@lateos/npm-scan 1.0.0 → 1.1.0

package/backend/tests-d6c.test.js

@@ -8,7 +8,7 @@ describe('D6a — tier1-version-confusion', () => {
   test('D6a: exact sentinel 99.99.99 → HIGH, confidenceScore >= 80', async () => {
     const pkg = { name: 'internal-utils', version: '99.99.99' };
     const findings = await detectors.runAll(pkg);
-    const match = findings.find(f => f.id === 'TIER1-VERSION-CONFUSION');
+    const match = findings.find((f) => f.id === 'TIER1-VERSION-CONFUSION');
     assert(match, 'Expected TIER1-VERSION-CONFUSION finding');
     assert.equal(match.confidence, 'HIGH');
     assert(match.confidenceScore >= 80, `confidenceScore ${match.confidenceScore} < 80`);
@@ -17,7 +17,7 @@ describe('D6a — tier1-version-confusion', () => {
   test('D6a: exact sentinel 9.9.9 → MEDIUM, confidenceScore >= 60', async () => {
     const pkg = { name: 'corp-auth', version: '9.9.9' };
     const findings = await detectors.runAll(pkg);
-    const match = findings.find(f => f.id === 'TIER1-VERSION-CONFUSION');
+    const match = findings.find((f) => f.id === 'TIER1-VERSION-CONFUSION');
     assert(match, 'Expected TIER1-VERSION-CONFUSION finding');
     assert.equal(match.confidence, 'MEDIUM');
     assert(match.confidenceScore >= 60, `confidenceScore ${match.confidenceScore} < 60`);
@@ -26,7 +26,7 @@ describe('D6a — tier1-version-confusion', () => {
   test('D6a: high-version heuristic 99.5.8 → MEDIUM, confidenceScore >= 60', async () => {
     const pkg = { name: 'internal-payments', version: '99.5.8' };
     const findings = await detectors.runAll(pkg);
-    const match = findings.find(f => f.id === 'TIER1-VERSION-CONFUSION');
+    const match = findings.find((f) => f.id === 'TIER1-VERSION-CONFUSION');
     assert(match, 'Expected TIER1-VERSION-CONFUSION finding');
     assert.equal(match.confidence, 'MEDIUM');
     assert(match.confidenceScore >= 60, `confidenceScore ${match.confidenceScore} < 60`);
@@ -35,21 +35,21 @@ describe('D6a — tier1-version-confusion', () => {
   test('D6a: heuristic does not fire on legitimate high patch, e.g. 1.99.0', async () => {
     const pkg = { name: 'some-lib', version: '1.99.0' };
     const findings = await detectors.runAll(pkg);
-    const match = findings.find(f => f.id === 'TIER1-VERSION-CONFUSION');
+    const match = findings.find((f) => f.id === 'TIER1-VERSION-CONFUSION');
     assert(!match);
   });
 
   test('D6a: no finding on legitimate semver 4.17.21', async () => {
     const pkg = { name: 'lodash', version: '4.17.21' };
     const findings = await detectors.runAll(pkg);
-    const match = findings.find(f => f.id === 'TIER1-VERSION-CONFUSION');
+    const match = findings.find((f) => f.id === 'TIER1-VERSION-CONFUSION');
     assert(!match);
   });
 
   test('D6a: no finding on KNOWN_REPUTABLE_PACKAGES regardless of version', async () => {
     const pkg = { name: 'react', version: '99.99.99' };
     const findings = await detectors.runAll(pkg);
-    const match = findings.find(f => f.id === 'TIER1-VERSION-CONFUSION');
+    const match = findings.find((f) => f.id === 'TIER1-VERSION-CONFUSION');
     assert(!match);
   });
 });
@@ -58,18 +58,30 @@ describe('D6a — tier1-version-confusion', () => {
 
 describe('D6c — tier1-cloud-imds', () => {
   test('D6c: detects GCP metadata endpoint in JS file', async () => {
-    const jsFiles = [{ path: 'index.js', content: 'fetch("http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token")' }];
+    const jsFiles = [
+      {
+        path: 'index.js',
+        content:
+          'fetch("http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token")',
+      },
+    ];
     const findings = await detectors.runAll({ name: 'test-pkg' }, jsFiles);
-    const match = findings.find(f => f.id === 'TIER1-CLOUD-IMDS');
+    const match = findings.find((f) => f.id === 'TIER1-CLOUD-IMDS');
     assert(match, 'Expected TIER1-CLOUD-IMDS finding');
     assert.equal(match.confidence, 'HIGH');
     assert(match.confidenceScore >= 80, `confidenceScore ${match.confidenceScore} < 80`);
   });
 
