herozion 1.0.96 → 1.0.102

package/install.js

@@ -9,6 +9,14 @@
  * alongside this package.  Running `npx herozion scan .` or adding herozion
  * as a dev-dependency keeps the scope limited to the project.
  *
+ * Security model (supply-chain integrity)
+ * ----------------------------------------
+ * 1. PRIMARY trust anchor: bin/checksums.json bundled inside this npm package.
+ *    These hashes are embedded at `npm publish` time and cannot be swapped by
+ *    a GitHub Releases compromise alone.
+ * 2. SECONDARY verification: <binary>.sha256 downloaded from GitHub Releases.
+ *    Both must agree; if either fails the binary is rejected.
+ *
  * Supported platforms:
  *   Windows  x64  → herozion-windows-amd64.exe
  *   Linux    x64  → herozion-linux-amd64
@@ -21,6 +29,7 @@
 const https = require("https");
 const fs = require("fs");
 const path = require("path");
+const crypto = require("crypto");
 const { execSync } = require("child_process");
 
 const VERSION = require("./package.json").version;
@@ -71,9 +80,38 @@ function download(url, destPath, redirectCount = 0) {
 
 // ── Main ──────────────────────────────────────────────────────────────────────
 
+/** Download text content (for checksum files). Returns full body as a string. */
+function downloadText(url, redirectCount = 0) {
+  return new Promise((resolve, reject) => {
+    if (redirectCount > 5) return reject(new Error("Too many redirects"));
+    https.get(url, { headers: { "User-Agent": "herozion-npm-installer" } }, (res) => {
+      if (res.statusCode === 301 || res.statusCode === 302) {
+        return resolve(downloadText(res.headers.location, redirectCount + 1));
+      }
+      if (res.statusCode !== 200) {
+        return reject(new Error(`HTTP ${res.statusCode} — failed to download ${url}`));
+      }
+      let data = "";
+      res.on("data", (chunk) => { data += chunk; });
+      res.on("end", () => resolve(data));
+      res.on("error", reject);
+    }).on("error", reject);
+  });
+}
+
+/** Return the lowercase hex SHA-256 digest of a local file. */
+function sha256File(filePath) {
+  const hash = crypto.createHash("sha256");
+  hash.update(fs.readFileSync(filePath));
+  return hash.digest("hex");
+}
+
+
+
 async function main() {
   const binaryName = getBinaryName();
   const url = `${BASE_URL}/${binaryName}`;
+  const checksumUrl = `${BASE_URL}/${binaryName}.sha256`;
 
   // Store the binary inside this package directory (node_modules/herozion/)
   const binDir = path.join(__dirname, "bin");
@@ -82,6 +120,7 @@ async function main() {
   const isWindows = process.platform === "win32";
   const destName = isWindows ? "herozion.exe" : "herozion";
   const destPath = path.join(binDir, destName);
+  const tmpPath = destPath + ".tmp";
 
   // Skip download if binary already exists and matches version
   const markerPath = path.join(binDir, `.version-${VERSION}`);
@@ -90,16 +129,69 @@ async function main() {
     return;
   }
 
+  // ── Load bundled checksums (primary trust anchor) ─────────────────────────
+  const bundledChecksumsPath = path.join(__dirname, "bin", "checksums.json");
+  let bundledHash = "";
+  try {
+    const bundled = JSON.parse(fs.readFileSync(bundledChecksumsPath, "utf8"));
+    bundledHash = (bundled[binaryName] || "").toLowerCase().trim();
+  } catch (_) {}
+
   console.log(`herozion: downloading ${binaryName} v${VERSION}...`);
   try {
-    await download(url, destPath);
+    // Download binary to a temporary path first, then verify checksum before placing
+    await download(url, tmpPath);
+
+    const actualHash = sha256File(tmpPath);
+
+    // ── Primary check: bundled checksum (trust anchor inside the npm package) ─
+    if (bundledHash) {
+      if (actualHash !== bundledHash) {
+        fs.unlinkSync(tmpPath);
+        throw new Error(
+          `Bundled checksum mismatch for ${binaryName}.\n` +
+          `  Expected (bundled) : ${bundledHash}\n` +
+          `  Got                : ${actualHash}\n` +
+          "The downloaded binary does not match the hash embedded in this npm package.\n" +
+          "This may indicate a supply-chain attack. Aborting installation."
+        );
+      }
+    }
+
+    // ── Secondary check: .sha256 from GitHub Releases ─────────────────────────
+    try {
+      const checksumData = await downloadText(checksumUrl);
+      const remoteHash = checksumData.trim().split(/\s+/)[0].toLowerCase();
+      if (remoteHash && actualHash !== remoteHash) {
+        fs.unlinkSync(tmpPath);
+        throw new Error(
+          `Remote checksum mismatch for ${binaryName}.\n` +
+          `  Expected (remote) : ${remoteHash}\n` +
+          `  Got               : ${actualHash}\n` +
+          "The downloaded binary does not match the GitHub Releases .sha256 file."
+        );
+      }
+    } catch (checksumErr) {
+      // If we have a valid bundled hash that already passed, remote failure is non-fatal
+      if (!bundledHash) {
+        throw checksumErr;
+      }
+      console.warn(`herozion: WARNING — could not verify remote checksum: ${checksumErr.message}`);
+      console.warn("Proceeding because bundled checksum verification passed.");
+    }
+
+    // Both checks passed — move binary into place
+    fs.renameSync(tmpPath, destPath);
     if (!isWindows) {
       fs.chmodSync(destPath, 0o755);
     }
     // Write version marker so we don't re-download on repeated installs
     fs.writeFileSync(markerPath, VERSION, "utf8");
-    console.log(`herozion: binary installed successfully.`);
+    const verifiedBy = bundledHash ? "bundled + remote SHA-256" : "remote SHA-256";
+    console.log(`herozion: binary installed successfully (verified: ${verifiedBy}).`);
   } catch (err) {
+    // Clean up temp file if it exists
+    try { fs.unlinkSync(tmpPath); } catch (_) {}
     // Non-fatal: warn and continue — the bin shim will give a clear error at runtime
     console.warn(`herozion: WARNING — could not download binary: ${err.message}`);
     console.warn("You can download it manually from:");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "herozion",
-  "version": "1.0.96",
+  "version": "1.0.102",
   "description": "Security audit and performance analysis CLI tool for developers",
   "keywords": [
     "security",