@profullstack/threatcrush 0.6.2 → 0.7.1

package/dist/daemon.js

@@ -4310,111 +4310,7 @@ function workerId() {
   return `${import_node_os4.default.hostname()}/${process.pid}`;
 }
 
-// src/scan/dependencies.ts
-var import_node_fs10 = require("fs");
-var import_node_path5 = require("path");
-var LOCKFILES = [
-  { file: "package-lock.json", ecosystem: "npm" },
-  { file: "pnpm-lock.yaml", ecosystem: "npm" },
-  { file: "yarn.lock", ecosystem: "npm" },
-  { file: "requirements.txt", ecosystem: "PyPI" },
-  { file: "Pipfile.lock", ecosystem: "PyPI" }
-];
-var MAX_DEPS_PER_LOCKFILE = 50;
-async function scanDependencies(targetPath) {
-  const findings = [];
-  for (const { file, ecosystem } of LOCKFILES) {
-    const lockPath = (0, import_node_path5.join)(targetPath, file);
-    if (!(0, import_node_fs10.existsSync)(lockPath)) continue;
-    let deps;
-    try {
-      deps = parseDependencies(lockPath, file);
-    } catch {
-      continue;
-    }
-    for (const dep of deps.slice(0, MAX_DEPS_PER_LOCKFILE)) {
-      let vulns;
-      try {
-        vulns = await queryOsv(dep.name, dep.version, ecosystem);
-      } catch {
-        continue;
-      }
-      for (const vuln of vulns) {
-        const cvss = vuln.severity?.find((entry) => entry.type === "CVSS_V3")?.score;
-        findings.push({
-          ruleId: "dependency-known-vulnerability",
-          title: "Dependency CVE",
-          file,
-          line: 1,
-          severity: severityFromCvss(cvss),
-          confidence: "evidence",
-          message: `${dep.name}@${dep.version}: ${vuln.summary ?? vuln.id}`,
-          consequence: "A published advisory exists for the exact version resolved in this lockfile.",
-          excerpt: `${vuln.id}${cvss ? ` (CVSS: ${cvss})` : ""}`,
-          category: "dependency"
-        });
-      }
-    }
-  }
-  return findings;
-}
-function severityFromCvss(score) {
-  if (!score) return "medium";
-  const value = Number.parseFloat(score);
-  if (Number.isNaN(value)) return "medium";
-  if (value >= 9) return "critical";
-  if (value >= 7) return "high";
-  if (value >= 4) return "medium";
-  return "low";
-}
-function parseDependencies(lockPath, filename) {
-  const deps = [];
-  if (filename === "package-lock.json") {
-    const lock = JSON.parse((0, import_node_fs10.readFileSync)(lockPath, "utf-8"));
-    const packages = lock.packages ?? lock.dependencies ?? {};
-    for (const [key, value] of Object.entries(packages)) {
-      const name = key.replace(/^node_modules\//, "");
-      const version = value?.version;
-      if (name && version && !name.startsWith(".")) deps.push({ name, version });
-    }
-    return deps;
-  }
-  if (filename === "requirements.txt") {
-    for (const line of (0, import_node_fs10.readFileSync)(lockPath, "utf-8").split("\n")) {
-      const match = /^([a-zA-Z0-9_.-]+)==([0-9.]+)/.exec(line);
-      if (match?.[1] && match[2]) deps.push({ name: match[1], version: match[2] });
-    }
-  }
-  return deps;
-}
-function isValidPackageName(name) {
-  return /^[@a-zA-Z0-9_.\-/]{1,214}$/.test(name);
-}
-function isValidVersion(version) {
-  return /^[0-9a-zA-Z._\-+]{1,50}$/.test(version);
-}
-async function queryOsv(name, version, ecosystem) {
-  if (!isValidPackageName(name) || !isValidVersion(version)) return [];
-  try {
-    const response = await fetch("https://api.osv.dev/v1/query", {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ package: { name, ecosystem }, version }),
-      signal: AbortSignal.timeout(5e3)
-    });
-    if (!response.ok) return [];
-    const data = await response.json();
-    return data.vulns ?? [];
-  } catch {
-    return [];
-  }
-}
-
-// src/scan/engine.ts
-var import_node_fs11 = require("fs");
-var import_node_path6 = require("path");
-
-// src/scan/types.ts
+// ../../packages/scan/src/types.ts
 var SEVERITY_ORDER = ["info", "low", "medium", "high", "critical"];
 function severityRank(severity) {
   const index = SEVERITY_ORDER.indexOf(severity);
@@ -4425,7 +4321,7 @@ function severityFor(declared, confidence) {
