flagrix 0.1.1 → 0.1.2

package/dist/{chunk-QKP4NQM3.js → chunk-AS7DXMSG.js}

@@ -361,6 +361,91 @@ function collectEvidence(content, patterns, max = MAX_EVIDENCE_LINES) {
   return evidence;
 }
 
+// node_modules/@flagrix/scanner-core/dist/utils/mask.js
+var REGEX_ALLOWED_AFTER_CHAR = /* @__PURE__ */ new Set([..."=(:,[!&|?{};+*%^<>~"]);
+var REGEX_ALLOWED_AFTER_WORD = /* @__PURE__ */ new Set(["return", "case", "typeof", "in", "of", "do", "void", "delete"]);
+function maskRegexLiterals(content) {
+  return content.split("\n").map(maskLine).join("\n");
+}
+function maskLine(line) {
+  let out = "";
+  let i = 0;
+  while (i < line.length) {
+    const ch = line[i];
+    if (ch === '"' || ch === "'" || ch === "`") {
+      const end = stringEnd(line, i);
+      out += line.slice(i, end);
+      i = end;
+      continue;
+    }
+    if (ch === "/" && line[i + 1] === "/") {
+      out += line.slice(i);
+      break;
+    }
+    if (ch === "/" && regexCanStartAfter(out)) {
+      const end = regexEnd(line, i);
+      if (end !== -1) {
+        out += " ".repeat(end - i);
+        i = end;
+        continue;
+      }
+    }
+    out += ch;
+    i++;
+  }
+  return out;
+}
+function regexCanStartAfter(before) {
+  const trimmed = before.trimEnd();
+  if (trimmed === "")
+    return true;
+  if (REGEX_ALLOWED_AFTER_CHAR.has(trimmed.slice(-1)))
+    return true;
+  const word = trimmed.match(/[A-Za-z_$][A-Za-z0-9_$]*$/)?.[0];
+  return word !== void 0 && REGEX_ALLOWED_AFTER_WORD.has(word);
+}
+function regexEnd(line, start) {
+  let i = start + 1;
+  let inClass = false;
+  let body = 0;
+  for (; i < line.length; i++) {
+    const ch = line[i];
+    if (ch === "\\") {
+      i++;
+      body++;
+      continue;
+    }
+    if (inClass) {
+      if (ch === "]")
+        inClass = false;
+    } else if (ch === "[") {
+      inClass = true;
+    } else if (ch === "/") {
+      if (body === 0)
+        return -1;
+      let end = i + 1;
+      while (end < line.length && /[a-z]/i.test(line[end]))
+        end++;
+      return end;
+    }
+    body++;
+  }
+  return -1;
+}
+function stringEnd(line, start) {
+  const quote = line[start];
+  let i = start + 1;
+  for (; i < line.length; i++) {
+    if (line[i] === "\\") {
+      i++;
+      continue;
+    }
+    if (line[i] === quote)
+      return i + 1;
+  }
+  return line.length;
+}
+
 // node_modules/@flagrix/scanner-core/dist/github/api-error.js
 async function githubApiError(response, fallback = "GitHub API error") {
   let apiMessage = "";
@@ -549,8 +634,9 @@ async function scanGitHubRepo(repo, options) {
         continue;
       const fileData = await contentResponse.json();
       const content = atob(fileData.content || "");
+      const matchable = /\.(?:js|ts)$/.test(file.path) ? maskRegexLiterals(content) : content;
       if (SCANNABLE_EXTENSIONS.some((ext) => file.path.endsWith(ext))) {
-        fileContents.push({ path: file.path, content });
+        fileContents.push({ path: file.path, content: matchable });
       }
       if (file.path.endsWith("package.json")) {
         const pkgFindings = await scanPackageJson(content, maliciousPackages, file.path);
@@ -567,10 +653,10 @@ async function scanGitHubRepo(repo, options) {
         patternsMatched += pyFindings.length;
       }
       if (SCANNABLE_EXTENSIONS.some((ext) => file.path.endsWith(ext))) {
-        const yaraFindings = applyYaraRules(content, yaraRules, file.path);
+        const yaraFindings = applyYaraRules(matchable, yaraRules, file.path);
         findings.push(...yaraFindings);
         patternsMatched += yaraFindings.length;
-        const obfuscationFindings = detectObfuscation(content, file.path, loadedRuleIds);
+        const obfuscationFindings = detectObfuscation(matchable, file.path, loadedRuleIds);
         findings.push(...obfuscationFindings);
         patternsMatched += obfuscationFindings.length;
       }
@@ -612,7 +698,8 @@ async function scanGitHubRepo(repo, options) {
         patternsMatched += supplyChainFindings.length;
       }
     }
-    const integrityFindings = await detectCodeIntegrityIssues(fileContents, repo);
+    const allPaths = tree.tree.filter((i) => i.type === "blob").map((i) => i.path);
+    const integrityFindings = await detectCodeIntegrityIssues(fileContents, allPaths, repo);
     findings.push(...integrityFindings);
     patternsMatched += integrityFindings.length;
     const riskScore = calculateRiskScore(findings);
@@ -1284,7 +1371,7 @@ function detectSuspiciousFileAccess(content, filePath, coveredRuleIds = /* @__PU
   }
   return findings;
 }
-async function detectCodeIntegrityIssues(files, _repo) {
+async function detectCodeIntegrityIssues(files, allPaths, _repo) {
   const findings = [];
   for (const file of files) {
     if (file.path.endsWith(".min.js") || file.path.endsWith(".min.css"))
@@ -1306,8 +1393,9 @@ async function detectCodeIntegrityIssues(files, _repo) {
       }
     }
   }
-  const hasLicense = files.some((f) => /^LICENSE|^COPYING/i.test(f.path));
-  if (!hasLicense && files.length > 5) {
+  const basename = (p) => p.split("/").pop() ?? p;
+  const hasLicense = allPaths.some((p) => /^(LICENSE|COPYING)/i.test(basename(p)));
+  if (!hasLicense && allPaths.length > 5) {
     findings.push({
       severity: "low",
       type: "CODE_INTEGRITY_ISSUE",
@@ -1315,8 +1403,8 @@ async function detectCodeIntegrityIssues(files, _repo) {
       codeExplanation: "\u{1F4C4} Missing license file. Legitimate open-source projects typically include a license. Absence may indicate a quickly assembled malicious repository."
     });
   }
-  const hasReadme = files.some((f) => /^README/i.test(f.path));
-  if (!hasReadme && files.length > 5) {
+  const hasReadme = allPaths.some((p) => /^README/i.test(basename(p)));
+  if (!hasReadme && allPaths.length > 5) {
     findings.push({
       severity: "low",
       type: "CODE_INTEGRITY_ISSUE",

