@quantakrypto/core 0.1.0

package/dist/dependencies.js

@@ -0,0 +1,276 @@
+import { makeFinding } from "./detect-utils.js";
+import { remediationText } from "./remediation.js";
+import { CWE_BROKEN_CRYPTO } from "./cwe.js";
+/** Known quantum-vulnerable npm dependencies. */
+export const vulnerableDependencies = [
+    {
+        name: "node-forge",
+        ecosystem: "npm",
+        reason: "Pure-JS implementation of RSA, RSA-OAEP, and X.509 PKI.",
+        algorithms: ["RSA"],
+        severity: "high",
+    },
+    {
+        name: "elliptic",
+        ecosystem: "npm",
+        reason: "Elliptic-curve ECDSA/ECDH (secp256k1, p256, ed25519).",
+        algorithms: ["ECDSA", "ECDH", "EdDSA"],
+        severity: "high",
+    },
+    {
+        name: "jsrsasign",
+        ecosystem: "npm",
+        reason: "RSA/ECDSA/DSA signing, JWT, and X.509 in pure JS.",
+        algorithms: ["RSA", "ECDSA", "DSA"],
+        severity: "high",
+    },
+    {
+        name: "node-rsa",
+        ecosystem: "npm",
+        reason: "Classical RSA encryption and signing.",
+        algorithms: ["RSA"],
+        severity: "high",
+    },
+    {
+        name: "ursa",
+        ecosystem: "npm",
+        reason: "OpenSSL-backed RSA encryption and signing bindings.",
+        algorithms: ["RSA"],
+        severity: "high",
+    },
+    {
+        name: "sshpk",
+        ecosystem: "npm",
+        reason: "Parses/handles SSH and PEM keys (RSA, ECDSA, Ed25519, DSA).",
+        algorithms: ["RSA", "ECDSA", "EdDSA", "DSA"],
+        severity: "medium",
+    },
+    {
+        name: "jsonwebtoken",
+        ecosystem: "npm",
+        reason: "JWTs commonly signed with RS256/ES256 (classical RSA/ECDSA).",
+        algorithms: ["RSA", "ECDSA"],
+        severity: "high",
+    },
+    {
+        name: "jose",
+        ecosystem: "npm",
+        reason: "JWS/JWE with classical RSA-OAEP, RSA-PSS, ECDH-ES and ECDSA.",
+        algorithms: ["RSA", "ECDH", "ECDSA", "EdDSA"],
+        severity: "high",
+    },
+    {
+        name: "jws",
+        ecosystem: "npm",
+        reason: "JSON Web Signatures using classical RS/ES algorithms.",
+        algorithms: ["RSA", "ECDSA"],
+        severity: "high",
+    },
+    {
+        name: "eccrypto",
+        ecosystem: "npm",
+        reason: "ECIES (ECDH-based) encryption and ECDSA signatures.",
+        algorithms: ["ECIES", "ECDH", "ECDSA"],
+        severity: "high",
+    },
+    {
+        name: "secp256k1",
+        ecosystem: "npm",
+        reason: "secp256k1 ECDSA/ECDH bindings (blockchain keys).",
+        algorithms: ["ECDSA", "ECDH"],
+        severity: "high",
+    },
+    {
+        name: "tweetnacl",
+        ecosystem: "npm",
+        reason: "X25519 key exchange and Ed25519 signatures (modern but classical).",
+        algorithms: ["X25519", "EdDSA"],
+        severity: "low",
+    },
+    {
+        name: "ed25519",
+        ecosystem: "npm",
+        reason: "Ed25519 signatures (classical).",
+        algorithms: ["EdDSA"],
+        severity: "low",
+    },
+    {
+        name: "@noble/curves",
+        ecosystem: "npm",
+        reason: "Audited classical curves: ECDSA, ECDH, Ed25519, X25519, secp256k1.",
+        algorithms: ["ECDSA", "ECDH", "EdDSA", "X25519"],
+        severity: "medium",
+    },
+    {
+        name: "@noble/secp256k1",
+        ecosystem: "npm",
+        reason: "secp256k1 ECDSA/ECDH (classical).",
+        algorithms: ["ECDSA", "ECDH"],
+        severity: "medium",
+    },
+    {
+        name: "@noble/ed25519",
+        ecosystem: "npm",
+        reason: "Ed25519 signatures and X25519 key exchange (classical).",
+        algorithms: ["EdDSA", "X25519"],
+        severity: "low",
+    },
+    {
+        name: "paseto",
+        ecosystem: "npm",
+        reason: "PASETO public tokens signed with classical Ed25519 (v2/v4) or RSA.",
+        algorithms: ["EdDSA", "RSA"],
+        severity: "medium",
+    },
+    {
+        name: "bcrypto",
+        ecosystem: "npm",
+        reason: "Broad classical crypto suite: RSA, ECDSA, ECDH, Ed25519, DSA.",
+        algorithms: ["RSA", "ECDSA", "ECDH", "EdDSA", "DSA"],
+        severity: "high",
+    },
+    {
+        name: "ecpair",
+        ecosystem: "npm",
+        reason: "secp256k1 ECDSA key pairs for Bitcoin.",
+        algorithms: ["ECDSA"],
+        severity: "medium",
+    },
+    {
+        name: "keypair",
+        ecosystem: "npm",
+        reason: "Pure-JS RSA key pair generation.",
+        algorithms: ["RSA"],
+        severity: "high",
+    },
+];
+/** Fast lookup map by package name. */
+const BY_NAME = new Map(vulnerableDependencies.map((d) => [d.name, d]));
+/**
+ * Precompiled `"name":` lookup regex per known package (P1-9): the package set
+ * is static, so we build the (escaped-name → RegExp) map once at module load
+ * rather than recompiling a fresh RegExp per found package per manifest.
