flagrix 0.1.0 → 0.1.2

package/assets/signatures-snapshot.json

@@ -1,6 +1,6 @@
 {
-  "version": "2025.01.26.001",
-  "lastUpdated": "2026-07-04T18:31:51.928Z",
+  "version": "2026.07.08.002",
+  "lastUpdated": "2026-07-08T16:18:50.866Z",
   "maliciousPackages": [
     {
       "name": "beavertail",
@@ -130,7 +130,13 @@
         "loader",
         "apt"
       ],
-      "severity": "critical"
+      "severity": "critical",
+      "fileExtensions": [
+        ".js",
+        ".ts",
+        ".mjs",
+        ".cjs"
+      ]
     },
     {
       "id": "BEAVERTAIL_EXFIL",
@@ -143,7 +149,13 @@
         "exfiltration",
         "apt"
       ],
-      "severity": "critical"
+      "severity": "critical",
+      "fileExtensions": [
+        ".js",
+        ".ts",
+        ".mjs",
+        ".cjs"
+      ]
     },
     {
       "id": "INVISIBLEFERRET_KEYLOG",
@@ -156,7 +168,10 @@
         "keylogger",
         "apt"
       ],
-      "severity": "critical"
+      "severity": "critical",
+      "fileExtensions": [
+        ".py"
+      ]
     },
     {
       "id": "REVERSE_SHELL",
@@ -168,7 +183,12 @@
         "backdoor",
         "remote-access"
       ],
-      "severity": "critical"
+      "severity": "critical",
+      "fileExtensions": [
+        ".js",
+        ".ts",
+        ".py"
+      ]
     },
     {
       "id": "CRYPTO_MINER",
@@ -180,7 +200,13 @@
         "crypto",
         "resource-abuse"
       ],
-      "severity": "high"
+      "severity": "critical",
+      "fileExtensions": [
+        ".js",
+        ".ts",
+        ".py",
+        ".sh"
+      ]
     },
     {
       "id": "CREDENTIAL_THEFT",
@@ -192,7 +218,13 @@
         "theft",
         "stealer"
       ],
-      "severity": "critical"
+      "severity": "critical",
+      "fileExtensions": [
+        ".js",
+        ".ts",
+        ".py",
+        ".sh"
+      ]
     },
     {
       "id": "ENV_EXFIL_WEBHOOK",
@@ -204,7 +236,12 @@
         "webhook",
         "secrets"
       ],
-      "severity": "high"
+      "severity": "high",
+      "fileExtensions": [
+        ".js",
+        ".ts",
+        ".py"
+      ]
     },
     {
       "id": "DISCORD_WEBHOOK_EXFIL",
@@ -216,7 +253,12 @@
         "discord",
         "webhook"
       ],
-      "severity": "high"
+      "severity": "high",
+      "fileExtensions": [
+        ".js",
+        ".ts",
+        ".py"
+      ]
     },
     {
       "id": "OBFUSCATED_EVAL",
@@ -228,19 +270,12 @@
         "eval",
         "payload"
       ],
-      "severity": "high"
-    },
-    {
-      "id": "OBFUSCATED_CODE_EVAL_DYNAMIC",
-      "name": "Dynamic Code Execution",
-      "pattern": "eval\\s*\\([^)]{0,200}\\)|new\\s+Function\\s*\\([^)]{0,200}\\)|setTimeout\\s*\\(\\s*[\"'`][^\"'`]{0,200}[\"'`]|setInterval\\s*\\(\\s*[\"'`][^\"'`]{0,200}[\"'`]",
-      "description": "eval(), new Function(), or setTimeout/setInterval with string argument — executes arbitrary dynamic code",
-      "tags": [
-        "obfuscation",
-        "eval",
-        "dynamic-code"
-      ],
-      "severity": "high"
+      "severity": "high",
+      "fileExtensions": [
+        ".js",
+        ".ts",
+        ".mjs"
+      ]
     },
     {
       "id": "HARDCODED_AWS_KEY",
@@ -252,7 +287,17 @@
         "aws",
         "credentials"
       ],
-      "severity": "critical"
+      "severity": "critical",
+      "fileExtensions": [
+        ".js",
+        ".ts",
+        ".py",
+        ".sh",
+        ".env",
+        ".json",
+        ".yaml",
+        ".yml"
+      ]
     },
     {
       "id": "HARDCODED_GITHUB_TOKEN",
@@ -264,7 +309,15 @@
         "github",
         "credentials"
       ],
-      "severity": "critical"
+      "severity": "critical",
+      "fileExtensions": [
+        ".js",
+        ".ts",
+        ".py",
+        ".sh",
+        ".yaml",
+        ".yml"
+      ]
     },
     {
       "id": "HARDCODED_STRIPE_KEY",
@@ -276,7 +329,12 @@
         "stripe",
         "credentials"
       ],
-      "severity": "critical"
+      "severity": "critical",
+      "fileExtensions": [
+        ".js",
+        ".ts",
+        ".py"
+      ]
     },
     {
       "id": "HARDCODED_API_KEY",
@@ -288,7 +346,12 @@
         "credentials",
         "api-key"
       ],
-      "severity": "critical"
+      "severity": "critical",
+      "fileExtensions": [
+        ".js",
+        ".ts",
+        ".py"
+      ]
     },
     {
       "id": "HARDCODED_DB_CONNECTION",
@@ -300,7 +363,13 @@
         "database",
         "credentials"
       ],
-      "severity": "high"
+      "severity": "high",
+      "fileExtensions": [
+        ".js",
+        ".ts",
+        ".py",
+        ".env"
+      ]
     },
     {
       "id": "NETWORK_DISCORD_WEBHOOK",
@@ -312,7 +381,13 @@
         "discord",
         "exfiltration"
       ],
