@weave_protocol/mund 0.2.3 â 0.3.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +135 -1
- package/dist/analyzers/code-analyzer.d.ts.map +1 -1
- package/dist/analyzers/code-analyzer.js +2 -1
- package/dist/analyzers/code-analyzer.js.map +1 -1
- package/dist/analyzers/exfiltration-detector.d.ts.map +1 -1
- package/dist/analyzers/exfiltration-detector.js +2 -1
- package/dist/analyzers/exfiltration-detector.js.map +1 -1
- package/dist/analyzers/index.d.ts.map +1 -1
- package/dist/analyzers/index.js +4 -2
- package/dist/analyzers/index.js.map +1 -1
- package/dist/analyzers/injection-detector.d.ts.map +1 -1
- package/dist/analyzers/injection-detector.js +2 -1
- package/dist/analyzers/injection-detector.js.map +1 -1
- package/dist/analyzers/mcp-server-analyzer.d.ts +2 -0
- package/dist/analyzers/mcp-server-analyzer.d.ts.map +1 -1
- package/dist/analyzers/mcp-server-analyzer.js.map +1 -1
- package/dist/analyzers/pii-detector.d.ts.map +1 -1
- package/dist/analyzers/pii-detector.js +2 -1
- package/dist/analyzers/pii-detector.js.map +1 -1
- package/dist/analyzers/regex.d.ts +10 -0
- package/dist/analyzers/regex.d.ts.map +1 -0
- package/dist/analyzers/regex.js +17 -0
- package/dist/analyzers/regex.js.map +1 -0
- package/dist/analyzers/secret-scanner.d.ts.map +1 -1
- package/dist/analyzers/secret-scanner.js +2 -1
- package/dist/analyzers/secret-scanner.js.map +1 -1
- package/dist/canary.d.ts +48 -0
- package/dist/canary.d.ts.map +1 -0
- package/dist/canary.js +149 -0
- package/dist/canary.js.map +1 -0
- package/dist/cli/scan.d.ts +50 -0
- package/dist/cli/scan.d.ts.map +1 -0
- package/dist/cli/scan.js +235 -0
- package/dist/cli/scan.js.map +1 -0
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +12 -4
- package/dist/index.js.map +1 -1
- package/dist/notifications/email.d.ts +21 -8
- package/dist/notifications/email.d.ts.map +1 -1
- package/dist/notifications/email.js +32 -178
- package/dist/notifications/email.js.map +1 -1
- package/dist/osv.d.ts +94 -0
- package/dist/osv.d.ts.map +1 -0
- package/dist/osv.js +239 -0
- package/dist/osv.js.map +1 -0
- package/dist/rugpull.d.ts +73 -0
- package/dist/rugpull.d.ts.map +1 -0
- package/dist/rugpull.js +177 -0
- package/dist/rugpull.js.map +1 -0
- package/dist/sarif.d.ts +20 -0
- package/dist/sarif.d.ts.map +1 -0
- package/dist/sarif.js +122 -0
- package/dist/sarif.js.map +1 -0
- package/dist/scoring.d.ts +26 -0
- package/dist/scoring.d.ts.map +1 -0
- package/dist/scoring.js +49 -0
- package/dist/scoring.js.map +1 -0
- package/dist/threat-intel-manager.d.ts.map +1 -1
- package/dist/threat-intel-manager.js +2 -1
- package/dist/threat-intel-manager.js.map +1 -1
- package/dist/tools/canary-rugpull.d.ts +7 -0
- package/dist/tools/canary-rugpull.d.ts.map +1 -0
- package/dist/tools/canary-rugpull.js +50 -0
- package/dist/tools/canary-rugpull.js.map +1 -0
- package/dist/tools/configuration.d.ts.map +1 -1
- package/dist/tools/configuration.js +2 -1
- package/dist/tools/configuration.js.map +1 -1
- package/dist/tools/index.d.ts +1 -0
- package/dist/tools/index.d.ts.map +1 -1
- package/dist/tools/index.js +4 -0
- package/dist/tools/index.js.map +1 -1
- package/dist/tools/mcp-scanning.d.ts.map +1 -1
- package/dist/tools/mcp-scanning.js +4 -0
- package/dist/tools/mcp-scanning.js.map +1 -1
- package/dist/tools/monitoring.d.ts.map +1 -1
- package/dist/tools/monitoring.js +22 -1
- package/dist/tools/monitoring.js.map +1 -1
- package/dist/version.d.ts +6 -0
- package/dist/version.d.ts.map +1 -0
- package/dist/version.js +19 -0
- package/dist/version.js.map +1 -0
- package/package.json +2 -4
- package/src/analyzers/code-analyzer.ts +2 -1
- package/src/analyzers/exfiltration-detector.ts +2 -1
- package/src/analyzers/index.ts +4 -2
- package/src/analyzers/injection-detector.ts +2 -1
- package/src/analyzers/mcp-server-analyzer.ts +2 -0
- package/src/analyzers/pii-detector.ts +2 -1
- package/src/analyzers/regex.ts +17 -0
- package/src/analyzers/secret-scanner.ts +2 -1
- package/src/canary.ts +165 -0
- package/src/cli/scan.ts +260 -0
- package/src/index.ts +13 -4
- package/src/notifications/email.ts +38 -194
- package/src/osv.ts +310 -0
- package/src/rugpull.ts +233 -0
- package/src/sarif.ts +146 -0
- package/src/scoring.ts +64 -0
- package/src/threat-intel-manager.ts +2 -1
- package/src/tools/canary-rugpull.ts +75 -0
- package/src/tools/configuration.ts +2 -1
- package/src/tools/index.ts +5 -0
- package/src/tools/mcp-scanning.ts +5 -0
- package/src/tools/monitoring.ts +23 -1
- package/src/version.ts +20 -0
- package/tests/analyzers/engine.test.ts +60 -0
- package/tests/analyzers/injection-and-code.test.ts +80 -0
- package/tests/analyzers/mcp-server-analyzer.test.ts +82 -0
- package/tests/analyzers/regex.test.ts +35 -0
