@theoptimalpartner/npm-security-kit 1.0.2 → 2.0.0-beta.1

package/template/scripts/check-malicious-packages.sh

@@ -1,118 +0,0 @@
-#!/bin/bash
-
-# Check for Malicious Packages Script
-# Verifica si hay paquetes maliciosos instalados contra la blacklist conocida
-
-set -e
-
-# Colors
-RED='\033[0;31m'
-GREEN='\033[0;32m'
-YELLOW='\033[1;33m'
-NC='\033[0m' # No Color
-
-BLACKLIST_FILE=".security/malicious-packages-blacklist.json"
-
-echo "========================================"
-echo "Malicious Package Detection"
-echo "========================================"
-echo ""
-
-# Check if blacklist file exists
-if [ ! -f "$BLACKLIST_FILE" ]; then
-    echo -e "${RED}✗ Blacklist file not found: $BLACKLIST_FILE${NC}"
-    exit 1
-fi
-
-echo "Loading blacklist..."
-BLACKLIST_COUNT=$(jq -r '.blacklistedPackages | length' "$BLACKLIST_FILE")
-LAST_UPDATED=$(jq -r '.lastUpdated' "$BLACKLIST_FILE")
-SOURCE=$(jq -r '.source' "$BLACKLIST_FILE")
-
-echo -e "${GREEN}✓ Loaded $BLACKLIST_COUNT malicious packages${NC}"
-echo "  Source: $SOURCE"
-echo "  Last Updated: $LAST_UPDATED"
-echo ""
-
-# Get installed packages
-echo "Analyzing installed packages..."
-INSTALLED_PACKAGES=$(npm list --json 2>/dev/null | jq -r '.. | .dependencies? // {} | keys[]' 2>/dev/null || echo "")
-
-if [ -z "$INSTALLED_PACKAGES" ]; then
-    echo -e "${YELLOW}⚠ Could not retrieve installed packages${NC}"
-    exit 1
-fi
-
-TOTAL_INSTALLED=$(echo "$INSTALLED_PACKAGES" | wc -l)
-echo "  Total installed packages: $TOTAL_INSTALLED"
-echo ""
-
-# Check against blacklist
-echo "Checking against blacklist..."
-FOUND_MALICIOUS=0
-MALICIOUS_FOUND=""
-
-while IFS= read -r package; do
-    if jq -e ".blacklistedPackages | index(\"$package\")" "$BLACKLIST_FILE" > /dev/null 2>&1; then
-        echo -e "${RED}✗ MALICIOUS PACKAGE DETECTED: $package${NC}"
-        FOUND_MALICIOUS=$((FOUND_MALICIOUS + 1))
-        MALICIOUS_FOUND="$MALICIOUS_FOUND\n  - $package"
-    fi
-done <<< "$INSTALLED_PACKAGES"
-
-# Check against patterns
-echo ""
-echo "Checking against malicious patterns..."
-PATTERN_MATCHES=0
-
-PATTERNS=$(jq -r '.patterns[].pattern' "$BLACKLIST_FILE")
-while IFS= read -r pattern; do
-    while IFS= read -r package; do
-        if echo "$package" | grep -qE "$pattern"; then
-            PATTERN_DESC=$(jq -r ".patterns[] | select(.pattern == \"$pattern\") | .description" "$BLACKLIST_FILE")
-            echo -e "${RED}✗ PATTERN MATCH: $package${NC}"
-            echo "  Pattern: $pattern"
-            echo "  Description: $PATTERN_DESC"
-            PATTERN_MATCHES=$((PATTERN_MATCHES + 1))
-            MALICIOUS_FOUND="$MALICIOUS_FOUND\n  - $package (pattern match)"
-        fi
-    done <<< "$INSTALLED_PACKAGES"
-done <<< "$PATTERNS"
-
-echo ""
-echo "========================================"
-echo "Results"
-echo "========================================"
-
-if [ $FOUND_MALICIOUS -eq 0 ] && [ $PATTERN_MATCHES -eq 0 ]; then
-    echo -e "${GREEN}✓ No malicious packages detected${NC}"
-    echo ""
-    echo "Summary:"
-    echo "  - Checked: $TOTAL_INSTALLED packages"
-    echo "  - Against: $BLACKLIST_COUNT known malicious packages"
-    echo "  - Found: 0 threats"
-    exit 0
-else
-    echo -e "${RED}✗ MALICIOUS PACKAGES FOUND!${NC}"
-    echo ""
-    echo "Summary:"
-    echo "  - Direct matches: $FOUND_MALICIOUS"
-    echo "  - Pattern matches: $PATTERN_MATCHES"
-    echo "  - Total threats: $((FOUND_MALICIOUS + PATTERN_MATCHES))"
-    echo ""
-    echo "Malicious packages found:"
-    echo -e "$MALICIOUS_FOUND"
-    echo ""
-    echo "IMMEDIATE ACTIONS REQUIRED:"
-    echo "1. DO NOT use this application"
-    echo "2. Uninstall malicious packages immediately"
-    echo "3. Review application logs for suspicious activity"
-    echo "4. Check for data exfiltration"
-    echo "5. Report to security team"
-    echo "6. Review package-lock.json for when it was added"
-    echo ""
-    echo "To remove:"
-    echo "  npm uninstall <package-name>"
-    echo ""
-    exit 1
-fi

