codeslick-cli 1.0.0

package/dist/src/lib/analyzers/javascript/security-checks/authentication-failures.js

@@ -0,0 +1,222 @@
+"use strict";
+/**
+ * JavaScript Authentication Failures Security Checks
+ * OWASP A07:2025 - Identification and Authentication Failures
+ *
+ * Detects missing MFA/2FA and lack of rate limiting on authentication endpoints.
+ * Phase 7B Week 3 Day 11: Cross-language authentication checks
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkAuthenticationFailures = checkAuthenticationFailures;
+const createVulnerability_1 = require("../utils/createVulnerability");
+/**
+ * Checks for authentication failure vulnerabilities in JavaScript code
+ *
+ * Covers (Enhanced Dec 30, 2025 - Phase 2):
+ * - Check #94: Missing MFA/2FA on login endpoints (MEDIUM)
+ * - Check #95: No rate limiting on login routes (MEDIUM)
+ * - Check #96: Plain-text password storage (CRITICAL) - NEW
+ * - Check #97: Weak password comparison (HIGH) - NEW
+ * - Check #98: Missing password hashing (CRITICAL) - NEW
+ * - Check #99: Session fixation vulnerability (HIGH) - NEW
+ * - Check #100: JWT without expiration (HIGH) - NEW
+ * - Check #101: Insecure session timeout (MEDIUM) - NEW
+ * - Check #102: Weak password requirements (LOW) - NEW
+ *
+ * @param lines - Array of code lines
+ * @returns Array of security vulnerabilities found
+ */
+function checkAuthenticationFailures(lines) {
+    const vulnerabilities = [];
+    let inMultiLineComment = false;
+    lines.forEach((line, index) => {
+        const lineNumber = index + 1;
+        const trimmed = line.trim();
+        // Track multi-line comment blocks (/* ... */)
+        if (trimmed.includes('/*')) {
+            inMultiLineComment = true;
+        }
+        if (trimmed.includes('*/')) {
+            inMultiLineComment = false;
+            return;
+        }
+        // Skip comments and empty lines
+        if (!trimmed || inMultiLineComment || trimmed.startsWith('//') || trimmed.startsWith('*'))
+            return;
+        // OWASP A07:2025 - Authentication Failures
+        // Check #94: Missing MFA/2FA - MEDIUM
+        // Pattern: Login routes that authenticate but don't check MFA
+        const loginRoutePattern = /\.(post|put)\s*\(\s*['"`]\/(login|auth|signin)/i;
+        if (trimmed.match(loginRoutePattern)) {
+            // Check next 20 lines for MFA verification
+            const nextLines = lines.slice(index, Math.min(index + 20, lines.length));
+            const hasMfaCheck = nextLines.some(l => {
+                const lowerLine = l.toLowerCase();
+                return lowerLine.includes('totp') ||
+                    lowerLine.includes('mfa') ||
+                    lowerLine.includes('2fa') ||
+                    lowerLine.includes('twofa') ||
+                    lowerLine.includes('twofactor') ||
+                    lowerLine.includes('otp') ||
+                    lowerLine.includes('verifycode') ||
+                    lowerLine.includes('authenticationcode');
+            });
+            if (!hasMfaCheck) {
+                vulnerabilities.push((0, createVulnerability_1.createJavaScriptSecurityVulnerability)('missing-mfa', 'Login endpoint missing multi-factor authentication (MFA/2FA)', 'Implement MFA: Verify TOTP/SMS code after password validation', lineNumber, 'Authentication relying solely on passwords is vulnerable to credential theft, phishing, and brute-force attacks. MFA adds critical defense layer.', 'User credentials stolen via phishing → Attacker logs in with password alone → Account compromised', [
+                    'Account takeover from stolen credentials',
+                    'Unauthorized access despite password theft',
+                    'Phishing attack success',
+                    'Credential stuffing attacks',
+                    'Compliance violations (PCI-DSS, SOC 2, NIST 800-63)'
+                ], 'app.post("/login", async (req, res) => {\n  if (validPassword) {\n    req.session.userId = user.id; // No MFA\n  }\n});', 'app.post("/login", async (req, res) => {\n  if (validPassword) {\n    if (!verifyTotp(user.secret, req.body.totpCode)) {\n      return res.status(401).send("Invalid MFA code");\n    }\n    req.session.userId = user.id;\n  }\n});', 'Implement TOTP-based MFA (Google Authenticator, Authy) or SMS-based verification as second authentication factor'));
+            }
+            // OWASP A07:2025 - Authentication Failures
+            // Check #95: No rate limiting on login - MEDIUM
+            // Check if route has rate limiting middleware
+            const hasRateLimiting = trimmed.includes('rateLimit') ||
+                trimmed.includes('rateLimiter') ||
+                trimmed.includes('limiter') ||
+                trimmed.includes('slowDown') ||
+                trimmed.includes('expressRateLimit');
+            if (!hasRateLimiting) {
+                vulnerabilities.push((0, createVulnerability_1.createJavaScriptSecurityVulnerability)('no-rate-limiting', 'Login endpoint missing rate limiting - vulnerable to brute-force attacks', 'Add rate limiting middleware: app.post("/login", rateLimit({ max: 5, windowMs: 15*60*1000 }), handler)', lineNumber, 'Login endpoints without rate limiting allow unlimited authentication attempts, enabling brute-force and credential stuffing attacks.', 'Attacker tries 10,000 passwords per minute → Eventually cracks weak passwords → Account compromised', [
+                    'Brute-force password attacks',
+                    'Credential stuffing with leaked password databases',
+                    'Account enumeration',
+                    'Denial of service from excessive login attempts',
+                    'Server resource exhaustion'
+                ], 'app.post("/login", (req, res) => {\n  // No rate limiting - unlimited attempts\n});', 'const loginLimiter = rateLimit({\n  windowMs: 15 * 60 * 1000, // 15 minutes\n  max: 5 // 5 attempts\n});\napp.post("/login", loginLimiter, (req, res) => {\n  // Rate limited\n});', 'Use express-rate-limit or similar middleware to limit login attempts to 5 per 15 minutes per IP address'));
+            }
+        }
+        // =============================================================================
+        // PHASE 2 ENHANCEMENTS (Dec 30, 2025) - A07 Authentication Improvements
+        // =============================================================================
+        // Check #96: Plain-text password storage (CRITICAL)
+        // Pattern: Arrays or objects with password fields containing plain-text values