- package/tests/analyzers/rules.test.ts +54 -0
- package/tests/analyzers/secret-scanner.test.ts +80 -0
- package/tests/canary.test.ts +79 -0
- package/tests/cli/scan.test.ts +92 -0
- package/tests/fixtures/canary/base64.json +9 -0
- package/tests/fixtures/canary/clean-output.json +8 -0
- package/tests/fixtures/canary/exact-leak.json +9 -0
- package/tests/fixtures/canary/lowercased.json +9 -0
- package/tests/fixtures/canary/other-token.json +8 -0
- package/tests/fixtures/canary/prefix-only.json +8 -0
- package/tests/fixtures/canary/reversed.json +9 -0
- package/tests/fixtures/canary/spaced-out.json +9 -0
- package/tests/fixtures/canary/zero-width.json +9 -0
- package/tests/fixtures/rugpull/description-changed/baseline.json +36 -0
- package/tests/fixtures/rugpull/description-changed/current.json +36 -0
- package/tests/fixtures/rugpull/description-changed/expected.json +11 -0
- package/tests/fixtures/rugpull/gains-execution/baseline.json +36 -0
- package/tests/fixtures/rugpull/gains-execution/current.json +36 -0
- package/tests/fixtures/rugpull/gains-execution/expected.json +18 -0
- package/tests/fixtures/rugpull/schema-changed/baseline.json +36 -0
- package/tests/fixtures/rugpull/schema-changed/current.json +39 -0
- package/tests/fixtures/rugpull/schema-changed/expected.json +11 -0
- package/tests/fixtures/rugpull/schema-key-reorder/baseline.json +36 -0
- package/tests/fixtures/rugpull/schema-key-reorder/current.json +36 -0
- package/tests/fixtures/rugpull/schema-key-reorder/expected.json +5 -0
- package/tests/fixtures/rugpull/server-renamed/baseline.json +36 -0
- package/tests/fixtures/rugpull/server-renamed/current.json +36 -0
- package/tests/fixtures/rugpull/server-renamed/expected.json +11 -0
- package/tests/fixtures/rugpull/tool-added/baseline.json +36 -0
- package/tests/fixtures/rugpull/tool-added/current.json +44 -0
- package/tests/fixtures/rugpull/tool-added/expected.json +11 -0
- package/tests/fixtures/rugpull/tool-removed/baseline.json +36 -0
- package/tests/fixtures/rugpull/tool-removed/current.json +21 -0
- package/tests/fixtures/rugpull/tool-removed/expected.json +11 -0
- package/tests/fixtures/rugpull/unchanged/baseline.json +36 -0
- package/tests/fixtures/rugpull/unchanged/current.json +36 -0
- package/tests/fixtures/rugpull/unchanged/expected.json +5 -0
- package/tests/fixtures.test.ts +40 -0
- package/tests/helpers.ts +51 -0
- package/tests/notifications/email.test.ts +68 -0
- package/tests/notifications/hub.test.ts +160 -0
- package/tests/osv.test.ts +117 -0
- package/tests/rugpull.test.ts +80 -0
- package/tests/sarif.test.ts +59 -0
- package/tests/scoring.test.ts +49 -0
- package/tests/tools/canary-rugpull.test.ts +57 -0
- package/tests/tools/monitoring.test.ts +95 -0
- package/vitest.config.ts +8 -0
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;GAGG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,OAAO,MAAM,SAAS,CAAC;AAG9B,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;GAGG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,OAAO,MAAM,SAAS,CAAC;AAG9B,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAElD,8BAA8B;AAC9B,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EACL,gBAAgB,EAChB,6BAA6B,EAC7B,uBAAuB,EACvB,sBAAsB,EACtB,iBAAiB,EACjB,oBAAoB,EACpB,uBAAuB,EACvB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,yBAAyB,CAAC;AAEjC,+EAA+E;AAC/E,wBAAwB;AACxB,+EAA+E;AAE/E,SAAS,UAAU;IACjB,MAAM,MAAM,GAAe;QACzB,GAAG,cAAc;QAEjB,mCAAmC;QACnC,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,MAAM,CAAC;QAC/C,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,WAAW;QAC1C,SAAS,EAAG,OAAO,CAAC,GAAG,CAAC,cAAmC,IAAI,OAAO;QAEtE,UAAU;QACV,SAAS,EAAG,OAAO,CAAC,GAAG,CAAC,cAA0C,IAAI,MAAM;QAE5E,UAAU;QACV,YAAY,EAAG,OAAO,CAAC,GAAG,CAAC,YAA2C,IAAI,QAAQ;QAClF,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB;QAE3C,WAAW;QACX,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe,KAAK,OAAO;QACnD,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY;QAEjC,gBAAgB;QAChB,aAAa,EAAE;YACb,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC;gBACtC,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB;gBAC3C,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB;gBACvC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,eAAe;gBAC5D,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,OAAO;gBACnD,YAAY,EAAG,OAAO,CAAC,GAAG,CAAC,uBAA+B,IAAI,MAAM;aACrE,CAAC,CAAC,CAAC,SAAS;YAEb,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC;gBACtC,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB;gBAC3C,YAAY,EAAG,OAAO,CAAC,GAAG,CAAC,uBAA+B,IAAI,MAAM;aACrE,CAAC,CAAC,CAAC,SAAS;YAEb,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC;gBACxC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;gBAC3C,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