-      "severity": "critical"
+      "severity": "critical",
+      "fileExtensions": [
+        ".js",
+        ".ts",
+        ".py",
+        ".sh"
+      ]
     },
     {
       "id": "NETWORK_TELEGRAM_TOKEN",
@@ -324,7 +399,13 @@
         "telegram",
         "c2"
       ],
-      "severity": "high"
+      "severity": "high",
+      "fileExtensions": [
+        ".js",
+        ".ts",
+        ".py",
+        ".sh"
+      ]
     },
     {
       "id": "NETWORK_PASTEBIN",
@@ -336,7 +417,13 @@
         "pastebin",
         "payload-hosting"
       ],
-      "severity": "medium"
+      "severity": "medium",
+      "fileExtensions": [
+        ".js",
+        ".ts",
+        ".py",
+        ".sh"
+      ]
     },
     {
       "id": "NETWORK_URL_SHORTENER",
@@ -348,7 +435,13 @@
         "url-shortener",
         "obfuscation"
       ],
-      "severity": "medium"
+      "severity": "medium",
+      "fileExtensions": [
+        ".js",
+        ".ts",
+        ".py",
+        ".sh"
+      ]
     },
     {
       "id": "NETWORK_SUSPICIOUS_TLD",
@@ -360,7 +453,13 @@
         "suspicious-domain",
         "malware-hosting"
       ],
-      "severity": "high"
+      "severity": "high",
+      "fileExtensions": [
+        ".js",
+        ".ts",
+        ".py",
+        ".sh"
+      ]
     },
     {
       "id": "NETWORK_NGROK_TUNNEL",
@@ -372,7 +471,13 @@
         "ngrok",
         "c2"
       ],
-      "severity": "medium"
+      "severity": "medium",
+      "fileExtensions": [
+        ".js",
+        ".ts",
+        ".py",
+        ".sh"
+      ]
     },
     {
       "id": "EXFIL_CLIPBOARD",
@@ -384,7 +489,11 @@
         "clipboard",
         "data-theft"
       ],
-      "severity": "high"
+      "severity": "high",
+      "fileExtensions": [
+        ".js",
+        ".ts"
+      ]
     },
     {
       "id": "EXFIL_COOKIE",
@@ -396,7 +505,11 @@
         "cookies",
         "session-theft"
       ],
-      "severity": "high"
+      "severity": "high",
+      "fileExtensions": [
+        ".js",
+        ".ts"
+      ]
     },
     {
       "id": "EXFIL_KEYLOGGER",
@@ -408,7 +521,11 @@
         "keylogger",
         "credential-theft"
       ],
-      "severity": "critical"
+      "severity": "critical",
+      "fileExtensions": [
+        ".js",
+        ".ts"
+      ]
     },
     {
       "id": "BACKDOOR_RCE_ENDPOINT",
@@ -420,7 +537,12 @@
         "rce",
         "critical"
       ],
-      "severity": "critical"
+      "severity": "critical",
+      "fileExtensions": [
+        ".js",
+        ".ts",
+        ".py"
+      ]
     },
     {
       "id": "BACKDOOR_DYNAMIC_REQUIRE",
@@ -432,7 +554,11 @@
         "rce",
         "dynamic-require"
       ],
-      "severity": "critical"
+      "severity": "critical",
+      "fileExtensions": [
+        ".js",
+        ".ts"
+      ]
     },
     {
       "id": "BACKDOOR_HARDCODED_AUTH",
@@ -444,7 +570,12 @@
         "auth-bypass",
         "hardcoded"
       ],
-      "severity": "critical"
+      "severity": "critical",
+      "fileExtensions": [
+        ".js",
+        ".ts",
+        ".py"
+      ]
     },
     {
       "id": "FILE_ACCESS_CREDENTIALS",
@@ -457,7 +588,12 @@
         "ssh",
         "aws"
       ],
-      "severity": "critical"
+      "severity": "critical",
+      "fileExtensions": [
+        ".js",
+        ".ts",
+        ".py"
+      ]
     },
     {
       "id": "FILE_ACCESS_SYSTEM",
@@ -469,7 +605,12 @@
         "system-files",
         "privilege-escalation"
       ],
-      "severity": "critical"
+      "severity": "critical",
+      "fileExtensions": [
+        ".js",
+        ".ts",
+        ".py"
+      ]
     },
     {
       "id": "FILE_ACCESS_BROWSER_DATA",
@@ -481,7 +622,12 @@
         "browser-data",
         "credential-theft"
       ],
-      "severity": "critical"
+      "severity": "critical",
+      "fileExtensions": [
+        ".js",
+        ".ts",
+        ".py"
+      ]
     },
     {
       "id": "SOCIAL_ENGINEERING_SECURITY_BYPASS",
@@ -503,7 +649,15 @@
         "base64",
         "obfuscation"
       ],
-      "severity": "medium"
+      "severity": "medium",
+      "minMatches": 6,
+      "fileExtensions": [
+        ".js",
+        ".ts",
+        ".py",
+        ".sh",
+        ".ps1"
+      ]
     },
     {
       "id": "OBF_HEX_STRINGS",
@@ -514,7 +668,13 @@
         "hex-encoding",
         "obfuscation"
       ],
-      "severity": "medium"
+      "severity": "medium",
+      "minMatches": 20,
+      "fileExtensions": [
+        ".js",
+        ".ts",
+        ".py"
+      ]
     },
     {
       "id": "OBF_EVAL",
@@ -526,7 +686,12 @@
         "dynamic-code",
         "obfuscation"
       ],
-      "severity": "high"
+      "severity": "high",
+      "fileExtensions": [
+        ".js",
+        ".ts",
+        ".mjs"
