@pbpyrojust/universal-security-audit 0.0.0-stage → 0.3.0

package/scripts/lib/script-inventory.mjs

@@ -0,0 +1,131 @@
+// ── Third-party script/library inventory + CMS core & plugin version detection ──
+
+// Recognize common CDN/library filename conventions, e.g. "jquery-3.6.0.min.js", "bootstrap.min.js?ver=4.6.0"
+const VERSION_IN_FILENAME_RE = /([a-z][a-z0-9.\-]*?)[-.]v?(\d+\.\d+(?:\.\d+)?)(?:\.min)?\.js/i;
+const KNOWN_LIB_HOST_HINTS = [
+  { re: /jquery(?!-ui)/i, name: 'jquery' },
+  { re: /jquery-ui/i, name: 'jquery-ui' },
+  { re: /bootstrap/i, name: 'bootstrap' },
+  { re: /lodash/i, name: 'lodash' },
+  { re: /underscore/i, name: 'underscore' },
+  { re: /angular(?!js)/i, name: 'angular' },
+  { re: /angular(?:js)?[.\-]/i, name: 'angularjs' },
+  { re: /react-dom/i, name: 'react-dom' },
+  { re: /react(?!-dom)/i, name: 'react' },
+  { re: /vue(?:\.runtime)?[.\-]/i, name: 'vue' },
+  { re: /moment/i, name: 'moment' },
+  { re: /handlebars/i, name: 'handlebars' },
+  { re: /swiper/i, name: 'swiper' },
+  { re: /slick/i, name: 'slick' },
+  { re: /fancybox/i, name: 'fancybox' },
+  { re: /font-awesome|fontawesome/i, name: 'font-awesome' },
+  { re: /gsap|tweenmax|tweenlite/i, name: 'gsap' },
+  { re: /d3(?:\.v\d+)?[.\-]/i, name: 'd3' },
+  { re: /chart(?:\.min)?\.js/i, name: 'chart.js' },
+  { re: /select2/i, name: 'select2' },
+  { re: /axios/i, name: 'axios' },
+];
+
+export function extractInventoryFromHtml(html = '', baseUrl) {
+  const scripts = [...html.matchAll(/<script[^>]+src=["']([^"']+)["']/gi)].map((m) => m[1]);
+  const styles = [...html.matchAll(/<link[^>]+href=["']([^"']+)["'][^>]*rel=["']stylesheet["']/gi)].map((m) => m[1]);
+  const generator = /<meta[^>]+name=["']generator["'][^>]+content=["']([^"']+)["']/i.exec(html)?.[1] || '';
+  const absolutize = (u) => { try { return new URL(u, baseUrl).toString(); } catch { return u; } };
+  return {
+    scriptUrls: scripts.map(absolutize),
+    styleUrls: styles.map(absolutize),
+    generator,
+  };
+}
+
+function versionFromPathSegment(url) {
+  // Catches CDN conventions like cdnjs.cloudflare.com/ajax/libs/bootstrap/4.6.0/js/bootstrap.min.js
+  // where the version is its own path segment rather than embedded in the filename or query string.
