@lateos/npm-scan 1.2.0 → 1.2.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.de.md +3 -98
- package/README.fr.md +3 -98
- package/README.ja.md +3 -98
- package/README.md +741 -864
- package/README.zh.md +3 -98
- package/backend/detectors/config/thresholds.js +56 -0
- package/backend/detectors/index.js +11 -0
- package/backend/detectors/tier1-build-config-abuse.js +264 -0
- package/package.json +1 -1
package/README.de.md
CHANGED
|
@@ -9,8 +9,8 @@
|
|
|
9
9
|
[](https://www.npmjs.com/package/@lateos/npm-scan)
|
|
10
10
|
[](LICENSING.md)
|
|
11
11
|
[](package.json)
|
|
12
|
-
[](https://github.com/lateos-ai/npm-scan)
|
|
13
|
+
[](https://github.com/lateos-ai/npm-scan)
|
|
14
14
|
[](https://hub.docker.com/r/lateos/npm-scan)
|
|
15
15
|
[](https://github.com/lateos-ai/npm-scan/actions/workflows/publish.yml)
|
|
16
16
|
|
|
@@ -485,102 +485,6 @@ npm-scan report --html > report.html
|
|
|
485
485
|
|
|
486
486
|
### Docker
|
|
487
487
|
|
|
488
|
-
Siehe den obigen [Docker-Schnellstart-Abschnitt](#-lateosnpm-scan-überall-mit-docker-ausführen--keine-installation) für Pull-Befehle, Compose-Pipeline und Multi-Arch-Images.
|
|
489
|
-
|
|
490
|
-
Scannen Sie die `package-lock.json` Ihres Projekts bei jedem PR — erkennt Typosquatting, obfuskierte Payloads, Credential-Stealer und Wurmverbreitung, bevor sie die Produktion erreichen:
|
|
491
|
-
|
|
492
|
-
```yaml
|
|
493
|
-
# .github/workflows/scan.yml
|
|
494
|
-
name: npm-scan
|
|
495
|
-
on:
|
|
496
|
-
pull_request:
|
|
497
|
-
paths:
|
|
498
|
-
- 'package-lock.json'
|
|
499
|
-
- '**/package.json'
|
|
500
|
-
jobs:
|
|
501
|
-
scan:
|
|
502
|
-
runs-on: ubuntu-latest
|
|
503
|
-
steps:
|
|
504
|
-
- uses: actions/checkout@v4
|
|
505
|
-
- uses: actions/setup-node@v4
|
|
506
|
-
with:
|
|
507
|
-
node-version: 20
|
|
508
|
-
- name: Scan lockfile
|
|
509
|
-
uses: lateos/npm-scan@v1
|
|
510
|
-
with:
|
|
511
|
-
scan-type: lockfile
|
|
512
|
-
fail-on: high
|
|
513
|
-
```
|
|
514
|
-
|
|
515
|
-
#### Action-Eingaben
|
|
516
|
-
|
|
517
|
-
| Eingabe | Standard | Beschreibung |
|
|
518
|
-
|-------|---------|-------------|
|
|
519
|
-
| `scan-type` | `lockfile` | `lockfile` zum Scannen von `package-lock.json` oder `package` zum Scannen eines bestimmten npm-Pakets |
|
|
520
|
-
| `package` | — | Paketname (erforderlich bei `scan-type=package`) |
|
|
521
|
-
| `fail-on` | `high` | Workflow bei diesem Schweregrad-Schwellwert fehlschlagen lassen: `none`, `low`, `medium`, `high`, `critical` |
|
|
522
|
-
| `policy-file` | — | Pfad zu einer YAML/JSON-Policy-Datei für Whitelists, Schweregrad-Überschreibungen und Unterdrückungen |
|
|
523
|
-
| `license-key` | — | Premium-Lizenzschlüssel für SIEM-Export und PDF-Berichte |
|
|
524
|
-
| `siem-format` | — | SIEM-Ausgabe: `cef`, `ecs`, `sentinel`, `qradar` (Premium) |
|
|
525
|
-
| `sbom-format` | — | SBOM-Ausgabe: `json`, `xml`, `spdx` |
|
|
526
|
-
|
|
527
|
-
#### Action-Ausgaben
|
|
528
|
-
|
|
529
|
-
| Ausgabe | Beschreibung |
|
|
530
|
-
