_SCORE_EXTREME';
+    reason = `Version ${versionStr} has z-score ${zScore.toFixed(1)} vs baseline mean ${baselineMeanVal} — extreme anomaly`;
+  } else if (zScore > 5 && !isNormalMajorBump) {
+    flagged = true;
+    confidenceScore = 85;
+    attackPattern = 'Z_SCORE_ANOMALY';
+    reason = `Version ${versionStr} has z-score ${zScore.toFixed(1)} vs baseline mean ${baselineMeanVal} — strong anomaly`;
+  } else if (zScore > 3 && !isNormalMajorBump) {
+    flagged = true;
+    confidenceScore = 72;
+    attackPattern = 'Z_SCORE_ELEVATED';
+    reason = `Version ${versionStr} has z-score ${zScore.toFixed(1)} vs baseline mean ${baselineMeanVal} — elevated anomaly`;
+  } else if (ratio > 10 && !isNormalMajorBump) {
+    flagged = true;
+    confidenceScore = 75;
+    attackPattern = 'MAJOR_VERSION_JUMP';
+    reason = `Version ${versionStr} exceeds max historical version (${baselineMaxVer}) by factor of ${ratio.toFixed(1)}`;
+  } else if (zScore > 2 && !isReasonableVersion) {
+    flagged = true;
+    confidenceScore = 55;
+    attackPattern = 'SUSPICIOUS_VERSION';
+    reason = `Version ${versionStr} has z-score ${zScore.toFixed(1)} and is outside expected version range`;
+  }
+
+  if (!flagged) {
+    return null;
+  }
+
+  return {
+    flagged,
+    confidenceScore: Math.min(100, confidenceScore),
+    confidence: confidenceScore >= 80 ? 'HIGH' : confidenceScore >= 60 ? 'MEDIUM' : 'LOW',
+    zScore: Math.round(zScore * 10) / 10,
+    baselineMax: baselineMaxVer,
+    baselineMean: baselineMeanVal,
+    reason,
+    attackPattern,
+  };
+}
+
+function severityLabel(sc) {
+  if (sc >= 90) {
+    return 'critical';
+  }
+  if (sc >= 70) {
+    return 'high';
+  }
+  if (sc >= 50) {
+    return 'medium';
+  }
+  return 'low';
+}
+
+function confidenceLabel(sc) {
+  if (sc >= 80) {
+    return 'HIGH';
+  }
+  if (sc >= 60) {
+    return 'MEDIUM';
+  }
+  return 'LOW';
+}
+
+export const name = 'tier1-version-anomaly';
+
+export async function scan(pkgJson, jsFiles, registryMeta, _allFiles) {
+  const pkgName = pkgJson?.name;
+  const version = pkgJson?.version;
+
+  if (!pkgName || !version) {
+    return [];
+  }
+  if (pkgName && KNOWN_REPUTABLE_PACKAGES.has(pkgName)) {
+    return [];
+  }
+
+  const result = analyzeAnomaly(pkgName, version, registryMeta);
+  if (!result) {
+    return [];
+  }
+
+  return [
+    {
+      detector: 'tier1-version-anomaly',
+      id: 'TIER1-VERSION-ANOMALY',
+      severity: severityLabel(result.confidenceScore),
+      confidence: confidenceLabel(result.confidenceScore),
+      confidenceScore: result.confidenceScore,
+      subtype: result.attackPattern.toLowerCase(),
+      message: `Version anomaly detected in "${pkgName}": ${result.reason}`,
+      evidence: [
+        `version: ${version}`,
+        `baseline_max: ${result.baselineMax}`,
+        `baseline_mean: ${result.baselineMean}`,
+        `z_score: ${result.zScore ?? 'N/A'}`,
+        `attack_pattern: ${result.attackPattern}`,
+      ],
+      crossFiles: [],
+      locations: [{ file: 'package.json', line: 3, column: 10 }],
+      reference: '176-package dependency confusion campaign',
+    },
+  ];
+}

package/backend/detectors/tier1-version-confusion.js

@@ -4,23 +4,37 @@ const SENTINEL_EXACT = ['99.99.99'];
 const SENTINEL_FAMILY = ['9.9.9', '9.9.10', '10.10.10', '11.11.11'];
 
 function severityLabel(score) {
-  if (score >= 80) return 'high';
-  if (score >= 60) return 'medium';
+  if (score >= 80) {
+    return 'high';
+  }
+  if (score >= 60) {
+    return 'medium';
+  }
   return 'low';
 }
 
 function confidenceLabel(score) {
-  if (score >= 80) return 'HIGH';
-  if (score >= 60) return 'MEDIUM';
+  if (score >= 80) {
+    return 'HIGH';
+  }
+  if (score >= 60) {
+    return 'MEDIUM';
+  }
   return 'LOW';
 }
 
 function parseVersion(version) {
-  if (!version || typeof version !== 'string') return null;
+  if (!version || typeof version !== 'string') {
+    return null;
+  }
   const parts = version.split('.');
-  if (parts.length !== 3) return null;
+  if (parts.length !== 3) {
+    return null;
+  }
   const [major, minor, patch] = parts.map(Number);
-  if (isNaN(major) || isNaN(minor) || isNaN(patch)) return null;
+  if (isNaN(major) || isNaN(minor) || isNaN(patch)) {
+    return null;
+  }
   return { major, minor, patch };
 }
 