+  try {
+    const segments = new URL(url).pathname.split('/').filter(Boolean);
+    const semverSegment = segments.find((s) => /^\d+\.\d+(?:\.\d+)?$/.test(s));
+    return semverSegment || null;
+  } catch { return null; }
+}
+
+export function identifyLibraries(urls = []) {
+  const found = new Map();
+  for (const url of urls) {
+    let filename;
+    try { filename = new URL(url).pathname.split('/').pop() || ''; } catch { filename = url; }
+    const verMatch = VERSION_IN_FILENAME_RE.exec(filename);
+    const queryVer = /[?&](?:ver|version|v)=([\d.]+)/i.exec(url)?.[1];
+    for (const hint of KNOWN_LIB_HOST_HINTS) {
+      if (hint.re.test(filename) || hint.re.test(url)) {
+        const version = verMatch?.[2] || queryVer || versionFromPathSegment(url) || null;
+        const key = hint.name;
+        if (!found.has(key) || (version && !found.get(key).version)) {
+          found.set(key, { name: hint.name, version, sourceUrl: url });
+        }
+        break;
+      }
+    }
+  }
+  return [...found.values()];
+}
+
+export function extractWpPluginsAndThemes(urls = []) {
+  const plugins = new Map();
+  const themes = new Map();
+  for (const url of urls) {
+    const pluginMatch = /\/wp-content\/plugins\/([^/]+)\//i.exec(url);
+    const themeMatch = /\/wp-content\/themes\/([^/]+)\//i.exec(url);
+    const queryVer = /[?&](?:ver|version)=([\d.]+)/i.exec(url)?.[1] || null;
+    if (pluginMatch) {
+      const slug = pluginMatch[1];
+      if (!plugins.has(slug) || (queryVer && !plugins.get(slug).version)) plugins.set(slug, { slug, version: queryVer, sourceUrl: url });
+    }
+    if (themeMatch) {
+      const slug = themeMatch[1];
+      if (!themes.has(slug) || (queryVer && !themes.get(slug).version)) themes.set(slug, { slug, version: queryVer, sourceUrl: url });
+    }
+  }
+  return { plugins: [...plugins.values()], themes: [...themes.values()] };
+}
+
+async function safeFetchText(url, timeoutMs = 6000) {
+  try {
+    const controller = new AbortController();
+    const t = setTimeout(() => controller.abort(), timeoutMs);
+    const res = await fetch(url, { signal: controller.signal, headers: { 'user-agent': 'Universal-Security-Audit' } });
+    clearTimeout(t);
+    if (!res.ok) return null;
+    return await res.text();
+  } catch { return null; }
+}
+
+export async function detectWpCoreVersion(origin, html, generator) {
+  const genMatch = /WordPress\s+([\d.]+)/i.exec(generator || '');
+  if (genMatch) return { version: genMatch[1], source: 'generator meta tag' };
+  const emojiMatch = /wp-emoji-release\.min\.js\?ver=([\d.]+)/i.exec(html || '');
+  if (emojiMatch) return { version: emojiMatch[1], source: 'wp-emoji script query param' };
+  const readme = await safeFetchText(new URL('/readme.html', origin).toString());
+  if (readme) {
+    const m = /<br\s*\/?>\s*Version\s+([\d.]+)/i.exec(readme) || /Version\s+([\d.]+)/i.exec(readme);
+    if (m) return { version: m[1], source: '/readme.html' };
+  }
+  return { version: null, source: null };
+}
+
+export async function fetchWpPluginReadmeVersion(origin, slug) {
+  const readme = await safeFetchText(new URL(`/wp-content/plugins/${slug}/readme.txt`, origin).toString());
+  if (!readme) return null;
+  const m = /Stable tag:\s*([\d.]+)/i.exec(readme);
+  return m ? m[1] : null;
+}
+