+ */
+const KEY_REGEX_BY_NAME = new Map(vulnerableDependencies.map((d) => {
+    const escaped = d.name.replace(/[.*+?^${}()|[\]\\/]/g, "\\$&");
+    return [d.name, new RegExp(`"${escaped}"\\s*:`)];
+}));
+/** Algorithm families that expose confidentiality (HNDL) rather than only signing. */
+const CONFIDENTIALITY_FAMILIES = new Set([
+    "RSA",
+    "ECDH",
+    "DH",
+    "ECIES",
+    "X25519",
+    "X448",
+]);
+/**
+ * Build a remediation string covering ALL families a package exposes (C5),
+ * rather than only `algorithms[0]`. De-duplicates the per-family recommendation
+ * strings and joins them, so a signature+KEM library points at both replacements.
+ */
+function multiFamilyRemediation(algorithms) {
+    const parts = new Set();
+    for (const a of algorithms)
+        parts.add(remediationText(a));
+    return [...parts].join("; ");
+}
+/** True if a file path looks like a manifest we can parse for dependencies. */
+export function isManifestFile(file) {
+    const base = file.split("/").pop() ?? file;
+    return base === "package.json" || base === "package-lock.json";
+}
+/**
+ * Build a finding for a vulnerable dependency located in a manifest. The
+ * location points at the line where the package name appears in the file (best
+ * effort), falling back to line 1.
+ */
+function dependencyFinding(dep, file, content, index) {
+    // Use the first listed algorithm for the headline family, but derive the
+    // remediation from ALL families the package exposes (C5).
+    const algorithm = dep.algorithms[0] ?? "unknown";
+    return makeFinding({
+        ruleId: "dep-vulnerable",
+        title: `Quantum-vulnerable dependency: ${dep.name}`,
+        category: "dependency",
+        severity: dep.severity,
+        confidence: "high",
+        algorithm,
+        // Confidentiality libs are HNDL-exposed; signature-only ones are not.
+        hndl: dep.algorithms.some((a) => CONFIDENTIALITY_FAMILIES.has(a)),
+        cwe: CWE_BROKEN_CRYPTO,
+        message: `${dep.name} — ${dep.reason}`,
+        remediation: multiFamilyRemediation(dep.algorithms),
+        file,
+        content,
+        index,
+    });
+}
+/** Locate the offset of a JSON key `"name"` in the manifest text (or 0). */
+function offsetOfKey(content, name) {
+    // Use the precompiled per-name regex (non-global; .exec from position 0).
+    const re = KEY_REGEX_BY_NAME.get(name);
+    if (!re)
+        return 0;
+    const m = re.exec(content);
+    return m ? m.index : 0;
+}
+/**
+ * Scan a single manifest file's contents for vulnerable dependencies.
+ *
+ * - `package.json`: dependencies / devDependencies / peerDependencies / optionalDependencies.
+ * - `package-lock.json` (v2/v3): the `packages` map keys (node_modules/<name>),
+ *   plus legacy `dependencies` map for v1.
+ *
+ * Returns one finding per distinct vulnerable package name found in the file.
+ */
+export function scanManifest(file, content) {
+    let json;
+    try {
+        json = JSON.parse(content);
+    }
+    catch {
+        return []; // not valid JSON — skip quietly.
+    }
+    if (json === null || typeof json !== "object")
+        return [];
+    const found = new Set();
+    const obj = json;
+    const collectFromRecord = (rec) => {
+        if (rec === null || typeof rec !== "object")
+            return;
+        for (const key of Object.keys(rec)) {
+            if (BY_NAME.has(key))
+                found.add(key);
+        }
+    };
+    // package.json dependency sections.
+    collectFromRecord(obj.dependencies);
+    collectFromRecord(obj.devDependencies);
+    collectFromRecord(obj.peerDependencies);
+    collectFromRecord(obj.optionalDependencies);
+    // package-lock.json v2/v3 "packages" map: keys are "node_modules/<name>".
+    const packages = obj.packages;
+    if (packages !== null && typeof packages === "object") {
+        for (const key of Object.keys(packages)) {
+            if (!key)
+                continue; // root package entry
+            const marker = "node_modules/";
+            const idx = key.lastIndexOf(marker);
+            const name = idx >= 0 ? key.slice(idx + marker.length) : key;
+            if (BY_NAME.has(name))
+                found.add(name);
+        }
+    }
+    const findings = [];
+    for (const name of found) {
+        const dep = BY_NAME.get(name);
+        if (!dep)
+            continue;
+        findings.push(dependencyFinding(dep, file, content, offsetOfKey(content, name)));
+    }
+    // Deterministic ordering by package name.
