@theoptimalpartner/npm-security-kit 1.0.1 → 2.0.0-beta.0

package/src/index.js

@@ -1,71 +0,0 @@
-/**
- * NPM Security Kit
- * Main entry point for programmatic usage
- */
-
-const path = require('path');
-const fs = require('fs');
-
-/**
- * Get path to template files
- */
-function getTemplatePath() {
-  return path.join(__dirname, '..', 'template');
-}
-
-/**
- * Get path to blacklist file
- */
-function getBlacklistPath() {
-  return path.join(getTemplatePath(), '.security', 'malicious-packages-blacklist.json');
-}
-
-/**
- * Load malicious packages blacklist
- */
-function loadBlacklist() {
-  const blacklistPath = getBlacklistPath();
-  if (!fs.existsSync(blacklistPath)) {
-    throw new Error('Blacklist file not found');
-  }
-  return JSON.parse(fs.readFileSync(blacklistPath, 'utf8'));
-}
-
-/**
- * Check if a package is in the blacklist
- * @param {string} packageName - Name of the package to check
- * @returns {boolean} - True if package is malicious
- */
-function isMalicious(packageName) {
-  const blacklist = loadBlacklist();
-  return blacklist.blacklistedPackages.includes(packageName);
-}
-
-/**
- * Check if a package matches malicious patterns
- * @param {string} packageName - Name of the package to check
- * @returns {boolean} - True if package matches a malicious pattern
- */
-function matchesMaliciousPattern(packageName) {
-  const blacklist = loadBlacklist();
-  return blacklist.patterns.some(p => {
-    const regex = new RegExp(p.pattern);
-    return regex.test(packageName);
-  });
-}
-
-/**
- * Get installation path
- */
-function getInstallPath() {
-  return path.join(__dirname, '..', 'bin', 'install.sh');
-}
-
-module.exports = {
-  getTemplatePath,
-  getBlacklistPath,
-  loadBlacklist,
-  isMalicious,
-  matchesMaliciousPattern,
-  getInstallPath
-};

package/template/.github/dependabot.yml

@@ -1,63 +0,0 @@
-version: 2
-updates:
-  # Enable version updates for npm dependencies
-  - package-ecosystem: "npm"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-      day: "monday"
-      time: "09:00"
-    # Limit the number of open pull requests
-    open-pull-requests-limit: 10
-    # Add reviewers
-    reviewers:
-      - "diego"
-    # Add labels
-    labels:
-      - "dependencies"
-      - "security"
-      - "automerge-candidate"
-    # Group updates
-    groups:
-      aws-sdk:
-        patterns:
-          - "@aws-sdk/*"
-      typescript:
-        patterns:
-          - "typescript"
-          - "@types/*"
-          - "ts-node"
-          - "tsx"
-      testing:
-        patterns:
-          - "jest"
-          - "@types/jest"
-          - "c8"
-      serverless:
-        patterns:
-          - "serverless*"
-    # Security updates configuration
-    versioning-strategy: increase
-    # Allow both direct and indirect updates
-    allow:
-      - dependency-type: "all"
-    # Ignore major version updates for now (require manual review)
-    ignore:
-      - dependency-name: "*"
-        update-types: ["version-update:semver-major"]
-    # Automatically rebase PRs
-    rebase-strategy: "auto"
-    # Commit message prefix
-    commit-message:
-      prefix: "chore"
-      prefix-development: "chore(dev)"
-      include: "scope"
-
-  # Monitor GitHub Actions
-  - package-ecosystem: "github-actions"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-    labels:
-      - "ci"
-      - "security"