+export async function detectDrupalCoreVersion(origin, html, generator) {
+  const genMatch = /Drupal\s+([\d.]+)/i.exec(generator || '');
+  if (genMatch) return { version: genMatch[1], source: 'generator meta tag' };
+  const changelog = await safeFetchText(new URL('/CHANGELOG.txt', origin).toString());
+  if (changelog) {
+    const m = /^Drupal\s+([\d.]+),/im.exec(changelog);
+    if (m) return { version: m[1], source: '/CHANGELOG.txt' };
+  }
+  return { version: null, source: null };
+}

package/scripts/lib/security-headers.mjs

@@ -0,0 +1,115 @@
+// ── Security response-header grading, modeled on securityheaders.com / Mozilla Observatory methodology ──
+
+function headerVal(headers, name) {
+  const v = headers.get?.(name) ?? headers[name] ?? headers[name.toLowerCase()];
+  return v == null ? null : String(v);
+}
+
+export function gradeCookies(setCookieHeaders = []) {
+  const findings = [];
+  for (const raw of setCookieHeaders) {
+    const name = raw.split('=')[0]?.trim() || 'cookie';
+    const lower = raw.toLowerCase();
+    const issues = [];
+    if (!lower.includes('secure')) issues.push('missing Secure');
+    if (!lower.includes('httponly')) issues.push('missing HttpOnly');
+    if (!lower.includes('samesite')) issues.push('missing SameSite');
+    if (issues.length) findings.push({ name, issues });
+  }
+  return findings;
+}
+
+export function gradeSecurityHeaders(headers, { isHttps = true } = {}) {
+  const get = (name) => headerVal(headers, name);
+  const checks = [];
+  let score = 100;
+
+  const csp = get('content-security-policy');
+  if (!csp) {
+    checks.push({ header: 'Content-Security-Policy', status: 'missing', severity: 'high', note: 'No CSP set — no defense-in-depth against XSS/injection.' });
+    score -= 20;
+  } else if (/unsafe-inline|unsafe-eval/i.test(csp)) {
+    checks.push({ header: 'Content-Security-Policy', status: 'weak', severity: 'medium', note: `Present but allows 'unsafe-inline'/'unsafe-eval'.` });
+    score -= 8;
+  } else {
+    checks.push({ header: 'Content-Security-Policy', status: 'present', severity: 'ok', note: 'Present.' });
+  }
+
+  const hsts = get('strict-transport-security');
+  if (isHttps && !hsts) {
+    checks.push({ header: 'Strict-Transport-Security', status: 'missing', severity: 'high', note: 'HTTPS site without HSTS — vulnerable to protocol downgrade/SSL-stripping.' });
+    score -= 15;
+  } else if (hsts) {
+    const maxAge = Number(/max-age=(\d+)/i.exec(hsts)?.[1] || 0);
+    if (maxAge < 15552000) {
+      checks.push({ header: 'Strict-Transport-Security', status: 'weak', severity: 'low', note: `max-age is only ${maxAge}s (recommended >= 6 months).` });
+      score -= 4;
+    } else {
+      checks.push({ header: 'Strict-Transport-Security', status: 'present', severity: 'ok', note: 'Present with adequate max-age.' });
+    }
+  }
+
+  const xfo = get('x-frame-options');
+  const cspFrameAncestors = /frame-ancestors/i.test(csp || '');
+  if (!xfo && !cspFrameAncestors) {
+    checks.push({ header: 'X-Frame-Options', status: 'missing', severity: 'medium', note: 'No clickjacking protection (no X-Frame-Options or CSP frame-ancestors).' });
+    score -= 10;
+  } else {
+    checks.push({ header: 'X-Frame-Options / frame-ancestors', status: 'present', severity: 'ok', note: 'Clickjacking protection present.' });
