@nikhil_telkar/codeshield 0.1.0 → 0.1.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (4) hide show
  1. package/README.md +72 -122
  2. package/dist/report/sarif.js +1 -1
  3. package/dist/report/sarif.js.map +1 -1
  4. package/package.json +7 -4
package/README.md CHANGED
@@ -2,9 +2,9 @@
2
2
 
3
3
  > **A fast, zero-dependency security scanner for AI-generated codebases.**
4
4
 
5
- AI coding assistants (Cursor, Copilot, ChatGPT, Claude, v0, Bolt) are extraordinary at writing code quickly, but they frequently reproduce dangerous security anti-patterns: hardcoding secrets, hallucinating nonexistent npm packages, string-concatenating SQL queries, using `Math.random()` for security tokens, or omitting basic security headers.
5
+ AI coding assistants (Cursor, Copilot, ChatGPT, Claude, v0, Bolt) are extraordinary at writing code quickly, but they frequently introduce dangerous security flaws: hardcoding API keys, hallucinating nonexistent npm packages, writing SQL queries with string concatenation, using `Math.random()` for auth tokens, or forgetting basic security headers like `helmet`.
6
6
 
7
- **CodeShield** acts as a lightweight security guardrail for your development workflow and CI/CD pipelines.
7
+ **CodeShield** acts as an instant security guardrail for your development workflow and CI/CD pipelines.
8
8
 
9
9
  ---
10
10
 
@@ -13,26 +13,26 @@ AI coding assistants (Cursor, Copilot, ChatGPT, Claude, v0, Bolt) are extraordin
13
13
  No installation required. Run directly with `npx`:
14
14
 
15
15
  ```bash
16
- # Scan current directory
17
- npx codeshield scan .
16
+ # Scan current project
17
+ npx @nikhil_telkar/codeshield scan .
18
18
 
19
19
  # Automatically apply safe fixes (.gitignore, .env.example)
20
- npx codeshield fix .
20
+ npx @nikhil_telkar/codeshield fix .
21
21
 
22
- # Check if an npm package is real, safe, or a typosquat
23
- npx codeshield verify express
22
+ # Check if an npm package is real, safe, or an AI hallucination
23
+ npx @nikhil_telkar/codeshield verify express
24
24
  ```
25
25
 
26
- Or install globally:
26
+ Or install globally to use the short `codeshield` command anywhere:
27
27
 
28
28
  ```bash
29
- npm install -g codeshield
29
+ npm install -g @nikhil_telkar/codeshield
30
30
  codeshield scan .
31
31
  ```
32
32
 
33
33
  ---
34
34
 
35
- ## 🖥️ Example Terminal Output
35
+ ## 🖥️ Clean, Developer-Friendly Terminal Output
36
36
 
