@theoptimalpartner/npm-security-kit 1.0.0

package/template/.github/workflows/security-audit.yml

@@ -0,0 +1,218 @@
+name: Security Audit
+
+on:
+  pull_request:
+    branches: [main, develop]
+  push:
+    branches: [main, develop]
+  schedule:
+    # Ejecutar semanalmente los lunes a las 9am UTC
+    - cron: '0 9 * * 1'
+  workflow_dispatch: # Permitir ejecución manual
+
+jobs:
+  npm-audit:
+    name: NPM Security Audit
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '18'
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Run npm audit
+        id: npm-audit
+        run: |
+          echo "Running npm audit..."
+          npm audit --audit-level=moderate || EXIT_CODE=$?
+
+          if [ $EXIT_CODE -ne 0 ]; then
+            echo "::warning::npm audit found vulnerabilities"
+            npm audit --json > npm-audit-report.json
+            echo "audit_failed=true" >> $GITHUB_OUTPUT
+          else
+            echo "::notice::No vulnerabilities found"
+            echo "audit_failed=false" >> $GITHUB_OUTPUT
+          fi
+
+          exit $EXIT_CODE
+        continue-on-error: true
+
+      - name: Upload audit report
+        if: steps.npm-audit.outputs.audit_failed == 'true'
+        uses: actions/upload-artifact@v4
+        with:
+          name: npm-audit-report
+          path: npm-audit-report.json
+          retention-days: 30
+
+      - name: Fail on critical vulnerabilities
+        if: steps.npm-audit.outputs.audit_failed == 'true'
+        run: |
+          echo "::error::Security vulnerabilities detected. Review the audit report."
+          exit 1
+
+  socket-security:
+    name: Socket.dev Security Scan
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '18'
+
+      - name: Install Socket CLI
+        run: npm install -g @socketsecurity/cli
+
+      - name: Socket Security Scan
+        run: |
+          echo "Running Socket security scan..."
+          socket npm audit || EXIT_CODE=$?
+
+          if [ $EXIT_CODE -ne 0 ]; then
+            echo "::warning::Socket detected security issues"
+          else
+            echo "::notice::No security issues detected by Socket"
+          fi
+
+  dependency-review:
+    name: Dependency Review
+    runs-on: ubuntu-latest
+    if: github.event_name == 'pull_request'
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Dependency Review
+        uses: actions/dependency-review-action@v4
+        with:
+          fail-on-severity: moderate
+          deny-licenses: GPL-3.0, AGPL-3.0
+
+  license-check:
+    name: License Compliance Check
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '18'
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Check for suspicious packages
+        run: |
+          echo "Checking for packages without licenses..."
+          npm list --json | jq -r '.dependencies | to_entries[] | select(.value.license == null or .value.license == "") | .key' || true
+
+          echo "Checking for deprecated packages..."
+          npm outdated || true
+
+  malicious-patterns:
+    name: Check for Malicious Patterns
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Check for suspicious install scripts
+        run: |
+          echo "Checking for suspicious preinstall/postinstall scripts..."
+          grep -r "preinstall\|postinstall" package.json || echo "No install scripts found"
+
+          if grep -r "preinstall\|postinstall" package.json; then
+            echo "::warning::Install scripts detected - review manually"
+          fi
+
+      - name: Check for hardcoded secrets
+        run: |
+          echo "Checking for hardcoded secrets..."
+          if grep -rE "(password|secret|api[_-]?key|token|auth).*=.*['\"]" --include="*.ts" --include="*.js" src/ 2>/dev/null; then
+            echo "::error::Potential hardcoded secrets found"
+            exit 1
+          else
+            echo "::notice::No hardcoded secrets detected"
+          fi
+
+      - name: Verify package-lock integrity
+        run: |
+          echo "Verifying package-lock.json integrity..."
+          if [ -f package-lock.json ]; then
+            npm ci --dry-run
+            echo "::notice::package-lock.json is valid"
+          else
+            echo "::error::package-lock.json not found"
+            exit 1
+          fi
+
+  known-malicious-packages:
+    name: Check Known Malicious Packages
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '18'
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Install jq
+        run: sudo apt-get install -y jq
+
+      - name: Check against malicious package blacklist
+        run: |
+          chmod +x ./scripts/check-malicious-packages.sh
+          ./scripts/check-malicious-packages.sh || EXIT_CODE=$?
+
+          if [ $EXIT_CODE -ne 0 ]; then
+            echo "::error::CRITICAL - Malicious packages detected!"