package/template/.github/workflows/security-audit.yml

@@ -1,218 +0,0 @@
-name: Security Audit
-
-on:
-  pull_request:
-    branches: [main, develop]
-  push:
-    branches: [main, develop]
-  schedule:
-    # Ejecutar semanalmente los lunes a las 9am UTC
-    - cron: '0 9 * * 1'
-  workflow_dispatch: # Permitir ejecución manual
-
-jobs:
-  npm-audit:
-    name: NPM Security Audit
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: '18'
-          cache: 'npm'
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Run npm audit
-        id: npm-audit
-        run: |
-          echo "Running npm audit..."
-          npm audit --audit-level=moderate || EXIT_CODE=$?
-
-          if [ $EXIT_CODE -ne 0 ]; then
-            echo "::warning::npm audit found vulnerabilities"
-            npm audit --json > npm-audit-report.json
-            echo "audit_failed=true" >> $GITHUB_OUTPUT
-          else
-            echo "::notice::No vulnerabilities found"
-            echo "audit_failed=false" >> $GITHUB_OUTPUT
-          fi
-
-          exit $EXIT_CODE
-        continue-on-error: true
-
-      - name: Upload audit report
-        if: steps.npm-audit.outputs.audit_failed == 'true'
-        uses: actions/upload-artifact@v4
-        with:
-          name: npm-audit-report
-          path: npm-audit-report.json
-          retention-days: 30
-
-      - name: Fail on critical vulnerabilities
-        if: steps.npm-audit.outputs.audit_failed == 'true'
-        run: |
-          echo "::error::Security vulnerabilities detected. Review the audit report."
-          exit 1
-
-  socket-security:
-    name: Socket.dev Security Scan
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: '18'
-
-      - name: Install Socket CLI
-        run: npm install -g @socketsecurity/cli
-
-      - name: Socket Security Scan
-        run: |
-          echo "Running Socket security scan..."
-          socket npm audit || EXIT_CODE=$?
-
-          if [ $EXIT_CODE -ne 0 ]; then
-            echo "::warning::Socket detected security issues"
-          else
-            echo "::notice::No security issues detected by Socket"
-          fi
-
-  dependency-review:
-    name: Dependency Review
-    runs-on: ubuntu-latest
-    if: github.event_name == 'pull_request'
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Dependency Review
-        uses: actions/dependency-review-action@v4
-        with:
-          fail-on-severity: moderate
-          deny-licenses: GPL-3.0, AGPL-3.0
-
-  license-check:
-    name: License Compliance Check
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: '18'
-          cache: 'npm'
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Check for suspicious packages
-        run: |
-          echo "Checking for packages without licenses..."
-          npm list --json | jq -r '.dependencies | to_entries[] | select(.value.license == null or .value.license == "") | .key' || true
-
-          echo "Checking for deprecated packages..."
-          npm outdated || true
-
-  malicious-patterns:
-    name: Check for Malicious Patterns
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Check for suspicious install scripts
-        run: |
-          echo "Checking for suspicious preinstall/postinstall scripts..."
-          grep -r "preinstall\|postinstall" package.json || echo "No install scripts found"
-
-          if grep -r "preinstall\|postinstall" package.json; then
-            echo "::warning::Install scripts detected - review manually"
-          fi
-
-      - name: Check for hardcoded secrets
-        run: |
-          echo "Checking for hardcoded secrets..."
-          if grep -rE "(password|secret|api[_-]?key|token|auth).*=.*['\"]" --include="*.ts" --include="*.js" src/ 2>/dev/null; then
-            echo "::error::Potential hardcoded secrets found"
-            exit 1
-          else
-            echo "::notice::No hardcoded secrets detected"
-          fi
-
-      - name: Verify package-lock integrity
-        run: |
-          echo "Verifying package-lock.json integrity..."
-          if [ -f package-lock.json ]; then
-            npm ci --dry-run
-            echo "::notice::package-lock.json is valid"
-          else
-            echo "::error::package-lock.json not found"
-            exit 1
-          fi
-
-  known-malicious-packages:
-    name: Check Known Malicious Packages
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: '18'
-          cache: 'npm'
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Install jq
-        run: sudo apt-get install -y jq
-
-      - name: Check against malicious package blacklist
-        run: |
-          chmod +x ./scripts/check-malicious-packages.sh
-          ./scripts/check-malicious-packages.sh || EXIT_CODE=$?
-
-          if [ $EXIT_CODE -ne 0 ]; then
-            echo "::error::CRITICAL - Malicious packages detected!"
-            exit 1
-          else
-            echo "::notice::No known malicious packages detected"
-          fi
-
-  summary:
-    name: Security Summary
-    runs-on: ubuntu-latest
-    needs: [npm-audit, socket-security, dependency-review, license-check, malicious-patterns, known-malicious-packages]
-    if: always()
-
-    steps:
-      - name: Security Summary
-        run: |
-          echo "## Security Audit Summary" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "- NPM Audit: ${{ needs.npm-audit.result }}" >> $GITHUB_STEP_SUMMARY
-          echo "- Socket Security: ${{ needs.socket-security.result }}" >> $GITHUB_STEP_SUMMARY
-          echo "- Dependency Review: ${{ needs.dependency-review.result }}" >> $GITHUB_STEP_SUMMARY
-          echo "- License Check: ${{ needs.license-check.result }}" >> $GITHUB_STEP_SUMMARY
-          echo "- Malicious Patterns: ${{ needs.malicious-patterns.result }}" >> $GITHUB_STEP_SUMMARY
-          echo "- Known Malicious Packages: ${{ needs.known-malicious-packages.result }}" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "Review the individual job logs for details." >> $GITHUB_STEP_SUMMARY