+        // User test case: const users = [{ id: "1", password: "admin123" }]
+        const plainTextPasswordPattern = /(?:password|passwd|pwd)\s*:\s*['"`][^'"`]+['"`]/i;
+        const userArrayPattern = /(const|let|var)\s+(users|accounts|credentials)\s*=\s*\[/i;
+        if (trimmed.match(plainTextPasswordPattern)) {
+            // Check if it's in a data structure (not env var or config)
+            const isNotEnvVar = !trimmed.includes('process.env') &&
+                !trimmed.includes('config.') &&
+                !trimmed.includes('process.env');
+            if (isNotEnvVar) {
+                vulnerabilities.push((0, createVulnerability_1.createJavaScriptSecurityVulnerability)('plaintext-password-storage', 'CRITICAL: Plain-text password stored in code - passwords must be hashed', 'Never store passwords in plain-text. Use bcrypt, argon2, or scrypt to hash passwords', lineNumber, 'Storing passwords in plain-text allows anyone with code access to read all user passwords. If the database or code is compromised, all user credentials are immediately exposed.', 'const users = [{ email: "admin", password: "pass123" }] → Database leaked → All passwords exposed', [
+                    'Complete credential exposure on any code/database leak',
+                    'Mass account takeover',
+                    'Users passwords stolen (often reused across sites)',
+                    'Regulatory violations (GDPR, CCPA, PCI-DSS)',
+                    'Reputation damage and legal liability',
+                    'Impossible to comply with "right to be forgotten"'
+                ], 'const users = [{ email: "admin@test.com", password: "admin123" }];', 'const users = [{ email: "admin@test.com", passwordHash: "$2b$10$..." }]; // Use bcrypt\n\n// When creating user:\nconst hash = await bcrypt.hash(password, 10);\nawait db.users.create({ email, passwordHash: hash });', 'NEVER store passwords in plain-text. Always use bcrypt.hash() with salt rounds >= 10, or argon2, or scrypt.'));
+            }
+        }
+        // Check #97: Weak password comparison (HIGH)
+        // Pattern: if (user.password === inputPassword) or if (password === req.body.password)
+        // User test case: if (user.password === inputPassword)
+        const weakPasswordComparison = /(user\.password|stored(?:Password|Pwd)|dbPassword|account\.password)\s*===?\s*(input(?:Password|Pwd)|req\.body\.password|password)/i;
+        if (trimmed.match(weakPasswordComparison)) {
+            vulnerabilities.push((0, createVulnerability_1.createJavaScriptSecurityVulnerability)('weak-password-comparison', 'HIGH: Direct password comparison instead of bcrypt.compare() - timing attacks possible', 'Use bcrypt.compare(inputPassword, user.passwordHash) for secure password verification', lineNumber, 'Direct string comparison of passwords (=== or ==) is vulnerable to timing attacks and indicates passwords are stored in plain-text. Password verification must use constant-time comparison via bcrypt.compare().', 'if (user.password === inputPassword) → Timing attack reveals password length → Brute force faster', [
+                'Timing attacks reveal password information',
+                'Indicates plain-text password storage',
+                'No protection against rainbow tables',
+                'Vulnerable to brute-force attacks',
+                'Non-constant-time comparison leaks data'
+            ], 'if (user.password === inputPassword) {\n  return res.json({ message: "Login successful" });\n}', 'const validPassword = await bcrypt.compare(inputPassword, user.passwordHash);\nif (validPassword) {\n  return res.json({ message: "Login successful" });\n}', 'Use bcrypt.compare() or argon2.verify() for password verification. Never use === or == to compare passwords.'));
+        }
+        // Check #98: Missing password hashing before storage (CRITICAL)
+        // Pattern: Saving password to database without hashing
+        const passwordSavePattern = /\.(create|save|insert|update)\s*\([^)]*password[^)]*\)/i;
+        const hasBcryptPattern = /bcrypt|argon2|scrypt|pbkdf2/i;
+        if (trimmed.match(passwordSavePattern)) {
+            // Check previous 10 lines for hashing
+            const previousLines = lines.slice(Math.max(0, index - 10), index);
+            const hasHashing = previousLines.some(l => l.match(hasBcryptPattern));
+            if (!hasHashing && !trimmed.match(hasBcryptPattern)) {
+                vulnerabilities.push((0, createVulnerability_1.createJavaScriptSecurityVulnerability)('missing-password-hashing', 'CRITICAL: Password saved to database without hashing - use bcrypt.hash() first', 'Hash password before saving: const hash = await bcrypt.hash(password, 10); db.users.create({ passwordHash: hash })', lineNumber, 'Saving passwords to the database without hashing creates a massive security vulnerability. If the database is compromised, all user passwords are immediately exposed in plain-text.', 'await db.users.create({ email, password }); → Database hacked → All passwords stolen', [
+                    'Database compromise exposes all passwords',
+                    'Mass account takeover',
+                    'Credential reuse across sites exploited',
+                    'Regulatory violations (GDPR Article 32, PCI-DSS 8.2.1)',
+                    'Class-action lawsuits and fines',
+                    'Permanent reputation damage'
+                ], 'await db.users.create({ email, password: req.body.password });', 'const passwordHash = await bcrypt.hash(req.body.password, 10);\nawait db.users.create({ email, passwordHash });', 'Always hash passwords with bcrypt (10+ rounds), argon2, or scrypt before saving to database. NEVER save plain-text passwords.'));
+            }
+        }
+        // Check #99: Session fixation vulnerability (HIGH)
+        // Pattern: Setting session.userId without regenerating session ID
+        const sessionAssignmentPattern = /(req\.session|session)\.\w+\s*=\s*user/i;
+        if (trimmed.match(sessionAssignmentPattern)) {
+            // Check for session regeneration in nearby lines
+            const contextLines = lines.slice(Math.max(0, index - 5), Math.min(index + 5, lines.length));
+            const hasSessionRegeneration = contextLines.some(l => {
+                const lowerLine = l.toLowerCase();
+                return lowerLine.includes('session.regenerate') ||
+                    lowerLine.includes('regeneratesession') ||