+            exit 1
+          else
+            echo "::notice::No known malicious packages detected"
+          fi
+
+  summary:
+    name: Security Summary
+    runs-on: ubuntu-latest
+    needs: [npm-audit, socket-security, dependency-review, license-check, malicious-patterns, known-malicious-packages]
+    if: always()
+
+    steps:
+      - name: Security Summary
+        run: |
+          echo "## Security Audit Summary" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "- NPM Audit: ${{ needs.npm-audit.result }}" >> $GITHUB_STEP_SUMMARY
+          echo "- Socket Security: ${{ needs.socket-security.result }}" >> $GITHUB_STEP_SUMMARY
+          echo "- Dependency Review: ${{ needs.dependency-review.result }}" >> $GITHUB_STEP_SUMMARY
+          echo "- License Check: ${{ needs.license-check.result }}" >> $GITHUB_STEP_SUMMARY
+          echo "- Malicious Patterns: ${{ needs.malicious-patterns.result }}" >> $GITHUB_STEP_SUMMARY
+          echo "- Known Malicious Packages: ${{ needs.known-malicious-packages.result }}" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "Review the individual job logs for details." >> $GITHUB_STEP_SUMMARY

package/template/.security/config.json

@@ -0,0 +1,94 @@
+{
+  "$schema": "https://json-schema.org/draft-07/schema#",
+  "projectName": "my-project",
+  "projectType": "node",
+  "version": "1.0.0",
+  "lastUpdated": "2025-10-20",
+  "settings": {
+    "strictMode": true,
+    "excludeDirs": [
+      "node_modules",
+      "dist",
+      "build",
+      ".next",
+      "coverage",
+      ".cache"
+    ],
+    "checkPatterns": true,
+    "checkTransitiveDeps": true,
+    "autoFixVulnerabilities": false
+  },
+  "notifications": {
+    "enabled": false,
+    "channels": {
+      "email": {
+        "enabled": false,
+        "addresses": []
+      },
+      "slack": {
+        "enabled": false,
+        "webhook": ""
+      },
+      "discord": {
+        "enabled": false,
+        "webhook": ""
+      }
+    }
+  },
+  "thresholds": {
+    "maxVulnerabilities": {
+      "critical": 0,
+      "high": 0,
+      "moderate": 5,
+      "low": 10
+    },
+    "maxPackageAge": {
+      "enabled": false,
+      "months": 24
+    },
+    "minDownloadsPerWeek": {
+      "enabled": false,
+      "count": 1000
+    }
+  },
+  "whitelist": {
+    "enabled": false,
+    "packages": [],
+    "authors": [],
+    "organizations": [
+      "aws-sdk",
+      "types",
+      "typescript-eslint"
+    ]
+  },
+  "integrations": {
+    "githubActions": {
+      "enabled": true,
+      "schedule": "0 9 * * 1",
+      "onPullRequest": true,
+      "onPush": true
+    },
+    "dependabot": {
+      "enabled": true,
+      "schedule": "weekly",
+      "automerge": false
+    },
+    "preCommitHooks": {
+      "enabled": false,
+      "blocking": false
+    }
+  },
+  "reporting": {
+    "format": "json",
+    "verbosity": "normal",
+    "includeTransitiveDeps": true,
+    "includeLicenses": true
+  },
+  "customBlacklist": {
+    "enabled": false,
+    "packages": [],
+    "patterns": [],
+    "domains": [],
+    "authors": []
+  }
+}

package/template/.security/malicious-packages-blacklist.json

@@ -0,0 +1,259 @@
+{
+  "lastUpdated": "2025-10-20",
+  "source": "Socket.dev - 175 Malicious npm Packages Host Phishing Infrastructure",
+  "url": "https://socket.dev/blog/175-malicious-npm-packages-host-phishing-infrastructure",
+  "threatLevel": "CRITICAL",
+  "attackType": "Supply Chain Compromise + Phishing Campaign",
+  "mitreAttack": [
+    "T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain",
+    "T1583.001 - Acquire Infrastructure: Domains",
