@panguard-ai/panguard-scan 1.6.0 → 1.7.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"discovery-scanner.d.ts","sourceRoot":"","sources":["../../src/scanners/discovery-scanner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAaL,KAAK,eAAe,EACpB,KAAK,eAAe,EACrB,MAAM,mBAAmB,CAAC;
|
|
1
|
+
{"version":3,"file":"discovery-scanner.d.ts","sourceRoot":"","sources":["../../src/scanners/discovery-scanner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAaL,KAAK,eAAe,EACpB,KAAK,eAAe,EACrB,MAAM,mBAAmB,CAAC;AA6F3B;;;;;;;;;;GAUG;AACH,wBAAsB,QAAQ,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC,CA4HhF"}
|
|
@@ -8,9 +8,40 @@
|
|
|
8
8
|
*
|
|
9
9
|
* @module @panguard-ai/panguard-scan/scanners/discovery-scanner
|
|
10
10
|
*/
|
|
11
|
-
import {
|
|
11
|
+
import { execFileSync } from 'node:child_process';
|
|
12
12
|
import { detectOS, getNetworkInterfaces, scanOpenPorts, getActiveConnections, getGateway, getDnsServersAsync, detectServices, detectSecurityTools, checkFirewall, auditUsers, calculateRiskScore, createLogger, } from '@panguard-ai/core';
|
|
13
13
|
const logger = createLogger('panguard-scan:discovery');
|
|
14
|
+
/**
|
|
15
|
+
* Run a fixed binary with a fixed args array and return trimmed stdout, or
|
|
16
|
+
* null on failure. Uses execFileSync (no shell) so arguments are never
|
|
17
|
+
* interpreted by a command interpreter.
|
|
18
|
+
*
|
|
19
|
+
* @param bin - Absolute path to the binary / 二進位檔絕對路徑
|
|
20
|
+
* @param args - Argument vector (never shell-interpreted) / 參數陣列（不經 shell）
|
|
21
|
+
* @param timeoutMs - Hard timeout in milliseconds / 逾時毫秒數
|
|
22
|
+
*/
|
|
23
|
+
function runCommand(bin, args, timeoutMs) {
|
|
24
|
+
try {
|
|
25
|
+
return execFileSync(bin, [...args], {
|
|
26
|
+
timeout: timeoutMs,
|
|
27
|
+
stdio: ['ignore', 'pipe', 'ignore'],
|
|
28
|
+
})
|
|
29
|
+
.toString()
|
|
30
|
+
.trim();
|
|
31
|
+
}
|
|
32
|
+
catch (err) {
|
|
33
|
+
// Some tools exit non-zero on success-with-results (e.g. `yum check-update`
|
|
34
|
+
// returns 100 when updates exist). execFileSync throws but still attaches
|
|
35
|
+
// captured stdout, so recover it rather than discarding usable output.
|
|
36
|
+
const stdout = err?.stdout;
|
|
37
|
+
if (stdout != null) {
|
|
38
|
+
const text = stdout.toString().trim();
|
|
39
|
+
if (text.length > 0)
|
|
40
|
+
return text;
|
|
41
|
+
}
|
|
42
|
+
return null;
|
|
43
|
+
}
|
|
44
|
+
}
|
|
14
45
|
/**
|
|
15
46
|
* Detect pending system updates based on platform.
|
|
16
47
|
* Returns { pendingUpdates, autoUpdateEnabled }.
|
|
@@ -19,59 +50,33 @@ function detectUpdateStatus() {
|
|
|
19
50
|
try {
|
|
20
51
|
const platform = process.platform;
|
|
21
52
|
if (platform === 'darwin') {
|
|
22
|
-
// macOS: check Software Update
|
|
23
|
-
|
|
53
|
+
// macOS: check Software Update (stderr merged into the captured text by
|
|
54
|
+
// softwareupdate itself; we no longer rely on a shell 2>&1 redirect).