+      ]
     },
     {
       "id": "OBF_NEW_FUNCTION",
@@ -538,7 +703,11 @@
         "dynamic-code",
         "obfuscation"
       ],
-      "severity": "high"
+      "severity": "high",
+      "fileExtensions": [
+        ".js",
+        ".ts"
+      ]
     },
     {
       "id": "OBF_SETTIMEOUT_STRING",
@@ -550,7 +719,11 @@
         "dynamic-code",
         "obfuscation"
       ],
-      "severity": "high"
+      "severity": "high",
+      "fileExtensions": [
+        ".js",
+        ".ts"
+      ]
     },
     {
       "id": "OBF_FROMCHARCODE",
@@ -562,7 +735,11 @@
         "obfuscation",
         "eval-bypass"
       ],
-      "severity": "medium"
+      "severity": "medium",
+      "fileExtensions": [
+        ".js",
+        ".ts"
+      ]
     },
     {
       "id": "OBF_CHARCODE_ARRAY",
@@ -573,7 +750,11 @@
         "charcode-array",
         "obfuscation"
       ],
-      "severity": "medium"
+      "severity": "medium",
+      "fileExtensions": [
+        ".js",
+        ".ts"
+      ]
     }
   ],
   "knownBadHashes": [],

package/dist/{chunk-FJUDM3F7.js → chunk-AS7DXMSG.js}

@@ -361,6 +361,91 @@ function collectEvidence(content, patterns, max = MAX_EVIDENCE_LINES) {
   return evidence;
 }
 
+// node_modules/@flagrix/scanner-core/dist/utils/mask.js
+var REGEX_ALLOWED_AFTER_CHAR = /* @__PURE__ */ new Set([..."=(:,[!&|?{};+*%^<>~"]);
+var REGEX_ALLOWED_AFTER_WORD = /* @__PURE__ */ new Set(["return", "case", "typeof", "in", "of", "do", "void", "delete"]);
+function maskRegexLiterals(content) {
+  return content.split("\n").map(maskLine).join("\n");
+}
+function maskLine(line) {
+  let out = "";
+  let i = 0;
+  while (i < line.length) {
+    const ch = line[i];
+    if (ch === '"' || ch === "'" || ch === "`") {
+      const end = stringEnd(line, i);
+      out += line.slice(i, end);
+      i = end;
+      continue;
+    }
+    if (ch === "/" && line[i + 1] === "/") {
+      out += line.slice(i);
+      break;
+    }
+    if (ch === "/" && regexCanStartAfter(out)) {
+      const end = regexEnd(line, i);
+      if (end !== -1) {
+        out += " ".repeat(end - i);
+        i = end;
+        continue;
+      }
+    }
+    out += ch;
+    i++;
+  }
+  return out;
+}
+function regexCanStartAfter(before) {
+  const trimmed = before.trimEnd();
+  if (trimmed === "")
+    return true;
+  if (REGEX_ALLOWED_AFTER_CHAR.has(trimmed.slice(-1)))
+    return true;
+  const word = trimmed.match(/[A-Za-z_$][A-Za-z0-9_$]*$/)?.[0];
+  return word !== void 0 && REGEX_ALLOWED_AFTER_WORD.has(word);
+}
+function regexEnd(line, start) {
+  let i = start + 1;
+  let inClass = false;
+  let body = 0;
+  for (; i < line.length; i++) {
+    const ch = line[i];
+    if (ch === "\\") {
+      i++;
+      body++;
+      continue;
+    }
+    if (inClass) {
+      if (ch === "]")
+        inClass = false;
+    } else if (ch === "[") {
+      inClass = true;
+    } else if (ch === "/") {
+      if (body === 0)
+        return -1;
+      let end = i + 1;
+      while (end < line.length && /[a-z]/i.test(line[end]))
+        end++;
+      return end;
+    }
+    body++;
+  }
+  return -1;
+}
+function stringEnd(line, start) {
+  const quote = line[start];
+  let i = start + 1;
+  for (; i < line.length; i++) {
+    if (line[i] === "\\") {
+      i++;
+      continue;
+    }
+    if (line[i] === quote)
+      return i + 1;
+  }
+  return line.length;
+}
+
 // node_modules/@flagrix/scanner-core/dist/github/api-error.js
 async function githubApiError(response, fallback = "GitHub API error") {
   let apiMessage = "";
@@ -441,9 +526,13 @@ function applyYaraRules(content, rules, filePath) {
   const isTest = isTestFile(filePath);
   for (const rule of rules) {
     try {
+      if (rule.fileExtensions && rule.fileExtensions.length > 0 && !rule.fileExtensions.some((ext) => filePath.endsWith(ext))) {
+        continue;
+      }
       const regex = new RegExp(rule.pattern, "gi");
       const matches2 = content.match(regex);
-      if (matches2 && matches2.length > 0) {
+      const required = rule.minMatches && rule.minMatches > 1 ? rule.minMatches : 1;
+      if (matches2 && matches2.length >= required) {
         if (isTest && rule.severity !== "critical") {
           continue;
         }
@@ -535,6 +624,7 @@ async function scanGitHubRepo(repo, options) {
     }
     const maliciousPackages = options.signatures.maliciousPackages;
     const yaraRules = options.signatures.yaraRules;
+    const loadedRuleIds = new Set(yaraRules.map((r) => r.id));
     const fileContents = [];
     for (const file of filesToScan) {
       filesScanned++;
@@ -544,8 +634,9 @@ async function scanGitHubRepo(repo, options) {
         continue;
       const fileData = await contentResponse.json();
       const content = atob(fileData.content || "");