+    "T1584.004 - Compromise Infrastructure: Server",
+    "T1566.001 - Phishing: Spearphishing Attachment",
+    "T1566.002 - Phishing: Spearphishing Link",
+    "T1056.003 - Input Capture: Web Portal Capture"
+  ],
+  "patterns": [
+    {
+      "pattern": "^redirect-[a-z0-9]{6}$",
+      "description": "Malicious redirect packages with random 6-character suffix",
+      "action": "BLOCK",
+      "severity": "CRITICAL"
+    }
+  ],
+  "blacklistedPackages": [
+    "redirect-04g1my",
+    "redirect-0g91q6",
+    "redirect-0vaxnw",
+    "redirect-1akzwg",
+    "redirect-1hvx9g",
+    "redirect-1knxok",
+    "redirect-1p89nj",
+    "redirect-1st7z7",
+    "redirect-1tokin",
+    "redirect-1ubpyu",
+    "redirect-1wc4gw",
+    "redirect-24nt59",
+    "redirect-24srjd",
+    "redirect-297vpk",
+    "redirect-2aie58",
+    "redirect-3viu68",
+    "redirect-406s9z",
+    "redirect-47cprv",
+    "redirect-4a6uhw",
+    "redirect-4dcjkh",
+    "redirect-4iyfat",
+    "redirect-4nwrkg",
+    "redirect-4r6ynv",
+    "redirect-53bw0r",
+    "redirect-57j5wb",
+    "redirect-594t6h",
+    "redirect-5cxzgs",
+    "redirect-5iqds5",
+    "redirect-5lpuku",
+    "redirect-5r42if",
+    "redirect-63cl4f",
+    "redirect-6lvcjm",
+    "redirect-7bqfg6",
+    "redirect-7qnew0",
+    "redirect-7vw41m",
+    "redirect-7yqujr",
+    "redirect-8f3x70",
+    "redirect-8py8qs",
+    "redirect-8ynd96",
+    "redirect-95fl17",
+    "redirect-9iak88",
+    "redirect-a1gs61",
+    "redirect-a1jnfo",
+    "redirect-aw9itj",
+    "redirect-b9diha",
+    "redirect-b9fv9e",
+    "redirect-byj4f5",
+    "redirect-c1n05c",
+    "redirect-ch5ayp",
+    "redirect-ci4ynt",
+    "redirect-cj50k2",
+    "redirect-cn040w",
+    "redirect-colaux",
+    "redirect-cuvccp",
+    "redirect-cwfpnz",
+    "redirect-cx4vm0",
+    "redirect-d0qfku",
+    "redirect-dna9sd",
+    "redirect-dravb9",
+    "redirect-e19jye",
+    "redirect-e761hq",
+    "redirect-eeu53f",
+    "redirect-elvwba",
+    "redirect-eqtqym",
+    "redirect-evb9wa",
+    "redirect-ewce43",
+    "redirect-f1wut9",
+    "redirect-f72kyw",
+    "redirect-fd91u6",
+    "redirect-fhelhf",
+    "redirect-fohapy",
+    "redirect-fwx2y7",
+    "redirect-g0ew1n",
+    "redirect-g7gn31",
+    "redirect-g7v030",
+    "redirect-gbgbgh",
+    "redirect-gjl674",
+    "redirect-gzixvc",
+    "redirect-gzkgcn",
+    "redirect-h0i672",
+    "redirect-h4y8f0",
+    "redirect-hi5ag9",
+    "redirect-ht8x82",
+    "redirect-hx522h",
+    "redirect-icp3vd",
+    "redirect-igk4sd",
+    "redirect-iocz0a",
+    "redirect-j0rs4a",
+    "redirect-j5blfb",
+    "redirect-j8m62u",
+    "redirect-jr2idt",
+    "redirect-jw31kl",
+    "redirect-k1jlsf",
+    "redirect-k4s26t",
+    "redirect-k5j1u7",
+    "redirect-klea4q",
+    "redirect-ksm5w7",
+    "redirect-kz5pf4",
+    "redirect-l0m7on",
+    "redirect-l3td5c",
+    "redirect-l6qi9e",
+    "redirect-lbgja3",
+    "redirect-ld0k2a",
+    "redirect-lp2xe6",
+    "redirect-ltlpoj",
+    "redirect-lxzc6c",
+    "redirect-m92q7h",
+    "redirect-mop8sg",
+    "redirect-mrdlde",
+    "redirect-mz4116",
+    "redirect-n06xhl",
+    "redirect-n0c0pt",
+    "redirect-n2wvec",
+    "redirect-n79iht",
+    "redirect-n95xyv",
+    "redirect-nf0qo1",
+    "redirect-nixl3q",
+    "redirect-njmr1g",
+    "redirect-noyuan",
+    "redirect-nq70u6",
+    "redirect-nqfhsn",
+    "redirect-nron9d",
+    "redirect-nuyvwk",
+    "redirect-nzoblt",
+    "redirect-o92d2h",
+    "redirect-oroq43",
+    "redirect-p8ris1",
+    "redirect-pkkd5s",
+    "redirect-pqigpl",
+    "redirect-prhts6",