package/template/scripts/security-check.sh

@@ -1,166 +0,0 @@
-#!/bin/bash
-
-# Security Check Script
-# Ejecuta múltiples validaciones de seguridad en el proyecto
-
-set -e
-
-echo "========================================"
-echo "Security Audit Script"
-echo "========================================"
-echo ""
-
-# Colors for output
-RED='\033[0;31m'
-GREEN='\033[0;32m'
-YELLOW='\033[1;33m'
-NC='\033[0m' # No Color
-
-ERRORS=0
-WARNINGS=0
-
-# Function to print colored output
-print_success() {
-    echo -e "${GREEN}✓ $1${NC}"
-}
-
-print_warning() {
-    echo -e "${YELLOW}⚠ $1${NC}"
-    ((WARNINGS++))
-}
-
-print_error() {
-    echo -e "${RED}✗ $1${NC}"
-    ((ERRORS++))
-}
-
-# 1. Check for package-lock.json
-echo "1. Checking package-lock.json..."
-if [ -f "package-lock.json" ]; then
-    print_success "package-lock.json exists"
-else
-    print_error "package-lock.json not found"
-fi
-echo ""
-
-# 2. NPM Audit
-echo "2. Running npm audit..."
-if npm audit --audit-level=moderate > /dev/null 2>&1; then
-    print_success "No vulnerabilities found"
-else
-    print_error "Vulnerabilities detected - run 'npm audit' for details"
-    npm audit --audit-level=moderate
-fi
-echo ""
-
-# 3. Check for outdated packages
-echo "3. Checking for outdated packages..."
-OUTDATED=$(npm outdated --json 2>/dev/null || echo "{}")
-if [ "$OUTDATED" = "{}" ]; then
-    print_success "All packages are up to date"
-else
-    print_warning "Some packages are outdated"
-    npm outdated
-fi
-echo ""
-
-# 4. Check for suspicious install scripts
-echo "4. Checking for install scripts..."
-INSTALL_SCRIPTS=$(grep -E '"(pre|post)?install"' package.json || true)
-if [ -z "$INSTALL_SCRIPTS" ]; then
-    print_success "No install scripts found"
-else
-    print_warning "Install scripts detected - review manually:"
-    echo "$INSTALL_SCRIPTS"
-fi
-echo ""
-
-# 5. Check for hardcoded secrets
-echo "5. Scanning for hardcoded secrets..."
-SECRETS=$(grep -rE "(password|secret|api[_-]?key|token).*=.*['\"]" --include="*.ts" --include="*.js" src/ 2>/dev/null || true)
-if [ -z "$SECRETS" ]; then
-    print_success "No hardcoded secrets detected"
-else
-    print_error "Potential hardcoded secrets found:"
-    echo "$SECRETS"
-fi
-echo ""
-
-# 6. Check for unprotected endpoints
-echo "6. Checking for unprotected endpoints..."
-UNPROTECTED=$(find src/handlers -name "*.ts" -not -path "*/__tests__/*" -exec grep -l "export.*handler" {} \; | xargs grep -L "withAuth\|validateToken\|withAdminApiKey\|withFlexibleAuth\|withClientApiKey" || true)
-if [ -z "$UNPROTECTED" ]; then
-    print_success "All endpoints appear to be protected"
-else
-    print_warning "Potentially unprotected endpoints found:"
-    echo "$UNPROTECTED"
-fi
-echo ""
-
-# 7. Check for packages without licenses
-echo "7. Checking package licenses..."
-UNLICENSED=$(npm list --json | jq -r '.dependencies | to_entries[] | select(.value.license == null or .value.license == "") | .key' 2>/dev/null || true)
-if [ -z "$UNLICENSED" ]; then
-    print_success "All packages have licenses"
-else
-    print_warning "Packages without licenses found:"
-    echo "$UNLICENSED"
-fi
-echo ""
-
-# 8. Check bundle size (if built)
-echo "8. Checking bundle size..."
-if [ -d "dist" ]; then
-    BUNDLE_SIZE=$(du -sh dist 2>/dev/null | cut -f1)
-    print_success "Bundle size: $BUNDLE_SIZE"
-else
-    print_warning "dist folder not found - run 'npm run build' first"
-fi
-echo ""
-
-# 9. Check for known malicious packages
-echo "9. Checking for known malicious packages..."
-if [ -f ".security/malicious-packages-blacklist.json" ]; then
-    MALICIOUS_CHECK=$(./scripts/check-malicious-packages.sh 2>&1)
-    if [ $? -eq 0 ]; then
-        print_success "No known malicious packages detected"
-    else
-        print_error "CRITICAL: Malicious packages detected!"
-        echo "$MALICIOUS_CHECK"
-    fi
-else
-    print_warning "Malicious package blacklist not found"
-fi
-echo ""
-
-# 10. Socket.dev check (if available)
-echo "10. Checking Socket.dev..."
-if command -v socket &> /dev/null; then
-    if socket npm audit > /dev/null 2>&1; then
-        print_success "Socket security check passed"
-    else
-        print_warning "Socket detected potential issues - review manually"
-    fi
-else
-    print_warning "Socket CLI not installed - install with: npm install -g @socketsecurity/cli"
-fi
-echo ""
-
-# Summary
-echo "========================================"
-echo "Summary"
-echo "========================================"
-echo -e "Errors: ${RED}$ERRORS${NC}"
-echo -e "Warnings: ${YELLOW}$WARNINGS${NC}"
-echo ""
-
-if [ $ERRORS -gt 0 ]; then
-    echo -e "${RED}Security check FAILED${NC}"
-    exit 1
-elif [ $WARNINGS -gt 0 ]; then
-    echo -e "${YELLOW}Security check PASSED with warnings${NC}"
-    exit 0
-else
-    echo -e "${GREEN}Security check PASSED${NC}"
-    exit 0
-fi