,KAAK,CAAC;gBAC9D,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,sBAAsB,KAAK,MAAM;gBAC1D,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;gBAC3C,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;gBAC3C,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,gBAAgB;gBAC7D,YAAY,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;gBAC1E,YAAY,EAAG,OAAO,CAAC,GAAG,CAAC,uBAA+B,IAAI,MAAM;aACrE,CAAC,CAAC,CAAC,SAAS;YAEb,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC;oBACxC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB;oBACjC,MAAM,EAAE,MAAe;oBACvB,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,SAAS;oBACpG,YAAY,EAAG,OAAO,CAAC,GAAG,CAAC,yBAA6E,IAAI,MAAM;iBACnH,CAAC,CAAC,CAAC,CAAC,SAAS;SACf;KACF,CAAC;IAEF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,+EAA+E;AAC/E,wCAAwC;AACxC,+EAA+E;AAE/E,SAAS,wBAAwB,CAAC,MAAiB;IACjD,MAAM,QAAQ,GAAG,6BAA6B,CAAC,WAAW,CAAC,CAAC;IAE5D,4BAA4B;IAC5B,MAAM,SAAS,GAAwC;QACrD,0BAA0B,EAAE,uBAAuB;QACnD,yBAAyB,EAAE,sBAAsB;QACjD,mBAAmB,EAAE,iBAAiB;QACtC,uBAAuB,EAAE,oBAAoB;QAC7C,0BAA0B,EAAE,uBAAuB;QACnD,kBAAkB,EAAE,gBAAgB;QACpC,oBAAoB,EAAE,kBAAkB;QACxC,qBAAqB,EAAE,mBAAmB;KAC3C,CAAC;IAEF,kDAAkD;IAClD,KAAK,MAAM,IAAI,IAAI,gBAAgB,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,MAAM;YAAE,SAAS;QAEtB,MAAM,CAAC,IAAI,CACT,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,WAAW,EAChB,MAAM,EACN,KAAK,EAAE,IAAS,EAAE,EAAE;YAClB,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,IAA6B,CAAC,CAAC;YAC7D,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO;oBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,iBAAiB,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC;iBACpG,CAAC;YACJ,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;gBACnC,OAAO;oBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;iBAC5E,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO;oBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gCACtD,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;6BAC9D,CAAC,EAAE,CAAC;iBACN,CAAC;YACJ,CAAC;QACH,CAAC,CACF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,wBAAwB;AACxB,+EAA+E;AAE/E,KAAK,UAAU,gBAAgB,CAAC,MAAkB;IAChD,oBAAoB;IACpB,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;QAC3B,IAAI,EAAE,iBAAiB;QACvB,OAAO,EAAE,UAAU,EAAE;KACtB,CAAC,CAAC;IAEH,qBAAqB;IACrB,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAEtC,6BAA6B;IAC7B,MAAM,QAAQ,GAAG,IAAI,cAAc,EAAE,CAAC;IAEtC,8BAA8B;IAC9B,MAAM,eAAe,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC;IAEpD,gEAAgE;IAChE,MAAM,KAAK,GAAoB,CAAC,GAAG,aAAa,CAAC,CAAC;IAElD,2CAA2C;IAC3C,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC;IAC5C,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YACvC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IAED,0BAA0B;IAC1B,mBAAmB,EAAE,CAAC;IACtB,gBAAgB,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;IAEvF,qCAAqC;IACrC,wBAAwB,CAAC,MAAM,CAAC,CAAC;IAEjC,sCAAsC;IACtC,MAAM,WAAW,GAAG,WAAW,CAAC,SAAS,EAAE,CAAC;IAE5C,mBAAmB;IACnB,OAAO,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAC/C,OAAO,CAAC,KAAK,CAAC,gBAAgB,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;IAClD,OAAO,CAAC,KAAK,CAAC,cAAc,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;IACnD,OAAO,CAAC,KAAK,CAAC,iBAAiB,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;IAC7E,OAAO,CAAC,KAAK,CAAC,mBAAmB,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACxE,OAAO,CAAC,KAAK,CAAC,mBAAmB,WAAW,CAAC,QAAQ,CAAC,KAAK,kBAAkB,WAAW,CAAC,OAAO,CAAC,OAAO,UAAU,CAAC,CAAC;IACpH,OAAO,CAAC,KAAK,CAAC,gBAAgB,eAAe,CAAC,gBAAgB,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC;IAEzF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,+EAA+E;AAC/E,qBAAqB;AACrB,+EAA+E;AAE/E,KAAK,UAAU,QAAQ,CAAC,MAAkB;IACxC,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC9C,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAE7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,OAAO,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;AACpD,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,MAAkB;IACvC,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IAEtB,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAEzC,wBAAwB;IACxB,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC/B,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,+BAA+B;IAC/B,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACrC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,eAAe;IACf,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAClC,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC;YAClD,kBAAkB,EAAE,SAAS;YAC7B,kBAAkB,EAAE,IAAI;SACzB,CAAC,CAAC;QAEH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC;QAEzC,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAChC,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