+                    lowerLine.includes('session.save');
+            });
+            if (!hasSessionRegeneration) {
+                vulnerabilities.push((0, createVulnerability_1.createJavaScriptSecurityVulnerability)('session-fixation', 'Session assigned without regeneration - vulnerable to session fixation attacks', 'Regenerate session ID after authentication: req.session.regenerate(() => { req.session.userId = user.id })', lineNumber, 'Setting session data without regenerating the session ID allows session fixation attacks, where an attacker can pre-set a victim\'s session ID and hijack their authenticated session.', 'Attacker gets session ID before login → Victim logs in with that ID → Attacker hijacks authenticated session', [
+                    'Session hijacking after authentication',
+                    'Session fixation attacks',
+                    'Unauthorized access to authenticated sessions',
+                    'Account takeover',
+                    'Bypass of authentication controls'
+                ], 'app.post("/login", (req, res) => {\n  req.session.userId = user.id; // Session fixation!\n});', 'app.post("/login", (req, res) => {\n  req.session.regenerate((err) => {\n    if (err) return res.status(500).send("Error");\n    req.session.userId = user.id; // New session ID\n    res.json({ success: true });\n  });\n});', 'Always call req.session.regenerate() before setting authentication data to prevent session fixation attacks.'));
+            }
+        }
+        // Check #100: JWT without expiration (HIGH)
+        // Pattern: jwt.sign({ userId }, secret) without expiresIn option
+        const jwtSignPattern = /jwt\.sign\s*\(\s*\{[^}]*\}\s*,\s*[^,)]+(?:\s*,\s*\{[^}]*\})?/i;
+        if (trimmed.match(jwtSignPattern)) {
+            const hasExpiration = trimmed.includes('expiresIn') ||
+                trimmed.includes('exp:') ||
+                trimmed.includes('exp :');
+            if (!hasExpiration) {
+                vulnerabilities.push((0, createVulnerability_1.createJavaScriptSecurityVulnerability)('jwt-no-expiration', 'JWT token issued without expiration - stolen tokens valid forever', 'Add expiration: jwt.sign({ userId }, secret, { expiresIn: "1h" })', lineNumber, 'JWTs without expiration never expire, meaning stolen tokens remain valid indefinitely. An attacker who obtains a token can use it forever unless the secret is rotated.', 'jwt.sign({ userId }, secret) → Token stolen → Attacker has permanent access', [
+                    'Stolen tokens valid indefinitely',
+                    'No token rotation possible',
+                    'Account takeover persists forever',
+                    'Cannot revoke compromised tokens',
+                    'Compliance violations (session timeout requirements)'
+                ], 'const token = jwt.sign({ userId }, secret);', 'const token = jwt.sign({ userId }, secret, { expiresIn: "1h" }); // 1 hour expiration', 'Always set expiresIn option when signing JWTs. Recommended: 1-24 hours for access tokens, 7-30 days for refresh tokens.'));
+            }
+        }
+        // Check #101: Insecure session timeout (MEDIUM)
+        // Pattern: session({ cookie: { maxAge: X }}) where X > 24 hours
+        const sessionConfigPattern = /session\s*\(\s*\{[^}]*cookie\s*:\s*\{[^}]*maxAge\s*:\s*(\d+)/i;
+        const match = trimmed.match(sessionConfigPattern);
+        if (match) {
+            const maxAge = parseInt(match[1], 10);
+            const oneDayMs = 24 * 60 * 60 * 1000;
+            if (maxAge > oneDayMs) {
+                const days = Math.floor(maxAge / oneDayMs);
+                vulnerabilities.push((0, createVulnerability_1.createJavaScriptSecurityVulnerability)('insecure-session-timeout', `Session timeout too long (${days} days) - should be <= 24 hours for security`, 'Set session maxAge to <= 24 hours: session({ cookie: { maxAge: 24 * 60 * 60 * 1000 }})', lineNumber, 'Long session timeouts increase the window of opportunity for session hijacking and unauthorized access. Best practice is 1-24 hours depending on sensitivity.', `Session valid for ${days} days → Device stolen/shared → Attacker has ${days} days of access`, [
+                    'Extended window for session hijacking',
+                    'Unauthorized access from shared/stolen devices',
+                    'Compliance violations (PCI-DSS, SOC 2)',
+                    'Stale authentication state',
+                    'Increased attack surface'
+                ], `session({ cookie: { maxAge: ${maxAge} }})`, 'session({ cookie: { maxAge: 24 * 60 * 60 * 1000 }}) // 24 hours max', 'Limit session timeout to 1-24 hours based on application sensitivity. Financial apps: 15-60 minutes.'));
+            }
+        }
+        // Check #102: Weak password requirements (LOW)
+        // Pattern: Password length checks < 12 characters
+        const passwordLengthCheck = /password\.length\s*[<>=!]+\s*(\d+)/i;
+        const lengthMatch = trimmed.match(passwordLengthCheck);
+        if (lengthMatch) {
+            const minLength = parseInt(lengthMatch[1], 10);
+            if (minLength < 12) {
+                vulnerabilities.push((0, createVulnerability_1.createJavaScriptSecurityVulnerability)('weak-password-requirements', `Weak password minimum length (${minLength} chars) - NIST recommends >= 12 characters`, 'Increase minimum password length to 12-16 characters minimum', lineNumber, 'Short password requirements make brute-force attacks easier. NIST SP 800-63B recommends minimum 12 characters for user-generated passwords.', `8-character password: ~2 hours to crack → 12-character password: ~200 years to crack`, [
+                    'Easier brute-force attacks',
+                    'Reduced entropy/password strength',
+                    'Compliance issues (NIST 800-63B)',
+                    'Dictionary attacks more effective'
+                ], `if (password.length < ${minLength}) return res.status(400).send("Too short");`, 'if (password.length < 12) return res.status(400).send("Password must be at least 12 characters");', 'Set minimum password length to 12-16 characters per NIST guidelines. Encourage passphrases over complex short passwords.'));
+            }
+        }
+    });
+    return vulnerabilities;
+}
+//# sourceMappingURL=authentication-failures.js.map