+      const matchable = /\.(?:js|ts)$/.test(file.path) ? maskRegexLiterals(content) : content;
       if (SCANNABLE_EXTENSIONS.some((ext) => file.path.endsWith(ext))) {
-        fileContents.push({ path: file.path, content });
+        fileContents.push({ path: file.path, content: matchable });
       }
       if (file.path.endsWith("package.json")) {
         const pkgFindings = await scanPackageJson(content, maliciousPackages, file.path);
@@ -562,10 +653,10 @@ async function scanGitHubRepo(repo, options) {
         patternsMatched += pyFindings.length;
       }
       if (SCANNABLE_EXTENSIONS.some((ext) => file.path.endsWith(ext))) {
-        const yaraFindings = applyYaraRules(content, yaraRules, file.path);
+        const yaraFindings = applyYaraRules(matchable, yaraRules, file.path);
         findings.push(...yaraFindings);
         patternsMatched += yaraFindings.length;
-        const obfuscationFindings = detectObfuscation(content, file.path);
+        const obfuscationFindings = detectObfuscation(matchable, file.path, loadedRuleIds);
         findings.push(...obfuscationFindings);
         patternsMatched += obfuscationFindings.length;
       }
@@ -575,22 +666,22 @@ async function scanGitHubRepo(repo, options) {
     findings.push(...languageFindings);
     patternsMatched += languageFindings.length;
     for (const file of fileContents) {
-      const secretFindings = detectHardcodedSecrets(file.content, file.path);
+      const secretFindings = detectHardcodedSecrets(file.content, file.path, loadedRuleIds);
       findings.push(...secretFindings);
       patternsMatched += secretFindings.length;
-      const networkFindings = detectNetworkPatterns(file.content, file.path);
+      const networkFindings = detectNetworkPatterns(file.content, file.path, loadedRuleIds);
       findings.push(...networkFindings);
       patternsMatched += networkFindings.length;
-      const miningFindings = detectCryptoMining(file.content, file.path);
+      const miningFindings = detectCryptoMining(file.content, file.path, loadedRuleIds);
       findings.push(...miningFindings);
       patternsMatched += miningFindings.length;
-      const exfiltrationFindings = detectDataExfiltration(file.content, file.path);
+      const exfiltrationFindings = detectDataExfiltration(file.content, file.path, loadedRuleIds);
       findings.push(...exfiltrationFindings);
       patternsMatched += exfiltrationFindings.length;
-      const backdoorFindings = detectBackdoors(file.content, file.path);
+      const backdoorFindings = detectBackdoors(file.content, file.path, loadedRuleIds);
       findings.push(...backdoorFindings);
       patternsMatched += backdoorFindings.length;
-      const fileAccessFindings = detectSuspiciousFileAccess(file.content, file.path);
+      const fileAccessFindings = detectSuspiciousFileAccess(file.content, file.path, loadedRuleIds);
       findings.push(...fileAccessFindings);
       patternsMatched += fileAccessFindings.length;
       const socialEngFindings = detectSocialEngineering(file.content, file.path);
@@ -607,7 +698,8 @@ async function scanGitHubRepo(repo, options) {
         patternsMatched += supplyChainFindings.length;
       }
     }
-    const integrityFindings = await detectCodeIntegrityIssues(fileContents, repo);
+    const allPaths = tree.tree.filter((i) => i.type === "blob").map((i) => i.path);
+    const integrityFindings = await detectCodeIntegrityIssues(fileContents, allPaths, repo);
     findings.push(...integrityFindings);
     patternsMatched += integrityFindings.length;
     const riskScore = calculateRiskScore(findings);
@@ -721,11 +813,19 @@ function scanPythonDeps(content, maliciousPackages, filePath) {
   }
   return findings;
 }
-function detectObfuscation(content, filePath) {
+var BUILTIN_OBFUSCATION_RULE_IDS = {
+  base64: "OBF_BASE64_HEAVY",
+  hex: "OBF_HEX_STRINGS",
+  eval: "OBF_EVAL",
+  newFunction: "OBF_NEW_FUNCTION",
+  timerString: "OBF_SETTIMEOUT_STRING",
+  longLine: "OBF_LONG_LINE"
+};
+function detectObfuscation(content, filePath, coveredRuleIds = /* @__PURE__ */ new Set()) {
   const findings = [];
   if (isTestFile(filePath))
     return findings;
-  const base64Matches = content.match(/[A-Za-z0-9+/]{50,}={0,2}/g);
+  const base64Matches = coveredRuleIds.has(BUILTIN_OBFUSCATION_RULE_IDS.base64) ? null : content.match(/[A-Za-z0-9+/]{50,}={0,2}/g);
   if (base64Matches && base64Matches.length > 5) {
     const snippet = base64Matches.slice(0, 3).join("\n") + (base64Matches.length > 3 ? "\n... and more" : "");
     findings.push({
@@ -737,7 +837,7 @@ function detectObfuscation(content, filePath) {
       codeExplanation: "\u{1F513} Multiple Base64-encoded strings found. Base64 is commonly used to hide malicious payloads, URLs, or commands from code reviewers."