,eAAe;IACf,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE;QACxC,OAAO,CAAC,KAAK,CAAC,qCAAqC,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,MAAM,CAAC,CAAC;IACvF,CAAC,CAAC,CAAC;AACL,CAAC;AAED,+EAA+E;AAC/E,eAAe;AACf,+EAA+E;AAE/E,SAAS,SAAS;IAChB,OAAO,CAAC,GAAG,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2Db,CAAC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAEnC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;QACvB,OAAO,CAAC,IAAI,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,CAAC;IAED,sBAAsB;IACtB,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACnD,SAAS,EAAE,CAAC;QACZ,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACtD,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;QAC1B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,cAAc;IACd,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAE5B,oBAAoB;IACpB,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IACnD,IAAI,cAAc,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,cAAc,GAAG,CAAC,CAAC,EAAE,CAAC;QACtD,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,cAAc,GAAG,CAAC,CAAqB,CAAC;IAClE,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,SAAS,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC,EAAE,CAAC;QAC5C,MAAM,CAAC,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,SAAS,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC,EAAE,CAAC;QAC5C,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;IACpC,CAAC;IAED,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC;IAC3B,CAAC;IAED,4BAA4B;IAC5B,IAAI,CAAC;QACH,IAAI,MAAM,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;YAChC,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;QACxB,CAAC;aAAM,CAAC;YACN,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAC;QACrD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,MAAM;AACN,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE;IACnB,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;IACrC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC;AAEH,+EAA+E;AAC/E,+BAA+B;AAC/B,+EAA+E;AAE/E,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAC5E,OAAO,EAAE,gBAAgB,EAAE,6BAA6B,EAAE,MAAM,yBAAyB,CAAC;AAC1F,cAAc,yBAAyB,CAAC"}
|
|
@@ -1,18 +1,31 @@
|
|
|
1
1
|
/**
|
|
2
2
|
* Mund - The Guardian Protocol
|
|
3
|
-
* Email Notifier -
|
|
3
|
+
* Email Notifier - NOT IMPLEMENTED in v0.2.x.
|
|
4
|
+
*
|
|
5
|
+
* The nodemailer dependency was removed because it carried a
|
|
6
|
+
* high-severity CVE and was never actually wired up (the previous
|
|
7
|
+
* revision had only comments like "In a real implementation, use
|
|
8
|
+
* nodemailer here"). Carrying a prod dep for a feature nobody uses
|
|
9
|
+
* meant inheriting its CVE for no benefit.
|
|
10
|
+
*
|
|
11
|
+
* This stub keeps the INotifier contract so NotificationManager can
|
|
12
|
+
* still wire it up when `notificationConfig.email.smtp_host` is set,
|
|
13
|
+
* but every send() call returns false and logs a one-time warning,
|
|
14
|
+
* so operators see email alerts aren't actually being delivered.
|
|
15
|
+
*
|
|
16
|
+
* When/if email notifications become a real feature:
|
|
17
|
+
* 1. npm install nodemailer@^10 @types/nodemailer
|
|
18
|
+
* 2. Replace this stub with a real implementation
|
|
19
|
+
* 3. Add test fixtures under test/notifications/
|
|
20
|
+
* 4. Remove the console.warn in the constructor
|
|
4
21
|
*/
|
|
5
22
|
import type { INotifier, NotificationPayload, EmailConfig } from '../types.js';
|
|
6
23
|
export declare class EmailNotifier implements INotifier {
|
|
7
24
|
name: string;
|
|
8
|
-
|
|
25
|
+
readonly config: EmailConfig;
|
|
26
|
+
private warned;
|
|
9
27
|
constructor(config: EmailConfig);
|
|
10
|
-
send(
|
|
11
|
-
private formatEmail;
|
|
12
|
-
private escapeHtml;
|
|
13
|
-
private getSeverityColor;
|
|
14
|
-
private getSeverityEmoji;
|
|
15
|
-
private meetsMinSeverity;
|
|
28
|
+
send(_payload: NotificationPayload): Promise<boolean>;
|
|
16
29
|
}
|
|
17
30
|
export default EmailNotifier;
|
|
18
31
|
//# sourceMappingURL=email.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"email.d.ts","sourceRoot":"","sources":["../../src/notifications/email.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"email.d.ts","sourceRoot":"","sources":["../../src/notifications/email.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE/E,qBAAa,aAAc,YAAW,SAAS;IAC7C,IAAI,SAAmB;IAIvB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,OAAO,CAAC,MAAM,CAAS;gBAEX,MAAM,EAAE,WAAW;IAUzB,IAAI,CAAC,QAAQ,EAAE,mBAAmB,GAAG,OAAO,CAAC,OAAO,CAAC;CAU5D;AAED,eAAe,aAAa,CAAC"}
|
|
@@ -1,191 +1,45 @@
|
|
|
1
1
|
/**
|
|
2
2
|
* Mund - The Guardian Protocol
|
|
3
|
-
* Email Notifier -
|
|
3
|
+
* Email Notifier - NOT IMPLEMENTED in v0.2.x.