package/dist/src/lib/analyzers/javascript/security-checks/authentication-failures.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authentication-failures.js","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/javascript/security-checks/authentication-failures.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;AAsBH,kEAmUC;AAtVD,sEAAqF;AAErF;;;;;;;;;;;;;;;;GAgBG;AACH,SAAgB,2BAA2B,CACzC,KAAe;IAEf,MAAM,eAAe,GAA4B,EAAE,CAAC;IACpD,IAAI,kBAAkB,GAAG,KAAK,CAAC;IAE/B,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,UAAU,GAAG,KAAK,GAAG,CAAC,CAAC;QAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAE5B,8CAA8C;QAC9C,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,kBAAkB,GAAG,IAAI,CAAC;QAC5B,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,kBAAkB,GAAG,KAAK,CAAC;YAC3B,OAAO;QACT,CAAC;QAED,gCAAgC;QAChC,IAAI,CAAC,OAAO,IAAI,kBAAkB,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO;QAElG,2CAA2C;QAC3C,sCAAsC;QACtC,8DAA8D;QAC9D,MAAM,iBAAiB,GAAG,iDAAiD,CAAC;QAE5E,IAAI,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC;YACrC,2CAA2C;YAC3C,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YACzE,MAAM,WAAW,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;gBACrC,MAAM,SAAS,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;gBAClC,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC;oBAC1B,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC;oBACzB,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC;oBACzB,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC;oBAC3B,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC;oBAC/B,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC;oBACzB,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC;oBAChC,SAAS,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC;YAClD,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,eAAe,CAAC,IAAI,CAAC,IAAA,2DAAqC,EACxD,aAAa,EACb,8DAA8D,EAC9D,+DAA+D,EAC/D,UAAU,EACV,mJAAmJ,EACnJ,mGAAmG,EACnG;oBACE,0CAA0C;oBAC1C,4CAA4C;oBAC5C,yBAAyB;oBACzB,6BAA6B;oBAC7B,qDAAqD;iBACtD,EACD,yHAAyH,EACzH,sOAAsO,EACtO,kHAAkH,CACnH,CAAC,CAAC;YACL,CAAC;YAED,2CAA2C;YAC3C,gDAAgD;YAChD,8CAA8C;YAC9C,MAAM,eAAe,GAAG,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;gBAC7B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;gBAC/B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAC3B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;gBAC5B,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;YAE7D,IAAI,CAAC,eAAe,EAAE,CAAC;gBACrB,eAAe,CAAC,IAAI,CAAC,IAAA,2DAAqC,EACxD,kBAAkB,EAClB,0EAA0E,EAC1E,wGAAwG,EACxG,UAAU,EACV,sIAAsI,EACtI,qGAAqG,EACrG;oBACE,8BAA8B;oBAC9B,oDAAoD;oBACpD,qBAAqB;oBACrB,iDAAiD;oBACjD,4BAA4B;iBAC7B,EACD,qFAAqF,EACrF,oLAAoL,EACpL,yGAAyG,CAC1G,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,gFAAgF;QAChF,wEAAwE;QACxE,gFAAgF;QAEhF,oDAAoD;QACpD,+EAA+E;QAC/E,oEAAoE;QACpE,MAAM,wBAAwB,GAAG,kDAAkD,CAAC;QACpF,MAAM,gBAAgB,GAAG,0DAA0D,CAAC;QAEpF,IAAI,OAAO,CAAC,KAAK,CAAC,wBAAwB,CAAC,EAAE,CAAC;YAC5C,4DAA4D;YAC5D,MAAM,WAAW,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;gBAChC,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAC5B,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;YAErD,IAAI,WAAW,EAAE,CAAC;gBAChB,eAAe,CAAC,IAAI,CAAC,IAAA,2DAAqC,EACxD,4BAA4B,EAC5B,yEAAyE,EACzE,sFAAsF,EACtF,UAAU,EACV,kLAAkL,EAClL,mGAAmG,EACnG;oBACE,wDAAwD;oBACxD,uBAAuB;oBACvB,oDAAoD;oBACpD,6CAA6C;oBAC7C,uCAAuC;oBACvC,mDAAmD;iBACpD,EACD,oEAAoE,EACpE,wNAAwN,EACxN,6GAA6G,CAC9G,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,6CAA6C;QAC7C,uFAAuF;QACvF,uDAAuD;QACvD,MAAM,sBAAsB,GAAG,qIAAqI,CAAC;QAErK,IAAI,OAAO,CAAC,KAAK,CAAC,sBAAsB,CAAC,EAAE,CAAC;YAC1C,eAAe,CAAC,IAAI,CAAC,IAAA,2DAAqC,EACxD,0BAA0B,EAC1B,wFAAwF,EACxF,uFAAuF,EACvF,UAAU,EACV,mNAAmN,EACnN,mGAAmG,EACnG;gBACE,4CAA4C;gBAC5C,uCAAuC;gBACvC,sCAAsC;gBACtC,mCAAmC;gBACnC,yCAAyC;aAC1C,EACD,gGAAgG,EAChG,6JAA6J,EAC7J,8GAA8G,CAC/G,CAAC,CAAC;QACL,CAAC;QAED,gEAAgE;QAChE,uDAAuD;QACvD,MAAM,mBAAmB,GAAG,yDAAyD,CAAC;QACtF,MAAM,gBAAgB,GAAG,8BAA8B,CAAC;QAExD,IAAI,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAAC,EAAE,CAAC;YACvC,sCAAsC;YACtC,MAAM,aAAa,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;YAClE,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC;YAEtE,IAAI,CAAC,UAAU,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBACpD,eAAe,CAAC,IAAI,CAAC,IAAA,2DAAqC,EACxD,0BAA0B,EAC1B,gFAAgF,EAChF,oHAAoH,EACpH,UAAU,EACV,sLAAsL,EACtL,sFAAsF,EACtF;oBACE,2CAA2C;oBAC3C,uBAAuB;oBACvB,yCAAyC;oBACzC,wDAAwD;oBACxD,iCAAiC;oBACjC,6BAA6B;iBAC9B,EACD,gEAAgE,EAChE,iHAAiH,EACjH,+HAA+H,CAChI,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,mDAAmD;QACnD,kEAAkE;QAClE,MAAM,wBAAwB,GAAG,yCAAyC,CAAC;QAE3E,IAAI,OAAO,CAAC,KAAK,CAAC,wBAAwB,CAAC,EAAE,CAAC;YAC5C,iDAAiD;YACjD,MAAM,YAAY,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YAC5F,MAAM,sBAAsB,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;gBACnD,MAAM,SAAS,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;gBAClC,OAAO,SAAS,CAAC,QAAQ,CAAC,oBAAoB,CAAC;oBACxC,SAAS,CAAC,QAAQ,CAAC,mBAAmB,CAAC;oBACvC,SAAS,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;YAC5C,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,sBAAsB,EAAE,CAAC;gBAC5B,eAAe,CAAC,IAAI,CAAC,IAAA,2DAAqC,EACxD,kBAAkB,EAClB,gFAAgF,EAChF,4GAA4G,EAC5G,UAAU,EACV,wLAAwL,EACxL,8GAA8G,EAC9G;oBACE,wCAAwC;oBACxC,0BAA0B;oBAC1B,+CAA+C;oBAC/C,kBAAkB;oBAClB,mCAAmC;iBACpC,EACD,+FAA+F,EAC/F,gOAAgO,EAChO,8GAA8G,CAC/G,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,4CAA4C;QAC5C,iEAAiE;QACjE,MAAM,cAAc,GAAG,+DAA+D,CAAC;QAEvF,IAAI,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC;YAClC,MAAM,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;gBAC9B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;gBACxB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAE/C,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,eAAe,CAAC,IAAI,CAAC,IAAA,2DAAqC,EACxD,mBAAmB,EACnB,mEAAmE,EACnE,mEAAmE,EACnE,UAAU,EACV,yKAAyK,EACzK,6EAA6E,EAC7E;oBACE,kCAAkC;oBAClC,4BAA4B;oBAC5B,mCAAmC;oBACnC,kCAAkC;oBAClC,sDAAsD;iBACvD,EACD,6CAA6C,EAC7C,uFAAuF,EACvF,yHAAyH,CAC1H,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,gDAAgD;QAChD,gEAAgE;QAChE,MAAM,oBAAoB,GAAG,+DAA+D,CAAC;QAC7F,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;QAElD,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACtC,MAAM,QAAQ,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;YAErC,IAAI,MAAM,GAAG,QAAQ,EAAE,CAAC;gBACtB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,QAAQ,CAAC,CAAC;gBAC3C,eAAe,CAAC,IAAI,CAAC,IAAA,2DAAqC,EACxD,0BAA0B,EAC1B,6BAA6B,IAAI,6CAA6C,EAC9E,wFAAwF,EACxF,UAAU,EACV,+JAA+J,EAC/J,qBAAqB,IAAI,+CAA+C,IAAI,iBAAiB,EAC7F;oBACE,uCAAuC;oBACvC,gDAAgD;oBAChD,wCAAwC;oBACxC,4BAA4B;oBAC5B,0BAA0B;iBAC3B,EACD,+BAA+B,MAAM,MAAM,EAC3C,qEAAqE,EACrE,sGAAsG,CACvG,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,+CAA+C;QAC/C,kDAAkD;QAClD,MAAM,mBAAmB,GAAG,qCAAqC,CAAC;QAClE,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;QAEvD,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,SAAS,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAE/C,IAAI,SAAS,GAAG,EAAE,EAAE,CAAC;gBACnB,eAAe,CAAC,IAAI,CAAC,IAAA,2DAAqC,EACxD,4BAA4B,EAC5B,iCAAiC,SAAS,4CAA4C,EACtF,8DAA8D,EAC9D,UAAU,EACV,6IAA6I,EAC7I,sFAAsF,EACtF;oBACE,4BAA4B;oBAC5B,mCAAmC;oBACnC,kCAAkC;oBAClC,mCAAmC;iBACpC,EACD,yBAAyB,SAAS,6CAA6C,EAC/E,mGAAmG,EACnG,0HAA0H,CAC3H,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IAEH,CAAC,CAAC,CAAC;IAEH,OAAO,eAAe,CAAC;AACzB,CAAC"}