     });
   }
-  const hexMatches = content.match(/\\x[0-9a-fA-F]{2}/g);
+  const hexMatches = coveredRuleIds.has(BUILTIN_OBFUSCATION_RULE_IDS.hex) ? null : content.match(/\\x[0-9a-fA-F]{2}/g);
   if (hexMatches && hexMatches.length > 20) {
     findings.push({
       severity: "medium",
@@ -749,11 +849,11 @@ function detectObfuscation(content, filePath) {
     });
   }
   const evalPatterns = [
-    { pattern: /eval\s*\([^)]{0,200}\)/gi, name: "eval" },
-    { pattern: /new\s+Function\s*\([^)]{0,200}\)/gi, name: "Function constructor" },
-    { pattern: /setTimeout\s*\(\s*["'`][^"'`]{0,200}["'`]/gi, name: "setTimeout with string" },
-    { pattern: /setInterval\s*\(\s*["'`][^"'`]{0,200}["'`]/gi, name: "setInterval with string" }
-  ];
+    { pattern: /eval\s*\([^)]{0,200}\)/gi, name: "eval", ruleId: BUILTIN_OBFUSCATION_RULE_IDS.eval },
+    { pattern: /new\s+Function\s*\([^)]{0,200}\)/gi, name: "Function constructor", ruleId: BUILTIN_OBFUSCATION_RULE_IDS.newFunction },
+    { pattern: /setTimeout\s*\(\s*["'`][^"'`]{0,200}["'`]/gi, name: "setTimeout with string", ruleId: BUILTIN_OBFUSCATION_RULE_IDS.timerString },
+    { pattern: /setInterval\s*\(\s*["'`][^"'`]{0,200}["'`]/gi, name: "setInterval with string", ruleId: BUILTIN_OBFUSCATION_RULE_IDS.timerString }
+  ].filter(({ ruleId }) => !coveredRuleIds.has(ruleId));
   for (const { pattern, name } of evalPatterns) {
     const matches2 = content.match(pattern);
     if (matches2 && matches2.length > 0) {
@@ -783,7 +883,7 @@ function detectObfuscation(content, filePath) {
     /atob\s*\(/i,
     /fromCharCode/i
   ];
-  const lines = content.split("\n");
+  const lines = coveredRuleIds.has(BUILTIN_OBFUSCATION_RULE_IDS.longLine) ? [] : content.split("\n");
   const suspiciousLines = [];
   lines.forEach((line, index) => {
     if (line.length > 5e3) {
@@ -1029,23 +1129,23 @@ function detectSuspiciousPackageNames(content, filePath) {
   }
   return findings;
 }
-function detectHardcodedSecrets(content, filePath) {
+function detectHardcodedSecrets(content, filePath, coveredRuleIds = /* @__PURE__ */ new Set()) {
   const findings = [];
   if (isTestFile(filePath))
     return findings;
   const secretPatterns = [
-    { pattern: /(?:api[_-]?key|apikey)\s*[:=]\s*['"]([^'"]{20,})['"]/gi, type: "API Key", severity: "critical" },
-    { pattern: /(?:secret[_-]?key|secret)\s*[:=]\s*['"]([^'"]{20,})['"]/gi, type: "Secret Key", severity: "critical" },
-    { pattern: /(?:password|passwd|pwd)\s*[:=]\s*['"]([^'"]{8,})['"]/gi, type: "Password", severity: "critical" },
-    { pattern: /(?:token|auth[_-]?token)\s*[:=]\s*['"]([^'"]{20,})['"]/gi, type: "Auth Token", severity: "critical" },
-    { pattern: /(?:private[_-]?key|privatekey)\s*[:=]\s*['"]([^'"]{20,})['"]/gi, type: "Private Key", severity: "critical" },
-    { pattern: /AKIA[0-9A-Z]{16}/g, type: "AWS Access Key", severity: "critical" },
-    { pattern: /ghp_[a-zA-Z0-9]{36}/g, type: "GitHub Personal Access Token", severity: "critical" },
-    { pattern: /gho_[a-zA-Z0-9]{36}/g, type: "GitHub OAuth Token", severity: "critical" },
-    { pattern: /sk_live_[a-zA-Z0-9]{24,}/g, type: "Stripe Live Key", severity: "critical" },
-    { pattern: /(?:mongodb|mongo)[+:\/\/]{0,6}[^@\s]+:[^@\s]+@/gi, type: "MongoDB Connection String", severity: "high" },
-    { pattern: /postgres:\/\/[^@\s]+:[^@\s]+@/gi, type: "PostgreSQL Connection String", severity: "high" }
-  ];
+    { pattern: /(?:api[_-]?key|apikey)\s*[:=]\s*['"]([^'"]{20,})['"]/gi, type: "API Key", severity: "critical", ruleId: "HARDCODED_API_KEY" },
+    { pattern: /(?:secret[_-]?key|secret)\s*[:=]\s*['"]([^'"]{20,})['"]/gi, type: "Secret Key", severity: "critical", ruleId: "HARDCODED_API_KEY" },
+    { pattern: /(?:password|passwd|pwd)\s*[:=]\s*['"]([^'"]{8,})['"]/gi, type: "Password", severity: "critical", ruleId: null },
+    { pattern: /(?:token|auth[_-]?token)\s*[:=]\s*['"]([^'"]{20,})['"]/gi, type: "Auth Token", severity: "critical", ruleId: "HARDCODED_API_KEY" },
+    { pattern: /(?:private[_-]?key|privatekey)\s*[:=]\s*['"]([^'"]{20,})['"]/gi, type: "Private Key", severity: "critical", ruleId: "HARDCODED_API_KEY" },
+    { pattern: /AKIA[0-9A-Z]{16}/g, type: "AWS Access Key", severity: "critical", ruleId: "HARDCODED_AWS_KEY" },
+    { pattern: /ghp_[a-zA-Z0-9]{36}/g, type: "GitHub Personal Access Token", severity: "critical", ruleId: "HARDCODED_GITHUB_TOKEN" },
+    { pattern: /gho_[a-zA-Z0-9]{36}/g, type: "GitHub OAuth Token", severity: "critical", ruleId: "HARDCODED_GITHUB_TOKEN" },
+    { pattern: /sk_live_[a-zA-Z0-9]{24,}/g, type: "Stripe Live Key", severity: "critical", ruleId: "HARDCODED_STRIPE_KEY" },
+    { pattern: /(?:mongodb|mongo)[+:\/\/]{0,6}[^@\s]+:[^@\s]+@/gi, type: "MongoDB Connection String", severity: "high", ruleId: "HARDCODED_DB_CONNECTION" },
+    { pattern: /postgres:\/\/[^@\s]+:[^@\s]+@/gi, type: "PostgreSQL Connection String", severity: "high", ruleId: "HARDCODED_DB_CONNECTION" }
+  ].filter(({ ruleId }) => !ruleId || !coveredRuleIds.has(ruleId));
   const foundSecrets = [];
   const matchedRegexes = [];
   for (const { pattern, type, severity } of secretPatterns) {
@@ -1069,7 +1169,7 @@ function detectHardcodedSecrets(content, filePath) {
   }
   return findings;
 }
-function detectNetworkPatterns(content, filePath) {
+function detectNetworkPatterns(content, filePath, coveredRuleIds = /* @__PURE__ */ new Set()) {
   const findings = [];
   if (isTestFile(filePath))
     return findings;
@@ -1078,13 +1178,13 @@ function detectNetworkPatterns(content, filePath) {
     // dotted/number sequence (avoids flagging version strings like "1.2.3.4.5" or
     // impossible IPs like "999.999.999.999"), and excluding private/link-local ranges.