|
|
55
|
+
const output = runCommand('/usr/sbin/softwareupdate', ['-l'], 10000) ?? '';
|
|
24
56
|
const matches = output.match(/\* /g);
|
|
25
57
|
const pending = matches ? matches.length : 0;
|
|
26
58
|
// Check if auto-update is enabled
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
const autoOutput = execSync('defaults read /Library/Preferences/com.apple.SoftwareUpdate AutomaticCheckEnabled 2>/dev/null', { timeout: 5000 })
|
|
30
|
-
.toString()
|
|
31
|
-
.trim();
|
|
32
|
-
autoEnabled = autoOutput === '1';
|
|
33
|
-
}
|
|
34
|
-
catch {
|
|
35
|
-
// Ignore — cannot determine auto-update status
|
|
36
|
-
}
|
|
59
|
+
const autoOutput = runCommand('/usr/bin/defaults', ['read', '/Library/Preferences/com.apple.SoftwareUpdate', 'AutomaticCheckEnabled'], 5000);
|
|
60
|
+
const autoEnabled = autoOutput === '1';
|
|
37
61
|
return { pendingUpdates: pending, autoUpdateEnabled: autoEnabled };
|
|
38
62
|
}
|
|
39
63
|
if (platform === 'linux') {
|
|
40
64
|
// Try apt (Debian/Ubuntu)
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
const count = parseInt(output, 10);
|
|
48
|
-
const autoEnabled = (() => {
|
|
49
|
-
try {
|
|
50
|
-
return (execSync('systemctl is-enabled unattended-upgrades 2>/dev/null', { timeout: 5000 })
|
|
51
|
-
.toString()
|
|
52
|
-
.trim() === 'enabled');
|
|
53
|
-
}
|
|
54
|
-
catch {
|
|
55
|
-
return false;
|
|
56
|
-
}
|
|
57
|
-
})();
|
|
58
|
-
return { pendingUpdates: isNaN(count) ? 0 : count, autoUpdateEnabled: autoEnabled };
|
|
59
|
-
}
|
|
60
|
-
catch {
|
|
61
|
-
/* not apt-based */
|
|
65
|
+
const aptOutput = runCommand('/usr/bin/apt', ['list', '--upgradable'], 10000);
|
|
66
|
+
if (aptOutput !== null) {
|
|
67
|
+
// Replaces shell `grep -c upgradable`: count lines mentioning upgradable.
|
|
68
|
+
const count = aptOutput.split('\n').filter((line) => line.includes('upgradable')).length;
|
|
69
|
+
const autoStatus = runCommand('/usr/bin/systemctl', ['is-enabled', 'unattended-upgrades'], 5000);
|
|
70
|
+
return { pendingUpdates: count, autoUpdateEnabled: autoStatus === 'enabled' };
|
|
62
71
|
}
|
|
63
72
|
// Try yum/dnf (RHEL/CentOS/Fedora)
|
|
64
|
-
|
|
65
|
-
|
|
66
|
-
|
|
67
|
-
|
|
68
|
-
|
|
69
|
-
|
|
70
|
-
|
|
71
|
-
return { pendingUpdates: isNaN(count) ? 0 : count, autoUpdateEnabled: false };
|
|
72
|
-
}
|
|
73
|
-
catch {
|
|
74
|
-
/* not yum-based */
|
|
73
|
+
const yumOutput = runCommand('/usr/bin/yum', ['check-update'], 10000);
|
|
74
|
+
if (yumOutput !== null) {
|
|
75
|
+
// Replaces shell `tail -n +3 | wc -l`: skip the 2-line header, then
|
|
76
|
+
// count remaining non-empty package lines.