+    findings.sort((a, b) => (a.title < b.title ? -1 : a.title > b.title ? 1 : 0));
+    return findings;
+}
+//# sourceMappingURL=dependencies.js.map

package/dist/dependencies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dependencies.js","sourceRoot":"","sources":["../src/dependencies.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAE7C,iDAAiD;AACjD,MAAM,CAAC,MAAM,sBAAsB,GAA2B;IAC5D;QACE,IAAI,EAAE,YAAY;QAClB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,yDAAyD;QACjE,UAAU,EAAE,CAAC,KAAK,CAAC;QACnB,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,UAAU;QAChB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,uDAAuD;QAC/D,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC;QACtC,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,WAAW;QACjB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,mDAAmD;QAC3D,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC;QACnC,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,UAAU;QAChB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,uCAAuC;QAC/C,UAAU,EAAE,CAAC,KAAK,CAAC;QACnB,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,MAAM;QACZ,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,qDAAqD;QAC7D,UAAU,EAAE,CAAC,KAAK,CAAC;QACnB,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,OAAO;QACb,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,6DAA6D;QACrE,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC;QAC5C,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,cAAc;QACpB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,8DAA8D;QACtE,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,MAAM;QACZ,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,8DAA8D;QACtE,UAAU,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC;QAC7C,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,KAAK;QACX,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,uDAAuD;QAC/D,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,UAAU;QAChB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,qDAAqD;QAC7D,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC;QACtC,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,WAAW;QACjB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,kDAAkD;QAC1D,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;QAC7B,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,WAAW;QACjB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,oEAAoE;QAC5E,UAAU,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC;QAC/B,QAAQ,EAAE,KAAK;KAChB;IACD;QACE,IAAI,EAAE,SAAS;QACf,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,iCAAiC;QACzC,UAAU,EAAE,CAAC,OAAO,CAAC;QACrB,QAAQ,EAAE,KAAK;KAChB;IACD;QACE,IAAI,EAAE,eAAe;QACrB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,oEAAoE;QAC5E,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC;QAChD,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,mCAAmC;QAC3C,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;QAC7B,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,yDAAyD;QACjE,UAAU,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC;QAC/B,QAAQ,EAAE,KAAK;KAChB;IACD;QACE,IAAI,EAAE,QAAQ;QACd,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,oEAAoE;QAC5E,UAAU,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC;QAC5B,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,SAAS;QACf,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,+DAA+D;QACvE,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;QACpD,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,QAAQ;QACd,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,wCAAwC;QAChD,UAAU,EAAE,CAAC,OAAO,CAAC;QACrB,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,SAAS;QACf,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,kCAAkC;QAC1C,UAAU,EAAE,CAAC,KAAK,CAAC;QACnB,QAAQ,EAAE,MAAM;KACjB;CACF,CAAC;AAEF,uCAAuC;AACvC,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAC/C,CAAC;AAEF;;;;GAIG;AACH,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAC/B,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAoB,EAAE;IACjD,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,sBAAsB,EAAE,MAAM,CAAC,CAAC;IAC/D,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,IAAI,OAAO,QAAQ,CAAC,CAAC,CAAC;AACnD,CAAC,CAAC,CACH,CAAC;AAEF,sFAAsF;AACtF,MAAM,wBAAwB,GAAiC,IAAI,GAAG,CAAkB;IACtF,KAAK;IACL,MAAM;IACN,IAAI;IACJ,OAAO;IACP,QAAQ;IACR,MAAM;CACP,CAAC,CAAC;AAEH;;;;GAIG;AACH,SAAS,sBAAsB,CAAC,UAAsC;IACpE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,UAAU;QAAE,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1D,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC/B,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC;IAC3C,OAAO,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,mBAAmB,CAAC;AACjE,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CACxB,GAAyB,EACzB,IAAY,EACZ,OAAe,EACf,KAAa;IAEb,yEAAyE;IACzE,0DAA0D;IAC1D,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC;IACjD,OAAO,WAAW,CAAC;QACjB,MAAM,EAAE,gBAAgB;QACxB,KAAK,EAAE,kCAAkC,GAAG,CAAC,IAAI,EAAE;QACnD,QAAQ,EAAE,YAAY;QACtB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,UAAU,EAAE,MAAM;QAClB,SAAS;QACT,sEAAsE;QACtE,IAAI,EAAE,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,wBAAwB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACjE,GAAG,EAAE,iBAAiB;QACtB,OAAO,EAAE,GAAG,GAAG,CAAC,IAAI,MAAM,GAAG,CAAC,MAAM,EAAE;QACtC,WAAW,EAAE,sBAAsB,CAAC,GAAG,CAAC,UAAU,CAAC;QACnD,IAAI;QACJ,OAAO;QACP,KAAK;KACN,CAAC,CAAC;AACL,CAAC;AAED,4EAA4E;AAC5E,SAAS,WAAW,CAAC,OAAe,EAAE,IAAY;IAChD,0EAA0E;IAC1E,MAAM,EAAE,GAAG,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC,EAAE;QAAE,OAAO,CAAC,CAAC;IAClB,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3B,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACzB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,OAAe;IACxD,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,iCAAiC;IAC9C,CAAC;IACD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IAEzD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,GAAG,GAAG,IAA+B,CAAC;IAE5C,MAAM,iBAAiB,GAAG,CAAC,GAAY,EAAQ,EAAE;QAC/C,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO;QACpD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAA8B,CAAC,EAAE,CAAC;YAC9D,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC;IAEF,oCAAoC;IACpC,iBAAiB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACpC,iBAAiB,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACvC,iBAAiB,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACxC,iBAAiB,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAE5C,0EAA0E;IAC1E,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;IAC9B,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACtD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,QAAmC,CAAC,EAAE,CAAC;YACnE,IAAI,CAAC,GAAG;gBAAE,SAAS,CAAC,qBAAqB;YACzC,MAAM,MAAM,GAAG,eAAe,CAAC;YAC/B,MAAM,GAAG,GAAG,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YACpC,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;YAC7D,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IACnF,CAAC;IACD,0CAA0C;IAC1C,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9E,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/detect-utils.d.ts

@@ -0,0 +1,63 @@
+/**
+ * Shared helpers for the regex-based source detectors: turning a string offset
+ * into a 1-based line/column, extracting a trimmed single-line snippet, and a
+ * small factory for building Finding objects with consistent remediation text.