     { pattern: /(?:https?:\/\/)?(?<![\d.])(?!(?:127\.|10\.|192\.168\.|169\.254\.|172\.(?:1[6-9]|2\d|3[01])\.))(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(?:\.(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}(?![\d.])(?::\d{1,5})?/g, type: "Hardcoded IP Address", severity: "high" },
-    { pattern: /https?:\/\/discord(?:app)?\.com\/api\/webhooks\/\d+\/[a-zA-Z0-9_-]+/gi, type: "Discord Webhook", severity: "critical" },
-    { pattern: /\d{8,10}:[a-zA-Z0-9_-]{35}/g, type: "Telegram Bot Token", severity: "high" },
-    { pattern: /(?:pastebin\.com|hastebin\.com|paste\.ee)\/[a-zA-Z0-9]+/gi, type: "Pastebin URL", severity: "medium" },
-    { pattern: /(?:bit\.ly|tinyurl\.com|t\.co)\/[a-zA-Z0-9]+/gi, type: "URL Shortener", severity: "medium" },
-    { pattern: /https?:\/\/[a-zA-Z0-9-]+\.(?:tk|ml|ga|cf|gq|onion|xyz)(?:\/|$)/gi, type: "Suspicious Domain TLD", severity: "high" },
-    { pattern: /https?:\/\/[a-zA-Z0-9-]+\.ngrok\.io/gi, type: "Ngrok Tunnel", severity: "medium" }
-  ];
+    { pattern: /https?:\/\/discord(?:app)?\.com\/api\/webhooks\/\d+\/[a-zA-Z0-9_-]+/gi, type: "Discord Webhook", severity: "critical", ruleId: "NETWORK_DISCORD_WEBHOOK" },
+    { pattern: /\d{8,10}:[a-zA-Z0-9_-]{35}/g, type: "Telegram Bot Token", severity: "high", ruleId: "NETWORK_TELEGRAM_TOKEN" },
+    { pattern: /(?:pastebin\.com|hastebin\.com|paste\.ee)\/[a-zA-Z0-9]+/gi, type: "Pastebin URL", severity: "medium", ruleId: "NETWORK_PASTEBIN" },
+    { pattern: /(?:bit\.ly|tinyurl\.com|t\.co)\/[a-zA-Z0-9]+/gi, type: "URL Shortener", severity: "medium", ruleId: "NETWORK_URL_SHORTENER" },
+    { pattern: /https?:\/\/[a-zA-Z0-9-]+\.(?:tk|ml|ga|cf|gq|onion|xyz)(?:\/|$)/gi, type: "Suspicious Domain TLD", severity: "high", ruleId: "NETWORK_SUSPICIOUS_TLD" },
+    { pattern: /https?:\/\/[a-zA-Z0-9-]+\.ngrok\.io/gi, type: "Ngrok Tunnel", severity: "medium", ruleId: "NETWORK_NGROK_TUNNEL" }
+  ].filter((p) => !("ruleId" in p) || !coveredRuleIds.has(p.ruleId));
   for (const { pattern, type, severity } of suspiciousPatterns) {
     const matches2 = content.match(pattern);
     if (matches2 && matches2.length > 0) {
@@ -1108,8 +1208,10 @@ function detectNetworkPatterns(content, filePath) {
   }
   return findings;
 }
-function detectCryptoMining(content, filePath) {
+function detectCryptoMining(content, filePath, coveredRuleIds = /* @__PURE__ */ new Set()) {
   const findings = [];
+  if (coveredRuleIds.has("CRYPTO_MINER"))
+    return findings;
   const miningPatterns = [
     /coinhive|coin-hive|crypto-loot|cryptoloot|jsecoin/gi,
     /stratum\+tcp|stratum\.|\bpool\./gi,
@@ -1142,18 +1244,18 @@ function detectCryptoMining(content, filePath) {
   }
   return findings;
 }
-function detectDataExfiltration(content, filePath) {
+function detectDataExfiltration(content, filePath, coveredRuleIds = /* @__PURE__ */ new Set()) {
   const findings = [];
   if (isTestFile(filePath))
     return findings;
   const exfiltrationPatterns = [
-    { pattern: /navigator\.clipboard\.read(?:Text)?\s*\(/gi, type: "Clipboard Access", severity: "high" },
-    { pattern: /localStorage\.getItem|sessionStorage\.getItem/gi, type: "Storage Access", severity: "medium" },
-    { pattern: /document\.cookie/gi, type: "Cookie Access", severity: "high" },
-    { pattern: /(?:addEventListener|on)\s*\(\s*['"](?:keydown|keypress|keyup)['"]/gi, type: "Keylogger Pattern", severity: "critical" },
-    { pattern: /(?:input|password|email)[\w-]*\.value/gi, type: "Form Data Access", severity: "medium" },
-    { pattern: /new\s+FormData\s*\([^)]*\)[\s\S]{0,100}(?:fetch|axios|XMLHttpRequest)/gi, type: "Form Data Transmission", severity: "high" }
-  ];
+    { pattern: /navigator\.clipboard\.read(?:Text)?\s*\(/gi, type: "Clipboard Access", severity: "high", ruleId: "EXFIL_CLIPBOARD" },
+    { pattern: /localStorage\.getItem|sessionStorage\.getItem/gi, type: "Storage Access", severity: "medium", ruleId: null },
+    { pattern: /document\.cookie/gi, type: "Cookie Access", severity: "high", ruleId: "EXFIL_COOKIE" },