|
|
77
|
+
const lines = yumOutput.split('\n');
|
|
78
|
+
const count = lines.slice(2).filter((line) => line.trim().length > 0).length;
|
|
79
|
+
return { pendingUpdates: count, autoUpdateEnabled: false };
|
|
75
80
|
}
|
|
76
81
|
}
|
|
77
82
|
// Fallback: unknown
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"discovery-scanner.js","sourceRoot":"","sources":["../../src/scanners/discovery-scanner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,
|
|
1
|
+
{"version":3,"file":"discovery-scanner.js","sourceRoot":"","sources":["../../src/scanners/discovery-scanner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EACL,QAAQ,EACR,oBAAoB,EACpB,aAAa,EACb,oBAAoB,EACpB,UAAU,EACV,kBAAkB,EAClB,cAAc,EACd,mBAAmB,EACnB,aAAa,EACb,UAAU,EACV,kBAAkB,EAClB,YAAY,GAGb,MAAM,mBAAmB,CAAC;AAE3B,MAAM,MAAM,GAAG,YAAY,CAAC,yBAAyB,CAAC,CAAC;AAEvD;;;;;;;;GAQG;AACH,SAAS,UAAU,CAAC,GAAW,EAAE,IAAuB,EAAE,SAAiB;IACzE,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE;YAClC,OAAO,EAAE,SAAS;YAClB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;SACpC,CAAC;aACC,QAAQ,EAAE;aACV,IAAI,EAAE,CAAC;IACZ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,4EAA4E;QAC5E,0EAA0E;QAC1E,uEAAuE;QACvE,MAAM,MAAM,GAAI,GAA2C,EAAE,MAAM,CAAC;QACpE,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;YACnB,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC;YACtC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;QACnC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB;IACzB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QAElC,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1B,wEAAwE;YACxE,sEAAsE;YACtE,MAAM,MAAM,GAAG,UAAU,CAAC,0BAA0B,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;YAC3E,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACrC,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7C,kCAAkC;YAClC,MAAM,UAAU,GAAG,UAAU,CAC3B,mBAAmB,EACnB,CAAC,MAAM,EAAE,+CAA+C,EAAE,uBAAuB,CAAC,EAClF,IAAI,CACL,CAAC;YACF,MAAM,WAAW,GAAG,UAAU,KAAK,GAAG,CAAC;YACvC,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,CAAC;QACrE,CAAC;QAED,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YACzB,0BAA0B;YAC1B,MAAM,SAAS,GAAG,UAAU,CAAC,cAAc,EAAE,CAAC,MAAM,EAAE,cAAc,CAAC,EAAE,KAAK,CAAC,CAAC;YAC9E,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;gBACvB,0EAA0E;gBAC1E,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC;gBACzF,MAAM,UAAU,GAAG,UAAU,CAC3B,oBAAoB,EACpB,CAAC,YAAY,EAAE,qBAAqB,CAAC,EACrC,IAAI,CACL,CAAC;gBACF,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,iBAAiB,EAAE,UAAU,KAAK,SAAS,EAAE,CAAC;YAChF,CAAC;YAED,mCAAmC;YACnC,MAAM,SAAS,GAAG,UAAU,CAAC,cAAc,EAAE,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,CAAC;YACtE,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;gBACvB,oEAAoE;gBACpE,2CAA2C;gBAC3C,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACpC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;gBAC7E,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC;YAC7D,CAAC;QACH,CAAC;QAED,oBAAoB;QACpB,OAAO,EAAE,cAAc,EAAE,CAAC,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC;IACzD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,gCAAgC,EAAE;YAC5C,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACxD,CAAC,CAAC;QACH,OAAO,EAAE,cAAc,EAAE,CAAC,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC;IACzD,