package/dist/src/lib/analyzers/javascript/security-checks/credential-crypto.d.ts

@@ -0,0 +1,28 @@
+/**
+ * JavaScript Credential and Cryptography Security Detection Module
+ *
+ * Detects authentication and cryptographic vulnerabilities:
+ * - Hardcoded credentials (passwords, API keys, tokens)
+ * - Weak random number generation (Math.random)
+ * - Weak cryptographic algorithms (MD5, SHA1)
+ * - Insecure storage of sensitive data
+ *
+ * Part of modularized JavaScript analyzer (150-300 LOC per module)
+ * Extracted from monolithic javascript-analyzer.ts (2,672 LOC)
+ *
+ * @module credential-crypto
+ */
+import { SecurityVulnerability } from '../../types';
+/**
+ * Type for createSecurityVulnerability function
+ */
+export type CreateVulnerabilityFn = (id: string, message: string, fix: string, lineNumber: number, explanation: string, example: string, impacts: string[], codeExample: string, fixedCodeExample: string, fixDetails: string) => SecurityVulnerability;
+/**
+ * Check for credential and cryptography vulnerabilities in JavaScript code
+ *
+ * @param code - Full source code
+ * @param createVulnerability - Function to create vulnerability objects
+ * @returns Array of detected vulnerabilities
+ */
+export declare function checkCredentialCrypto(code: string, createVulnerability: CreateVulnerabilityFn): SecurityVulnerability[];
+//# sourceMappingURL=credential-crypto.d.ts.map

package/dist/src/lib/analyzers/javascript/security-checks/credential-crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-crypto.d.ts","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/javascript/security-checks/credential-crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEpD;;GAEG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAClC,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,EACX,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EAAE,EACjB,WAAW,EAAE,MAAM,EACnB,gBAAgB,EAAE,MAAM,EACxB,UAAU,EAAE,MAAM,KACf,qBAAqB,CAAC;AAE3B;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,mBAAmB,EAAE,qBAAqB,GACzC,qBAAqB,EAAE,CAiSzB"}

package/dist/src/lib/analyzers/javascript/security-checks/credential-crypto.js

@@ -0,0 +1,176 @@
+"use strict";
+/**
+ * JavaScript Credential and Cryptography Security Detection Module
+ *
+ * Detects authentication and cryptographic vulnerabilities:
+ * - Hardcoded credentials (passwords, API keys, tokens)
+ * - Weak random number generation (Math.random)
+ * - Weak cryptographic algorithms (MD5, SHA1)
+ * - Insecure storage of sensitive data
+ *
+ * Part of modularized JavaScript analyzer (150-300 LOC per module)
+ * Extracted from monolithic javascript-analyzer.ts (2,672 LOC)
+ *
+ * @module credential-crypto
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkCredentialCrypto = checkCredentialCrypto;
+/**
+ * Check for credential and cryptography vulnerabilities in JavaScript code
+ *
+ * @param code - Full source code
+ * @param createVulnerability - Function to create vulnerability objects
+ * @returns Array of detected vulnerabilities
+ */
+function checkCredentialCrypto(code, createVulnerability) {
+    const vulnerabilities = [];
+    const lines = code.split('\n');
+    let inMultiLineComment = false;
+    lines.forEach((line, index) => {
+        const lineNumber = index + 1;
+        const trimmed = line.trim();
+        // Track multi-line comment blocks
+        if (trimmed.includes('/*')) {
+            inMultiLineComment = true;
+        }
+        if (trimmed.includes('*/')) {
+            inMultiLineComment = false;
+            return;
+        }
+        // Skip comments and empty lines
+        if (!trimmed || inMultiLineComment || trimmed.startsWith('//') || trimmed.startsWith('*')) {
+            return;
+        }
+        // OWASP A07:2021 - Authentication & Identification Failures
+        // 1. Hardcoded credentials - CRITICAL
+        if (trimmed.match(/(password|passwd|pwd|secret|token|api[-_]?key|private[-_]?key|auth|encryption[-_]?key)/i) &&
+            trimmed.match(/[:=]\s*['"`]/) &&
+            !trimmed.includes('process.env') &&
+            !trimmed.includes('config.') &&
+            !trimmed.startsWith('//')) {
+            vulnerabilities.push(createVulnerability('hardcoded-credentials', 'Hardcoded credentials exposed in source code', 'Use environment variables (process.env) or secret management services', lineNumber, 'Hardcoded credentials in source code are visible to anyone with access to the repository, including attackers who gain access to the codebase.', 'const password = "MySecretPass123" // Visible in Git history forever', [
+                'Unauthorized access to systems',
+                'Account takeover',
+                'Data breach',
+                'Lateral movement in infrastructure',
+                'Cannot be rotated without code changes'
+            ], 'const apiKey = "sk-1234567890abcdef";', 'const apiKey = process.env.API_KEY; // Store in .env file (add to .gitignore)', 'Store secrets in environment variables or secret management services (AWS Secrets Manager, Azure Key Vault, HashiCorp Vault)'));
+        }
+        // OWASP A02:2021 - Cryptographic Failures
+        // 2. Math.random() for security - MEDIUM
+        if (trimmed.match(/Math\.random\(\)/)) {
+            vulnerabilities.push(createVulnerability('weak-random', 'Math.random() is cryptographically weak and predictable', 'Use crypto.randomBytes() (Node.js) or crypto.getRandomValues() (Browser)', lineNumber, 'Math.random() uses a pseudorandom number generator that is predictable and unsuitable for security purposes like token generation.', 'const token = Math.random().toString(36) // Predictable, can be brute-forced', [
+                'Predictable tokens/session IDs',
+                'Session hijacking',
+                'Authentication bypass',
+                'Weak cryptographic keys'