37
37
  ```text
38
38
  CodeShield — scanning /Users/dev/my-ai-app
@@ -41,83 +41,76 @@ CodeShield — scanning /Users/dev/my-ai-app
41
41
  ────────────────────────────────────────────────────────────
42
42
  Security Score : 54/100 [Grade C] (Needs Attention)
43
43
  Files Scanned : 42 files
44
- Findings : 4 [1 critical, 2 high, 1 medium]
45
- Duration : 32ms
44
+ Findings : 3 [1 critical, 1 high, 1 medium]
45
+ Duration : 28ms
46
46
  ────────────────────────────────────────────────────────────
47
47
 
48
48
  🎯 Fix These First (Top Priorities):
49
49
 
50
50
  🔴 CRITICAL [SEC-001] Hardcoded AWS Access Key
51
- Location : src/config/aws.ts:14
52
- CWE : CWE-798
53
- Why : An AWS Access Key ID was found directly in your code. Anyone with access
54
- to this repo can compromise your AWS account and spin up costly resources.
55
- Fix : Move credentials to process.env.AWS_ACCESS_KEY_ID or use IAM roles.
56
- Prompt : Refactor src/config/aws.ts to load AWS credentials from
57
- process.env.AWS_ACCESS_KEY_ID and process.env.AWS_SECRET_ACCESS_KEY.
58
- Update .env.example with placeholders.
59
-
60
- 🟠 HIGH [DEP-001] Likely Hallucinated npm Package
61
- Location : package.json:18
62
- CWE : CWE-829
63
- Why : "auth0-express-secure-kit" does not exist in the npm registry.
64
- AI models often hallucinate plausible-sounding package names.
65
- Fix : Remove the package from package.json and replace it with an official library.
66
- Prompt : The dependency "auth0-express-secure-kit" does not exist on npm.
67
- Rewrite our auth integration using the official "express-openid-connect" SDK.
68
-
69
- 🟡 MEDIUM [ENV-001] .env File Not in .gitignore
70
- Location : .env:1
71
- CWE : CWE-552
72
- Why : A .env file containing environment variables exists but is not ignored by git.
73
- Fix : Run `codeshield fix` to automatically add .env to .gitignore.
51
+ File : src/config/aws.ts:14
52
+ Line : AWS_ACCESS_KEY_ID=AKIA****
53
+ Issue : An AWS Access Key ID was found directly in your code. Anyone with access to this repo can compromise your AWS account.
54
+ Fix : Move credentials to process.env.AWS_ACCESS_KEY_ID or use IAM roles.
55
+ AI Prompt : Refactor src/config/aws.ts to load AWS credentials from process.env.AWS_ACCESS_KEY_ID.
56
+
57
+ 🟠 HIGH [COD-002] SQL Query Built via String Concatenation (SQL Injection)
58
+ File : src/routes/users.ts:28
59
+ Line : const query = "SELECT * FROM users WHERE id = '" + req.query.id + "'";
60
+ Issue : Constructing SQL queries using template literals or string concatenation allows SQL Injection.
61
+ Fix : Use parameterized queries (e.g., db.query("SELECT * FROM users WHERE id = $1", [id])).
62
+ AI Prompt : Refactor the SQL query on line 28 to use parameterized queries with placeholders.
63
+
64
+ 🟡 MEDIUM [COD-011] Missing Security Headers Middleware (Helmet) in Express App
65
+ File : src/server.ts:1
66
+ Issue : Express application initialized without helmet() security headers middleware.
67
+ Fix : Install helmet (`npm install helmet`) and add `app.use(helmet())` near the top of your Express middleware stack.
68
+ AI Prompt : Import `helmet` from "helmet" and add `app.use(helmet())` right after initializing the Express application.
74
69
  ```
75
70
 
76
71
  ---
77
72
 
78
73
  ## 🔍 What CodeShield Checks
79
74
 
80
- CodeShield evaluates codebases across four core dimensions:
75
+ CodeShield evaluates codebases across four core dimensions with **zero runtime dependencies**:
81
76
 