|--------|-------------|
|
|
531
|
-
| `findings-count` | Anzahl der erkannten Ergebnisse |
|
|
532
|
-
| `scan-id` | Scan-ID für spätere Referenz in Berichten |
|
|
533
|
-
|
|
534
|
-
#### Beispiel: Bestimmtes Paket mit Policy + SBOM scannen
|
|
535
|
-
|
|
536
|
-
```yaml
|
|
537
|
-
- uses: lateos/npm-scan@v1
|
|
538
|
-
with:
|
|
539
|
-
scan-type: package
|
|
540
|
-
package: lodash
|
|
541
|
-
policy-file: .npm-scan.yml
|
|
542
|
-
sbom-format: spdx
|
|
543
|
-
fail-on: critical
|
|
544
|
-
```
|
|
545
|
-
|
|
546
|
-
#### Beispiel: Mit SIEM-Export scannen (Premium)
|
|
547
|
-
|
|
548
|
-
```yaml
|
|
549
|
-
- uses: lateos/npm-scan@v1
|
|
550
|
-
with:
|
|
551
|
-
scan-type: lockfile
|
|
552
|
-
siem-format: cef
|
|
553
|
-
license-key: ${{ secrets.NPM_SCAN_LICENSE_KEY }}
|
|
554
|
-
```
|
|
555
|
-
|
|
556
|
-
### CI/CD-Pipeline
|
|
557
|
-
|
|
558
|
-
Direkte Integration in Ihre bestehende Pipeline ohne die Composite-Action:
|
|
559
|
-
|
|
560
|
-
```bash
|
|
561
|
-
# Lock-Datei scannen, Build bei hohem Schweregrad fehlschlagen lassen
|
|
562
|
-
npm-scan scan-lockfile --policy .npm-scan.yml || exit 1
|
|
563
|
-
|
|
564
|
-
# Bestimmtes Paket scannen, nur bei kritisch fehlschlagen
|
|
565
|
-
npm-scan scan lodash --policy .npm-scan.yml || exit 1
|
|
566
|
-
|
|
567
|
-
# SBOM als Build-Artefakt generieren
|
|
568
|
-
npm-scan scan express --sbom spdx > express-sbom.spdx.json
|
|
569
|
-
|
|
570
|
-
# HTML-Compliance-Bericht in CI generieren
|
|
571
|
-
npm-scan report --html > report.html
|
|
572
|
-
|
|
573
|
-
# Bericht als Artefakt hochladen
|
|
574
|
-
# uses: actions/upload-artifact@v4
|
|
575
|
-
# with:
|
|
576
|
-
# name: npm-scan-report
|
|
577
|
-
# path: report.html
|
|
578
|
-
```
|
|
579
|
-
|
|
580
|
-
### Docker
|
|
581
|
-
|
|
582
|
-
Siehe den obigen [Docker-Schnellstart-Abschnitt](#-lateosnpm-scan-überall-mit-docker-ausführen--keine-installation) für Pull-Befehle, Compose-Pipeline und Multi-Arch-Images.
|
|
583
|
-
|
|
584
488
|
---
|
|
585
489
|
|
|
586
490
|
## 🗺️ Roadmap und Enterprise-Funktionen
|
|
@@ -706,4 +610,5 @@ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
|
706
610
|
|
|
707
611
|
```bash
|
|
708
612
|
npx @lateos/npm-scan scan lodash
|
|
613
|
+
```
|
|
709
614
|
```
|
package/README.fr.md
CHANGED
|
@@ -9,8 +9,8 @@
|
|
|
9
9
|
[](https://www.npmjs.com/package/@lateos/npm-scan)
|
|
10
10
|
[](LICENSING.md)
|
|
11
11
|
[](package.json)
|
|
12
|
-
[](https://github.com/lateos-ai/npm-scan)
|
|
13
|
+
[](https://github.com/lateos-ai/npm-scan)
|
|
14
14
|
[](https://hub.docker.com/r/lateos/npm-scan)
|
|
15
15
|
[](https://github.com/lateos-ai/npm-scan/actions/workflows/publish.yml)
|
|
16
16
|
|
|
@@ -485,102 +485,6 @@ npm-scan report --html > report.html
|
|
|
485
485
|
|
|
486
486
|
### Docker
|
|
487
487
|
|
|
488
|
-
Voir la [section Démarrage rapide Docker](#-exécutez-lateosnpm-scan-partout-avec-docker--zéro-installation) ci-dessus pour les commandes de tirage, le pipeline Compose et les images multi-arch.