+    { pattern: /(?:addEventListener|on)\s*\(\s*['"](?:keydown|keypress|keyup)['"]/gi, type: "Keylogger Pattern", severity: "critical", ruleId: "EXFIL_KEYLOGGER" },
+    { pattern: /(?:input|password|email)[\w-]*\.value/gi, type: "Form Data Access", severity: "medium", ruleId: null },
+    { pattern: /new\s+FormData\s*\([^)]*\)[\s\S]{0,100}(?:fetch|axios|XMLHttpRequest)/gi, type: "Form Data Transmission", severity: "high", ruleId: null }
+  ].filter(({ ruleId }) => !ruleId || !coveredRuleIds.has(ruleId));
   const detectedPatterns = [];
   const matchedRegexes = [];
   let highestSeverity = "medium";
@@ -1178,16 +1280,16 @@ function detectDataExfiltration(content, filePath) {
   }
   return findings;
 }
-function detectBackdoors(content, filePath) {
+function detectBackdoors(content, filePath, coveredRuleIds = /* @__PURE__ */ new Set()) {
   const findings = [];
   const backdoorPatterns = [
-    { pattern: /eval\s*\(\s*(?:request|req)(?:\.|\.body|\.query)/gi, type: "Remote Code Execution Endpoint", severity: "critical" },
-    { pattern: /exec\s*\(\s*(?:request|req)(?:\.|\.body|\.query)/gi, type: "Command Injection Endpoint", severity: "critical" },
-    { pattern: /require\s*\(\s*(?:request|req)(?:\.|\.body|\.query)/gi, type: "Dynamic Require", severity: "critical" },
-    { pattern: /new\s+Function\s*\([^)]*(?:request|req)/gi, type: "Dynamic Function from Request", severity: "critical" },
-    { pattern: /(?:admin|debug|backdoor|shell)[\w]*\s*[:=]\s*(?:true|1|"[^"]*")\s*(?:\/\/|#)?\s*(?:TODO|FIXME|HACK)?/gi, type: "Debug/Admin Flag", severity: "high" },
-    { pattern: /(?:password|auth)\s*(?:===?|==)\s*['"][^'"]{0,20}['"]\s*\)/gi, type: "Hardcoded Auth Bypass", severity: "critical" }
-  ];
+    { pattern: /eval\s*\(\s*(?:request|req)(?:\.|\.body|\.query)/gi, type: "Remote Code Execution Endpoint", severity: "critical", ruleId: "BACKDOOR_RCE_ENDPOINT" },
+    { pattern: /exec\s*\(\s*(?:request|req)(?:\.|\.body|\.query)/gi, type: "Command Injection Endpoint", severity: "critical", ruleId: "BACKDOOR_RCE_ENDPOINT" },
+    { pattern: /require\s*\(\s*(?:request|req)(?:\.|\.body|\.query)/gi, type: "Dynamic Require", severity: "critical", ruleId: "BACKDOOR_DYNAMIC_REQUIRE" },
+    { pattern: /new\s+Function\s*\([^)]*(?:request|req)/gi, type: "Dynamic Function from Request", severity: "critical", ruleId: null },
+    { pattern: /(?:admin|debug|backdoor|shell)[\w]*\s*[:=]\s*(?:true|1|"[^"]*")\s*(?:\/\/|#)?\s*(?:TODO|FIXME|HACK)?/gi, type: "Debug/Admin Flag", severity: "high", ruleId: null },
+    { pattern: /(?:password|auth)\s*(?:===?|==)\s*['"][^'"]{0,20}['"]\s*\)/gi, type: "Hardcoded Auth Bypass", severity: "critical", ruleId: "BACKDOOR_HARDCODED_AUTH" }
+  ].filter(({ ruleId }) => !ruleId || !coveredRuleIds.has(ruleId));
   for (const { pattern, type, severity } of backdoorPatterns) {
     const matches2 = content.match(pattern);
     if (matches2) {
@@ -1242,17 +1344,17 @@ function detectSupplyChainRisks(content, filePath) {
   }
   return findings;
 }
-function detectSuspiciousFileAccess(content, filePath) {
+function detectSuspiciousFileAccess(content, filePath, coveredRuleIds = /* @__PURE__ */ new Set()) {
   const findings = [];
   if (isTestFile(filePath))
     return findings;
   const fileAccessPatterns = [
-    { pattern: /(?:fs\.read|readFileSync|readFile)\s*\([^)]*(?:\.ssh|\.aws|\.gnupg|\.docker|id_rsa|credentials)/gi, type: "SSH/AWS Credentials Access", severity: "critical" },
-    { pattern: /(?:fs\.read|readFileSync|readFile)\s*\([^)]*(?:etc\/passwd|etc\/shadow|\.bash_history|\.zsh_history)/gi, type: "System File Access", severity: "critical" },
-    { pattern: /(?:fs\.read|readFileSync|readFile)\s*\([^)]*(?:Chrome|Firefox|Safari|Edge)[\w\s/\\]*(?:Cookies|Login|History)/gi, type: "Browser Data Access", severity: "critical" },
-    { pattern: /(?:fs\.write|writeFileSync|writeFile)\s*\([^)]*(?:\/etc|\/sys|\/bin|C:\\\\Windows)/gi, type: "System Directory Write", severity: "critical" },