|
|
4
|
+
*
|
|
5
|
+
* The nodemailer dependency was removed because it carried a
|
|
6
|
+
* high-severity CVE and was never actually wired up (the previous
|
|
7
|
+
* revision had only comments like "In a real implementation, use
|
|
8
|
+
* nodemailer here"). Carrying a prod dep for a feature nobody uses
|
|
9
|
+
* meant inheriting its CVE for no benefit.
|
|
10
|
+
*
|
|
11
|
+
* This stub keeps the INotifier contract so NotificationManager can
|
|
12
|
+
* still wire it up when `notificationConfig.email.smtp_host` is set,
|
|
13
|
+
* but every send() call returns false and logs a one-time warning,
|
|
14
|
+
* so operators see email alerts aren't actually being delivered.
|
|
15
|
+
*
|
|
16
|
+
* When/if email notifications become a real feature:
|
|
17
|
+
* 1. npm install nodemailer@^10 @types/nodemailer
|
|
18
|
+
* 2. Replace this stub with a real implementation
|
|
19
|
+
* 3. Add test fixtures under test/notifications/
|
|
20
|
+
* 4. Remove the console.warn in the constructor
|
|
4
21
|
*/
|
|
5
|
-
// Note: In production, use nodemailer
|
|
6
|
-
// For now, we'll implement a basic interface that can be extended
|
|
7
22
|
export class EmailNotifier {
|
|
8
23
|
name = 'EmailNotifier';
|
|
24
|
+
// Config is retained so a future real implementation can see what
|
|
25
|
+
// shape to expect. Public (not private) because noUnusedLocals flags
|
|
26
|
+
// unread private members even with an underscore prefix.
|
|
9
27
|
config;
|
|
28
|
+
warned = false;
|
|
10
29
|
constructor(config) {
|
|
11
30
|
this.config = config;
|
|
31
|
+
console.warn('[mund] EmailNotifier configured but NOT IMPLEMENTED in this version. ' +
|
|
32
|
+
'Email alerts will be dropped. Use a webhook, Slack, or Teams notifier ' +
|
|
33
|
+
'for actual delivery. Track at ' +
|
|
34
|
+
'https://github.com/Tyox-all/Weave_Protocol/issues');
|
|
12
35
|
}
|
|
13
|
-
async send(
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
36
|
+
async send(_payload) {
|
|
37
|
+
if (!this.warned) {
|
|
38
|
+
console.error('[mund] EmailNotifier.send() called but email delivery is not ' +
|
|
39
|
+
'implemented. Alert dropped. (This warning fires once per process.)');
|
|
40
|
+
this.warned = true;
|
|
18
41
|
}
|
|
19
|
-
|
|
20
|
-
try {
|
|
21
|
-
// In a real implementation, use nodemailer here
|
|
22
|
-
// For now, we'll log the email content
|
|
23
|
-
console.log('Email notification would be sent:');
|
|
24
|
-
console.log('To:', this.config.to_addresses.join(', '));
|
|
25
|
-
console.log('Subject:', emailContent.subject);
|
|
26
|
-
console.log('Body:', emailContent.html.substring(0, 500) + '...');
|
|
27
|
-
// Uncomment when nodemailer is configured:
|
|
28
|
-
// const transporter = nodemailer.createTransport({
|
|
29
|
-
// host: this.config.smtp_host,
|
|
30
|
-
// port: this.config.smtp_port,
|
|
31
|
-
// secure: this.config.smtp_secure,
|
|
32
|
-
// auth: this.config.smtp_user ? {
|
|
33
|
-
// user: this.config.smtp_user,
|
|
34
|
-
// pass: this.config.smtp_pass
|
|
35
|
-
// } : undefined
|
|
36
|
-
// });
|
|
37
|
-
//
|
|
38
|
-
// await transporter.sendMail({
|
|
39
|
-
// from: this.config.from_address,
|
|
40
|
-
// to: this.config.to_addresses.join(', '),
|
|
41
|
-
// subject: emailContent.subject,
|
|
42
|
-
// html: emailContent.html,
|
|
43
|
-
// text: emailContent.text
|
|
44
|
-
// });
|
|
45
|
-
return true;
|
|
46
|
-
}
|
|
47
|
-
catch (error) {
|
|
48
|
-
console.error('Failed to send email notification:', error);
|
|
49
|
-
return false;
|
|
50
|
-
}
|
|
51
|
-
}
|
|
52
|
-
formatEmail(payload) {
|
|
53
|
-
const { event } = payload;
|
|
54
|
-
const severityEmoji = this.getSeverityEmoji(event.severity);
|
|
55
|
-
const severityColor = this.getSeverityColor(event.severity);
|
|
56
|
-
const subject = `${severityEmoji} [Mund ${event.severity.toUpperCase()}] ${event.rule_name}`;
|
|
57
|
-
const html = `
|
|
58
|
-
<!DOCTYPE html>
|
|
59
|
-
<html>
|
|
60
|
-
<head>
|
|
61
|
-
<style>
|
|
62
|
-
body { font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif; line-height: 1.6; color: #333; }