+            ], 'const token = Math.random().toString(36).substr(2);', '// Node.js:\nconst token = require("crypto").randomBytes(32).toString("hex");\n// Browser:\nconst token = crypto.getRandomValues(new Uint8Array(32));', 'Use cryptographically secure random number generators for all security-sensitive operations'));
+        }
+        // 3. Weak cryptographic algorithms (MD5, SHA1) - HIGH
+        if (trimmed.match(/createHash\s*\(\s*['"](?:md5|sha1)['"]\s*\)/i) ||
+            trimmed.match(/crypto\.(?:md5|sha1)/i) ||
+            trimmed.match(/\.(?:md5|sha1)\s*\(/i)) {
+            vulnerabilities.push(createVulnerability('weak-cryptographic-algorithm', 'Weak cryptographic algorithm (MD5/SHA1) vulnerable to collision attacks', 'Use SHA-256 or stronger (SHA-384, SHA-512, SHA-3)', lineNumber, 'MD5 and SHA-1 are cryptographically broken and vulnerable to collision attacks. Attackers can generate different inputs that produce the same hash, compromising data integrity and digital signatures.', 'crypto.createHash("md5").update(password).digest("hex") // Attacker can generate collisions', [
+                'Hash collision attacks',
+                'Password cracking (rainbow tables)',
+                'Digital signature forgery',
+                'Data integrity compromise',
+                'Compliance violations (PCI-DSS, FIPS)'
+            ], 'const hash = crypto.createHash("md5").update(data).digest("hex");', 'const hash = crypto.createHash("sha256").update(data).digest("hex"); // Use SHA-256 or stronger', 'Replace MD5/SHA-1 with SHA-256, SHA-384, SHA-512, or SHA-3. For password hashing, use bcrypt, scrypt, or Argon2'));
+        }
+        // 4. Insecure password hashing - CRITICAL
+        if (trimmed.match(/password|passwd|pwd/i) &&
+            (trimmed.match(/createHash\s*\(\s*['"]sha256['"]\s*\)/i) ||
+                trimmed.match(/\.hash\s*\(/i) && !trimmed.match(/bcrypt|scrypt|argon2|pbkdf2/i))) {
+            vulnerabilities.push(createVulnerability('insecure-password-hashing', 'Password hashed with fast algorithm vulnerable to brute-force attacks', 'Use bcrypt, scrypt, Argon2, or PBKDF2 for password hashing', lineNumber, 'Fast hash algorithms like SHA-256 allow attackers to try billions of password combinations per second. Password-specific algorithms like bcrypt intentionally slow down the hashing process.', 'const hash = crypto.createHash("sha256").update(password).digest("hex") // Can test 10B+ passwords/sec on GPU', [
+                'Password cracking (brute-force)',
+                'Rainbow table attacks',
+                'Account takeover',
+                'Data breach',
+                'Compliance violations (NIST, OWASP)'
+            ], 'const passwordHash = crypto.createHash("sha256").update(password).digest("hex");', 'const bcrypt = require("bcrypt");\nconst passwordHash = await bcrypt.hash(password, 10); // 10 rounds = ~100ms per hash', 'Use bcrypt (recommended), scrypt, Argon2, or PBKDF2 for password hashing. These algorithms are designed to be slow and resistant to brute-force attacks'));
+        }
+        // 5. Weak JWT secret - HIGH
+        if (trimmed.match(/jwt\.sign|jsonwebtoken/i) && trimmed.match(/['"`].*['"`]/) && !trimmed.match(/process\.env/)) {
+            vulnerabilities.push(createVulnerability('weak-jwt-secret', 'JWT signed with weak or hardcoded secret', 'Use strong, randomly generated secret from environment variables', lineNumber, 'Weak JWT secrets allow attackers to forge authentication tokens, bypassing authentication entirely. Hardcoded secrets in source code are easily discovered.', 'jwt.sign(payload, "secret123") // Weak secret, attacker can forge tokens', [
+                'Authentication bypass (forged tokens)',
+                'Account takeover',
+                'Privilege escalation',
+                'Unauthorized access to protected resources'
+            ], 'const token = jwt.sign(payload, "secret");', 'const token = jwt.sign(payload, process.env.JWT_SECRET); // Strong random secret (32+ characters)', 'Generate a cryptographically random JWT secret (32+ characters) and store in environment variables. Never hardcode secrets in source code'));
+        }
+        // 6. Missing JWT expiration - MEDIUM
+        if (trimmed.match(/jwt\.sign/i) && !trimmed.match(/expiresIn|exp:/i)) {
+            vulnerabilities.push(createVulnerability('missing-jwt-expiration', 'JWT created without expiration time', 'Add expiresIn option to jwt.sign()', lineNumber, 'JWTs without expiration remain valid forever, even if a user logs out or their account is compromised. Stolen tokens can be used indefinitely.', 'jwt.sign(payload, secret) // Token never expires, valid forever', [
+                'Stolen tokens remain valid indefinitely',
+                'No way to revoke compromised tokens',
+                'Session hijacking',
+                'Compliance violations (require periodic re-authentication)'
+            ], 'const token = jwt.sign(payload, secret);', 'const token = jwt.sign(payload, secret, { expiresIn: "1h" }); // Token expires in 1 hour', 'Always set an expiration time for JWTs using expiresIn option. Use short expiration times (1-24 hours) and implement token refresh if needed'));
+        }
+        // 7. Insecure random for security tokens - HIGH
+        if (trimmed.match(/token|sessionId|nonce|salt/i) &&
+            (trimmed.match(/Math\.random/) || trimmed.match(/Date\.now/) || trimmed.match(/new Date\(\)\.getTime/))) {
+            vulnerabilities.push(createVulnerability('insecure-token-generation', 'Security token generated with weak randomness', 'Use crypto.randomBytes() for generating security tokens', lineNumber, 'Tokens generated with Math.random(), timestamps, or other weak sources can be predicted by attackers, allowing them to guess valid tokens.', 'const sessionId = Date.now() + Math.random() // Predictable pattern, attacker can enumerate valid sessions', [
+                'Session hijacking (predictable session IDs)',
+                'Token guessing attacks',
+                'CSRF token bypass',
+                'Authentication bypass'
+            ], 'const token = Date.now() + "-" + Math.random().toString(36);', 'const crypto = require("crypto");\nconst token = crypto.randomBytes(32).toString("hex"); // Cryptographically secure', 'Use crypto.randomBytes() (Node.js) or crypto.getRandomValues() (browser) for all security-sensitive tokens'));
+        }