+  }
+
+  const xcto = get('x-content-type-options');
+  if (!xcto || !/nosniff/i.test(xcto)) {
+    checks.push({ header: 'X-Content-Type-Options', status: 'missing', severity: 'low', note: 'MIME-sniffing not disabled.' });
+    score -= 6;
+  } else {
+    checks.push({ header: 'X-Content-Type-Options', status: 'present', severity: 'ok', note: 'nosniff set.' });
+  }
+
+  const refPol = get('referrer-policy');
+  if (!refPol) {
+    checks.push({ header: 'Referrer-Policy', status: 'missing', severity: 'low', note: 'No referrer policy — full URLs (possibly with tokens) may leak to third parties.' });
+    score -= 6;
+  } else {
+    checks.push({ header: 'Referrer-Policy', status: 'present', severity: 'ok', note: `Set to "${refPol}".` });
+  }
+
+  const permPol = get('permissions-policy');
+  if (!permPol) {
+    checks.push({ header: 'Permissions-Policy', status: 'missing', severity: 'low', note: 'No restriction on powerful browser features (camera, mic, geolocation, etc).' });
+    score -= 5;
+  } else {
+    checks.push({ header: 'Permissions-Policy', status: 'present', severity: 'ok', note: 'Present.' });
+  }
+
+  const coop = get('cross-origin-opener-policy');
+  if (!coop) {
+    checks.push({ header: 'Cross-Origin-Opener-Policy', status: 'missing', severity: 'low', note: 'No COOP — window.opener-based attacks (e.g. tabnabbing) not mitigated.' });
+    score -= 4;
+  } else {
+    checks.push({ header: 'Cross-Origin-Opener-Policy', status: 'present', severity: 'ok', note: 'Present.' });
+  }
+
+  const corp = get('cross-origin-resource-policy');
+  if (!corp) {
+    checks.push({ header: 'Cross-Origin-Resource-Policy', status: 'missing', severity: 'info', note: 'Not set (defense-in-depth for cross-origin resource embedding).' });
+    score -= 2;
+  } else {
+    checks.push({ header: 'Cross-Origin-Resource-Policy', status: 'present', severity: 'ok', note: 'Present.' });
+  }
+
+  const serverHeader = get('server');
+  const poweredBy = get('x-powered-by');
+  if (serverHeader && /\d/.test(serverHeader)) {
+    checks.push({ header: 'Server', status: 'disclosure', severity: 'low', note: `Reveals version info: "${serverHeader}".` });
+    score -= 3;
+  }
+  if (poweredBy) {
+    checks.push({ header: 'X-Powered-By', status: 'disclosure', severity: 'low', note: `Reveals stack info: "${poweredBy}".` });
+    score -= 3;
+  }
+
+  score = Math.max(0, Math.min(100, score));
+  const grade = score >= 95 ? 'A+' : score >= 85 ? 'A' : score >= 75 ? 'B' : score >= 60 ? 'C' : score >= 40 ? 'D' : 'F';
+  return { score, grade, checks };
+}

package/scripts/lib/security-txt.mjs

@@ -0,0 +1,69 @@
+/**
+ * security.txt (RFC 9116): how researchers report vulnerabilities to you.
+ *
+ * Looks for /.well-known/security.txt (the RFC's location), falling back to
+ * /security.txt (legacy), and validates what the RFC requires:
+ *  - Contact: at least one (mailto:, https: or tel: URI)
+ *  - Expires: exactly one, an ISO 8601 date in the future (the RFC
+ *    recommends less than a year ahead)
+ *  - served over HTTPS as text/plain
+ *  - Canonical, if present, should include the URL it was fetched from
+ * and notes the optional fields (Policy, Encryption, Acknowledgments,
+ * Preferred-Languages, Hiring) and whether it's PGP-signed.