   return severityRank(declared) > severityRank("medium") ? "medium" : declared;
 }
 
-// src/scan/code-rules.ts
+// ../../packages/scan/src/code-rules.ts
 var UNTRUSTED_JS = /\b(?:req|request|ctx|context)\s*\.\s*(?:body|query|params|param|headers|cookies|url|files)\b|\bprocess\.argv\b|\bwindow\.location\b|\bdocument\.location\b|\blocation\.(?:search|hash|href)\b|\bsearchParams\s*\.\s*(?:get|getAll|has|entries|keys|values|forEach)\b|\bgetParameter\s*\(|\bgetQueryString\s*\(|\bgetInputStream\s*\(/;
 var UNTRUSTED_PY = /\brequest\b|\bparams\b|\bflask\b|\bsys\.argv\b|\bos\.environ\b\s*\[/;
 var UNTRUSTED_RB = /\bparams\s*\[|\brequest\b|\bcookies\s*\[/;
@@ -4809,6 +4705,7 @@ var CODE_RULES = [
   },
   {
     id: "tls-verification-disabled",
+    inherent: true,
     title: "TLS certificate verification disabled",
     consequence: "Every connection made this way is trivially interceptable; the encryption is decorative.",
     cwe: "CWE-295",
@@ -4902,6 +4799,7 @@ var CODE_RULES = [
   // of privileged work actually happens, and they run as whoever invoked them.
   {
     id: "sh-remote-script-execution",
+    inherent: true,
     title: "network output piped into a shell",
     consequence: "Whatever that URL serves at the moment this runs is executed as the invoking user. There is no version, no signature, and no review \u2014 a compromise of the host, or anyone able to answer for it, is a compromise of every machine that runs the script.",
     cwe: "CWE-494",
@@ -4957,6 +4855,7 @@ var CODE_RULES = [
   },
   {
     id: "sh-insecure-transport-flag",
+    inherent: true,
     title: "certificate verification disabled",
     consequence: "Anyone positioned between this host and the server can substitute the response. When the response is a package, a key or a script, that is remote code execution with the transport doing nothing to stop it.",
     cwe: "CWE-295",
@@ -4971,6 +4870,7 @@ var CODE_RULES = [
   },
   {
     id: "sh-plaintext-download",
+    inherent: true,
     title: "download over plain HTTP",
     consequence: "The response arrives unauthenticated over a channel any intermediary can rewrite. Where the payload is an archive, a package list or a key, substituting it is straightforward and leaves nothing for the script to notice.",
     cwe: "CWE-319",
@@ -4982,6 +4882,7 @@ var CODE_RULES = [
   },
   {
     id: "sh-world-writable-permissions",
+    inherent: true,
     title: "world-writable permissions",
     consequence: "Any local account can rewrite the file. If it is a script, a config or anything on a privileged path, the next process to read it runs someone else\u2019s content.",
     cwe: "CWE-732",
@@ -5099,6 +5000,91 @@ var CODE_RULES = [
     languages: ["php"],
     pattern: /\bextract\s*\(\s*\$_(?:GET|POST|REQUEST|COOKIE)\b|\bimport_request_variables\s*\(/,
     guard: false
+  },
+  // ── Java and Go: classes the other languages already had ─────────────────
+  //
+  // Command injection, SSRF and path traversal were implemented for JavaScript
+  // and, in part, for Go, and never for Java — so the same defect in the same
+  // codebase was reported or not depending on which file it lived in. TLS
+  // verification, weak hashing and insecure randomness are deliberately absent
+  // here: `tls-verification-disabled`, `weak-hash-on-credential` and
+  // `insecure-randomness-for-secret` are language-agnostic and already cover
+  // both, including Go's `InsecureSkipVerify` and Java's `MessageDigest`.
+  {
+    id: "java-runtime-exec-concatenation",
+    title: "Runtime.exec with a concatenated command",
+    consequence: "The single-string form of `exec` is split on whitespace and handed to the OS. A value carrying a space becomes extra arguments, and where a shell is invoked, `;` and `$(\u2026)` become extra commands.",
+    cwe: "CWE-78",
+    severity: "critical",
+    languages: ["java"],
+    // The array form — `exec(new String[]{"git", arg})` — passes argv and is
+    // the fix, so it is not matched: the `+` has to be inside the string
+    // argument for this to fire.