+        // =============================================================================
+        // PHASE B - Weak Encryption (AES-ECB) Detection (Dec 21, 2025)
+        // =============================================================================
+        // 8. Weak Encryption - AES-ECB Mode - HIGH
+        if (trimmed.includes('crypto.create') &&
+            (trimmed.includes('Cipher') || trimmed.includes('Decipher')) &&
+            (trimmed.includes('ecb') || trimmed.includes('ECB'))) {
+            vulnerabilities.push(createVulnerability('weak-encryption-ecb', 'Weak encryption - AES-ECB mode does not hide data patterns', 'Use AES-GCM or AES-CBC mode with proper IV instead of ECB', lineNumber, 'Electronic Codebook (ECB) mode is insecure because identical plaintext blocks produce identical ciphertext blocks, revealing data patterns. This allows attackers to detect repeated data and perform pattern analysis attacks.', 'const cipher = crypto.createCipheriv(\'aes-256-ecb\', key, null); // Identical blocks = identical ciphertext', [
+                'Data pattern disclosure',
+                'Plaintext recovery through pattern analysis',
+                'Cryptographic attacks (block rearrangement)',
+                'Weak confidentiality protection'
+            ], 'crypto.createCipheriv(\'aes-256-ecb\', key, null)', 'const iv = crypto.randomBytes(16);\nconst cipher = crypto.createCipheriv(\'aes-256-gcm\', key, iv); // GCM provides authentication', 'Never use ECB mode. Use AES-GCM (authenticated encryption) or AES-CBC with random IV'));
+        }
+        // 9. Insecure crypto.createCipher (deprecated) - HIGH
+        if (trimmed.includes('crypto.createCipher(') || trimmed.includes('crypto.createDecipher(')) {
+            vulnerabilities.push(createVulnerability('deprecated-createcipher', 'Deprecated crypto.createCipher uses weak MD5 key derivation', 'Use crypto.createCipheriv with properly derived keys (PBKDF2/scrypt)', lineNumber, 'crypto.createCipher is deprecated because it uses weak MD5-based key derivation, making it vulnerable to brute force and rainbow table attacks. Modern standards require proper key derivation functions.', 'const cipher = crypto.createCipher(\'aes-256-cbc\', \'password\'); // Weak MD5 key derivation', [
+                'Weak key derivation (MD5)',
+                'Password brute force attacks',
+                'Rainbow table attacks',
+                'Insufficient protection against cryptanalysis'
+            ], 'crypto.createCipher(\'aes-256-cbc\', password)', 'const key = crypto.pbkdf2Sync(password, salt, 100000, 32, \'sha256\');\nconst iv = crypto.randomBytes(16);\nconst cipher = crypto.createCipheriv(\'aes-256-gcm\', key, iv);', 'Use createCipheriv with PBKDF2 or scrypt for key derivation, never createCipher'));
+        }
+        // =============================================================================
+        // PHASE B - Insecure TLS Configuration Detection (Dec 21, 2025)
+        // =============================================================================
+        // 10. Insecure TLS - rejectUnauthorized: false - HIGH
+        if (trimmed.includes('rejectUnauthorized') && trimmed.includes('false')) {
+            vulnerabilities.push(createVulnerability('insecure-tls-reject-unauthorized', 'TLS certificate validation disabled - vulnerable to man-in-the-middle attacks', 'Never set rejectUnauthorized: false in production - use proper certificates', lineNumber, 'Disabling certificate validation (rejectUnauthorized: false) allows man-in-the-middle attackers to intercept encrypted connections by presenting fake certificates. This defeats the entire purpose of TLS/HTTPS.', 'https.request({ hostname: \'api.example.com\', rejectUnauthorized: false }); // Attack: MITM intercepts traffic', [
+                'Man-in-the-middle attacks',
+                'Data interception and theft',
+                'Credential theft',
+                'Session hijacking',
+                'Complete loss of confidentiality'
+            ], 'rejectUnauthorized: false', '// Use valid certificates instead of disabling validation\n// For development: Use self-signed certs with NODE_EXTRA_CA_CERTS\nconst options = { hostname: \'api.example.com\' }; // Default: rejectUnauthorized: true', 'Never disable certificate validation. Use proper CA-signed certificates or NODE_EXTRA_CA_CERTS for development'));
+        }
+        // 11. Insecure TLS - minVersion < TLS 1.2 - HIGH
+        const hasMinVersionOrProtocol = trimmed.includes('minVersion') || trimmed.includes('secureProtocol');
+        const hasInsecureTLS = (trimmed.includes('TLSv1.0') || trimmed.includes('TLSv1.1') ||
+            (trimmed.includes('TLSv1\'') && !trimmed.includes('TLSv1.')) ||
+            (trimmed.includes('TLSv1"') && !trimmed.includes('TLSv1.')) ||
+            trimmed.includes('SSLv') ||
+            trimmed.includes('TLS1_0') || trimmed.includes('TLS1_1'));
+        if (hasMinVersionOrProtocol && hasInsecureTLS) {
+            vulnerabilities.push(createVulnerability('insecure-tls-version', 'Insecure TLS version - use TLS 1.2 or higher', 'Set minVersion to \'TLSv1.2\' or \'TLSv1.3\' to enforce secure protocols', lineNumber, 'TLS 1.0 and 1.1 are deprecated and vulnerable to attacks like BEAST, POODLE, and downgrade attacks. Modern standards require TLS 1.2 or higher for secure communications.', 'tls.createServer({ minVersion: \'TLSv1\' }); // Vulnerable to BEAST, POODLE attacks', [
+                'Protocol downgrade attacks',
+                'BEAST attack (TLS 1.0)',
+                'POODLE attack (SSLv3)',
+                'Weak cipher suite negotiation',
+                'Man-in-the-middle attacks'
+            ], 'minVersion: \'TLSv1\'', 'const options = { minVersion: \'TLSv1.2\' }; // Or \'TLSv1.3\' for maximum security', 'Use TLS 1.2 or 1.3. TLS 1.0/1.1 and SSLv3 are deprecated and insecure'));
+        }
+    });
+    return vulnerabilities;
+}
+//# sourceMappingURL=credential-crypto.js.map