+ */
+export async function checkSecurityTxt(origin, { timeoutMs = 8000, now = new Date() } = {}) {
+  const candidates = ['/.well-known/security.txt', '/security.txt'];
+  for (const path of candidates) {
+    const url = new URL(path, origin).toString();
+    let res;
+    let text = '';
+    try {
+      const ctrl = new AbortController();
+      const timer = setTimeout(() => ctrl.abort(), timeoutMs);
+      res = await fetch(url, { redirect: 'follow', signal: ctrl.signal, headers: { 'user-agent': 'Universal-Security-Audit security.txt check' } });
+      clearTimeout(timer);
+      text = res.ok ? await res.text() : '';
+    } catch {
+      continue;
+    }
+    if (!res.ok || !text.trim() || /<html|<!doctype/i.test(text.slice(0, 200))) continue;
+    return { found: true, url, legacyLocation: path === '/security.txt', ...validate(text, url, res, now) };
+  }
+  return { found: false, url: new URL(candidates[0], origin).toString(), problems: [], warnings: [], fields: {} };
+}
+
+function validate(text, url, res, now) {
+  const signed = text.includes('-----BEGIN PGP SIGNED MESSAGE-----');
+  const fields = {};
+  for (const raw of text.split(/\r?\n/)) {
+    const line = raw.trim();
+    if (!line || line.startsWith('#') || line.startsWith('-----')) continue;
+    const i = line.indexOf(':');
+    if (i < 1) continue;
+    const key = line.slice(0, i).trim().toLowerCase();
+    (fields[key] ||= []).push(line.slice(i + 1).trim());
+  }
+  const problems = [];
+  const warnings = [];
+  const contacts = fields.contact || [];
+  if (!contacts.length) problems.push('No Contact field (required): add at least one, e.g. "Contact: mailto:security@example.com".');
+  for (const c of contacts) {
+    if (!/^(mailto:|https:|tel:)/i.test(c)) problems.push(`Contact "${c}" isn't a mailto:, https: or tel: URI.`);
+  }
+  const expires = fields.expires || [];
+  if (!expires.length) problems.push('No Expires field (required): add one, e.g. "Expires: 2027-06-30T00:00:00Z".');
+  else if (expires.length > 1) problems.push('More than one Expires field (only one is allowed).');
+  else {
+    const when = new Date(expires[0]);
+    if (Number.isNaN(when.getTime())) problems.push(`Expires "${expires[0]}" isn't a valid ISO 8601 date.`);
+    else if (when <= now) problems.push(`Expired on ${when.toISOString().slice(0, 10)}: researchers are told to treat the file as stale. Update Expires.`);
+    else if (when - now > 366 * 86400000) warnings.push(`Expires is more than a year ahead (${when.toISOString().slice(0, 10)}); the RFC recommends under a year so the file gets reviewed.`);
+  }
+  if (!url.startsWith('https:')) problems.push('Served over plain HTTP; security.txt must be served over HTTPS.');
+  const type = res.headers.get('content-type') || '';
+  if (!/^text\/plain/i.test(type)) warnings.push(`Content-Type is "${type || 'missing'}"; it should be text/plain; charset=utf-8.`);
+  const canonical = fields.canonical || [];
+  if (canonical.length && !canonical.some((c) => c.replace(/\/$/, '') === url.replace(/\/$/, ''))) warnings.push(`Canonical (${canonical.join(', ')}) doesn't list the URL it was served from (${url}).`);
+  if (!fields.policy) warnings.push('No Policy field: link to a vulnerability disclosure policy so researchers know the rules.');
+  return { problems, warnings, signed, fields: Object.fromEntries(Object.entries(fields).map(([k, v]) => [k, v.join(' | ')])) };
+}

package/scripts/lib/subdomain-enum.mjs

@@ -0,0 +1,64 @@
+// ── Passive subdomain enumeration via crt.sh (certificate-transparency log search). Purely reads
+// public CT log data — no active DNS brute force. Optional liveness check is a single HEAD request
+// per discovered host, capped by --intensity. ──
+import dns from 'node:dns/promises';
+
+// crt.sh is a free community service that frequently returns 502/503 under load or takes 10-20s+ to
+// respond — this is normal for it, not a sign anything is wrong. Retry with backoff before giving up.