82
- ### 1. Secrets Scanner (`src/scanners/secrets.ts`)
83
- - **AWS Credentials:** Hardcoded `AKIA...` access keys and credentials (`CWE-798`).
77
+ ### 1. Secrets Scanner
78
+ - **AWS Credentials:** Hardcoded `AKIA...` access keys (`CWE-798`).
84
79
  - **Stripe Keys:** Live API keys (`sk_live_...`) (`CWE-798`).
85
80
  - **GitHub Tokens:** Personal access tokens (`ghp_...`, `github_pat_...`) (`CWE-798`).
86
81
  - **AI Provider API Keys:** OpenAI (`sk-...`), Anthropic (`sk-ant-...`) keys (`CWE-798`).
87
- - **Supabase Service Keys:** Hardcoded `service_role` JWTs (`CWE-798`).
88
- - **Database Connection Strings:** URLs containing credentials (`postgres://user:pass@host/db`) (`CWE-256`).
82
+ - **Supabase Service Keys:** Hardcoded `service_role` administrative keys (`CWE-798`).
83
+ - **Database Connection Strings:** URLs containing embedded passwords (`postgres://user:pass@host/db`) (`CWE-256`).
89
84
  - **Private Key Headers:** Unencrypted PEM blocks (`BEGIN RSA/OPENSSH PRIVATE KEY`) (`CWE-312`).
90
85
  - **Hardcoded JWT Secrets:** Literal strings passed to `jwt.sign()` (`CWE-798`).
91
- - **High-Entropy Generic Secrets:** Assignments to API key / secret variables (`CWE-798`).
92
- - **Client-Side Secret Leakage:** Private keys placed in `NEXT_PUBLIC_*` or `VITE_*` variables (`CWE-200`).
93
-
94
- ### 2. Environment Scanner (`src/scanners/env.ts`)
95
- - **Unignored `.env` Files:** Real credentials exposed to git tracking (`CWE-552`).
96
- - **Committed `.env` Files:** Credentials already committed into git (`CWE-552`).
97
- - **Missing `.env.example`:** Repositories with `.env` but no sanitized template for teammates (`CWE-552`).
98
- - **Production Source Maps:** `productionBrowserSourceMaps: true` or `sourcemap: true` leaking proprietary source code in production bundles (`CWE-540`).
99
-
100
- ### 3. Dependency Scanner (`src/scanners/dependencies.ts`)
101
- - **Hallucinated Packages (DEP-001):** Packages in `package.json` that do not exist on npm (`CWE-829`).
102
- - **Newly Published Packages (DEP-002):** Dependencies published $< 30$ days ago (`CWE-829`).
103
- - **Install Scripts (DEP-003):** Packages with `preinstall`, `install`, or `postinstall` lifecycle hooks that run arbitrary shell code (`CWE-829`).
104
- - **Typosquatting (DEP-004):** Dependencies 1 edit away from popular libraries (`expres`, `reakt`, `lodahs`) (`CWE-829`).
105
- - **Registry Errors (DEP-005):** Unreachable packages reported as "Could not check" (never silently passed as safe).
106
-
107
- ### 4. Code Scanner (`src/scanners/code.ts`)
108
- - **Arbitrary Code Execution:** `eval()` and `new Function()` (`CWE-95`).
86
+ - **Generic API Credentials:** High-entropy API key and token assignments (`CWE-798`).
87
+ - **Public Client Leaks:** Private keys placed in `NEXT_PUBLIC_*` or `VITE_*` variables (`CWE-200`).
88
+
89
+ ### 2. Dependency Scanner (AI Hallucination Guard)
90
+ - **Hallucinated Packages (DEP-001):** Verifies all dependencies in `package.json` against the npm registry to catch non-existent packages invented by AI tools (`CWE-829`).
91
+ - **Newly Published Packages (DEP-002):** Warns if dependencies were published $< 30$ days ago (`CWE-829`).
92
+ - **Install Scripts (DEP-003):** Flags packages that run `preinstall`, `install`, or `postinstall` shell scripts (`CWE-829`).
93
+ - **Typosquatting (DEP-004):** Detects packages that are 1 character away from popular libraries (`expres`, `lodahs`) (`CWE-829`).
94
+
95
+ ### 3. Environment & Config Scanner
96
+ - **Unignored `.env` Files:** Credentials exposed to git tracking (`CWE-552`).
97
+ - **Missing `.env.example`:** Repositories with `.env` but no sanitized template for collaborators (`CWE-552`).
98
+ - **Production Source Maps:** `productionBrowserSourceMaps: true` or `sourcemap: true` leaking unminified code in production (`CWE-540`).
99
+
100
+ ### 4. Code Pattern Scanner
101
+ - **Dynamic Code Execution:** `eval()` and `new Function()` (`CWE-95`).
109
102
  - **SQL Injection:** String concatenation in `db.query()`, `prisma.$queryRawUnsafe()`, etc. (`CWE-89`).
110
- - **NoSQL Injection:** Raw `req.body` or `req.query` passed directly into MongoDB/Mongoose filters (`CWE-943`).
103
+ - **NoSQL Injection:** Raw `req.body` or `req.query` passed directly into MongoDB/Mongoose queries (`CWE-943`).
111
104
  - **Command Injection:** `child_process.exec()` called with variables (`CWE-78`).
112
- - **Insecure Randomness:** `Math.random()` used for passwords, secrets, or tokens (`CWE-338`).
105
+ - **Insecure Randomness:** `Math.random()` used for tokens, passwords, or session IDs (`CWE-338`).
113
106
  - **Broken Cryptography:** MD5 or SHA-1 used for password hashing (`CWE-328`).
114
107
  - **Cross-Site Scripting (XSS):** `dangerouslySetInnerHTML` or `element.innerHTML` with dynamic variables (`CWE-79`).
115
- - **Permissive CORS:** `cors({ origin: '*' })` with credentials enabled (`CWE-942`).
108
+ - **Permissive CORS:** `cors({ origin: '*' })` (`CWE-942`).
116
109
  - **Insecure Cookies:** `res.cookie()` without `httpOnly: true` or `secure: true` (`CWE-1004`, `CWE-614`).
117
110
  - **Indefinite JWTs:** `jwt.sign()` calls missing an `expiresIn` option (`CWE-613`).
118
- - **Missing Helmet:** Express applications without the `helmet` security header middleware (`CWE-693`).
111
+ - **Missing Helmet:** Express applications without `helmet` security header middleware (`CWE-693`).
119
112
  - **Stack Trace Leakage:** Returning `err.stack` in HTTP responses (`CWE-209`).
120
- - **Client-Side Supabase Admin:** Using Supabase `service_role` keys inside frontend files (`CWE-200`).
113
+ - **Client-Side Supabase Admin:** Using Supabase `service_role` keys inside frontend components (`CWE-200`).
121
114
 