package/dist/src/lib/analyzers/javascript/security-checks/credential-crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-crypto.js","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/javascript/security-checks/credential-crypto.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;GAaG;;AA2BH,sDAoSC;AA3SD;;;;;;GAMG;AACH,SAAgB,qBAAqB,CACnC,IAAY,EACZ,mBAA0C;IAE1C,MAAM,eAAe,GAA4B,EAAE,CAAC;IACpD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,kBAAkB,GAAG,KAAK,CAAC;IAE/B,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,UAAU,GAAG,KAAK,GAAG,CAAC,CAAC;QAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAE5B,kCAAkC;QAClC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,kBAAkB,GAAG,IAAI,CAAC;QAC5B,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,kBAAkB,GAAG,KAAK,CAAC;YAC3B,OAAO;QACT,CAAC;QAED,gCAAgC;QAChC,IAAI,CAAC,OAAO,IAAI,kBAAkB,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1F,OAAO;QACT,CAAC;QAED,4DAA4D;QAC5D,sCAAsC;QACtC,IAAI,OAAO,CAAC,KAAK,CAAC,yFAAyF,CAAC;YACxG,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC;YAC7B,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;YAChC,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;YAC5B,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,eAAe,CAAC,IAAI,CAAC,mBAAmB,CACtC,uBAAuB,EACvB,8CAA8C,EAC9C,uEAAuE,EACvE,UAAU,EACV,gJAAgJ,EAChJ,sEAAsE,EACtE;gBACE,gCAAgC;gBAChC,kBAAkB;gBAClB,aAAa;gBACb,oCAAoC;gBACpC,wCAAwC;aACzC,EACD,uCAAuC,EACvC,+EAA+E,EAC/E,8HAA8H,CAC/H,CAAC,CAAC;QACL,CAAC;QAED,0CAA0C;QAC1C,yCAAyC;QACzC,IAAI,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACtC,eAAe,CAAC,IAAI,CAAC,mBAAmB,CACtC,aAAa,EACb,yDAAyD,EACzD,0EAA0E,EAC1E,UAAU,EACV,oIAAoI,EACpI,8EAA8E,EAC9E;gBACE,gCAAgC;gBAChC,mBAAmB;gBACnB,uBAAuB;gBACvB,yBAAyB;aAC1B,EACD,qDAAqD,EACrD,uJAAuJ,EACvJ,6FAA6F,CAC9F,CAAC,CAAC;QACL,CAAC;QAED,sDAAsD;QACtD,IAAI,OAAO,CAAC,KAAK,CAAC,8CAA8C,CAAC;YAC7D,OAAO,CAAC,KAAK,CAAC,uBAAuB,CAAC;YACtC,OAAO,CAAC,KAAK,CAAC,sBAAsB,CAAC,EAAE,CAAC;YAC1C,eAAe,CAAC,IAAI,CAAC,mBAAmB,CACtC,8BAA8B,EAC9B,yEAAyE,EACzE,mDAAmD,EACnD,UAAU,EACV,yMAAyM,EACzM,6FAA6F,EAC7F;gBACE,wBAAwB;gBACxB,oCAAoC;gBACpC,2BAA2B;gBAC3B,2BAA2B;gBAC3B,uCAAuC;aACxC,EACD,mEAAmE,EACnE,iGAAiG,EACjG,iHAAiH,CAClH,CAAC,CAAC;QACL,CAAC;QAED,0CAA0C;QAC1C,IAAI,OAAO,CAAC,KAAK,CAAC,sBAAsB,CAAC;YACrC,CAAC,OAAO,CAAC,KAAK,CAAC,wCAAwC,CAAC;gBACvD,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC,EAAE,CAAC;YACtF,eAAe,CAAC,IAAI,CAAC,mBAAmB,CACtC,2BAA2B,EAC3B,uEAAuE,EACvE,4DAA4D,EAC5D,UAAU,EACV,8LAA8L,EAC9L,+GAA+G,EAC/G;gBACE,iCAAiC;gBACjC,uBAAuB;gBACvB,kBAAkB;gBAClB,aAAa;gBACb,qCAAqC;aACtC,EACD,kFAAkF,EAClF,yHAAyH,EACzH,yJAAyJ,CAC1J,CAAC,CAAC;QACL,CAAC;QAED,4BAA4B;QAC5B,IAAI,OAAO,CAAC,KAAK,CAAC,yBAAyB,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC;YAChH,eAAe,CAAC,IAAI,CAAC,mBAAmB,CACtC,iBAAiB,EACjB,0CAA0C,EAC1C,kEAAkE,EAClE,UAAU,EACV,6JAA6J,EAC7J,0EAA0E,EAC1E;gBACE,uCAAuC;gBACvC,kBAAkB;gBAClB,sBAAsB;gBACtB,4CAA4C;aAC7C,EACD,4CAA4C,EAC5C,mGAAmG,EACnG,2IAA2I,CAC5I,CAAC,CAAC;QACL,CAAC;QAED,qCAAqC;QACrC,IAAI,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC;YACrE,eAAe,CAAC,IAAI,CAAC,mBAAmB,CACtC,wBAAwB,EACxB,qCAAqC,EACrC,oCAAoC,EACpC,UAAU,EACV,gJAAgJ,EAChJ,iEAAiE,EACjE;gBACE,yCAAyC;gBACzC,qCAAqC;gBACrC,mBAAmB;gBACnB,4DAA4D;aAC7D,EACD,0CAA0C,EAC1C,0FAA0F,EAC1F,8IAA8I,CAC/I,CAAC,CAAC;QACL,CAAC;QAED,gDAAgD;QAChD,IAAI,OAAO,CAAC,KAAK,CAAC,6BAA6B,CAAC;YAC5C,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC,EAAE,CAAC;YAC5G,eAAe,CAAC,IAAI,CAAC,mBAAmB,CACtC,2BAA2B,EAC3B,+CAA+C,EAC/C,yDAAyD,EACzD,UAAU,EACV,4IAA4I,EAC5I,4GAA4G,EAC5G;gBACE,6CAA6C;gBAC7C,wBAAwB;gBACxB,mBAAmB;gBACnB,uBAAuB;aACxB,EACD,8DAA8D,EAC9D,sHAAsH,EACtH,4GAA4G,CAC7G,CAAC,CAAC;QACL,CAAC;QAED,gFAAgF;QAChF,+DAA+D;QAC/D,gFAAgF;QAEhF,2CAA2C;QAC3C,IAAI,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;YACjC,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YAC5D,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACzD,eAAe,CAAC,IAAI,CAAC,mBAAmB,CACtC,qBAAqB,EACrB,4DAA4D,EAC5D,2DAA2D,EAC3D,UAAU,EACV,iOAAiO,EACjO,8GAA8G,EAC9G;gBACE,yBAAyB;gBACzB,6CAA6C;gBAC7C,6CAA6C;gBAC7C,iCAAiC;aAClC,EACD,mDAAmD,EACnD,oIAAoI,EACpI,sFAAsF,CACvF,CAAC,CAAC;QACL,CAAC;QAED,sDAAsD;QACtD,IAAI,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAC,EAAE,CAAC;YAC3F,eAAe,CAAC,IAAI,CAAC,mBAAmB,CACtC,yBAAyB,EACzB,6DAA6D,EAC7D,sEAAsE,EACtE,UAAU,EACV,2MAA2M,EAC3M,+FAA+F,EAC/F;gBACE,2BAA2B;gBAC3B,8BAA8B;gBAC9B,uBAAuB;gBACvB,+CAA+C;aAChD,EACD,gDAAgD,EAChD,6KAA6K,EAC7K,iFAAiF,CAClF,CAAC,CAAC;QACL,CAAC;QAED,gFAAgF;QAChF,gEAAgE;QAChE,gFAAgF;QAEhF,sDAAsD;QACtD,IAAI,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACxE,eAAe,CAAC,IAAI,CAAC,mBAAmB,CACtC,kCAAkC,EAClC,+EAA+E,EAC/E,6EAA6E,EAC7E,UAAU,EACV,mNAAmN,EACnN,iHAAiH,EACjH;gBACE,2BAA2B;gBAC3B,6BAA6B;gBAC7B,kBAAkB;gBAClB,mBAAmB;gBACnB,kCAAkC;aACnC,EACD,2BAA2B,EAC3B,wNAAwN,EACxN,gHAAgH,CACjH,CAAC,CAAC;QACL,CAAC;QAED,iDAAiD;QACjD,MAAM,uBAAuB,GAAG,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QACrG,MAAM,cAAc,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;YAC1D,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC5D,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC3D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;YACxB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QAElF,IAAI,uBAAuB,IAAI,cAAc,EAAE,CAAC;YAC9C,eAAe,CAAC,IAAI,CAAC,mBAAmB,CACtC,sBAAsB,EACtB,8CAA8C,EAC9C,0EAA0E,EAC1E,UAAU,EACV,2KAA2K,EAC3K,qFAAqF,EACrF;gBACE,4BAA4B;gBAC5B,wBAAwB;gBACxB,uBAAuB;gBACvB,+BAA+B;gBAC/B,2BAA2B;aAC5B,EACD,uBAAuB,EACvB,qFAAqF,EACrF,uEAAuE,CACxE,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,eAAe,CAAC;AACzB,CAAC"}

package/dist/src/lib/analyzers/javascript/security-checks/enhanced-supply-chain.d.ts

@@ -0,0 +1,23 @@
+/**
+ * JavaScript Enhanced Supply Chain Security Checks
+ * OWASP A03:2025 - Software Supply Chain Failures (Enhanced)
+ *
+ * Enhanced supply chain security checks building on existing dependency scanning.
+ * Focuses on runtime dependencies, package integrity, and malicious code patterns.
+ */
+import { SecurityVulnerability } from '../../types';
+/**
+ * Checks for enhanced supply chain security vulnerabilities in JavaScript code
+ *
+ * Covers:
+ * - Check #1: Dynamic imports without integrity validation (HIGH)
+ * - Check #2: Runtime dependency loading (MEDIUM)
+ * - Check #3: Suspicious package patterns (HIGH)
+ * - Check #4: Unrestricted CDN usage (MEDIUM)
+ * - Check #5: Package typosquatting patterns (MEDIUM)
+ *
+ * @param lines - Array of code lines
+ * @returns Array of security vulnerabilities found
+ */
+export declare function checkEnhancedSupplyChain(lines: string[]): SecurityVulnerability[];
+//# sourceMappingURL=enhanced-supply-chain.d.ts.map

package/dist/src/lib/analyzers/javascript/security-checks/enhanced-supply-chain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"enhanced-supply-chain.d.ts","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/javascript/security-checks/enhanced-supply-chain.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAGpD;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,MAAM,EAAE,GACd,qBAAqB,EAAE,CAmKzB"}