+export async function enumerateSubdomainsCrtSh(domain, { timeoutMs = 20000, retries = 2 } = {}) {
+  let lastError = null;
+  for (let attempt = 0; attempt <= retries; attempt++) {
+    const controller = new AbortController();
+    const t = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+      const res = await fetch(`https://crt.sh/?q=%25.${encodeURIComponent(domain)}&output=json`, {
+        headers: { 'user-agent': 'Universal-Security-Audit', accept: 'application/json' },
+        signal: controller.signal,
+      });
+      clearTimeout(t);
+      if (!res.ok) { lastError = `HTTP ${res.status}`; }
+      else {
+        const data = await res.json().catch(() => []);
+        const names = new Set();
+        for (const entry of data) {
+          for (const raw of String(entry.name_value || '').split('\n')) {
+            const name = raw.trim().toLowerCase().replace(/^\*\./, '');
+            if (name.endsWith(domain) && name !== domain && !name.includes(' ')) names.add(name);
+          }
+        }
+        return { checked: true, subdomains: [...names].sort() };
+      }
+    } catch (e) {
+      clearTimeout(t);
+      lastError = String(e?.message || e);
+    }
+    if (attempt < retries) await new Promise((r) => setTimeout(r, 2000 * (attempt + 1)));
+  }
+  return { checked: false, error: lastError, subdomains: [] };
+}
+
+export async function checkLiveness(hostnames = [], { limit = 15, concurrency = 8, timeoutMs = 5000, onProgress = null } = {}) {
+  const queue = hostnames.slice(0, limit);
+  const total = queue.length;
+  const results = [];
+  async function worker() {
+    while (queue.length) {
+      const host = queue.shift();
+      let resolved = false;
+      try { await dns.resolve(host); resolved = true; } catch {}
+      if (!resolved) { results.push({ host, alive: false, resolved: false }); if (onProgress) onProgress(results.length, total, { host, alive: false }); continue; }
+      try {
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), timeoutMs);
+        const res = await fetch(`https://${host}/`, { method: 'HEAD', redirect: 'manual', signal: controller.signal, headers: { 'user-agent': 'Universal-Security-Audit' } });
+        clearTimeout(timer);
+        results.push({ host, alive: true, resolved: true, status: res.status });
+      } catch {
+        results.push({ host, alive: false, resolved: true });
+      }
+      if (onProgress) onProgress(results.length, total, results[results.length - 1]);
+    }
+  }
+  await Promise.all(Array.from({ length: Math.min(concurrency, queue.length || 1) }, worker));
+  return results;
+}

package/scripts/lib/tls-enum.mjs

@@ -0,0 +1,49 @@
+// ── TLS protocol-version enumeration: actually attempts a handshake pinned to each protocol
+// version, rather than only reporting whatever the server negotiated on one default connection.
+// Node's bundled OpenSSL refuses to even attempt TLSv1/TLSv1.1 by default (SECLEVEL restriction) —
+// `@SECLEVEL=0` in the cipher string lifts that CLIENT-side restriction so the server's real answer
+// comes through. Forcing individually weak cipher suites (RC4/3DES/NULL/export-grade) is NOT
+// included: modern Node's OpenSSL build has those compiled out entirely ("no cipher match" even
+// with SECLEVEL=0), so we cannot reliably ask the server that question from this client at all —
+// claiming to test for them would risk a false "not vulnerable" reading. ──
+import tls from 'node:tls';
+
+const PROTOCOLS = ['TLSv1', 'TLSv1.1', 'TLSv1.2', 'TLSv1.3'];
+const LEGACY_PROTOCOLS = new Set(['TLSv1', 'TLSv1.1']);
+
+function probeProtocol(host, port, protocol, timeoutMs) {
+  return new Promise((resolve) => {
+    let settled = false;
+    let socket;
+    try {
+      socket = tls.connect({
+        host, port, servername: host, minVersion: protocol, maxVersion: protocol,
+        rejectUnauthorized: false, timeout: timeoutMs, ciphers: 'DEFAULT@SECLEVEL=0',
+      });
+    } catch (e) {
+      resolve({ protocol, supported: false, testable: true, error: String(e?.message || e) });
+      return;
+    }
+    const finish = (supported, error) => {
+      if (settled) return;
+      settled = true;
+      socket.destroy();
+      resolve({ protocol, supported, testable: true, error: error || null });
+    };
+    socket.setTimeout(timeoutMs, () => finish(false, 'timeout'));
+    socket.once('secureConnect', () => finish(true, null));
+    socket.once('error', (e) => finish(false, String(e?.message || e)));
+  });
+}
+
+export async function enumerateTlsProtocols(host, { port = 443, timeoutMs = 6000 } = {}) {
+  const results = [];
+  for (const protocol of PROTOCOLS) {
+    results.push(await probeProtocol(host, port, protocol, timeoutMs));
+  }
+  return results;
+}
+
+export function getWeakProtocolFindings(protocolResults = []) {
+  return protocolResults.filter((r) => r.supported && LEGACY_PROTOCOLS.has(r.protocol));
+}

package/scripts/lib/vuln-lookup.mjs

@@ -0,0 +1,118 @@
+// ── Live vulnerability data sources: OSV.dev (npm-ecosystem JS libs) + WPScan (WordPress core/plugins/themes) ──
+
+const osvCache = new Map();
+const wpscanCache = new Map();
+
+// Map detected front-end library names to their npm package name for OSV lookups.