122
115
  ---
123
116
 
@@ -141,7 +134,7 @@ Usage:
141
134
  | `--sarif` | Output static analysis results in SARIF v2.1.0 format (for GitHub Security). |
142
135
  | `--fail-on <severity>` | Set exit code to 1 if any findings match or exceed `<severity>` (`critical`, `high`, `medium`, `low`, `info`). Default: `info`. |
143
136
  | `--severity <severity>` | Filter the report to only include findings at or above `<severity>`. Default: `info`. |
144
- | `--offline` | Skip all npm registry lookups (runs purely offline). |
137
+ | `--offline` | Skip all npm registry lookups (runs purely offline in $< 50\text{ms}$). |
145
138
 
146
139
  ### Fix Options
147
140
 
@@ -165,35 +158,32 @@ Usage:
165
158
 
166
159
  CodeShield calculates an objective score between **0 and 100**:
167
160
 
168
- $$\text{Score} = \max\left(0, 100 - \sum \text{Deductions}\right)$$
161
+ $$\text{Score} = \max\left(0, 100 - \sum \text{Capped Deductions}\right)$$
169
162
 
170
163
  ### Severity Weights & Deductions
171
164
 
172
165
  | Severity | Points Deducted per Finding | Maximum Deductions per Rule |
173
166
  | :--- | :---: | :---: |
174
- | **Critical** | -25 | Max 2 findings counted (-50) |
175
- | **High** | -15 | Max 2 findings counted (-30) |
176
- | **Medium** | -8 | Max 2 findings counted (-16) |
177
- | **Low** | -3 | Max 2 findings counted (-6) |
178
- | **Info** | -1 | Max 2 findings counted (-2) |
167
+ | **Critical** | -25 | Capped at -35 max per rule |
168
+ | **High** | -15 | Capped at -35 max per rule |
169
+ | **Medium** | -8 | Capped at -35 max per rule |
170
+ | **Low** | -3 | Capped at -35 max per rule |
171
+ | **Info** | 0 | 0 |
179
172
 
180
173
  ### Anti-Noise Rule Capping
181
- To ensure that a single noisy rule in a large codebase does not artificially zero out your score, deductions are capped at **2 findings per individual rule**.
174
+ To prevent a single repetitive issue (such as 50 missing cookie flags) from zeroing out the entire score, deductions for any single rule are capped at **35 points**.
182
175
 