+    pattern: /\b(?:Runtime\s*\.\s*getRuntime\s*\(\s*\)\s*\.\s*exec|ProcessBuilder)\s*\(\s*(?:"[^"\n]*"\s*\+|\w+\s*\+\s*")/
+  },
+  {
+    id: "java-ssrf-outbound-request",
+    title: "outbound request to a computed URL",
+    consequence: "The destination is chosen by the caller, so the request can be aimed at internal services and cloud metadata endpoints that are reachable from this host and from nowhere else.",
+    cwe: "CWE-918",
+    severity: "high",
+    languages: ["java"],
+    pattern: /\bnew\s+URL\s*\(\s*(?!\s*"[a-z]+:\/\/[^"\n]*"\s*\))[^)\n]*\w|\bHttpRequest\s*\.\s*newBuilder\s*\(\s*\)\s*\.\s*uri\s*\(\s*URI\s*\.\s*create\s*\(\s*[^"\n)]/,
+    needsContext: true
+  },
+  {
+    id: "java-request-path-traversal",
+    title: "file path built from request data",
+    consequence: "A `../` sequence in the value walks out of the intended directory. The process then reads or writes wherever it lands, with its own privileges.",
+    cwe: "CWE-22",
+    severity: "high",
+    languages: ["java"],
+    pattern: /\b(?:new\s+File|new\s+FileInputStream|new\s+FileOutputStream|Paths\s*\.\s*get|Files\s*\.\s*(?:readAllBytes|newInputStream|newOutputStream|copy|delete))\s*\([^)\n]*\+/,
+    // `getCanonicalPath().startsWith(base)` is the check that makes this safe,
+    // and it is normally a line or two below the construction.
+    guard: /getCanonicalPath|toRealPath|normalize\s*\(\s*\)|\bstartsWith\s*\(/,
+    guardForward: 4,
+    needsContext: true
+  },
+  {
+    id: "java-broken-cipher",
+    inherent: true,
+    title: "broken cipher or ECB mode",
+    consequence: "DES, RC2, RC4 and Blowfish are broken or too small to rely on. ECB encrypts identical plaintext blocks to identical ciphertext blocks, so structure in the data survives encryption and is readable straight off the ciphertext.",
+    cwe: "CWE-327",
+    severity: "high",
+    languages: ["java"],
+    // Bare `"AES"` is included: the JCE resolves it to `AES/ECB/PKCS5Padding`,
+    // so the default is the mode this rule exists to catch.
+    pattern: /\bCipher\s*\.\s*getInstance\s*\(\s*"(?:DES|DESede|RC2|RC4|ARCFOUR|Blowfish)(?:\/|")|\bCipher\s*\.\s*getInstance\s*\(\s*"[^"\n]*\/ECB\/|\bCipher\s*\.\s*getInstance\s*\(\s*"AES"\s*\)/,
+    guard: false
+  },
+  {
+    id: "go-request-path-traversal",
+    title: "file path built from request data",
+    consequence: "A `../` sequence in the value walks out of the intended directory, and the handler serves or writes whatever it reaches.",
+    cwe: "CWE-22",
+    severity: "high",
+    languages: ["go"],
+    pattern: /\b(?:os\s*\.\s*(?:Open|OpenFile|ReadFile|Create|Remove|WriteFile)|ioutil\s*\.\s*(?:ReadFile|WriteFile)|http\s*\.\s*ServeFile)\s*\([^)\n]*(?:r\s*\.\s*URL|FormValue|Query\s*\(\s*\)\s*\.\s*Get|mux\s*\.\s*Vars|\bfilepath\s*\.\s*Join\s*\([^)\n]*\w)/,
+    // `filepath.Clean` alone does not bound the result to a directory, so it is
+    // not a guard here — the containment check is.
+    guard: /\bstrings\s*\.\s*HasPrefix\s*\(|\bfilepath\s*\.\s*Rel\s*\(|\bfs\s*\.\s*ValidPath\s*\(|\bhttp\s*\.\s*Dir\b/,
+    guardBack: 5,
+    guardForward: 3,
+    needsContext: true
+  },
+  {
+    id: "go-template-escaping-bypass",
+    title: "value marked as pre-escaped HTML",
+    consequence: "`template.HTML` tells `html/template` the value is already safe, which switches off the contextual escaping that makes the package worth using. Markup in the value reaches the page intact.",
+    cwe: "CWE-79",
+    severity: "high",
+    languages: ["go"],
+    // A conversion of a *variable*. `template.HTML("<br>")` on a literal is a
+    // constant the author wrote and is not a finding.