+    "redirect-q2htwu",
+    "redirect-q4vs8m",
+    "redirect-q84l3v",
+    "redirect-qbzqro",
+    "redirect-qrah57",
+    "redirect-qx2www",
+    "redirect-r0ajvl",
+    "redirect-r3s2jv",
+    "redirect-rc2ewa",
+    "redirect-rmunkl",
+    "redirect-rrfeb9",
+    "redirect-s7usff",
+    "redirect-shqv6v",
+    "redirect-sjcr8c",
+    "redirect-sormfb",
+    "redirect-sr2min",
+    "redirect-sykre1",
+    "redirect-t09ul0",
+    "redirect-t65vz6",
+    "redirect-t8kcsk",
+    "redirect-u0e2q7",
+    "redirect-ubp4cs",
+    "redirect-uc8xfg",
+    "redirect-udmf0u",
+    "redirect-uplctp",
+    "redirect-uxwcv8",
+    "redirect-v74zee",
+    "redirect-vlgk2c",
+    "redirect-vpvoos",
+    "redirect-w9cx9u",
+    "redirect-whb6rt",
+    "redirect-wu8gx9",
+    "redirect-x2giv7",
+    "redirect-x4imdv",
+    "redirect-xgcv6j",
+    "redirect-xi84nq",
+    "redirect-xs13nr",
+    "redirect-y8p47m",
+    "redirect-ystrj5",
+    "redirect-ytimeb",
+    "redirect-za4566",
+    "redirect-zbhdm7",
+    "redirect-zfwzmc",
+    "redirect-zoju4g",
+    "redirect-homer-flajpt"
+  ],
+  "maliciousDomains": [
+    "cfn.jackpotmastersdanske.com",
+    "musicboxcr.com",
+    "villasmbuva.co.mz",
+    "cfn.fejyhy.com",
+    "cfn.fenamu.com",
+    "cfn.notwinningbutpartici.com",
+    "elkendinsc.com"
+  ],
+  "suspiciousNpmAccounts": [
+    {
+      "username": "zamaniboss",
+      "email": "frankmease22@gmail.com"
+    },
+    {
+      "username": "ghoxt",
+      "email": "harimetal@squbee.com"
+    },
+    {
+      "username": "smfcs",
+      "email": "Lee.Ja@bi-energykr.net"
+    },
+    {
+      "username": "doggymugu",
+      "email": "r99990077@gmail.com"
+    },
+    {
+      "username": "flajpt",
+      "email": "homerstreetgy@proton.me"
+    },
+    {
+      "username": "milotank",
+      "email": "inf@mail.legaldispensarysearch.com"
+    },
+    {
+      "username": "remdd100",
+      "email": "remmdd@smartmode.j.pl"
+    },
+    {
+      "username": "remdd101",
+      "email": "remmdd1@smartmode.j.pl"
+    },
+    {
+      "username": "remdd1012",
+      "email": "remmdd12@smartmode.j.pl"
+    }
+  ],
+  "indicators": {
+    "htmlMetaTag": "nb830r6x",
+    "description": "HTML meta tag used in phishing pages"
+  },
+  "attackDescription": "Phishing campaign weaponizing the npm ecosystem. Threat actors seeded 175+ throwaway packages as disposable hosting for JavaScript that auto-redirects victims to credential-harvesting sites. Targets spanning 135+ organizations.",
+  "recommendations": [
+    "Block all packages matching pattern ^redirect-[a-z0-9]{6}$",
+    "Verify package author reputation before installation",
+    "Use Socket.dev CLI to detect malicious packages before installation",
+    "Monitor for unexpected redirects in application behavior",
+    "Implement CSP (Content Security Policy) to prevent unauthorized redirects"
+  ]
+}

package/template/scripts/check-malicious-packages.sh

@@ -0,0 +1,118 @@
+#!/bin/bash
+
+# Check for Malicious Packages Script
+# Verifica si hay paquetes maliciosos instalados contra la blacklist conocida
+
+set -e
+
+# Colors
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+NC='\033[0m' # No Color
+
+BLACKLIST_FILE=".security/malicious-packages-blacklist.json"
+
+echo "========================================"
+echo "Malicious Package Detection"
+echo "========================================"
+echo ""
+
+# Check if blacklist file exists
+if [ ! -f "$BLACKLIST_FILE" ]; then
+    echo -e "${RED}✗ Blacklist file not found: $BLACKLIST_FILE${NC}"
+    exit 1
+fi
+
+echo "Loading blacklist..."