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,MAAuB;IACpD,MAAM,CAAC,IAAI,CAAC,gCAAgC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAE1F,kCAAkC;IAClC,cAAc;IACd,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IAC1C,MAAM,EAAE,GAAG,MAAM,QAAQ,EAAE,CAAC;IAE5B,iCAAiC;IACjC,cAAc;IACd,MAAM,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAG,oBAAoB,EAAE,CAAC;IAE1C,0BAA0B;IAC1B,aAAa;IACb,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IACnC,MAAM,SAAS,GAAG,MAAM,aAAa,EAAE,CAAC;IAExC,sDAAsD;IACtD,uBAAuB;IACvB,IAAI,iBAAiB,GAAqD,EAAE,CAAC;IAC7E,IAAI,MAAM,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;QAC5B,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;QAC1C,iBAAiB,GAAG,MAAM,oBAAoB,EAAE,CAAC;IACnD,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;IAC3D,CAAC;IAED,sBAAsB;IACtB,YAAY;IACZ,MAAM,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,MAAM,UAAU,EAAE,CAAC;IAEnC,0BAA0B;IAC1B,kBAAkB;IAClB,MAAM,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,MAAM,kBAAkB,EAAE,CAAC;IAEvC,kCAAkC;IAClC,eAAe;IACf,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,MAAM,cAAc,EAAE,CAAC;IAExC,gCAAgC;IAChC,cAAc;IACd,MAAM,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IACxC,MAAM,aAAa,GAAG,MAAM,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAE1D,gCAAgC;IAChC,eAAe;IACf,MAAM,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,MAAM,aAAa,EAAE,CAAC;IAEvC,+BAA+B;IAC/B,gBAAgB;IAChB,MAAM,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,MAAM,UAAU,EAAE,CAAC;IAEjC,wCAAwC;IACxC,kBAAkB;IAClB,MAAM,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,kBAAkB,EAAE,CAAC;IAErC,2CAA2C;IAC3C,eAAe;IACf,MAAM,aAAa,GAA6B;QAC9C,EAAE;QACF,QAAQ,EAAE,EAAE,CAAC,QAAQ;QACrB,OAAO,EAAE;YACP,UAAU;YACV,SAAS;YACT,iBAAiB;YACjB,OAAO;YACP,GAAG;SACJ;QACD,SAAS;QACT,QAAQ;QACR,QAAQ,EAAE;YACR,aAAa;YACb,QAAQ;YACR,OAAO;YACP,KAAK;SACN;KACF,CAAC;IAEF,gCAAgC;IAChC,eAAe;IACf,MAAM,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IACtC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,kBAAkB,CAAC,aAAa,CAAC,CAAC;IAEjE,oCAAoC;IACpC,uBAAuB;IACvB,MAAM,MAAM,GAAoB;QAC9B,EAAE;QACF,QAAQ,EAAE,EAAE,CAAC,QAAQ;QACrB,OAAO,EAAE;YACP,UAAU;YACV,SAAS;YACT,iBAAiB;YACjB,OAAO;YACP,GAAG;SACJ;QACD,SAAS;QACT,QAAQ;QACR,QAAQ,EAAE;YACR,aAAa;YACb,QAAQ;YACR,OAAO;YACP,KAAK;SACN;QACD,eAAe,EAAE,OAAO;QACxB,SAAS;QACT,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACvC,CAAC;IAEF,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE;QAChC,SAAS;QACT,YAAY,EAAE,OAAO,CAAC,MAAM;QAC5B,UAAU,EAAE,SAAS,CAAC,MAAM;QAC5B,aAAa,EAAE,QAAQ,CAAC,MAAM;QAC9B,UAAU,EAAE,KAAK,CAAC,MAAM;KACzB,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@panguard-ai/panguard-scan",
|
|
3
|
-
"version": "1.
|
|
3
|
+
"version": "1.7.0",
|
|
4
4
|
"license": "MIT",
|
|
5
5
|
"repository": {
|
|
6
6
|
"type": "git",
|
|
@@ -29,13 +29,14 @@
|
|
|
29
29
|
"files": [
|
|
30
30
|
"dist",
|
|
31
31
|
"package.json",
|
|
32
|
-
"README.md"
|
|
32
|
+
"README.md",
|
|
33
|
+
"LICENSE"
|
|
33
34
|
],
|
|
34
35
|
"dependencies": {
|
|
35
36
|
"commander": "^12.0.0",
|
|
36
37
|
"pdfkit": "^0.15.0",
|
|
37
|
-
"@panguard-ai/
|
|
38
|
-
"@panguard-ai/
|
|
38
|
+
"@panguard-ai/security-hardening": "1.7.0",
|
|
39
|
+
"@panguard-ai/core": "1.7.0"
|
|
39
40
|
},
|
|
40
41
|
"devDependencies": {
|
|
41
42
|
"@types/node": "^22.14.0",
|