+ */
+import type { AlgorithmFamily, Confidence, Finding, FindingCategory, Severity } from "./types.js";
+/** A 1-based line/column position derived from a character offset. */
+export interface LineCol {
+    line: number;
+    column: number;
+}
+/**
+ * Convert a 0-based character offset within `content` into a 1-based
+ * line/column. Newlines are LF; CR is treated as an ordinary character, so on
+ * CRLF files the column includes the trailing CR offset harmlessly.
+ */
+export declare function offsetToLineCol(content: string, offset: number): LineCol;
+/** Extract the (trimmed) single source line containing `offset`. */
+export declare function lineAt(content: string, offset: number): string;
+/** Inputs for {@link makeFinding}. */
+export interface FindingSpec {
+    ruleId: string;
+    title: string;
+    category: FindingCategory;
+    severity: Severity;
+    confidence: Confidence;
+    algorithm?: AlgorithmFamily;
+    hndl: boolean;
+    message: string;
+    /** Override the auto-derived remediation text. */
+    remediation?: string;
+    /** Associated CWE id (e.g. "CWE-327"). */
+    cwe?: string;
+    /** The matched source text and its start offset within `content`. */
+    file: string;
+    content: string;
+    index: number;
+    /** Length of the match, used to compute endLine for multi-line matches. */
+    matchLength?: number;
+}
+/**
+ * Build a {@link Finding} with location info derived from a match offset. When
+ * no explicit remediation is given but an algorithm is, the canonical
+ * remediation text for that family is used.
+ */
+export declare function makeFinding(spec: FindingSpec): Finding;
+/** True if `filePath` has one of the given (lower-case, dotted) extensions. */
+export declare function hasExtension(filePath: string, exts: readonly string[]): boolean;
+/** JavaScript / TypeScript source extensions handled by the source detectors. */
+export declare const JS_TS_EXTENSIONS: readonly string[];
+/**
+ * Given a SORTED ascending array of call offsets, return true when `idx` is at
+ * or after some call offset `c` with `idx - c < window`. Runs in O(log n) by
+ * binary-searching the largest call offset ≤ `idx` and checking the gap. This
+ * replaces the previous O(matches × calls) linear scan (`nearCall`).
+ */
+export declare function nearSortedCall(sortedCalls: readonly number[], idx: number, window: number): boolean;
+/**
+ * Run a global regex over `content`, invoking `onMatch` for each hit. Resets
+ * lastIndex and guards against zero-width matches (which would loop forever).
+ */
+export declare function eachMatch(re: RegExp, content: string, onMatch: (match: RegExpExecArray) => void): void;
+//# sourceMappingURL=detect-utils.d.ts.map

package/dist/detect-utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"detect-utils.d.ts","sourceRoot":"","sources":["../src/detect-utils.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAGlG,sEAAsE;AACtE,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAUxE;AAED,oEAAoE;AACpE,wBAAgB,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAM9D;AAED,sCAAsC;AACtC,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,eAAe,CAAC;IAC1B,QAAQ,EAAE,QAAQ,CAAC;IACnB,UAAU,EAAE,UAAU,CAAC;IACvB,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,0CAA0C;IAC1C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,2EAA2E;IAC3E,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAkCtD;AAED,+EAA+E;AAC/E,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAG/E;AAED,iFAAiF;AACjF,eAAO,MAAM,gBAAgB,EAAE,SAAS,MAAM,EAAmD,CAAC;AAElG;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,WAAW,EAAE,SAAS,MAAM,EAAE,EAC9B,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,GACb,OAAO,CAgBT;AAED;;;GAGG;AACH,wBAAgB,SAAS,CACvB,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,GACxC,IAAI,CAQN"}

package/dist/detect-utils.js

@@ -0,0 +1,113 @@
+import { remediationText } from "./remediation.js";
+/**
+ * Convert a 0-based character offset within `content` into a 1-based
+ * line/column. Newlines are LF; CR is treated as an ordinary character, so on
+ * CRLF files the column includes the trailing CR offset harmlessly.