+    pattern: /\btemplate\s*\.\s*(?:HTML|JS|CSS|HTMLAttr|URL|Srcset)\s*\(\s*(?!\s*[`"])/,
+    needsContext: true
   }
 ];
 var COMMENT_PREFIX = /^\s*(?:\/\/|\/\*|\*|#|--|<!--)/;
@@ -5149,6 +5135,9 @@ function fileTextOf(lines) {
   }
   return text;
 }
+function withoutSingleQuoted(text) {
+  return text.replace(/'[^'\n]*'/g, "''");
+}
 function evaluateRule(rule, ctx) {
   if (rule.languages && !rule.languages.includes(ctx.language)) return null;
   const line = ctx.lines[ctx.index] ?? "";
@@ -5163,13 +5152,15 @@ function evaluateRule(rule, ctx) {
   const guard = rule.guard === void 0 ? GENERIC_GUARD : rule.guard;
   if (guard && (guard.test(line) || guard.test(context))) return null;
   const untrusted = untrustedPatternFor(ctx.language);
-  const contextual = untrusted.test(line) || untrusted.test(context);
+  const probeLine = ctx.language === "shell" ? withoutSingleQuoted(line) : line;
+  const probeContext = ctx.language === "shell" ? withoutSingleQuoted(context) : context;
+  const contextual = untrusted.test(probeLine) || untrusted.test(probeContext);
   if (rule.needsContext && !contextual) return null;
-  const confidence = contextual ? "contextual" : "pattern";
+  const confidence = rule.inherent ? "evidence" : contextual ? "contextual" : "pattern";
   return { rule, confidence, severity: severityFor(rule.severity, confidence) };
 }
 
-// src/scan/manifest-rules.ts
+// ../../packages/scan/src/manifest-rules.ts
 var POPULAR_NPM = [
   "react",
   "react-dom",
@@ -5444,7 +5435,7 @@ function scanRequirementsTxt(text) {
   return findings;
 }
 
-// src/scan/secret-rules.ts
+// ../../packages/scan/src/secret-rules.ts
 var SECRET_RULES = [
   {
     id: "secret-aws-access-key",
@@ -5627,7 +5618,15 @@ var SENSITIVE_FILES = [
   // match. Reporting the file itself trades a real finding for a chore.
 ];
 
-// src/scan/engine.ts
+// ../../packages/scan/src/text.ts
+function baseNameOf(path) {
+  return path.slice(path.lastIndexOf("/") + 1);
+}
+function extensionOf(path) {
+  const base = baseNameOf(path);
+  const dot = base.lastIndexOf(".");
+  return dot <= 0 ? "" : base.slice(dot);
+}
 var SKIP_DIRS = /* @__PURE__ */ new Set([
   "node_modules",
   ".git",
@@ -5736,7 +5735,7 @@ var LANGUAGE_BY_EXTENSION = {
 };
 function languageOf(filename) {
   if (filename.startsWith(".env") || filename.endsWith(".env")) return "config";
-  return LANGUAGE_BY_EXTENSION[(0, import_node_path6.extname)(filename).toLowerCase()] ?? "other";
+  return LANGUAGE_BY_EXTENSION[extensionOf(filename).toLowerCase()] ?? "other";
 }
 var LANGUAGE_BY_INTERPRETER = {
   sh: "shell",
@@ -5756,10 +5755,12 @@ var LANGUAGE_BY_INTERPRETER = {
   php: "php"
 };
 function languageOfShebang(firstLine) {
-  const match = /^#!\s*(\S+)(?:\s+(\S+))?/.exec(firstLine);
+  const match = /^#!\s*(\S+)(?:\s+(.+?))?\s*$/.exec(firstLine);
   if (!match) return null;
-  const command = (0, import_node_path6.basename)(match[1]);
-  const name = command === "env" && match[2] ? (0, import_node_path6.basename)(match[2]) : command;
+  const command = baseNameOf(match[1]);
+  const args = match[2]?.trim().split(/\s+/) ?? [];
+  const splitString = args[0] === "-S" || args[0] === "--split-string";
+  const name = command === "env" ? baseNameOf(args[splitString ? 1 : 0] ?? "") : command;
   const exact = LANGUAGE_BY_INTERPRETER[name];
   if (exact) return exact;
   const stripped = name.replace(/[\d.]+$/, "");
@@ -5861,6 +5862,10 @@ function scanManifest(relativePath, filename, text) {
     category: "manifest"
   }));
 }
+
+// ../../packages/scan/src/node/walk.ts
+var import_node_fs10 = require("fs");
+var import_node_path5 = require("path");
 function scanPath(targetPath, options = {}) {
   const maxFileBytes = options.maxFileBytes ?? 1024 * 1024;