   test('D6c: detects Azure IMDS endpoint in JS file', async () => {
-    const jsFiles = [{ path: 'app.js', content: 'axios.get("http://169.254.169.254/metadata/instance", { headers: { Metadata: "true" } })' }];
+    const jsFiles = [
+      {
+        path: 'app.js',
+        content:
+          'axios.get("http://169.254.169.254/metadata/instance", { headers: { Metadata: "true" } })',
+      },
+    ];
     const findings = await detectors.runAll({ name: 'test-pkg' }, jsFiles);
-    const match = findings.find(f => f.id === 'TIER1-CLOUD-IMDS');
+    const match = findings.find((f) => f.id === 'TIER1-CLOUD-IMDS');
     assert(match, 'Expected TIER1-CLOUD-IMDS finding');
     assert.equal(match.confidence, 'HIGH');
     assert(match.confidenceScore >= 80, `confidenceScore ${match.confidenceScore} < 80`);
@@ -80,11 +92,12 @@ describe('D6c — tier1-cloud-imds', () => {
       name: 'malicious-pkg',
       version: '1.0.0',
       scripts: {
-        postinstall: 'node -e "require(\\"http\\").get(\\"http://metadata.google.internal/computeMetadata/v1/\\")"',
+        postinstall:
+          'node -e "require(\\"http\\").get(\\"http://metadata.google.internal/computeMetadata/v1/\\")"',
       },
     };
     const findings = await detectors.runAll(pkg);
-    const match = findings.find(f => f.id === 'TIER1-CLOUD-IMDS');
+    const match = findings.find((f) => f.id === 'TIER1-CLOUD-IMDS');
     assert(match, 'Expected TIER1-CLOUD-IMDS finding');
     assert.equal(match.confidence, 'HIGH');
     assert(match.confidenceScore >= 80, `confidenceScore ${match.confidenceScore} < 80`);
@@ -93,14 +106,14 @@ describe('D6c — tier1-cloud-imds', () => {
   test('D6c: no finding on clean JS with no IMDS patterns', async () => {
     const jsFiles = [{ path: 'clean.js', content: 'const x = 1 + 1;' }];
     const findings = await detectors.runAll({ name: 'test-pkg' }, jsFiles);
-    const match = findings.find(f => f.id === 'TIER1-CLOUD-IMDS');
+    const match = findings.find((f) => f.id === 'TIER1-CLOUD-IMDS');
     assert(!match);
   });
 
   test('D6c: no finding when 169.254.169.254 appears without /metadata path', async () => {
     const jsFiles = [{ path: 'docs.js', content: '// link-local range starts at 169.254.0.0' }];
     const findings = await detectors.runAll({ name: 'test-pkg' }, jsFiles);
-    const match = findings.find(f => f.id === 'TIER1-CLOUD-IMDS');
+    const match = findings.find((f) => f.id === 'TIER1-CLOUD-IMDS');
     assert(!match);
   });
 });

package/backend/tests-d7-obfuscation.test.js

@@ -4,29 +4,27 @@ import * as detectors from './detectors/index.js';
 
 describe('D7: Obfuscation Heuristics', () => {
   test('D7: flags heavily obfuscated postinstall script', async () => {
-    const obfuscated =
-      `var _0x=["eval","fromCharCode","charCodeAt"];for(var i=0;i<999;i++){var x=String.fromCharCode(i);if(i>500){eval(atob("Y29uc3QgeCA9ICdtYWxpY2lvdXMnO2V2YWwoeCk7Y29uc3QgeSA9ICdiYWNrZG9vcic7ZXZhbCh5KTs="))}}var _0xe="\\x65\\x76\\x61\\x6c\\x28\\x61\\x74\\x6f\\x62\\x28\\x22\\x59\\x6d\\x39\\x75\\x62\\x47\\x38\\x67"`;
+    const obfuscated = `var _0x=["eval","fromCharCode","charCodeAt"];for(var i=0;i<999;i++){var x=String.fromCharCode(i);if(i>500){eval(atob("Y29uc3QgeCA9ICdtYWxpY2lvdXMnO2V2YWwoeCk7Y29uc3QgeSA9ICdiYWNrZG9vcic7ZXZhbCh5KTs="))}}var _0xe="\\x65\\x76\\x61\\x6c\\x28\\x61\\x74\\x6f\\x62\\x28\\x22\\x59\\x6d\\x39\\x75\\x62\\x47\\x38\\x67"`;
     const pkg = {
       name: 'malicious-pkg',
       version: '1.0.0',
       scripts: { postinstall: obfuscated },
     };
     const findings = await detectors.runAll(pkg);
-    const match = findings.find(f => f.id === 'TIER1-OBFUSCATION-HEURISTICS');
+    const match = findings.find((f) => f.id === 'TIER1-OBFUSCATION-HEURISTICS');
     assert(match, 'Expected TIER1-OBFUSCATION-HEURISTICS finding');
     assert(match.confidenceScore >= 75, `confidenceScore ${match.confidenceScore} < 75`);
   });
 