package/template/.security/config.json

@@ -1,94 +0,0 @@
-{
-  "$schema": "https://json-schema.org/draft-07/schema#",
-  "projectName": "my-project",
-  "projectType": "node",
-  "version": "1.0.0",
-  "lastUpdated": "2025-10-20",
-  "settings": {
-    "strictMode": true,
-    "excludeDirs": [
-      "node_modules",
-      "dist",
-      "build",
-      ".next",
-      "coverage",
-      ".cache"
-    ],
-    "checkPatterns": true,
-    "checkTransitiveDeps": true,
-    "autoFixVulnerabilities": false
-  },
-  "notifications": {
-    "enabled": false,
-    "channels": {
-      "email": {
-        "enabled": false,
-        "addresses": []
-      },
-      "slack": {
-        "enabled": false,
-        "webhook": ""
-      },
-      "discord": {
-        "enabled": false,
-        "webhook": ""
-      }
-    }
-  },
-  "thresholds": {
-    "maxVulnerabilities": {
-      "critical": 0,
-      "high": 0,
-      "moderate": 5,
-      "low": 10
-    },
-    "maxPackageAge": {
-      "enabled": false,
-      "months": 24
-    },
-    "minDownloadsPerWeek": {
-      "enabled": false,
-      "count": 1000
-    }
-  },
-  "whitelist": {
-    "enabled": false,
-    "packages": [],
-    "authors": [],
-    "organizations": [
-      "aws-sdk",
-      "types",
-      "typescript-eslint"
-    ]
-  },
-  "integrations": {
-    "githubActions": {
-      "enabled": true,
-      "schedule": "0 9 * * 1",
-      "onPullRequest": true,
-      "onPush": true
-    },
-    "dependabot": {
-      "enabled": true,
-      "schedule": "weekly",
-      "automerge": false
-    },
-    "preCommitHooks": {
-      "enabled": false,
-      "blocking": false
-    }
-  },
-  "reporting": {
-    "format": "json",
-    "verbosity": "normal",
-    "includeTransitiveDeps": true,
-    "includeLicenses": true
-  },
-  "customBlacklist": {
-    "enabled": false,
-    "packages": [],
-    "patterns": [],
-    "domains": [],
-    "authors": []
-  }
-}