+ */
+export function offsetToLineCol(content, offset) {
+    let line = 1;
+    let lastNewline = -1;
+    for (let i = 0; i < offset && i < content.length; i++) {
+        if (content.charCodeAt(i) === 10 /* \n */) {
+            line++;
+            lastNewline = i;
+        }
+    }
+    return { line, column: offset - lastNewline };
+}
+/** Extract the (trimmed) single source line containing `offset`. */
+export function lineAt(content, offset) {
+    let start = offset;
+    while (start > 0 && content.charCodeAt(start - 1) !== 10)
+        start--;
+    let end = offset;
+    while (end < content.length && content.charCodeAt(end) !== 10)
+        end++;
+    return content.slice(start, end).replace(/\r$/, "").trim();
+}
+/**
+ * Build a {@link Finding} with location info derived from a match offset. When
+ * no explicit remediation is given but an algorithm is, the canonical
+ * remediation text for that family is used.
+ */
+export function makeFinding(spec) {
+    const { line, column } = offsetToLineCol(spec.content, spec.index);
+    const snippet = lineAt(spec.content, spec.index);
+    const remediation = spec.remediation ?? (spec.algorithm ? remediationText(spec.algorithm) : undefined);
+    const location = {
+        file: spec.file,
+        line,
+        column,
+        snippet: snippet.length > 200 ? `${snippet.slice(0, 197)}...` : snippet,
+    };
+    if (spec.matchLength && spec.matchLength > 0) {
+        const matched = spec.content.slice(spec.index, spec.index + spec.matchLength);
+        const extraLines = (matched.match(/\n/g) ?? []).length;
+        if (extraLines > 0)
+            location.endLine = line + extraLines;
+    }
+    const finding = {
+        ruleId: spec.ruleId,
+        title: spec.title,
+        category: spec.category,
+        severity: spec.severity,
+        confidence: spec.confidence,
+        hndl: spec.hndl,
+        message: spec.message,
+        location,
+    };
+    if (spec.algorithm)
+        finding.algorithm = spec.algorithm;
+    if (remediation)
+        finding.remediation = remediation;
+    if (spec.cwe)
+        finding.cwe = spec.cwe;
+    return finding;
+}
+/** True if `filePath` has one of the given (lower-case, dotted) extensions. */
+export function hasExtension(filePath, exts) {
+    const lower = filePath.toLowerCase();
+    return exts.some((e) => lower.endsWith(e));
+}
+/** JavaScript / TypeScript source extensions handled by the source detectors. */
+export const JS_TS_EXTENSIONS = [".js", ".jsx", ".ts", ".tsx", ".mjs", ".cjs"];
+/**
+ * Given a SORTED ascending array of call offsets, return true when `idx` is at
+ * or after some call offset `c` with `idx - c < window`. Runs in O(log n) by
+ * binary-searching the largest call offset ≤ `idx` and checking the gap. This
+ * replaces the previous O(matches × calls) linear scan (`nearCall`).
+ */
+export function nearSortedCall(sortedCalls, idx, window) {
+    // Find the rightmost element <= idx.
+    let lo = 0;
+    let hi = sortedCalls.length - 1;
+    let best = -1;
+    while (lo <= hi) {
+        const mid = (lo + hi) >>> 1;
+        if (sortedCalls[mid] <= idx) {
+            best = mid;
+            lo = mid + 1;
+        }
+        else {
+            hi = mid - 1;
+        }
+    }
+    if (best < 0)
+        return false;
+    return idx - sortedCalls[best] < window;
+}
+/**
+ * Run a global regex over `content`, invoking `onMatch` for each hit. Resets
+ * lastIndex and guards against zero-width matches (which would loop forever).