|
|
489
|
-
|
|
490
|
-
Scannez le `package-lock.json` de votre projet à chaque PR — détecte les typosquattings, les charges utiles obfusquées, les voleurs d'identifiants et la propagation de ver avant qu'ils n'atteignent la production :
|
|
491
|
-
|
|
492
|
-
```yaml
|
|
493
|
-
# .github/workflows/scan.yml
|
|
494
|
-
name: npm-scan
|
|
495
|
-
on:
|
|
496
|
-
pull_request:
|
|
497
|
-
paths:
|
|
498
|
-
- 'package-lock.json'
|
|
499
|
-
- '**/package.json'
|
|
500
|
-
jobs:
|
|
501
|
-
scan:
|
|
502
|
-
runs-on: ubuntu-latest
|
|
503
|
-
steps:
|
|
504
|
-
- uses: actions/checkout@v4
|
|
505
|
-
- uses: actions/setup-node@v4
|
|
506
|
-
with:
|
|
507
|
-
node-version: 20
|
|
508
|
-
- name: Scan lockfile
|
|
509
|
-
uses: lateos/npm-scan@v1
|
|
510
|
-
with:
|
|
511
|
-
scan-type: lockfile
|
|
512
|
-
fail-on: high
|
|
513
|
-
```
|
|
514
|
-
|
|
515
|
-
#### Entrées de l'action
|
|
516
|
-
|
|
517
|
-
| Entrée | Défaut | Description |
|
|
518
|
-
|-------|---------|-------------|
|
|
519
|
-
| `scan-type` | `lockfile` | `lockfile` pour scanner `package-lock.json` ou `package` pour scanner un paquet npm spécifique |
|
|
520
|
-
| `package` | — | Nom du paquet (requis quand `scan-type=package`) |
|
|
521
|
-
| `fail-on` | `high` | Faire échouer le workflow à ce seuil de sévérité : `none`, `low`, `medium`, `high`, `critical` |
|
|
522
|
-
| `policy-file` | — | Chemin vers un fichier de politique YAML/JSON pour listes blanches, surcharges de sévérité et suppressions |
|
|
523
|
-
| `license-key` | — | Clé de licence premium pour l'export SIEM et les rapports PDF |
|
|
524
|
-
| `siem-format` | — | Sortie SIEM : `cef`, `ecs`, `sentinel`, `qradar` (premium) |
|
|
525
|
-
| `sbom-format` | — | Sortie SBOM : `json`, `xml`, `spdx` |
|
|
526
|
-
|
|
527
|
-
#### Sorties de l'action
|
|
528
|
-
|
|
529
|
-
| Sortie | Description |
|
|
530
|
-
|--------|-------------|
|
|
531
|
-
| `findings-count` | Nombre de résultats détectés |
|
|
532
|
-
| `scan-id` | ID du scan pour référence ultérieure dans les rapports |
|
|
533
|
-
|
|
534
|
-
#### Exemple : scanner un paquet spécifique avec politique + SBOM
|
|
535
|
-
|
|
536
|
-
```yaml
|
|
537
|
-
- uses: lateos/npm-scan@v1
|
|
538
|
-
with:
|
|
539
|
-
scan-type: package
|
|
540
|
-
package: lodash
|
|
541
|
-
policy-file: .npm-scan.yml
|
|
542
|
-
sbom-format: spdx
|
|
543
|
-
fail-on: critical
|
|
544
|
-
```
|
|
545
|
-
|
|
546
|
-
#### Exemple : scanner avec export SIEM (premium)
|
|
547
|
-
|
|
548
|
-
```yaml
|
|
549
|
-
- uses: lateos/npm-scan@v1
|
|
550
|
-
with:
|
|
551
|
-
scan-type: lockfile
|
|
552
|
-
siem-format: cef
|
|
553
|
-
license-key: ${{ secrets.NPM_SCAN_LICENSE_KEY }}
|
|
554
|
-
```
|
|
555
|
-
|
|
556
|
-
### Pipeline CI/CD
|
|
557
|
-
|
|
558
|
-
Intégrez directement dans votre pipeline existant sans l'action composite :
|
|
559
|
-
|
|
560
|
-
```bash
|
|
561
|
-
# Scanner le fichier de verrouillage, échouer le build en sévérité élevée
|
|
562
|
-
npm-scan scan-lockfile --policy .npm-scan.yml || exit 1
|
|
563
|
-
|
|
564
|
-
# Scanner un paquet spécifique, échouer seulement sur critique
|
|
565
|
-
npm-scan scan lodash --policy .npm-scan.yml || exit 1
|
|
566
|
-
|
|
567
|
-
# Générer un SBOM comme artefact de build
|
|
568
|
-
npm-scan scan express --sbom spdx > express-sbom.spdx.json
|
|
569
|
-
|
|
570
|
-
# Générer un rapport de conformité HTML dans le CI
|
|
571
|
-
npm-scan report --html > report.html
|
|
572
|
-
|
|
573
|
-
# Télécharger le rapport comme artefact
|
|
574
|
-
# uses: actions/upload-artifact@v4
|
|
575
|
-
# with:
|
|
576
|
-
# name: npm-scan-report
|
|
577
|
-
# path: report.html
|
|
578
|
-
```
|
|
579
|
-
|
|
580
|
-
### Docker
|
|
581
|
-
|
|
582
|
-
Voir la [section Démarrage rapide Docker](#-exécutez-lateosnpm-scan-partout-avec-docker--zéro-installation) ci-dessus pour les commandes de tirage, le pipeline Compose et les images multi-arch.