   const allowed = options.categories ? new Set(options.categories) : null;
@@ -5870,15 +5875,15 @@ function scanPath(targetPath, options = {}) {
   let suppressed = 0;
   const rootIsDirectory = (() => {
     try {
-      return (0, import_node_fs11.statSync)(targetPath).isDirectory();
+      return (0, import_node_fs10.statSync)(targetPath).isDirectory();
     } catch {
       return true;
     }
   })();
-  const walkRoot = rootIsDirectory ? targetPath : (0, import_node_path6.dirname)(targetPath);
+  const walkRoot = rootIsDirectory ? targetPath : (0, import_node_path5.dirname)(targetPath);
   const scanFile = (fullPath, filename) => {
     const relativePath = toRelative(walkRoot, fullPath);
-    const extension = (0, import_node_path6.extname)(filename).toLowerCase();
+    const extension = (0, import_node_path5.extname)(filename).toLowerCase();
     const isManifest = filename === "package.json" || filename === "requirements.txt";
     const scannable = SCAN_EXTENSIONS.has(extension) || filename.startsWith(".env");
     const mayDeclareInterpreter = !scannable && !isManifest && extension === "";
@@ -5890,26 +5895,26 @@ function scanPath(targetPath, options = {}) {
     let handle;
     let declared = null;
     try {
-      handle = (0, import_node_fs11.openSync)(fullPath, "r");
+      handle = (0, import_node_fs10.openSync)(fullPath, "r");
     } catch {
       unreadable.push(relativePath);
       return;
     }
     try {
-      if ((0, import_node_fs11.fstatSync)(handle).size > maxFileBytes) return;
+      if ((0, import_node_fs10.fstatSync)(handle).size > maxFileBytes) return;
       if (mayDeclareInterpreter) {
         const prefix = Buffer.alloc(128);
-        const read = (0, import_node_fs11.readSync)(handle, prefix, 0, prefix.length, 0);
+        const read = (0, import_node_fs10.readSync)(handle, prefix, 0, prefix.length, 0);
         declared = languageOfShebang(prefix.subarray(0, read).toString("utf-8").split("\n", 1)[0] ?? "");
         if (!declared) return;
       }
-      text = (0, import_node_fs11.readFileSync)(handle, "utf-8");
+      text = (0, import_node_fs10.readFileSync)(handle, "utf-8");
     } catch {
       unreadable.push(relativePath);
       return;
     } finally {
       try {
-        (0, import_node_fs11.closeSync)(handle);
+        (0, import_node_fs10.closeSync)(handle);
       } catch {
       }
     }
@@ -5926,13 +5931,13 @@ function scanPath(targetPath, options = {}) {
   const walk = (currentPath) => {
     let entries;
     try {
-      entries = (0, import_node_fs11.readdirSync)(currentPath, { withFileTypes: true });
+      entries = (0, import_node_fs10.readdirSync)(currentPath, { withFileTypes: true });
     } catch {
       unreadable.push(toRelative(walkRoot, currentPath));
       return;
     }
     for (const entry of entries) {
-      const fullPath = (0, import_node_path6.join)(currentPath, entry.name);
+      const fullPath = (0, import_node_path5.join)(currentPath, entry.name);
       if (entry.isDirectory()) {
         if (SKIP_DIRS.has(entry.name)) continue;
         walk(fullPath);
@@ -5945,7 +5950,7 @@ function scanPath(targetPath, options = {}) {
   if (rootIsDirectory) {
     walk(targetPath);
   } else {
-    scanFile(targetPath, (0, import_node_path6.basename)(targetPath));
+    scanFile(targetPath, (0, import_node_path5.basename)(targetPath));
   }
   const filtered = allowed ? findings.filter((f) => allowed.has(f.category)) : findings;
   filtered.sort(
@@ -5976,11 +5981,111 @@ function recordSensitiveFile(filename, relativePath, sink, fileFindings) {
   }
 }
 function toRelative(base, target) {
-  const rel = (0, import_node_path6.relative)(base, target);
-  return (rel === "" ? target : rel).split(import_node_path6.sep).join("/");