+ */
+export function eachMatch(re, content, onMatch) {
+    const g = re.global ? re : new RegExp(re.source, `${re.flags}g`);
+    g.lastIndex = 0;
+    let m;
+    while ((m = g.exec(content)) !== null) {
+        onMatch(m);
+        if (m.index === g.lastIndex)
+            g.lastIndex++; // avoid infinite loop on empty match
+    }
+}
+//# sourceMappingURL=detect-utils.js.map

package/dist/detect-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"detect-utils.js","sourceRoot":"","sources":["../src/detect-utils.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAQnD;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe,EAAE,MAAc;IAC7D,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,WAAW,GAAG,CAAC,CAAC,CAAC;IACrB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtD,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,CAAC;YAC1C,IAAI,EAAE,CAAC;YACP,WAAW,GAAG,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,GAAG,WAAW,EAAE,CAAC;AAChD,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,MAAM,CAAC,OAAe,EAAE,MAAc;IACpD,IAAI,KAAK,GAAG,MAAM,CAAC;IACnB,OAAO,KAAK,GAAG,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,CAAC;IAClE,IAAI,GAAG,GAAG,MAAM,CAAC;IACjB,OAAO,GAAG,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE;QAAE,GAAG,EAAE,CAAC;IACrE,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AAC7D,CAAC;AAwBD;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,IAAiB;IAC3C,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACnE,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAEjD,MAAM,WAAW,GACf,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAErF,MAAM,QAAQ,GAAwB;QACpC,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,IAAI;QACJ,MAAM;QACN,OAAO,EAAE,OAAO,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO;KACxE,CAAC;IAEF,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,GAAG,CAAC,EAAE,CAAC;QAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;QAC9E,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACvD,IAAI,UAAU,GAAG,CAAC;YAAE,QAAQ,CAAC,OAAO,GAAG,IAAI,GAAG,UAAU,CAAC;IAC3D,CAAC;IAED,MAAM,OAAO,GAAY;QACvB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ;KACT,CAAC;IACF,IAAI,IAAI,CAAC,SAAS;QAAE,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IACvD,IAAI,WAAW;QAAE,OAAO,CAAC,WAAW,GAAG,WAAW,CAAC;IACnD,IAAI,IAAI,CAAC,GAAG;QAAE,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IACrC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,YAAY,CAAC,QAAgB,EAAE,IAAuB;IACpE,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACrC,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,MAAM,gBAAgB,GAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AAElG;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAC5B,WAA8B,EAC9B,GAAW,EACX,MAAc;IAEd,qCAAqC;IACrC,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,IAAI,EAAE,GAAG,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC;IAChC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC;IACd,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC;QAChB,MAAM,GAAG,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;QAC5B,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC;YAC5B,IAAI,GAAG,GAAG,CAAC;YACX,EAAE,GAAG,GAAG,GAAG,CAAC,CAAC;QACf,CAAC;aAAM,CAAC;YACN,EAAE,GAAG,GAAG,GAAG,CAAC,CAAC;QACf,CAAC;IACH,CAAC;IACD,IAAI,IAAI,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3B,OAAO,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC;AAC1C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CACvB,EAAU,EACV,OAAe,EACf,OAAyC;IAEzC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,GAAG,CAAC,CAAC;IACjE,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC;IAChB,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACtC,OAAO,CAAC,CAAC,CAAC,CAAC;QACX,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,SAAS;YAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,qCAAqC;IACnF,CAAC;AACH,CAAC"}

package/dist/detectors/pem.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Config / certificate detector: finds PEM-encoded cryptographic material in
+ * any text file (source, config, .pem, .key, .crt, .env, …). This catches
+ * embedded private keys and X.509 certificates regardless of language.
+ */
+import type { Detector } from "../types.js";
+/** Detects PEM key/certificate material in arbitrary files. */
+export declare const pemDetector: Detector;
+//# sourceMappingURL=pem.d.ts.map

package/dist/detectors/pem.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pem.d.ts","sourceRoot":"","sources":["../../src/detectors/pem.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAW,MAAM,aAAa,CAAC;AAuHrD,+DAA+D;AAC/D,eAAO,MAAM,WAAW,EAAE,QAoCzB,CAAC"}

package/dist/detectors/pem.js

@@ -0,0 +1,137 @@
+import { eachMatch, makeFinding } from "../detect-utils.js";
+import { CWE_BROKEN_CRYPTO, CWE_HARDCODED_KEY } from "../cwe.js";
+const PEM_RULES = [
+    {
+        re: /-----BEGIN RSA PRIVATE KEY-----/g,
+        ruleId: "pem-rsa-private-key",