183
176
  ### Grade Scale
184
-
185
- - **90–100 [Grade A]** — Excellent: No critical or high issues found.
177
+ - **90–100 [Grade A]** — Excellent: Clean security posture.
186
178
  - **75–89 [Grade B]** — Good: Minor low/medium issues.
187
- - **50–74 [Grade C]** — Needs Attention: High-risk findings present.
188
- - **25–49 [Grade D]** — Poor: Multiple severe vulnerabilities.
189
- - **0–24 [Grade F]** — Failing: Immediate remediation required.
179
+ - **60–74 [Grade C]** — Needs Attention: High-risk findings present.
180
+ - **40–59 [Grade D]** — Poor: Multiple severe vulnerabilities.
181
+ - **0–39 [Grade F]** — Critical: Immediate attention required.
190
182
 
191
183
  ---
192
184
 
193
185
  ## 🤖 CI / CD Integration
194
186
 
195
- ### GitHub Actions Workflow
196
-
197
187
  Add `.github/workflows/security.yml`:
198
188
 
199
189
  ```yaml
@@ -219,12 +209,12 @@ jobs:
219
209
 
220
210
  # Option A: Fail the build on high/critical findings
221
211
  - name: Run CodeShield Scan
222
- run: npx codeshield scan . --fail-on high
212
+ run: npx @nikhil_telkar/codeshield scan . --fail-on high
223
213
 
224
214
  # Option B: Upload SARIF report to GitHub Advanced Security tab
225
215
  - name: Generate SARIF report
226
216
  if: always()
227
- run: npx codeshield scan . --sarif > results.sarif
217
+ run: npx @nikhil_telkar/codeshield scan . --sarif > results.sarif
228
218
 
229
219
  - name: Upload SARIF to GitHub Code Scanning
230
220
  uses: github/codeql-action/upload-sarif@v3
@@ -241,50 +231,10 @@ jobs:
241
231
  - **Zero Telemetry:** No analytics, no phone-home pings, no cookies, no tracking.
242
232
  - **Zero Runtime Dependencies:** Zero third-party packages installed in production. Zero supply chain risk.
243
233
  - **Strict Read-Only Scanning:** CodeShield inspects text files using Node built-in file APIs. It **never** dynamically evaluates, requires, or imports your code.
244
- - **Optional Network Access:** The only network request CodeShield can make is an HTTPS query to `https://registry.npmjs.org/<package>` to verify npm packages during `codeshield verify` or standard scans. Pass `--offline` to run completely disconnected from the network.
245
-
246
- ---
247
-
248
- ## ⚠️ Honest Limitations
249
-
250
- > **"CodeShield catches common security mistakes; it does not prove your code is secure."**
251
-
252
- 1. **Heuristic Pattern Matching:** CodeShield scans for known insecure patterns, signatures, and anti-patterns common to AI-generated code. It does not perform symbolic execution or full AST taint tracking across modules.
253
- 2. **Obfuscation & Dynamic Code:** Heavily obfuscated code or multi-step indirect injections (e.g., retrieving a malicious SQL string from a third-party microservice) will not be detected.
254
- 3. **Business Logic Vulnerabilities:** Flaws in business logic (such as missing multi-tenant authorization checks or broken role-based access control) require human review and threat modeling.
255
- 4. **Defense in Depth:** CodeShield is designed as a fast pre-commit check and CI gate. It should be used alongside comprehensive unit/integration testing, dynamic testing (DAST), and professional security audits.
256
-
257
- ---
258
-
259
- ## 🧩 How to Add a Rule
260
-
261
- CodeShield uses a data-driven rule registry. To add a new rule:
262
-
263
- 1. Open [`src/scanners/code.ts`](file:///Users/nikhiltelkar19gmail.com/Desktop/CODESHILD/src/scanners/code.ts) (or `secrets.ts` / `env.ts`).
264
- 2. Add a rule object to `CODE_RULES`:
265
-
266
- ```typescript