|
|
63
|
-
.container { max-width: 600px; margin: 0 auto; padding: 20px; }
|
|
64
|
-
.header { background: ${severityColor}; color: white; padding: 20px; border-radius: 8px 8px 0 0; }
|
|
65
|
-
.content { background: #f8f9fa; padding: 20px; border: 1px solid #dee2e6; border-top: none; border-radius: 0 0 8px 8px; }
|
|
66
|
-
.snippet { background: #1e1e1e; color: #d4d4d4; padding: 15px; border-radius: 4px; font-family: monospace; overflow-x: auto; }
|
|
67
|
-
.details { margin-top: 20px; }
|
|
68
|
-
.detail-row { display: flex; border-bottom: 1px solid #dee2e6; padding: 8px 0; }
|
|
69
|
-
.detail-label { font-weight: bold; width: 120px; flex-shrink: 0; }
|
|
70
|
-
.detail-value { color: #495057; }
|
|
71
|
-
.footer { margin-top: 20px; padding-top: 20px; border-top: 1px solid #dee2e6; font-size: 12px; color: #6c757d; }
|
|
72
|
-
</style>
|
|
73
|
-
</head>
|
|
74
|
-
<body>
|
|
75
|
-
<div class="container">
|
|
76
|
-
<div class="header">
|
|
77
|
-
<h1 style="margin: 0;">${severityEmoji} Mund Security Alert</h1>
|
|
78
|
-
<p style="margin: 10px 0 0 0; opacity: 0.9;">${event.rule_name}</p>
|
|
79
|
-
</div>
|
|
80
|
-
<div class="content">
|
|
81
|
-
<h3>Detected Content</h3>
|
|
82
|
-
<div class="snippet">${this.escapeHtml(event.content_snippet)}</div>
|
|
83
|
-
|
|
84
|
-
<div class="details">
|
|
85
|
-
<h3>Event Details</h3>
|
|
86
|
-
<div class="detail-row">
|
|
87
|
-
<span class="detail-label">Severity:</span>
|
|
88
|
-
<span class="detail-value">${event.severity.toUpperCase()}</span>
|
|
89
|
-
</div>
|
|
90
|
-
<div class="detail-row">
|
|
91
|
-
<span class="detail-label">Type:</span>
|
|
92
|
-
<span class="detail-value">${event.type}</span>
|
|
93
|
-
</div>
|
|
94
|
-
<div class="detail-row">
|
|
95
|
-
<span class="detail-label">Action:</span>
|
|
96
|
-
<span class="detail-value">${event.action_taken}</span>
|
|
97
|
-
</div>
|
|
98
|
-
<div class="detail-row">
|
|
99
|
-
<span class="detail-label">Rule ID:</span>
|
|
100
|
-
<span class="detail-value">${event.rule_id}</span>
|
|
101
|
-
</div>
|
|
102
|
-
<div class="detail-row">
|
|
103
|
-
<span class="detail-label">Event ID:</span>
|
|
104
|
-
<span class="detail-value">${event.id}</span>
|
|
105
|
-
</div>
|
|
106
|
-
<div class="detail-row">
|
|
107
|
-
<span class="detail-label">Timestamp:</span>
|
|
108
|
-
<span class="detail-value">${event.timestamp.toISOString()}</span>
|
|
109
|
-
</div>
|
|
110
|
-
${event.context.tool_name ? `
|
|
111
|
-
<div class="detail-row">
|
|
112
|
-
<span class="detail-label">Tool:</span>
|
|
113
|
-
<span class="detail-value">${event.context.tool_name}</span>
|
|
114
|
-
</div>
|
|
115
|
-
` : ''}
|
|
116
|
-
${event.context.agent_id ? `
|
|
117
|
-
<div class="detail-row">
|
|
118
|
-
<span class="detail-label">Agent:</span>
|
|
119
|
-
<span class="detail-value">${event.context.agent_id}</span>
|
|
120
|
-
</div>
|
|
121
|
-
` : ''}
|
|
122
|
-
</div>
|
|
123
|
-
|
|
124
|
-
<div class="footer">
|
|
125
|
-
This alert was generated by Mund - The Guardian Protocol.<br>
|
|
126
|
-
Review and acknowledge this alert in your security dashboard.
|
|
127
|
-
</div>
|
|
128
|
-
</div>
|
|
129
|
-
</div>
|
|
130
|
-
</body>
|
|
131
|
-
</html>`;
|
|
132
|
-
const text = `
|
|
133
|
-
MUND SECURITY ALERT
|
|
134
|
-
====================
|
|
135
|
-
|
|
136
|
-
${event.severity.toUpperCase()}: ${event.rule_name}
|
|
137
|
-
|
|
138
|
-
Detected Content:
|
|
139
|
-
${event.content_snippet}
|
|
140
|
-
|
|
141
|
-
Event Details:
|
|
142
|
-
- Severity: ${event.severity.toUpperCase()}
|
|
143
|
-
- Type: ${event.type}
|
|
144
|
-
- Action: ${event.action_taken}
|
|
145
|
-
- Rule ID: ${event.rule_id}
|
|
146
|
-
- Event ID: ${event.id}
|
|
147
|
-
- Timestamp: ${event.timestamp.toISOString()}
|
|
148
|
-
${event.context.tool_name ? `- Tool: ${event.context.tool_name}` : ''}
|
|
149
|
-
${event.context.agent_id ? `- Agent: ${event.context.agent_id}` : ''}
|
|
150
|
-
|
|
151
|
-
---
|
|
152
|
-
This alert was generated by Mund - The Guardian Protocol.