@@ -30,77 +44,83 @@ function matchesHeuristic(parsed) {
 
 export const name = 'tier1-version-confusion';
 
-export async function scan(pkgJson, jsFiles, registryMeta, allFiles) {
+export async function scan(pkgJson, _jsFiles, _registryMeta, _allFiles) {
   const pkgName = pkgJson?.name;
   const version = pkgJson?.version;
 
-  if (!pkgName || !version) return [];
-  if (KNOWN_REPUTABLE_PACKAGES.has(pkgName)) return [];
+  if (!pkgName || !version) {
+    return [];
+  }
+  if (KNOWN_REPUTABLE_PACKAGES.has(pkgName)) {
+    return [];
+  }
 
   const parsed = parseVersion(version);
-  if (!parsed) return [];
+  if (!parsed) {
+    return [];
+  }
 
   const vStr = version;
 
   // Priority: SENTINEL_EXACT > SENTINEL_FAMILY > HEURISTIC
   if (SENTINEL_EXACT.includes(vStr)) {
     const score = 85;
-    return [{
-      detector: 'tier1-version-confusion',
-      id: 'TIER1-VERSION-CONFUSION',
-      severity: severityLabel(score),
-      confidence: confidenceLabel(score),
-      confidenceScore: score,
-      subtype: 'sentinel_exact',
-      message: `Package "${pkgName}" uses exact sentinel version ${vStr} — dependency confusion indicator`,
-      evidence: [
-        `version: ${vStr}`,
-        `sentinel: exact match`,
-      ],
-      crossFiles: [],
-      locations: [{ file: 'package.json', line: 3, column: 10 }],
-      reference: 'Sonatype-2026-003429',
-    }];
+    return [
+      {
+        detector: 'tier1-version-confusion',
+        id: 'TIER1-VERSION-CONFUSION',
+        severity: severityLabel(score),
+        confidence: confidenceLabel(score),
+        confidenceScore: score,
+        subtype: 'sentinel_exact',
+        message: `Package "${pkgName}" uses exact sentinel version ${vStr} — dependency confusion indicator`,
+        evidence: [`version: ${vStr}`, `sentinel: exact match`],
+        crossFiles: [],
+        locations: [{ file: 'package.json', line: 3, column: 10 }],
+        reference: 'Sonatype-2026-003429',
+      },
+    ];
   }
 
   if (SENTINEL_FAMILY.includes(vStr)) {
     const score = 65;
-    return [{
-      detector: 'tier1-version-confusion',
-      id: 'TIER1-VERSION-CONFUSION',
-      severity: severityLabel(score),
-      confidence: confidenceLabel(score),
-      confidenceScore: score,
-      subtype: 'sentinel_family',
-      message: `Package "${pkgName}" uses sentinel family version ${vStr} — dependency confusion indicator`,
-      evidence: [
-        `version: ${vStr}`,
-        `sentinel: family match`,
-      ],
-      crossFiles: [],
-      locations: [{ file: 'package.json', line: 3, column: 10 }],
-      reference: 'Sonatype-2026-003429',
-    }];
+    return [
+      {
+        detector: 'tier1-version-confusion',
+        id: 'TIER1-VERSION-CONFUSION',
+        severity: severityLabel(score),
+        confidence: confidenceLabel(score),
+        confidenceScore: score,
+        subtype: 'sentinel_family',
+        message: `Package "${pkgName}" uses sentinel family version ${vStr} — dependency confusion indicator`,
+        evidence: [`version: ${vStr}`, `sentinel: family match`],
+        crossFiles: [],
+        locations: [{ file: 'package.json', line: 3, column: 10 }],
+        reference: 'Sonatype-2026-003429',
+      },
+    ];
   }
 
   if (matchesHeuristic(parsed)) {
     const score = 62;
-    return [{
-      detector: 'tier1-version-confusion',
-      id: 'TIER1-VERSION-CONFUSION',
-      severity: severityLabel(score),
-      confidence: confidenceLabel(score),
-      confidenceScore: score,
-      subtype: 'high_version_heuristic',
-      message: `Package "${pkgName}" version ${vStr} matches high-version heuristic — possible dependency confusion`,
-      evidence: [
-        `version: ${vStr}`,
-        `major: ${parsed.major}, minor: ${parsed.minor}, patch: ${parsed.patch}`,
-      ],
-      crossFiles: [],
-      locations: [{ file: 'package.json', line: 3, column: 10 }],
-      reference: 'Microsoft Scope Confusion',
-    }];
+    return [
+      {
+        detector: 'tier1-version-confusion',
+        id: 'TIER1-VERSION-CONFUSION',
+        severity: severityLabel(score),
+        confidence: confidenceLabel(score),
+        confidenceScore: score,
+        subtype: 'high_version_heuristic',
+        message: `Package "${pkgName}" version ${vStr} matches high-version heuristic — possible dependency confusion`,
+        evidence: [
+          `version: ${vStr}`,
+          `major: ${parsed.major}, minor: ${parsed.minor}, patch: ${parsed.patch}`,
+        ],
+        crossFiles: [],
+        locations: [{ file: 'package.json', line: 3, column: 10 }],
+        reference: 'Microsoft Scope Confusion',
+      },
+    ];
   }
 
   return [];