+const NPM_ECOSYSTEM_NAMES = {
+  jquery: 'jquery',
+  'jquery-ui': 'jquery-ui',
+  bootstrap: 'bootstrap',
+  lodash: 'lodash',
+  underscore: 'underscore',
+  angular: '@angular/core',
+  angularjs: 'angular',
+  react: 'react',
+  'react-dom': 'react-dom',
+  vue: 'vue',
+  moment: 'moment',
+  handlebars: 'handlebars',
+  swiper: 'swiper',
+  slick: 'slick-carousel',
+  fancybox: '@fancyapps/fancybox',
+  'font-awesome': 'font-awesome',
+  gsap: 'gsap',
+  d3: 'd3',
+  chartjs: 'chart.js',
+  'chart.js': 'chart.js',
+  select2: 'select2',
+  axios: 'axios',
+};
+
+export function npmPackageNameFor(libName) {
+  return NPM_ECOSYSTEM_NAMES[String(libName || '').toLowerCase()] || null;
+}
+
+export async function osvLookup(packageName, version) {
+  if (!packageName || !version) return { checked: false, vulns: [] };
+  const key = `${packageName}@${version}`;
+  if (osvCache.has(key)) return osvCache.get(key);
+  const result = { checked: true, vulns: [], error: null };
+  try {
+    const res = await fetch('https://api.osv.dev/v1/query', {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ version, package: { name: packageName, ecosystem: 'npm' } }),
+    });
+    if (res.ok) {
+      const data = await res.json();
+      result.vulns = (data.vulns || []).map((v) => ({
+        id: v.id,
+        summary: v.summary || v.details?.slice(0, 200) || '',
+        severity: (v.severity || []).map((s) => s.score).join(', ') || (v.database_specific?.severity || ''),
+        url: v.references?.find((r) => r.type === 'ADVISORY' || r.type === 'WEB')?.url || `https://osv.dev/vulnerability/${v.id}`,
+      }));
+    } else {
+      result.error = `HTTP ${res.status}`;
+    }
+  } catch (e) {
+    result.error = String(e?.message || e);
+  }
+  osvCache.set(key, result);
+  return result;
+}
+
+function wpscanHeaders(apiKey) {
+  return apiKey ? { Authorization: `Token token=${apiKey}` } : {};
+}
+
+async function wpscanGet(pathSegment, apiKey) {
+  const key = pathSegment;
+  if (wpscanCache.has(key)) return wpscanCache.get(key);
+  const result = { checked: true, vulns: [], error: null, rateLimited: false };
+  try {
+    const res = await fetch(`https://wpscan.com/api/v3/${pathSegment}`, { headers: wpscanHeaders(apiKey) });
+    if (res.status === 429) {
+      result.error = 'rate_limited';
+      result.rateLimited = true;
+    } else if (res.status === 401 || res.status === 403) {
+      result.error = 'unauthorized (check WPSCAN_API_KEY)';
+    } else if (res.status === 404) {
+      // Not found = no known record for this slug/version; not an error.