+BLACKLIST_COUNT=$(jq -r '.blacklistedPackages | length' "$BLACKLIST_FILE")
+LAST_UPDATED=$(jq -r '.lastUpdated' "$BLACKLIST_FILE")
+SOURCE=$(jq -r '.source' "$BLACKLIST_FILE")
+
+echo -e "${GREEN}✓ Loaded $BLACKLIST_COUNT malicious packages${NC}"
+echo "  Source: $SOURCE"
+echo "  Last Updated: $LAST_UPDATED"
+echo ""
+
+# Get installed packages
+echo "Analyzing installed packages..."
+INSTALLED_PACKAGES=$(npm list --json 2>/dev/null | jq -r '.. | .dependencies? // {} | keys[]' 2>/dev/null || echo "")
+
+if [ -z "$INSTALLED_PACKAGES" ]; then
+    echo -e "${YELLOW}⚠ Could not retrieve installed packages${NC}"
+    exit 1
+fi
+
+TOTAL_INSTALLED=$(echo "$INSTALLED_PACKAGES" | wc -l)
+echo "  Total installed packages: $TOTAL_INSTALLED"
+echo ""
+
+# Check against blacklist
+echo "Checking against blacklist..."
+FOUND_MALICIOUS=0
+MALICIOUS_FOUND=""
+
+while IFS= read -r package; do
+    if jq -e ".blacklistedPackages | index(\"$package\")" "$BLACKLIST_FILE" > /dev/null 2>&1; then
+        echo -e "${RED}✗ MALICIOUS PACKAGE DETECTED: $package${NC}"
+        FOUND_MALICIOUS=$((FOUND_MALICIOUS + 1))
+        MALICIOUS_FOUND="$MALICIOUS_FOUND\n  - $package"
+    fi
+done <<< "$INSTALLED_PACKAGES"
+
+# Check against patterns
+echo ""
+echo "Checking against malicious patterns..."
+PATTERN_MATCHES=0
+
+PATTERNS=$(jq -r '.patterns[].pattern' "$BLACKLIST_FILE")
+while IFS= read -r pattern; do
+    while IFS= read -r package; do
+        if echo "$package" | grep -qE "$pattern"; then
+            PATTERN_DESC=$(jq -r ".patterns[] | select(.pattern == \"$pattern\") | .description" "$BLACKLIST_FILE")
+            echo -e "${RED}✗ PATTERN MATCH: $package${NC}"
+            echo "  Pattern: $pattern"
+            echo "  Description: $PATTERN_DESC"
+            PATTERN_MATCHES=$((PATTERN_MATCHES + 1))
+            MALICIOUS_FOUND="$MALICIOUS_FOUND\n  - $package (pattern match)"
+        fi
+    done <<< "$INSTALLED_PACKAGES"
+done <<< "$PATTERNS"
+
+echo ""
+echo "========================================"
+echo "Results"
+echo "========================================"
+
+if [ $FOUND_MALICIOUS -eq 0 ] && [ $PATTERN_MATCHES -eq 0 ]; then
+    echo -e "${GREEN}✓ No malicious packages detected${NC}"
+    echo ""
+    echo "Summary:"
+    echo "  - Checked: $TOTAL_INSTALLED packages"
+    echo "  - Against: $BLACKLIST_COUNT known malicious packages"
+    echo "  - Found: 0 threats"
+    exit 0
+else
+    echo -e "${RED}✗ MALICIOUS PACKAGES FOUND!${NC}"
+    echo ""
+    echo "Summary:"
+    echo "  - Direct matches: $FOUND_MALICIOUS"
+    echo "  - Pattern matches: $PATTERN_MATCHES"
+    echo "  - Total threats: $((FOUND_MALICIOUS + PATTERN_MATCHES))"
+    echo ""
+    echo "Malicious packages found:"
+    echo -e "$MALICIOUS_FOUND"
+    echo ""
+    echo "IMMEDIATE ACTIONS REQUIRED:"
+    echo "1. DO NOT use this application"
+    echo "2. Uninstall malicious packages immediately"
+    echo "3. Review application logs for suspicious activity"
+    echo "4. Check for data exfiltration"
+    echo "5. Report to security team"
+    echo "6. Review package-lock.json for when it was added"
+    echo ""
+    echo "To remove:"
+    echo "  npm uninstall <package-name>"
+    echo ""
+    exit 1
+fi