bastion-scan 0.2.0 → 0.2.1

package/dist/index.js

@@ -2366,20 +2366,69 @@ import { satisfies } from "semver";
 
 // src/data/compromised-packages.ts
 var COMPROMISED_PACKAGES = [
-  // Initial seed entries to be added after reviewing:
-  // - StepSecurity SHA1-Hulud IoC report
-  // - Snyk vulnerability database entries
-  // - npm security advisories for worm-propagated packages
-  //
-  // Example structure for future entries:
-  // {
-  //   name: 'example-malicious-pkg',
-  //   versionRange: '>=1.0.0 <1.2.0',
-  //   advisoryId: 'GHSA-xxxx-xxxx-xxxx',
-  //   source: 'shai-hulud',
-  //   dateAdded: '2026-05-16',
-  //   description: 'Malicious postinstall script exfiltrating env vars',
-  // },
+  // 1. event-stream -- cryptocurrency wallet theft (2018)
+  {
+    name: "event-stream",
+    versionRange: "=3.3.6",
+    advisoryId: "GHSA-mh6f-8j2x-4483",
+    source: "manual",
+    dateAdded: "2026-05-23",
+    description: "Backdoor injected via flatmap-stream dependency targeting Copay bitcoin wallet private keys."
+  },
+  // 2. ua-parser-js -- account takeover, cryptominer (2021)
+  {
+    name: "ua-parser-js",
+    versionRange: "=0.7.29 || =0.8.0 || =1.0.0",
+    advisoryId: "GHSA-pjwm-rvh2-c87w",
+    source: "manual",
+    dateAdded: "2026-05-23",
+    description: "npm account compromised; three versions published with cryptominer and password stealer."
+  },
+  // 3. coa -- credential harvesting (2021)
+  {
+    name: "coa",
+    versionRange: "=2.0.3 || =2.0.4 || =2.1.1 || =2.1.3 || =3.0.1 || =3.1.3",
+    advisoryId: "GHSA-73qr-pfmq-6rp8",
+    source: "manual",
+    dateAdded: "2026-05-23",
+    description: "npm account compromised; six malicious versions published with credential-harvesting payload."
+  },
+  // 4. rc -- credential harvesting (2021, same campaign as coa)
+  {
+    name: "rc",
+    versionRange: "=1.2.9 || =1.3.9 || =2.3.9",
+    advisoryId: "GHSA-g2q5-5433-rhrf",
+    source: "manual",
+    dateAdded: "2026-05-23",
+    description: "npm account compromised in the same campaign as coa; three malicious versions with credential-harvesting payload."
+  },
+  // 5. node-ipc -- destructive protestware (2022)
+  {
+    name: "node-ipc",
+    versionRange: ">=10.1.1 <10.1.3",
+    advisoryId: "GHSA-97m3-w2cp-4xx6",
+    source: "manual",
+    dateAdded: "2026-05-23",
+    description: "Maintainer added code to overwrite files with heart emojis on systems with Russian or Belarusian IP addresses."
+  },
+  // 6. node-ipc -- hidden functionality (2022, same maintainer)
+  {
+    name: "node-ipc",
+    versionRange: "=9.2.2",
+    advisoryId: "GHSA-8gr3-2gjw-jj7g",
+    source: "manual",
+    dateAdded: "2026-05-23",
+    description: "Hidden functionality added by maintainer in a separate version line from the destructive 10.1.x protestware."
+  },
+  // 7. faker -- sabotaged by maintainer (2022)
+  {
+    name: "faker",
+    versionRange: "=6.6.6",
+    advisoryId: "GHSA-5w9c-rv96-fr7g",
+    source: "manual",
+    dateAdded: "2026-05-23",
+    description: "Maintainer replaced all functional code with empty exports as a protest. Still live on npm as latest. Use @faker-js/faker instead."
+  }
 ];
 
 // src/checks/supply-chain/compromised-deps.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bastion-scan",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Privacy-first security checker for web projects. 15 checks, zero data uploaded, actionable fixes.",
   "type": "module",
   "bin": {