+  const rel = (0, import_node_path5.relative)(base, target);
+  return (rel === "" ? target : rel).split(import_node_path5.sep).join("/");
+}
+
+// ../../packages/scan/src/node/dependencies.ts
+var import_node_fs11 = require("fs");
+var import_node_path6 = require("path");
+var LOCKFILES = [
+  { file: "package-lock.json", ecosystem: "npm" },
+  { file: "pnpm-lock.yaml", ecosystem: "npm" },
+  { file: "yarn.lock", ecosystem: "npm" },
+  { file: "requirements.txt", ecosystem: "PyPI" },
+  { file: "Pipfile.lock", ecosystem: "PyPI" }
+];
+var MAX_DEPS_PER_LOCKFILE = 50;
+async function scanDependencies(targetPath) {
+  const findings = [];
+  for (const { file, ecosystem } of LOCKFILES) {
+    const lockPath = (0, import_node_path6.join)(targetPath, file);
+    if (!(0, import_node_fs11.existsSync)(lockPath)) continue;
+    let deps;
+    try {
+      deps = parseDependencies(lockPath, file);
+    } catch {
+      continue;
+    }
+    for (const dep of deps.slice(0, MAX_DEPS_PER_LOCKFILE)) {
+      let vulns;
+      try {
+        vulns = await queryOsv(dep.name, dep.version, ecosystem);
+      } catch {
+        continue;
+      }
+      for (const vuln of vulns) {
+        const cvss = vuln.severity?.find((entry) => entry.type === "CVSS_V3")?.score;
+        findings.push({
+          ruleId: "dependency-known-vulnerability",
+          title: "Dependency CVE",
+          file,
+          line: 1,
+          severity: severityFromCvss(cvss),
+          confidence: "evidence",
+          message: `${dep.name}@${dep.version}: ${vuln.summary ?? vuln.id}`,
+          consequence: "A published advisory exists for the exact version resolved in this lockfile.",
+          excerpt: `${vuln.id}${cvss ? ` (CVSS: ${cvss})` : ""}`,
+          category: "dependency"
+        });
+      }
+    }
+  }
+  return findings;
+}
+function severityFromCvss(score) {
+  if (!score) return "medium";
+  const value = Number.parseFloat(score);
+  if (Number.isNaN(value)) return "medium";
+  if (value >= 9) return "critical";
+  if (value >= 7) return "high";
+  if (value >= 4) return "medium";
+  return "low";
+}
+function parseDependencies(lockPath, filename) {
+  const deps = [];
+  if (filename === "package-lock.json") {
+    const lock = JSON.parse((0, import_node_fs11.readFileSync)(lockPath, "utf-8"));
+    const packages = lock.packages ?? lock.dependencies ?? {};
+    for (const [key, value] of Object.entries(packages)) {
+      const name = key.replace(/^node_modules\//, "");
+      const version = value?.version;
+      if (name && version && !name.startsWith(".")) deps.push({ name, version });
+    }
+    return deps;
+  }
+  if (filename === "requirements.txt") {
+    for (const line of (0, import_node_fs11.readFileSync)(lockPath, "utf-8").split("\n")) {
+      const match = /^([a-zA-Z0-9_.-]+)==([0-9.]+)/.exec(line);
+      if (match?.[1] && match[2]) deps.push({ name: match[1], version: match[2] });
+    }
+  }
+  return deps;
+}
+function isValidPackageName(name) {
+  return /^[@a-zA-Z0-9_.\-/]{1,214}$/.test(name);
+}
+function isValidVersion(version) {
+  return /^[0-9a-zA-Z._\-+]{1,50}$/.test(version);
+}
+async function queryOsv(name, version, ecosystem) {
+  if (!isValidPackageName(name) || !isValidVersion(version)) return [];
+  try {
+    const response = await fetch("https://api.osv.dev/v1/query", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ package: { name, ecosystem }, version }),
+      signal: AbortSignal.timeout(5e3)
+    });
+    if (!response.ok) return [];
+    const data = await response.json();
+    return data.vulns ?? [];
+  } catch {
+    return [];
+  }
 }
 
-// src/scan/sarif.ts
+// ../../packages/scan/src/node/sarif.ts
 var import_node_crypto = require("crypto");
 var import_node_path7 = require("path");