   test('D7: detects XOR cipher pattern in preinstall script', async () => {
-    const xorCode =
-      `var _0xk=[0x66,0x6c,0x61,0x67];var _0xd="LzdHJKdUp4VWt5S292RXBsb3Zlck5pZ2h0U2VjcmV0S2V5Rm9yRW50cm9weUJvb3N0";let r='';for(let i=0;i<str.length;i++){r+=String.fromCharCode(str.charCodeAt(i)^_0xk[i%4]);if(i>50){eval(atob("RGV0ZWN0ZWQ="))}}`;
+    const xorCode = `var _0xk=[0x66,0x6c,0x61,0x67];var _0xd="LzdHJKdUp4VWt5S292RXBsb3Zlck5pZ2h0U2VjcmV0S2V5Rm9yRW50cm9weUJvb3N0";let r='';for(let i=0;i<str.length;i++){r+=String.fromCharCode(str.charCodeAt(i)^_0xk[i%4]);if(i>50){eval(atob("RGV0ZWN0ZWQ="))}}`;
     const pkg = {
       name: 'suspicious-pkg',
       version: '1.0.0',
       scripts: { preinstall: xorCode },
     };
     const findings = await detectors.runAll(pkg);
-    const match = findings.find(f => f.id === 'TIER1-OBFUSCATION-HEURISTICS');
+    const match = findings.find((f) => f.id === 'TIER1-OBFUSCATION-HEURISTICS');
     assert(match, 'Expected TIER1-OBFUSCATION-HEURISTICS finding');
     assert(match.confidenceScore >= 70, `confidenceScore ${match.confidenceScore} < 70`);
   });
@@ -43,20 +41,19 @@ describe('D7: Obfuscation Heuristics', () => {
       scripts: { postinstall: normalCode },
     };
     const findings = await detectors.runAll(pkg);
-    const match = findings.find(f => f.id === 'TIER1-OBFUSCATION-HEURISTICS');
+    const match = findings.find((f) => f.id === 'TIER1-OBFUSCATION-HEURISTICS');
     assert(!match, 'Should not flag normal palindrome function');
   });
 
   test('D7: flags high entropy in postinstall script', async () => {
-    const highEntropyCode =
-      `var x="T3NobmFJc0VudHJvcHlCb29zdGVkV2l0aEJhc2U2NFBheWxvYWRUaGF0U2hvdWxkQmVQbGVudHlPZkNoYXJhY3RlcnNGb3JIaWdoRW50cm9weVNjb3JlQW5kSXRTaG91bGRCZU9mVmVyeUhpZ2hRdWFsaXR5VG9NYWtlVGhlVGVzdFBhc3NBbmRJdFNob3VsZEJlT2ZNaXhlZENhc2VXaXRoTnVtYmVyc0FuZFNwZWNpYWxDaGFyYWN0ZXJzRm9yTWF4RW50cm9weQ==";`;
+    const highEntropyCode = `var x="T3NobmFJc0VudHJvcHlCb29zdGVkV2l0aEJhc2U2NFBheWxvYWRUaGF0U2hvdWxkQmVQbGVudHlPZkNoYXJhY3RlcnNGb3JIaWdoRW50cm9weVNjb3JlQW5kSXRTaG91bGRCZU9mVmVyeUhpZ2hRdWFsaXR5VG9NYWtlVGhlVGVzdFBhc3NBbmRJdFNob3VsZEJlT2ZNaXhlZENhc2VXaXRoTnVtYmVyc0FuZFNwZWNpYWxDaGFyYWN0ZXJzRm9yTWF4RW50cm9weQ==";`;
     const pkg = {
       name: 'high-entropy-pkg',
       version: '1.0.0',
       scripts: { postinstall: highEntropyCode },
     };
     const findings = await detectors.runAll(pkg);
-    const match = findings.find(f => f.id === 'TIER1-OBFUSCATION-HEURISTICS');
+    const match = findings.find((f) => f.id === 'TIER1-OBFUSCATION-HEURISTICS');
     assert(match, 'Expected TIER1-OBFUSCATION-HEURISTICS finding');
     assert(match.confidenceScore >= 55, `confidenceScore ${match.confidenceScore} < 55`);
   });
@@ -74,7 +71,7 @@ describe('D7: Obfuscation Heuristics', () => {
       scripts: { postinstall: cleanCode },
     };
     const findings = await detectors.runAll(pkg);
-    const match = findings.find(f => f.id === 'TIER1-OBFUSCATION-HEURISTICS');
+    const match = findings.find((f) => f.id === 'TIER1-OBFUSCATION-HEURISTICS');
     assert(!match, 'Should not flag clean build script');
   });
 
@@ -85,7 +82,7 @@ describe('D7: Obfuscation Heuristics', () => {
       scripts: { postinstall: 'eval(atob("dmFyIHg9J21hbGljaW91cyc7"))' },
     };
     const findings = await detectors.runAll(pkg);
-    const match = findings.find(f => f.id === 'TIER1-OBFUSCATION-HEURISTICS');
+    const match = findings.find((f) => f.id === 'TIER1-OBFUSCATION-HEURISTICS');
     assert(!match);
   });
 });