+        title: "RSA private key (PEM)",
+        category: "certificate",
+        severity: "critical",
+        algorithm: "RSA",
+        hndl: true,
+        cwe: CWE_HARDCODED_KEY,
+        message: "Embedded RSA private key (PKCS#1 PEM); classical and not quantum-safe.",
+        remediation: "Migrate to ML-DSA / ML-KEM keys and remove embedded private keys from source.",
+    },
+    {
+        re: /-----BEGIN EC PRIVATE KEY-----/g,
+        ruleId: "pem-ec-private-key",
+        title: "EC private key (PEM)",
+        category: "certificate",
+        severity: "critical",
+        algorithm: "ECDSA",
+        hndl: true,
+        cwe: CWE_HARDCODED_KEY,
+        message: "Embedded EC private key (SEC1 PEM); classical ECDSA/ECDH key, not quantum-safe.",
+        remediation: "Migrate to ML-DSA (FIPS 204) keys and remove embedded private keys from source.",
+    },
+    {
+        re: /-----BEGIN DSA PRIVATE KEY-----/g,
+        ruleId: "pem-dsa-private-key",
+        title: "DSA private key (PEM)",
+        category: "certificate",
+        severity: "critical",
+        algorithm: "DSA",
+        hndl: false,
+        cwe: CWE_HARDCODED_KEY,
+        message: "Embedded DSA private key (PEM); classical, already deprecated, and not quantum-safe.",
+        remediation: "Rotate immediately (DSA is deprecated) and migrate to ML-DSA-65 (FIPS 204).",
+    },
+    {
+        re: /-----BEGIN OPENSSH PRIVATE KEY-----/g,
+        ruleId: "pem-openssh-private-key",
+        title: "OpenSSH private key",
+        category: "certificate",
+        severity: "critical",
+        algorithm: "unknown",
+        hndl: true,
+        cwe: CWE_HARDCODED_KEY,
+        message: "Embedded OpenSSH private key (RSA/ECDSA/Ed25519); classical and not quantum-safe.",
+        remediation: "Rotate the key; plan migration to PQC-capable SSH (e.g. sntrup761x25519).",
+    },
+    {
+        re: /-----BEGIN PGP PRIVATE KEY BLOCK-----/g,
+        ruleId: "pem-pgp-private-key",
+        title: "PGP/GPG private key block",
+        category: "certificate",
+        severity: "critical",
+        algorithm: "unknown",
+        hndl: true,
+        cwe: CWE_HARDCODED_KEY,
+        message: "Embedded PGP/GPG private key block (RSA/ECDSA/EdDSA/ElGamal); classical and not quantum-safe.",
+        remediation: "Rotate the key; track OpenPGP PQC drafts for migration.",
+    },
+    {
+        re: /-----BEGIN PGP MESSAGE-----/g,
+        ruleId: "pem-pgp-message",
+        title: "PGP/GPG encrypted message",
+        category: "certificate",
+        severity: "low",
+        algorithm: "unknown",
+        hndl: true,
+        cwe: CWE_BROKEN_CRYPTO,
+        message: "Embedded PGP/GPG message; likely encrypted with classical RSA/ElGamal (harvest-now-decrypt-later).",
+        remediation: "Re-encrypt with PQC-capable tooling as OpenPGP PQC profiles mature.",
+    },
+    {
+        re: /-----BEGIN (?:ENCRYPTED )?PRIVATE KEY-----/g,
+        ruleId: "pem-pkcs8-private-key",
+        title: "Private key (PKCS#8 PEM)",
+        category: "certificate",
+        severity: "critical",
+        algorithm: "unknown",
+        hndl: true,
+        cwe: CWE_HARDCODED_KEY,
+        message: "Embedded PKCS#8 private key; likely classical RSA/EC, not quantum-safe.",
+        remediation: "Migrate to PQC keys and remove embedded private keys from source.",
+    },
+    {
+        re: /-----BEGIN CERTIFICATE-----/g,
+        ruleId: "pem-certificate",
+        title: "X.509 certificate (PEM)",
+        category: "certificate",
+        severity: "low",
+        algorithm: "unknown",
+        hndl: false,
+        cwe: CWE_BROKEN_CRYPTO,
+        message: "Embedded X.509 certificate; almost certainly signed with classical RSA/ECDSA.",
+        remediation: "Plan re-issuance with PQC-capable CAs as ML-DSA certificate profiles mature.",
+    },
+];
+/** Detects PEM key/certificate material in arbitrary files. */
+export const pemDetector = {
+    id: "pem-material",
+    description: "PEM-encoded private keys and X.509 certificates in any file",
+    scope: "config",
+    language: "any",
+    // Applies to every text file; the walker already filters out binaries.
+    appliesTo: () => true,
+    detect({ file, content }) {
+        // Fast reject: only proceed if a PEM header is present at all.
+        if (!content.includes("-----BEGIN "))
+            return [];
+        const findings = [];
+        for (const rule of PEM_RULES) {
+            eachMatch(rule.re, content, (m) => {
+                findings.push(makeFinding({
+                    ruleId: rule.ruleId,
+                    title: rule.title,
+                    category: rule.category,
+                    severity: rule.severity,
+                    confidence: "high",
+                    algorithm: rule.algorithm,
+                    hndl: rule.hndl,
+                    cwe: rule.cwe,