package/dist/cli.js

@@ -11,7 +11,7 @@ import {
   scanGitHubRepo,
   scanGitHubUser,
   wantJson
-} from "./chunk-QKP4NQM3.js";
+} from "./chunk-AS7DXMSG.js";
 
 // src/cli.ts
 import { parseArgs } from "util";
@@ -132,7 +132,7 @@ async function main() {
       }
       return runScanUser(target, { json: values.json, token: values.token });
     case "mcp": {
-      const { runMcp } = await import("./mcp-B4RQXV5T.js");
+      const { runMcp } = await import("./mcp-LS7GRB2C.js");
       return runMcp();
     }
     default:

package/dist/{mcp-B4RQXV5T.js → mcp-LS7GRB2C.js}

@@ -7,7 +7,7 @@ import {
   scanGitHubRepo,
   scanGitHubUser,
   securityScore
-} from "./chunk-QKP4NQM3.js";
+} from "./chunk-AS7DXMSG.js";
 
 // src/commands/mcp.ts
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flagrix",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Scan GitHub repos and profiles for malware before you clone — CLI and MCP server for the Flagrix scanner",
   "license": "MIT",
   "type": "module",
@@ -51,7 +51,7 @@
     "zod": "^3.24.0"
   },
   "devDependencies": {
-    "@flagrix/scanner-core": "^0.1.0",
+    "@flagrix/scanner-core": "^0.1.2",
     "@types/node": "^20.0.0",
     "tsup": "^8.0.0",
     "typescript": "^5.0.0",