-    { pattern: /(?:fs\.unlink|unlinkSync|rmSync|rm\s+-rf)/gi, type: "File Deletion", severity: "medium" }
-  ];
+    { pattern: /(?:fs\.read|readFileSync|readFile)\s*\([^)]*(?:\.ssh|\.aws|\.gnupg|\.docker|id_rsa|credentials)/gi, type: "SSH/AWS Credentials Access", severity: "critical", ruleId: "FILE_ACCESS_CREDENTIALS" },
+    { pattern: /(?:fs\.read|readFileSync|readFile)\s*\([^)]*(?:etc\/passwd|etc\/shadow|\.bash_history|\.zsh_history)/gi, type: "System File Access", severity: "critical", ruleId: "FILE_ACCESS_SYSTEM" },
+    { pattern: /(?:fs\.read|readFileSync|readFile)\s*\([^)]*(?:Chrome|Firefox|Safari|Edge)[\w\s/\\]*(?:Cookies|Login|History)/gi, type: "Browser Data Access", severity: "critical", ruleId: "FILE_ACCESS_BROWSER_DATA" },
+    { pattern: /(?:fs\.write|writeFileSync|writeFile)\s*\([^)]*(?:\/etc|\/sys|\/bin|C:\\\\Windows)/gi, type: "System Directory Write", severity: "critical", ruleId: null },
+    { pattern: /(?:fs\.unlink|unlinkSync|rmSync|rm\s+-rf)/gi, type: "File Deletion", severity: "medium", ruleId: null }
+  ].filter(({ ruleId }) => !ruleId || !coveredRuleIds.has(ruleId));
   for (const { pattern, type, severity } of fileAccessPatterns) {
     const matches2 = content.match(pattern);
     if (matches2) {
@@ -1269,7 +1371,7 @@ function detectSuspiciousFileAccess(content, filePath) {
   }
   return findings;
 }
-async function detectCodeIntegrityIssues(files, _repo) {
+async function detectCodeIntegrityIssues(files, allPaths, _repo) {
   const findings = [];
   for (const file of files) {
     if (file.path.endsWith(".min.js") || file.path.endsWith(".min.css"))
@@ -1291,8 +1393,9 @@ async function detectCodeIntegrityIssues(files, _repo) {
       }
     }
   }
-  const hasLicense = files.some((f) => /^LICENSE|^COPYING/i.test(f.path));
-  if (!hasLicense && files.length > 5) {
+  const basename = (p) => p.split("/").pop() ?? p;
+  const hasLicense = allPaths.some((p) => /^(LICENSE|COPYING)/i.test(basename(p)));
+  if (!hasLicense && allPaths.length > 5) {
     findings.push({
       severity: "low",
       type: "CODE_INTEGRITY_ISSUE",
@@ -1300,8 +1403,8 @@ async function detectCodeIntegrityIssues(files, _repo) {
       codeExplanation: "\u{1F4C4} Missing license file. Legitimate open-source projects typically include a license. Absence may indicate a quickly assembled malicious repository."
     });
   }
-  const hasReadme = files.some((f) => /^README/i.test(f.path));
-  if (!hasReadme && files.length > 5) {
+  const hasReadme = allPaths.some((p) => /^README/i.test(basename(p)));
+  if (!hasReadme && allPaths.length > 5) {
     findings.push({
       severity: "low",
       type: "CODE_INTEGRITY_ISSUE",

package/dist/cli.js

@@ -11,7 +11,7 @@ import {
   scanGitHubRepo,
   scanGitHubUser,
   wantJson
-} from "./chunk-FJUDM3F7.js";
+} from "./chunk-AS7DXMSG.js";
 
 // src/cli.ts
 import { parseArgs } from "util";
@@ -132,7 +132,7 @@ async function main() {
       }
       return runScanUser(target, { json: values.json, token: values.token });
     case "mcp": {
-      const { runMcp } = await import("./mcp-S44QVYNH.js");
+      const { runMcp } = await import("./mcp-LS7GRB2C.js");
       return runMcp();
     }
     default:

package/dist/{mcp-S44QVYNH.js → mcp-LS7GRB2C.js}

@@ -7,7 +7,7 @@ import {
   scanGitHubRepo,
   scanGitHubUser,
   securityScore
-} from "./chunk-FJUDM3F7.js";
+} from "./chunk-AS7DXMSG.js";
 
 // src/commands/mcp.ts
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flagrix",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Scan GitHub repos and profiles for malware before you clone — CLI and MCP server for the Flagrix scanner",
   "license": "MIT",
   "type": "module",
@@ -51,7 +51,7 @@
     "zod": "^3.24.0"
   },
   "devDependencies": {
-    "@flagrix/scanner-core": "github:flagrix-io/flagrix-scanner-core",
+    "@flagrix/scanner-core": "^0.1.2",
     "@types/node": "^20.0.0",
     "tsup": "^8.0.0",
     "typescript": "^5.0.0",