|
|
583
|
-
|
|
584
488
|
---
|
|
585
489
|
|
|
586
490
|
## 🗺️ Feuille de route et fonctionnalités Enterprise
|
|
@@ -706,4 +610,5 @@ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
|
706
610
|
|
|
707
611
|
```bash
|
|
708
612
|
npx @lateos/npm-scan scan lodash
|
|
613
|
+
```
|
|
709
614
|
```
|
package/README.ja.md
CHANGED
|
@@ -9,8 +9,8 @@
|
|
|
9
9
|
[](https://www.npmjs.com/package/@lateos/npm-scan)
|
|
10
10
|
[](LICENSING.md)
|
|
11
11
|
[](package.json)
|
|
12
|
-
[](https://github.com/lateos-ai/npm-scan)
|
|
13
|
+
[](https://github.com/lateos-ai/npm-scan)
|
|
14
14
|
[](https://hub.docker.com/r/lateos/npm-scan)
|
|
15
15
|
[](https://github.com/lateos-ai/npm-scan/actions/workflows/publish.yml)
|
|
16
16
|
|
|
@@ -481,102 +481,6 @@ npm-scan report --html > report.html
|
|
|
481
481
|
|
|
482
482
|
### Docker
|
|
483
483
|
|
|
484
|
-
上記の[Dockerクイックスタート](#-dockerでlateosnpm-scanをどこでも実行--インストール不要)セクションを参照してください。プルコマンド、Composeパイプライン、マルチアーキテクチャイメージについて説明しています。
|
|
485
|
-
|
|
486
|
-
すべてのPRでプロジェクトの`package-lock.json`をスキャン——タイポスクワッティング、難読化ペイロード、認証情報窃取ツール、ワーム伝播を本番環境に到達する前に検出：
|
|
487
|
-
|
|
488
|
-
```yaml
|
|
489
|
-
# .github/workflows/scan.yml
|
|
490
|
-
name: npm-scan
|
|
491
|
-
on:
|
|
492
|
-
pull_request:
|
|
493
|
-
paths:
|
|
494
|
-
- 'package-lock.json'
|
|
495
|
-
- '**/package.json'
|
|
496
|
-
jobs:
|
|
497
|
-
scan:
|
|
498
|
-
runs-on: ubuntu-latest
|
|
499
|
-
steps:
|
|
500
|
-
- uses: actions/checkout@v4
|
|
501
|
-
- uses: actions/setup-node@v4
|
|
502
|
-
with:
|
|
503
|
-
node-version: 20
|
|
504
|
-
- name: Scan lockfile
|
|
505
|
-
uses: lateos/npm-scan@v1
|
|
506
|
-
with:
|
|
507
|
-
scan-type: lockfile
|
|
508
|
-
fail-on: high
|
|
509
|
-
```
|
|
510
|
-
|
|
511
|
-
#### Action入力
|
|
512
|
-
|
|
513
|
-
| 入力 | デフォルト | 説明 |
|
|
514
|
-
|-------|---------|-------------|
|
|
515
|
-
| `scan-type` | `lockfile` | `lockfile`は`package-lock.json`をスキャン、`package`は特定のnpmパッケージをスキャン |
|
|
516
|
-
| `package` | — | パッケージ名（`scan-type=package`時に必須） |
|
|
517
|
-
| `fail-on` | `high` | この重要度しきい値でワークフローを失敗させる：`none`、`low`、`medium`、`high`、`critical` |
|
|
518
|
-
| `policy-file` | — | 許可リスト、重要度上書き、抑制用のYAML/JSONポリシーファイルへのパス |
|
|
519
|
-