267
- {
268
- id: 'COD-014',
269
- severity: 'high',
270
- cwe: 'CWE-312',
271
- title: 'Sensitive Token Stored in LocalStorage',
272
- explanation: 'Storing session tokens in localStorage exposes them to XSS attacks.',
273
- fix: 'Store tokens in HttpOnly, secure cookies instead.',
274
- prompt: 'Refactor this code to store auth tokens in HttpOnly secure cookies instead of localStorage.',
275
- matches(line: string, _file: ScannedFile): boolean {
276
- return /localStorage\.setItem\s*\(\s*['"`](?:token|jwt|auth)['"`]/i.test(line);
277
- },
278
- }
279
- ```
280
-
281
- 3. Add unit tests and ReDoS performance benchmarks in `tests/code.test.ts`.
282
- 4. Run `npm test` to verify.
283
-
284
- See [CONTRIBUTING.md](file:///Users/nikhiltelkar19gmail.com/Desktop/CODESHILD/CONTRIBUTING.md) for full instructions and best practices.
234
+ - **Optional Network Access:** The only network request CodeShield can make is an HTTPS query to `https://registry.npmjs.org/<package>` to verify npm packages during `codeshield verify` or standard scans. Pass `--offline` to run completely disconnected.
285
235
 
286
236
  ---
287
237
 
288
238
  ## 📄 License
289
239
 
290
- [MIT](file:///Users/nikhiltelkar19gmail.com/Desktop/CODESHILD/LICENSE) © 2026 Nikhil Telkar
240
+ [MIT](LICENSE) © 2026 Nikhil Telkar
package/dist/report/sarif.js CHANGED
@@ -56,7 +56,7 @@ export function formatSarifReport(result, version = '0.1.0') {
56
56
  driver: {
57
57
  name: 'CodeShield',
58
58
  version,
59
- informationUri: 'https://github.com/nikhiltelkar/codeshield',
59
+ informationUri: 'https://github.com/nikhiltelkar2005-glitch/codeshield_npm_package',
60
60
  rules: sarifRules,
61
61
  },
62
62
  },
package/dist/report/sarif.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"sarif.js","sourceRoot":"","sources":["../../src/report/sarif.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAkChD,SAAS,oBAAoB,CAAC,GAAa;IACzC,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,UAAU,CAAC;QAChB,KAAK,MAAM;YACT,OAAO,OAAO,CAAC;QACjB,KAAK,QAAQ;YACX,OAAO,SAAS,CAAC;QACnB,KAAK,KAAK;YACR,OAAO,MAAM,CAAC;QAChB,KAAK,MAAM;YACT,OAAO,MAAM,CAAC;IAClB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAAkB,EAAE,OAAO,GAAG,OAAO;IACrE,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAwF,CAAC;IAEjH,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QAChC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5B,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE;gBACrB,EAAE,EAAE,CAAC,CAAC,MAAM;gBACZ,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC;gBACvB,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC;gBACzC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC;gBACpB,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACjC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACzD,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,gBAAgB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;QAClC,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,WAAW,YAAY,CAAC,CAAC,GAAG,EAAE,EAAE;QACnD,UAAU,EAAE;YACV,IAAI,EAAE,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;SAC9C;KACF,CAAC,CAAC,CAAC;IAEJ,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC7C,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,KAAK,EAAE,oBAAoB,CAAC,CAAC,CAAC,QAAQ,CAAC;QACvC,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,EAAE,EAAE;QAC1E,SAAS,EAAE;YACT;gBACE,gBAAgB,EAAE;oBAChB,gBAAgB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE;oBACjC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE;iBAC3C;aACF;SACF;KACF,CAAC,CAAC,CAAC;IAEJ,MAAM,KAAK,GAAgB;QACzB,OAAO,EAAE,gGAAgG;QACzG,OAAO,EAAE,OAAO;QAChB,IAAI,EAAE;YACJ;gBACE,IAAI,EAAE;oBACJ,MAAM,EAAE;wBACN,IAAI,EAAE,YAAY;wBAClB,OAAO;wBACP,cAAc,EAAE,4CAA4C;wBAC5D,KAAK,EAAE,UAAU;qBAClB;iBACF;gBACD,OAAO,EAAE,YAAY;aACtB;SACF;KACF,CAAC;IAEF,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AACxC,CAAC"}