|
|
153
|
-
`;
|
|
154
|
-
return { subject, html, text };
|
|
155
|
-
}
|
|
156
|
-
escapeHtml(text) {
|
|
157
|
-
return text
|
|
158
|
-
.replace(/&/g, '&')
|
|
159
|
-
.replace(/</g, '<')
|
|
160
|
-
.replace(/>/g, '>')
|
|
161
|
-
.replace(/"/g, '"')
|
|
162
|
-
.replace(/'/g, ''');
|
|
163
|
-
}
|
|
164
|
-
getSeverityColor(severity) {
|
|
165
|
-
const colors = {
|
|
166
|
-
critical: '#dc3545',
|
|
167
|
-
high: '#fd7e14',
|
|
168
|
-
medium: '#ffc107',
|
|
169
|
-
low: '#17a2b8',
|
|
170
|
-
info: '#6c757d'
|
|
171
|
-
};
|
|
172
|
-
return colors[severity] || colors.info;
|
|
173
|
-
}
|
|
174
|
-
getSeverityEmoji(severity) {
|
|
175
|
-
const emojis = {
|
|
176
|
-
critical: 'đ¨',
|
|
177
|
-
high: 'â ī¸',
|
|
178
|
-
medium: 'âĄ',
|
|
179
|
-
low: 'âšī¸',
|
|
180
|
-
info: 'đ'
|
|
181
|
-
};
|
|
182
|
-
return emojis[severity] || 'đ';
|
|
183
|
-
}
|
|
184
|
-
meetsMinSeverity(eventSeverity, minSeverity) {
|
|
185
|
-
const order = ['critical', 'high', 'medium', 'low', 'info'];
|
|
186
|
-
const eventIndex = order.indexOf(eventSeverity);
|
|
187
|
-
const minIndex = order.indexOf(minSeverity);
|
|
188
|
-
return eventIndex <= minIndex;
|
|
42
|
+
return false;
|
|
189
43
|
}
|
|
190
44
|
}
|
|
191
45
|
export default EmailNotifier;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"email.js","sourceRoot":"","sources":["../../src/notifications/email.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"email.js","sourceRoot":"","sources":["../../src/notifications/email.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAIH,MAAM,OAAO,aAAa;IACxB,IAAI,GAAG,eAAe,CAAC;IACvB,kEAAkE;IAClE,qEAAqE;IACrE,yDAAyD;IAChD,MAAM,CAAc;IACrB,MAAM,GAAG,KAAK,CAAC;IAEvB,YAAY,MAAmB;QAC7B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,OAAO,CAAC,IAAI,CACV,uEAAuE;YACrE,wEAAwE;YACxE,gCAAgC;YAChC,mDAAmD,CACtD,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,QAA6B;QACtC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,OAAO,CAAC,KAAK,CACX,+DAA+D;gBAC7D,oEAAoE,CACvE,CAAC;YACF,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACrB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAED,eAAe,aAAa,CAAC"}
|
package/dist/osv.d.ts
ADDED
|
@@ -0,0 +1,94 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Mund - The Guardian Protocol
|
|
3
|
+
* OSV.dev dependency vulnerability lookups with an offline fallback
|
|
4
|
+
*
|
|
5
|
+
* Live path: POST /v1/querybatch for every name@version in a lockfile,
|
|
6
|
+
* then GET /v1/vulns/{id} once per unique advisory for details.
|
|
7
|
+
*
|
|
8
|
+
* Offline path: every successful live lookup is written to an on-disk
|
|
9
|
+
* cache. When the network is unavailable (or MUND_OFFLINE=1 / --offline),
|
|
10
|
+
* results come from that cache and are reported with source "cache", so
|
|
11
|
+
* callers can tell a clean result from an unchecked one. Packages that
|
|
12
|
+
* were never looked up are reported as unchecked, never as clean.
