canship 0.1.0 → 0.1.1

package/README.md

@@ -16,7 +16,7 @@ Node.js 18 or later is required. Git is optional; only commit-history checks req
 
 | Check | Risk | Severity |
 |---|---|---|
-| Hardcoded credentials | A scanned file contains a recognised OpenAI, Anthropic, AWS, Stripe, GitHub, Slack, SendGrid, private-key, or database credential | P0 |
+| Hardcoded credentials | A scanned file contains a recognised OpenAI, Anthropic, AWS, Stripe, GitHub, npm, Slack, SendGrid, private-key, or database credential | P0 |
 | Private values in public environment variables | The value may be included in browser-delivered code | P0 |
 | Supabase `service_role` key reachable from client code | A `service_role` key can bypass Row Level Security (RLS) policies | P0 |
 | Git-tracked `.env` files | Recognised credentials remain in repository history; substantial unrecognised values may also produce a lower-confidence finding | P0 |

package/README.zh-CN.md

@@ -16,7 +16,7 @@ npx canship
 
 | 检查项 | 风险 | 级别 |
 |---|---|---|
-| 硬编码凭据 | 当前扫描文件中包含已识别的 OpenAI、Anthropic、AWS、Stripe、GitHub、Slack、SendGrid、私钥或数据库连接凭据 | P0 |
+| 硬编码凭据 | 当前扫描文件中包含已识别的 OpenAI、Anthropic、AWS、Stripe、GitHub、npm、Slack、SendGrid、私钥或数据库连接凭据 | P0 |
 | 公开环境变量中的私密值 | 私密值可能被打包进浏览器代码 | P0 |
 | 客户端可访问 Supabase `service_role` key | `service_role` 可绕过 Row Level Security（RLS）策略 | P0 |
 | Git 跟踪的 `.env` 文件 | 已识别凭据会留在仓库历史中；未识别但内容仍像真实配置的文件也可能产生低置信度结果 | P0 |

package/dist/cli.js

@@ -44,6 +44,20 @@ var SECRET_PATTERNS = [
     impact: "Grants access to your repositories \u2014 including private ones, and the ability to push code.",
     rotateAt: "https://github.com/settings/tokens"
   },
+  {
+    id: "npm-token",
+    name: "npm access token",
+    // Shape only, though npm encodes a CRC32 of the token into its last six
+    // characters and this could verify it. The github-token entry above uses
+    // the same scheme and does not verify it either, for the reason that
+    // settles it: if the algorithm ever changes, a checksum test turns a real
+    // leaked token into a silent pass. A false positive costs a glance. This
+    // particular false negative costs the account, and every account that
+    // installs anything published from it afterwards.
+    pattern: /\bnpm_[A-Za-z0-9]{36}\b/g,
+    impact: "Publishes packages under your account. Anyone who installs one afterwards runs whatever that version contains.",
+    rotateAt: "https://docs.npmjs.com/creating-and-viewing-access-tokens"
+  },
   {
     id: "google-api-key",
     name: "Google API key",
@@ -3671,7 +3685,7 @@ function renderHtml(result, opts) {
 }
 
 // src/cli.ts
-var VERSION = true ? "0.1.0" : "0.0.0-dev";
+var VERSION = true ? "0.1.1" : "0.0.0-dev";
 function argumentError(message) {
   process.stderr.write(`canship: ${cleanForOutput(message)}
 `);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "canship",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Static scanner for exposed credentials and open access rules in JS/TS front-end projects. Scans local files without executing project code or making network requests.",
   "keywords": [
     "security",