@theoptimalpartner/npm-security-kit 1.0.0

package/template/scripts/security-check.sh

@@ -0,0 +1,166 @@
+#!/bin/bash
+
+# Security Check Script
+# Ejecuta múltiples validaciones de seguridad en el proyecto
+
+set -e
+
+echo "========================================"
+echo "Security Audit Script"
+echo "========================================"
+echo ""
+
+# Colors for output
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+NC='\033[0m' # No Color
+
+ERRORS=0
+WARNINGS=0
+
+# Function to print colored output
+print_success() {
+    echo -e "${GREEN}✓ $1${NC}"
+}
+
+print_warning() {
+    echo -e "${YELLOW}⚠ $1${NC}"
+    ((WARNINGS++))
+}
+
+print_error() {
+    echo -e "${RED}✗ $1${NC}"
+    ((ERRORS++))
+}
+
+# 1. Check for package-lock.json
+echo "1. Checking package-lock.json..."
+if [ -f "package-lock.json" ]; then
+    print_success "package-lock.json exists"
+else
+    print_error "package-lock.json not found"
+fi
+echo ""
+
+# 2. NPM Audit
+echo "2. Running npm audit..."
+if npm audit --audit-level=moderate > /dev/null 2>&1; then
+    print_success "No vulnerabilities found"
+else
+    print_error "Vulnerabilities detected - run 'npm audit' for details"
+    npm audit --audit-level=moderate
+fi
+echo ""
+
+# 3. Check for outdated packages
+echo "3. Checking for outdated packages..."
+OUTDATED=$(npm outdated --json 2>/dev/null || echo "{}")
+if [ "$OUTDATED" = "{}" ]; then
+    print_success "All packages are up to date"
+else
+    print_warning "Some packages are outdated"
+    npm outdated
+fi
+echo ""
+
+# 4. Check for suspicious install scripts
+echo "4. Checking for install scripts..."
+INSTALL_SCRIPTS=$(grep -E '"(pre|post)?install"' package.json || true)
+if [ -z "$INSTALL_SCRIPTS" ]; then
+    print_success "No install scripts found"
+else
+    print_warning "Install scripts detected - review manually:"
+    echo "$INSTALL_SCRIPTS"
+fi
+echo ""
+
+# 5. Check for hardcoded secrets
+echo "5. Scanning for hardcoded secrets..."
+SECRETS=$(grep -rE "(password|secret|api[_-]?key|token).*=.*['\"]" --include="*.ts" --include="*.js" src/ 2>/dev/null || true)
+if [ -z "$SECRETS" ]; then
+    print_success "No hardcoded secrets detected"
+else
+    print_error "Potential hardcoded secrets found:"
+    echo "$SECRETS"
+fi
+echo ""
+
+# 6. Check for unprotected endpoints
+echo "6. Checking for unprotected endpoints..."
+UNPROTECTED=$(find src/handlers -name "*.ts" -not -path "*/__tests__/*" -exec grep -l "export.*handler" {} \; | xargs grep -L "withAuth\|validateToken\|withAdminApiKey\|withFlexibleAuth\|withClientApiKey" || true)
+if [ -z "$UNPROTECTED" ]; then
+    print_success "All endpoints appear to be protected"
+else
+    print_warning "Potentially unprotected endpoints found:"
+    echo "$UNPROTECTED"
+fi
+echo ""
+
+# 7. Check for packages without licenses
+echo "7. Checking package licenses..."
+UNLICENSED=$(npm list --json | jq -r '.dependencies | to_entries[] | select(.value.license == null or .value.license == "") | .key' 2>/dev/null || true)
+if [ -z "$UNLICENSED" ]; then
+    print_success "All packages have licenses"
+else
+    print_warning "Packages without licenses found:"
+    echo "$UNLICENSED"
+fi
+echo ""
+
+# 8. Check bundle size (if built)
+echo "8. Checking bundle size..."
+if [ -d "dist" ]; then
+    BUNDLE_SIZE=$(du -sh dist 2>/dev/null | cut -f1)
+    print_success "Bundle size: $BUNDLE_SIZE"
+else
+    print_warning "dist folder not found - run 'npm run build' first"
+fi
+echo ""
+
+# 9. Check for known malicious packages
+echo "9. Checking for known malicious packages..."
+if [ -f ".security/malicious-packages-blacklist.json" ]; then
+    MALICIOUS_CHECK=$(./scripts/check-malicious-packages.sh 2>&1)
+    if [ $? -eq 0 ]; then
+        print_success "No known malicious packages detected"
+    else
+        print_error "CRITICAL: Malicious packages detected!"
+        echo "$MALICIOUS_CHECK"
+    fi
+else
+    print_warning "Malicious package blacklist not found"
+fi
+echo ""
+
+# 10. Socket.dev check (if available)
+echo "10. Checking Socket.dev..."
+if command -v socket &> /dev/null; then
+    if socket npm audit > /dev/null 2>&1; then
+        print_success "Socket security check passed"
+    else
+        print_warning "Socket detected potential issues - review manually"
+    fi
+else
+    print_warning "Socket CLI not installed - install with: npm install -g @socketsecurity/cli"
+fi
+echo ""
+
+# Summary
+echo "========================================"
+echo "Summary"
+echo "========================================"
+echo -e "Errors: ${RED}$ERRORS${NC}"
+echo -e "Warnings: ${YELLOW}$WARNINGS${NC}"
+echo ""
+
+if [ $ERRORS -gt 0 ]; then
+    echo -e "${RED}Security check FAILED${NC}"
+    exit 1
+elif [ $WARNINGS -gt 0 ]; then
+    echo -e "${YELLOW}Security check PASSED with warnings${NC}"
+    exit 0
+else
+    echo -e "${GREEN}Security check PASSED${NC}"
+    exit 0
+fi