|
|
13
|
+
*/
|
|
14
|
+
import type { SecurityIssue, Severity } from './types.js';
|
|
15
|
+
export interface LockedPackage {
|
|
16
|
+
name: string;
|
|
17
|
+
version: string;
|
|
18
|
+
/** Lockfile key, e.g. "node_modules/qs", used to locate the finding. */
|
|
19
|
+
path?: string;
|
|
20
|
+
}
|
|
21
|
+
export interface OsvAdvisory {
|
|
22
|
+
id: string;
|
|
23
|
+
summary: string;
|
|
24
|
+
severity: Severity;
|
|
25
|
+
aliases: string[];
|
|
26
|
+
fixed?: string;
|
|
27
|
+
url: string;
|
|
28
|
+
}
|
|
29
|
+
export type OsvSource = 'live' | 'cache' | 'unavailable';
|
|
30
|
+
export interface OsvLookupResult {
|
|
31
|
+
source: OsvSource;
|
|
32
|
+
/** Keyed by "name@version". */
|
|
33
|
+
advisories: Map<string, OsvAdvisory[]>;
|
|
34
|
+
/** name@version keys with no live or cached answer. */
|
|
35
|
+
unchecked: string[];
|
|
36
|
+
/** Why the live lookup did not run or failed, if it didn't. */
|
|
37
|
+
error?: string;
|
|
38
|
+
}
|
|
39
|
+
export interface OsvClientOptions {
|
|
40
|
+
offline?: boolean;
|
|
41
|
+
cachePath?: string;
|
|
42
|
+
timeoutMs?: number;
|
|
43
|
+
fetch?: typeof fetch;
|
|
44
|
+
}
|
|
45
|
+
interface OsvVuln {
|
|
46
|
+
id: string;
|
|
47
|
+
summary?: string;
|
|
48
|
+
details?: string;
|
|
49
|
+
aliases?: string[];
|
|
50
|
+
severity?: Array<{
|
|
51
|
+
type: string;
|
|
52
|
+
score: string;
|
|
53
|
+
}>;
|
|
54
|
+
database_specific?: {
|
|
55
|
+
severity?: string;
|
|
56
|
+
};
|
|
57
|
+
affected?: Array<{
|
|
58
|
+
package?: {
|
|
59
|
+
name: string;
|
|
60
|
+
ecosystem: string;
|
|
61
|
+
};
|
|
62
|
+
ranges?: Array<{
|
|
63
|
+
events: Array<{
|
|
64
|
+
introduced?: string;
|
|
65
|
+
fixed?: string;
|
|
66
|
+
}>;
|
|
67
|
+
}>;
|
|
68
|
+
}>;
|
|
69
|
+
}
|
|
70
|
+
export declare function defaultCachePath(): string;
|
|
71
|
+
/** Parse an npm package-lock.json (lockfileVersion 1, 2 or 3). */
|
|
72
|
+
export declare function parseNpmLockfile(content: string): LockedPackage[];
|
|
73
|
+
export declare class OsvClient {
|
|
74
|
+
private readonly offline;
|
|
75
|
+
private readonly cachePath;
|
|
76
|
+
private readonly timeoutMs;
|
|
77
|
+
private readonly fetchImpl;
|
|
78
|
+
constructor(options?: OsvClientOptions);
|
|
79
|
+
lookup(packages: LockedPackage[], ecosystem?: string): Promise<OsvLookupResult>;
|
|
80
|
+
private lookupLive;
|
|
81
|
+
private lookupCached;
|
|
82
|
+
private request;
|
|
83
|
+
private readCache;
|
|
84
|
+
private writeCache;
|
|
85
|
+
}
|
|
86
|
+
/**
|
|
87
|
+
* OSV `severity[].score` is usually a CVSS *vector* string, not a number,
|
|
88
|
+
* so prefer the database's own label (GHSA sets it for npm advisories).
|
|
89
|
+
*/
|
|
90
|
+
export declare function parseSeverity(vuln: Pick<OsvVuln, 'severity' | 'database_specific'>): Severity;
|
|
91
|
+
/** Turn lookup results into SecurityIssues located in the lockfile. */
|
|
92
|
+
export declare function advisoriesToIssues(packages: LockedPackage[], result: OsvLookupResult, lockfileContent: string): SecurityIssue[];
|
|
93
|
+
export {};
|
|
94
|
+
//# sourceMappingURL=osv.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"osv.d.ts","sourceRoot":"","sources":["../src/osv.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAKH,OAAO,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAM1D,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,wEAAwE;IACxE,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,QAAQ,CAAC;IACnB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,OAAO,GAAG,aAAa,CAAC;AAEzD,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,SAAS,CAAC;IAClB,+BAA+B;IAC/B,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;IACvC,uDAAuD;IACvD,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,+DAA+D;IAC/D,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB;AAOD,UAAU,OAAO;IACf,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,QAAQ,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClD,iBAAiB,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1C,QAAQ,CAAC,EAAE,KAAK,CAAC;QACf,OAAO,CAAC,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,CAAC;QAC9C,MAAM,CAAC,EAAE,KAAK,CAAC;YAAE,MAAM,EAAE,KAAK,CAAC;gBAAE,UAAU,CAAC,EAAE,MAAM,CAAC;gBAAC,KAAK,CAAC,EAAE,MAAM,CAAA;aAAE,CAAC,CAAA;SAAE,CAAC,CAAC;KAC5E,CAAC,CAAC;CACJ;AAED,wBAAgB,gBAAgB,IAAI,MAAM,CAIzC;AAMD,kEAAkE;AAClE,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,aAAa,EAAE,CA6BjE;AAWD,qBAAa,SAAS;IACpB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAU;IAClC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAe;gBAE7B,OAAO,GAAE,gBAAqB;IAOpC,MAAM,CAAC,QAAQ,EAAE,aAAa,EAAE,EAAE,SAAS,SAAQ,GAAG,OAAO,CAAC,eAAe,CAAC;YAgBtE,UAAU;YA8BV,YAAY;YAeZ,OAAO;YAUP,SAAS;YAST,UAAU;CAWzB;AAqBD;;;GAGG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,UAAU,GAAG,mBAAmB,CAAC,GAAG,QAAQ,CAiB7F;AAMD,uEAAuE;AACvE,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,aAAa,EAAE,EACzB,MAAM,EAAE,eAAe,EACvB,eAAe,EAAE,MAAM,GACtB,aAAa,EAAE,CAyBjB"}
|