package/template/.security/malicious-packages-blacklist.json

@@ -1,259 +0,0 @@
-{
-  "lastUpdated": "2025-10-20",
-  "source": "Socket.dev - 175 Malicious npm Packages Host Phishing Infrastructure",
-  "url": "https://socket.dev/blog/175-malicious-npm-packages-host-phishing-infrastructure",
-  "threatLevel": "CRITICAL",
-  "attackType": "Supply Chain Compromise + Phishing Campaign",
-  "mitreAttack": [
-    "T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain",
-    "T1583.001 - Acquire Infrastructure: Domains",
-    "T1584.004 - Compromise Infrastructure: Server",
-    "T1566.001 - Phishing: Spearphishing Attachment",
-    "T1566.002 - Phishing: Spearphishing Link",
-    "T1056.003 - Input Capture: Web Portal Capture"
-  ],
-  "patterns": [
-    {
-      "pattern": "^redirect-[a-z0-9]{6}$",
-      "description": "Malicious redirect packages with random 6-character suffix",
-      "action": "BLOCK",
-      "severity": "CRITICAL"
-    }
-  ],
-  "blacklistedPackages": [
-    "redirect-04g1my",
-    "redirect-0g91q6",
-    "redirect-0vaxnw",
-    "redirect-1akzwg",
-    "redirect-1hvx9g",
-    "redirect-1knxok",
-    "redirect-1p89nj",
-    "redirect-1st7z7",
-    "redirect-1tokin",
-    "redirect-1ubpyu",
-    "redirect-1wc4gw",
-    "redirect-24nt59",
-    "redirect-24srjd",
-    "redirect-297vpk",
-    "redirect-2aie58",
-    "redirect-3viu68",
-    "redirect-406s9z",
-    "redirect-47cprv",
-    "redirect-4a6uhw",
-    "redirect-4dcjkh",
-    "redirect-4iyfat",
-    "redirect-4nwrkg",
-    "redirect-4r6ynv",
-    "redirect-53bw0r",
-    "redirect-57j5wb",
-    "redirect-594t6h",
-    "redirect-5cxzgs",
-    "redirect-5iqds5",
-    "redirect-5lpuku",
-    "redirect-5r42if",
-    "redirect-63cl4f",
-    "redirect-6lvcjm",
-    "redirect-7bqfg6",
-    "redirect-7qnew0",
-    "redirect-7vw41m",
-    "redirect-7yqujr",
-    "redirect-8f3x70",
-    "redirect-8py8qs",
-    "redirect-8ynd96",
-    "redirect-95fl17",
-    "redirect-9iak88",
-    "redirect-a1gs61",
-    "redirect-a1jnfo",
-    "redirect-aw9itj",
-    "redirect-b9diha",
-    "redirect-b9fv9e",
-    "redirect-byj4f5",
-    "redirect-c1n05c",
-    "redirect-ch5ayp",
-    "redirect-ci4ynt",
-    "redirect-cj50k2",
-    "redirect-cn040w",
-    "redirect-colaux",
-    "redirect-cuvccp",
-    "redirect-cwfpnz",
-    "redirect-cx4vm0",
-    "redirect-d0qfku",
-    "redirect-dna9sd",
-    "redirect-dravb9",
-    "redirect-e19jye",
-    "redirect-e761hq",
-    "redirect-eeu53f",
-    "redirect-elvwba",
-    "redirect-eqtqym",
-    "redirect-evb9wa",
-    "redirect-ewce43",
-    "redirect-f1wut9",
-    "redirect-f72kyw",
-    "redirect-fd91u6",
-    "redirect-fhelhf",
-    "redirect-fohapy",
-    "redirect-fwx2y7",
-    "redirect-g0ew1n",
-    "redirect-g7gn31",
-    "redirect-g7v030",
-    "redirect-gbgbgh",
-    "redirect-gjl674",
-    "redirect-gzixvc",
-    "redirect-gzkgcn",
-    "redirect-h0i672",
-    "redirect-h4y8f0",
-    "redirect-hi5ag9",
-    "redirect-ht8x82",
-    "redirect-hx522h",
-    "redirect-icp3vd",
-    "redirect-igk4sd",
-    "redirect-iocz0a",
-    "redirect-j0rs4a",
-    "redirect-j5blfb",
-    "redirect-j8m62u",
-    "redirect-jr2idt",
-    "redirect-jw31kl",
-    "redirect-k1jlsf",
-    "redirect-k4s26t",
-    "redirect-k5j1u7",
-    "redirect-klea4q",
-    "redirect-ksm5w7",
-    "redirect-kz5pf4",
-    "redirect-l0m7on",
-    "redirect-l3td5c",
-    "redirect-l6qi9e",
-    "redirect-lbgja3",
-    "redirect-ld0k2a",
-    "redirect-lp2xe6",