| `license-key` | — | SIEMエクスポートとPDFレポート用のプレミアムライセンスキー |
|
|
520
|
-
| `siem-format` | — | SIEM出力：`cef`、`ecs`、`sentinel`、`qradar`（プレミアム） |
|
|
521
|
-
| `sbom-format` | — | SBOM出力：`json`、`xml`、`spdx` |
|
|
522
|
-
|
|
523
|
-
#### Action出力
|
|
524
|
-
|
|
525
|
-
| 出力 | 説明 |
|
|
526
|
-
|--------|-------------|
|
|
527
|
-
| `findings-count` | 検出された発見項目の数 |
|
|
528
|
-
| `scan-id` | 後でレポートで参照するためのスキャンID |
|
|
529
|
-
|
|
530
|
-
#### 例：ポリシー＋SBOMで特定パッケージをスキャン
|
|
531
|
-
|
|
532
|
-
```yaml
|
|
533
|
-
- uses: lateos/npm-scan@v1
|
|
534
|
-
with:
|
|
535
|
-
scan-type: package
|
|
536
|
-
package: lodash
|
|
537
|
-
policy-file: .npm-scan.yml
|
|
538
|
-
sbom-format: spdx
|
|
539
|
-
fail-on: critical
|
|
540
|
-
```
|
|
541
|
-
|
|
542
|
-
#### 例：SIEMエクスポートでスキャン（プレミアム）
|
|
543
|
-
|
|
544
|
-
```yaml
|
|
545
|
-
- uses: lateos/npm-scan@v1
|
|
546
|
-
with:
|
|
547
|
-
scan-type: lockfile
|
|
548
|
-
siem-format: cef
|
|
549
|
-
license-key: ${{ secrets.NPM_SCAN_LICENSE_KEY }}
|
|
550
|
-
```
|
|
551
|
-
|
|
552
|
-
### CI/CDパイプライン
|
|
553
|
-
|
|
554
|
-
複合アクションを使わずに既存のパイプラインに直接統合：
|
|
555
|
-
|
|
556
|
-
```bash
|
|
557
|
-
# ロックファイルをスキャン、高重要度でビルドを失敗
|
|
558
|
-
npm-scan scan-lockfile --policy .npm-scan.yml || exit 1
|
|
559
|
-
|
|
560
|
-
# 特定のパッケージをスキャン、クリティカルのみで失敗
|
|
561
|
-
npm-scan scan lodash --policy .npm-scan.yml || exit 1
|
|
562
|
-
|
|
563
|
-
# SBOMをビルドアーティファクトとして生成
|
|
564
|
-
npm-scan scan express --sbom spdx > express-sbom.spdx.json
|
|
565
|
-
|
|
566
|
-
# CIでHTMLコンプライアンスレポートを生成
|
|
567
|
-
npm-scan report --html > report.html
|
|
568
|
-
|
|
569
|
-
# レポートをアーティファクトとしてアップロード
|
|
570
|
-
# uses: actions/upload-artifact@v4
|
|
571
|
-
# with:
|
|
572
|
-
# name: npm-scan-report
|
|
573
|
-
# path: report.html
|
|
574
|
-
```
|
|
575
|
-
|
|
576
|
-
### Docker
|
|
577
|
-
|
|
578
|
-
上記の[Dockerクイックスタート](#-dockerでlateosnpm-scanをどこでも実行--インストール不要)セクションを参照してください。プルコマンド、Composeパイプライン、マルチアーキテクチャイメージについて説明しています。
|
|
579
|
-
|
|
580
484
|
---
|
|
581
485
|
|
|
582
486
|
## 🗺️ ロードマップとエンタープライズ機能
|
|
@@ -702,4 +606,5 @@ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
|
702
606
|
|
|
703
607
|
```bash
|
|
704
608
|
npx @lateos/npm-scan scan lodash
|
|
609
|
+
```
|
|
705
610
|
```
|