1
+ {"version":3,"file":"sarif.js","sourceRoot":"","sources":["../../src/report/sarif.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAkChD,SAAS,oBAAoB,CAAC,GAAa;IACzC,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,UAAU,CAAC;QAChB,KAAK,MAAM;YACT,OAAO,OAAO,CAAC;QACjB,KAAK,QAAQ;YACX,OAAO,SAAS,CAAC;QACnB,KAAK,KAAK;YACR,OAAO,MAAM,CAAC;QAChB,KAAK,MAAM;YACT,OAAO,MAAM,CAAC;IAClB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAAkB,EAAE,OAAO,GAAG,OAAO;IACrE,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAwF,CAAC;IAEjH,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QAChC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5B,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE;gBACrB,EAAE,EAAE,CAAC,CAAC,MAAM;gBACZ,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC;gBACvB,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC;gBACzC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC;gBACpB,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACjC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACzD,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,gBAAgB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;QAClC,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,WAAW,YAAY,CAAC,CAAC,GAAG,EAAE,EAAE;QACnD,UAAU,EAAE;YACV,IAAI,EAAE,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;SAC9C;KACF,CAAC,CAAC,CAAC;IAEJ,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC7C,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,KAAK,EAAE,oBAAoB,CAAC,CAAC,CAAC,QAAQ,CAAC;QACvC,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,EAAE,EAAE;QAC1E,SAAS,EAAE;YACT;gBACE,gBAAgB,EAAE;oBAChB,gBAAgB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE;oBACjC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE;iBAC3C;aACF;SACF;KACF,CAAC,CAAC,CAAC;IAEJ,MAAM,KAAK,GAAgB;QACzB,OAAO,EAAE,gGAAgG;QACzG,OAAO,EAAE,OAAO;QAChB,IAAI,EAAE;YACJ;gBACE,IAAI,EAAE;oBACJ,MAAM,EAAE;wBACN,IAAI,EAAE,YAAY;wBAClB,OAAO;wBACP,cAAc,EAAE,mEAAmE;wBACnF,KAAK,EAAE,UAAU;qBAClB;iBACF;gBACD,OAAO,EAAE,YAAY;aACtB;SACF;KACF,CAAC;IAEF,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AACxC,CAAC"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@nikhil_telkar/codeshield",
3
- "version": "0.1.0",
3
+ "version": "0.1.1",
4
4
  "description": "Security scanner for AI-generated codebases.",
5
5
  "type": "module",
6
6
  "main": "dist/index.js",
@@ -32,12 +32,12 @@
32
32
  "license": "MIT",
33
33
  "repository": {
34
34
  "type": "git",
35
- "url": "https://github.com/nikhiltelkar/codeshield.git"
35
+ "url": "https://github.com/nikhiltelkar2005-glitch/codeshield_npm_package.git"
36
36
  },
37
37
  "bugs": {
38
- "url": "https://github.com/nikhiltelkar/codeshield/issues"
38
+ "url": "https://github.com/nikhiltelkar2005-glitch/codeshield_npm_package/issues"
39
39
  },
40
- "homepage": "https://github.com/nikhiltelkar/codeshield#readme",
40
+ "homepage": "https://github.com/nikhiltelkar2005-glitch/codeshield_npm_package#readme",
41
41
  "keywords": [
42
42
  "security",
43
43
  "scanner",
@@ -54,5 +54,8 @@
54
54
  "devDependencies": {
55
55
  "@types/node": "^22.0.0",
56
56
  "typescript": "^5.5.0"
57
+ },
58
+ "dependencies": {
59
+ "@nikhil_telkar/codeshield": "^0.1.0"
57
60
  }
58
61
  }