+    } else if (res.ok) {
+      const data = await res.json();
+      for (const entry of Object.values(data)) {
+        for (const v of entry.vulnerabilities || []) {
+          result.vulns.push({
+            id: v.id,
+            title: v.title,
+            fixedIn: v.fixed_in || null,
+            references: v.references?.url || v.references || [],
+          });
+        }
+      }
+    } else {
+      result.error = `HTTP ${res.status}`;
+    }
+  } catch (e) {
+    result.error = String(e?.message || e);
+  }
+  wpscanCache.set(key, result);
+  return result;
+}
+
+export async function wpscanCoreLookup(version, apiKey) {
+  if (!version) return { checked: false, vulns: [] };
+  const normalized = version.replace(/\./g, '');
+  return wpscanGet(`wordpresses/${normalized}`, apiKey);
+}
+
+export async function wpscanPluginLookup(slug, apiKey) {
+  if (!slug) return { checked: false, vulns: [] };
+  return wpscanGet(`plugins/${encodeURIComponent(slug)}`, apiKey);
+}
+
+export async function wpscanThemeLookup(slug, apiKey) {
+  if (!slug) return { checked: false, vulns: [] };
+  return wpscanGet(`themes/${encodeURIComponent(slug)}`, apiKey);
+}

package/scripts/lib/whois-lookup.mjs

@@ -0,0 +1,44 @@
+// ── Domain registration lookup via RDAP (the modern, HTTP/JSON successor to WHOIS). Uses rdap.org's
+// bootstrap redirector so we never need to know which registry serves a given TLD, and never need
+// to shell out to a system `whois` binary that may not exist on the host (containers, Windows, etc). ──
+
+function findValue(entities, role, key) {
+  const entity = (entities || []).find((e) => (e.roles || []).includes(role));
+  return entity?.vcardArray?.[1]?.find((f) => f[0] === key)?.[3] || null;
+}
+
+export async function rdapLookup(domain, { timeoutMs = 10000 } = {}) {
+  const controller = new AbortController();
+  const t = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const res = await fetch(`https://rdap.org/domain/${encodeURIComponent(domain)}`, {
+      headers: { 'user-agent': 'Universal-Security-Audit', accept: 'application/rdap+json' },
+      signal: controller.signal,
+      redirect: 'follow',
+    });
+    clearTimeout(t);
+    if (!res.ok) return { checked: false, error: `HTTP ${res.status}` };
+    const data = await res.json();
+    const events = data.events || [];
+    const registration = events.find((e) => e.eventAction === 'registration')?.eventDate || null;
+    const expiration = events.find((e) => e.eventAction === 'expiration')?.eventDate || null;
+    const lastChanged = events.find((e) => e.eventAction === 'last changed')?.eventDate || null;
+    const registrar = findValue(data.entities, 'registrar', 'fn') || data.entities?.find((e) => (e.roles || []).includes('registrar'))?.handle || null;
+    const registrantOrg = findValue(data.entities, 'registrant', 'org') || findValue(data.entities, 'registrant', 'fn');
+    const nameservers = (data.nameservers || []).map((ns) => ns.ldhName).filter(Boolean);
+    const statuses = data.status || [];
+
+    let daysUntilExpiration = null;
+    if (expiration) daysUntilExpiration = Math.round((new Date(expiration) - Date.now()) / (1000 * 60 * 60 * 24));
+
+    return {
+      checked: true, registrar, registrantOrg: registrantOrg || null, registration, expiration, lastChanged,
+      nameservers, statuses, daysUntilExpiration,
+      isExpiringSoon: daysUntilExpiration != null && daysUntilExpiration >= 0 && daysUntilExpiration < 30,
+      isExpired: daysUntilExpiration != null && daysUntilExpiration < 0,
+    };
+  } catch (e) {
+    clearTimeout(t);
+    return { checked: false, error: String(e?.message || e) };
+  }
+}