-    "redirect-ltlpoj",
-    "redirect-lxzc6c",
-    "redirect-m92q7h",
-    "redirect-mop8sg",
-    "redirect-mrdlde",
-    "redirect-mz4116",
-    "redirect-n06xhl",
-    "redirect-n0c0pt",
-    "redirect-n2wvec",
-    "redirect-n79iht",
-    "redirect-n95xyv",
-    "redirect-nf0qo1",
-    "redirect-nixl3q",
-    "redirect-njmr1g",
-    "redirect-noyuan",
-    "redirect-nq70u6",
-    "redirect-nqfhsn",
-    "redirect-nron9d",
-    "redirect-nuyvwk",
-    "redirect-nzoblt",
-    "redirect-o92d2h",
-    "redirect-oroq43",
-    "redirect-p8ris1",
-    "redirect-pkkd5s",
-    "redirect-pqigpl",
-    "redirect-prhts6",
-    "redirect-q2htwu",
-    "redirect-q4vs8m",
-    "redirect-q84l3v",
-    "redirect-qbzqro",
-    "redirect-qrah57",
-    "redirect-qx2www",
-    "redirect-r0ajvl",
-    "redirect-r3s2jv",
-    "redirect-rc2ewa",
-    "redirect-rmunkl",
-    "redirect-rrfeb9",
-    "redirect-s7usff",
-    "redirect-shqv6v",
-    "redirect-sjcr8c",
-    "redirect-sormfb",
-    "redirect-sr2min",
-    "redirect-sykre1",
-    "redirect-t09ul0",
-    "redirect-t65vz6",
-    "redirect-t8kcsk",
-    "redirect-u0e2q7",
-    "redirect-ubp4cs",
-    "redirect-uc8xfg",
-    "redirect-udmf0u",
-    "redirect-uplctp",
-    "redirect-uxwcv8",
-    "redirect-v74zee",
-    "redirect-vlgk2c",
-    "redirect-vpvoos",
-    "redirect-w9cx9u",
-    "redirect-whb6rt",
-    "redirect-wu8gx9",
-    "redirect-x2giv7",
-    "redirect-x4imdv",
-    "redirect-xgcv6j",
-    "redirect-xi84nq",
-    "redirect-xs13nr",
-    "redirect-y8p47m",
-    "redirect-ystrj5",
-    "redirect-ytimeb",
-    "redirect-za4566",
-    "redirect-zbhdm7",
-    "redirect-zfwzmc",
-    "redirect-zoju4g",
-    "redirect-homer-flajpt"
-  ],
-  "maliciousDomains": [
-    "cfn.jackpotmastersdanske.com",
-    "musicboxcr.com",
-    "villasmbuva.co.mz",
-    "cfn.fejyhy.com",
-    "cfn.fenamu.com",
-    "cfn.notwinningbutpartici.com",
-    "elkendinsc.com"
-  ],
-  "suspiciousNpmAccounts": [
-    {
-      "username": "zamaniboss",
-      "email": "frankmease22@gmail.com"
-    },
-    {
-      "username": "ghoxt",
-      "email": "harimetal@squbee.com"
-    },
-    {
-      "username": "smfcs",
-      "email": "Lee.Ja@bi-energykr.net"
-    },
-    {
-      "username": "doggymugu",
-      "email": "r99990077@gmail.com"
-    },
-    {
-      "username": "flajpt",
-      "email": "homerstreetgy@proton.me"
-    },
-    {
-      "username": "milotank",
-      "email": "inf@mail.legaldispensarysearch.com"
-    },
-    {
-      "username": "remdd100",
-      "email": "remmdd@smartmode.j.pl"
-    },
-    {
-      "username": "remdd101",
-      "email": "remmdd1@smartmode.j.pl"
-    },
-    {
-      "username": "remdd1012",
-      "email": "remmdd12@smartmode.j.pl"
-    }
-  ],
-  "indicators": {
-    "htmlMetaTag": "nb830r6x",
-    "description": "HTML meta tag used in phishing pages"
-  },
-  "attackDescription": "Phishing campaign weaponizing the npm ecosystem. Threat actors seeded 175+ throwaway packages as disposable hosting for JavaScript that auto-redirects victims to credential-harvesting sites. Targets spanning 135+ organizations.",
-  "recommendations": [
-    "Block all packages matching pattern ^redirect-[a-z0-9]{6}$",
-    "Verify package author reputation before installation",
-    "Use Socket.dev CLI to detect malicious packages before installation",
-    "Monitor for unexpected redirects in application behavior",
-    "Implement CSP (Content Security Policy) to prevent unauthorized redirects"
-  ]
-}