+                    message: rule.message,
+                    remediation: rule.remediation,
+                    file,
+                    content,
+                    index: m.index,
+                    matchLength: m[0].length,
+                }));
+            });
+        }
+        return findings;
+    },
+};
+//# sourceMappingURL=pem.js.map

package/dist/detectors/pem.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pem.js","sourceRoot":"","sources":["../../src/detectors/pem.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAgBjE,MAAM,SAAS,GAAc;IAC3B;QACE,EAAE,EAAE,kCAAkC;QACtC,MAAM,EAAE,qBAAqB;QAC7B,KAAK,EAAE,uBAAuB;QAC9B,QAAQ,EAAE,aAAa;QACvB,QAAQ,EAAE,UAAU;QACpB,SAAS,EAAE,KAAK;QAChB,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,iBAAiB;QACtB,OAAO,EAAE,wEAAwE;QACjF,WAAW,EAAE,+EAA+E;KAC7F;IACD;QACE,EAAE,EAAE,iCAAiC;QACrC,MAAM,EAAE,oBAAoB;QAC5B,KAAK,EAAE,sBAAsB;QAC7B,QAAQ,EAAE,aAAa;QACvB,QAAQ,EAAE,UAAU;QACpB,SAAS,EAAE,OAAO;QAClB,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,iBAAiB;QACtB,OAAO,EAAE,iFAAiF;QAC1F,WAAW,EAAE,iFAAiF;KAC/F;IACD;QACE,EAAE,EAAE,kCAAkC;QACtC,MAAM,EAAE,qBAAqB;QAC7B,KAAK,EAAE,uBAAuB;QAC9B,QAAQ,EAAE,aAAa;QACvB,QAAQ,EAAE,UAAU;QACpB,SAAS,EAAE,KAAK;QAChB,IAAI,EAAE,KAAK;QACX,GAAG,EAAE,iBAAiB;QACtB,OAAO,EAAE,sFAAsF;QAC/F,WAAW,EAAE,6EAA6E;KAC3F;IACD;QACE,EAAE,EAAE,sCAAsC;QAC1C,MAAM,EAAE,yBAAyB;QACjC,KAAK,EAAE,qBAAqB;QAC5B,QAAQ,EAAE,aAAa;QACvB,QAAQ,EAAE,UAAU;QACpB,SAAS,EAAE,SAAS;QACpB,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,iBAAiB;QACtB,OAAO,EAAE,mFAAmF;QAC5F,WAAW,EAAE,2EAA2E;KACzF;IACD;QACE,EAAE,EAAE,wCAAwC;QAC5C,MAAM,EAAE,qBAAqB;QAC7B,KAAK,EAAE,2BAA2B;QAClC,QAAQ,EAAE,aAAa;QACvB,QAAQ,EAAE,UAAU;QACpB,SAAS,EAAE,SAAS;QACpB,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,iBAAiB;QACtB,OAAO,EACL,+FAA+F;QACjG,WAAW,EAAE,yDAAyD;KACvE;IACD;QACE,EAAE,EAAE,8BAA8B;QAClC,MAAM,EAAE,iBAAiB;QACzB,KAAK,EAAE,2BAA2B;QAClC,QAAQ,EAAE,aAAa;QACvB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,SAAS;QACpB,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,iBAAiB;QACtB,OAAO,EACL,oGAAoG;QACtG,WAAW,EAAE,qEAAqE;KACnF;IACD;QACE,EAAE,EAAE,6CAA6C;QACjD,MAAM,EAAE,uBAAuB;QAC/B,KAAK,EAAE,0BAA0B;QACjC,QAAQ,EAAE,aAAa;QACvB,QAAQ,EAAE,UAAU;QACpB,SAAS,EAAE,SAAS;QACpB,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,iBAAiB;QACtB,OAAO,EAAE,yEAAyE;QAClF,WAAW,EAAE,mEAAmE;KACjF;IACD;QACE,EAAE,EAAE,8BAA8B;QAClC,MAAM,EAAE,iBAAiB;QACzB,KAAK,EAAE,yBAAyB;QAChC,QAAQ,EAAE,aAAa;QACvB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,SAAS;QACpB,IAAI,EAAE,KAAK;QACX,GAAG,EAAE,iBAAiB;QACtB,OAAO,EAAE,+EAA+E;QACxF,WAAW,EAAE,8EAA8E;KAC5F;CACF,CAAC;AAEF,+DAA+D;AAC/D,MAAM,CAAC,MAAM,WAAW,GAAa;IACnC,EAAE,EAAE,cAAc;IAClB,WAAW,EAAE,6DAA6D;IAC1E,KAAK,EAAE,QAAQ;IACf,QAAQ,EAAE,KAAK;IACf,uEAAuE;IACvE,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI;IACrB,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;QACtB,+DAA+D;QAC/D,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;YAAE,OAAO,EAAE,CAAC;QAEhD,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBAChC,QAAQ,CAAC,IAAI,CACX,WAAW,CAAC;oBACV,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,UAAU,EAAE,MAAM;oBAClB,SAAS,EAAE,IAAI,CAAC,SAAS;oBACzB,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,GAAG,EAAE,IAAI,CAAC,GAAG;oBACb,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,IAAI;oBACJ,OAAO;oBACP,KAAK,EAAE,CAAC,CAAC,KAAK;oBACd,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM;iBACzB,CAAC,CACH,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC"}

package/dist/detectors/source.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Source-code detectors for classical, non-quantum-safe asymmetric cryptography
+ * in JavaScript / TypeScript. Each detector is pure and stateless: it declares
+ * which files it applies to and returns zero or more Findings for a file's
+ * contents.
+ *
+ * The detection strategy is deliberately lexical (regex over source text). This
+ * is robust to bundling and partial files and keeps the package dependency-free.
+ * Confidence is set per-pattern to reflect how specific the match is.
+ *
+ * All per-file regexes are precompiled at module scope (not re-created per
+ * file) — `eachMatch` clones a fresh stateful copy only when a regex lacks the
+ * global flag, and these are all global, so they are reused safely.
+ *
+ * HNDL (harvest-now-decrypt-later) policy:
+ *   - confidentiality primitives (key exchange / KEM: ECDH, DH, RSA-OAEP) → hndl:true
+ *   - signatures (RSA-PSS, ECDSA, EdDSA, DSA, JWT alg) → hndl:false, but still high
+ *     severity because a quantum attacker can forge them.
+ *   - EC keygen is ambiguous (an 'ec' key feeds BOTH ECDSA and ECDH); it is
+ *     classified conservatively as key-exchange-capable (hndl:true).
+ */
+import type { Detector } from "../types.js";
+/** All built-in source/config detectors, in run order. */
+export declare const sourceDetectors: Detector[];
+//# sourceMappingURL=source.d.ts.map