kirograph 0.17.0 → 0.20.0

package/dist/security/data-flows.js

@@ -0,0 +1,286 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var data_flows_exports = {};
+__export(data_flows_exports, {
+  DataFlowAnalyzer: () => DataFlowAnalyzer
+});
+module.exports = __toCommonJS(data_flows_exports);
+function hasPatternsData(rawDb) {
+  try {
+    const result = rawDb.get("SELECT COUNT(*) as cnt FROM pattern_matches");
+    return (result?.cnt ?? 0) > 0;
+  } catch {
+    return false;
+  }
+}
+class DataFlowAnalyzer {
+  constructor(db) {
+    this.db = db;
+  }
+  async analyze() {
+    const rawDb = this.db.getRawDb();
+    const sqlFindings = [
+      ...this._detectDangerousEval(rawDb),
+      ...this._detectUnsafeDeserialize(rawDb),
+      ...this._detectHardcodedCrypto(rawDb),
+      ...this._detectSqlInjection(rawDb),
+      ...this._detectPathTraversal(rawDb)
+    ];
+    if (hasPatternsData(rawDb)) {
+      const astFindings = this.analyzeFromPatternMatches(rawDb);
+      const astKeys = new Set(astFindings.map((f) => `${f.filePath}:${f.line}`));
+      const filteredSql = sqlFindings.filter((f) => !astKeys.has(`${f.filePath}:${f.line}`));
+      return [...astFindings, ...filteredSql];
+    }
+    return sqlFindings;
+  }
+  analyzeFromPatternMatches(rawDb) {
+    const rows = rawDb.all("SELECT file_path, pattern_id, line, col, match_text, severity, owasp_category, language FROM pattern_matches");
+    return rows.map((row) => {
+      const type = this._patternIdToType(row.pattern_id);
+      const symbol = this._findEnclosingSymbol(rawDb, row.file_path, row.line);
+      return {
+        type,
+        severity: row.severity,
+        owaspCategory: row.owasp_category,
+        filePath: row.file_path,
+        line: row.line,
+        symbol: symbol ?? row.pattern_id,
+        description: `[AST pattern: ${row.pattern_id}] ${row.match_text.slice(0, 100)}`,
+        recommendation: this._getRecommendation(type)
+      };
+    });
+  }
+  _patternIdToType(patternId) {
+    if (patternId.startsWith("sql-injection")) return "sql-injection";
+    if (patternId.startsWith("dangerous-eval") || patternId.startsWith("dangerous-exec")) return "dangerous-eval";
+    if (patternId.startsWith("path-traversal")) return "path-traversal";
+    if (patternId.startsWith("prototype-pollution")) return "unsafe-deserialize";
+    if (patternId.startsWith("weak-crypto")) return "hardcoded-crypto";
+    return "dangerous-eval";
+  }
+  _findEnclosingSymbol(rawDb, filePath, line) {
+    const row = rawDb.get(
+      `SELECT name FROM nodes WHERE file_path = ? AND start_line <= ? AND end_line >= ? AND kind IN ('function', 'method', 'class') ORDER BY (end_line - start_line) ASC LIMIT 1`,
+      [filePath, line, line]
+    );
+    return row?.name ?? null;
+  }
+  _getRecommendation(type) {
+    const recs = {
+      "sql-injection": "Use parameterized queries. Never concatenate user input into SQL strings.",
+      "dangerous-eval": "Remove eval()/exec(). Use structured alternatives.",
+      "path-traversal": "Use path.resolve() and verify result is within an allowed base directory.",
+      "unsafe-deserialize": "Validate object keys before merge. Avoid untrusted deserialization.",
+      "hardcoded-crypto": "Use SHA-256+ for hashing. Use bcrypt/argon2 for passwords.",
+      "xss": "Sanitize output. Use a trusted template engine with auto-escaping."
+    };
+    return recs[type] ?? "Review and fix this security issue.";
+  }
+  // ── Detection: dangerous eval / exec ────────────────────────────────────────
+  _detectDangerousEval(rawDb) {
+    const rows = rawDb.all(`
+      SELECT n.name as caller, n.file_path, n.start_line, n2.name as callee
+      FROM edges e
+      JOIN nodes n  ON n.id  = e.source
+      JOIN nodes n2 ON n2.id = e.target
+      WHERE e.kind = 'calls'
+        AND n2.name IN ('eval', 'Function', 'execSync', 'exec', 'spawn', 'spawnSync', 'execFileSync', 'execFile')
+        AND n.file_path != ''
+    `);
+    return rows.map((row) => ({
+      type: "dangerous-eval",
+      severity: "critical",
+      owaspCategory: "A03",
+      filePath: row.file_path,
+      line: row.start_line,
+      symbol: row.caller,
+      description: `Function '${row.caller}' calls '${row.callee}', which can execute arbitrary code or OS commands.`,
+      recommendation: `Avoid '${row.callee}'. Use structured APIs or allowlists for dynamic execution. Validate and sanitize all inputs.`
+    }));
+  }
+  // ── Detection: unsafe deserialization ────────────────────────────────────────
+  _detectUnsafeDeserialize(rawDb) {
+    const rows = rawDb.all(`
+      SELECT n.name as caller, n.file_path, n.start_line, n2.name as callee
+      FROM edges e
+      JOIN nodes n  ON n.id  = e.source
+      JOIN nodes n2 ON n2.id = e.target
+      WHERE e.kind = 'calls'
+        AND (
+          n2.name IN ('unserialize', 'deserialize', 'fromJson', 'loads')
+          OR n2.name LIKE '%pickle%'
+          OR n2.name LIKE '%marshal%'
+          OR n2.name = 'yaml.load'
+        )
+        AND n.file_path != ''
+    `);
+    return rows.map((row) => ({
+      type: "unsafe-deserialize",
+      severity: "high",
+      owaspCategory: "A08",
+      filePath: row.file_path,
+      line: row.start_line,
+      symbol: row.caller,
+      description: `Function '${row.caller}' calls '${row.callee}', which may deserialize untrusted data unsafely.`,
+      recommendation: `Validate data before deserialization. Use safe alternatives (e.g. yaml.safe_load, JSON schema validation). Never deserialize data from untrusted sources.`
+    }));
+  }
+  // ── Detection: hardcoded weak crypto ─────────────────────────────────────────
+  _detectHardcodedCrypto(rawDb) {
+    const rows = rawDb.all(`
+      SELECT n.name as caller, n.file_path, n.start_line, n2.name as callee
+      FROM edges e
+      JOIN nodes n  ON n.id  = e.source
+      JOIN nodes n2 ON n2.id = e.target
+      WHERE e.kind = 'calls'
+        AND (
+          n2.name LIKE '%md5%'
+          OR n2.name LIKE '%sha1%'
+          OR n2.name LIKE '%des%'
+          OR n2.name LIKE '%rc4%'
+          OR n2.name LIKE '%blowfish%'
+        )
+        AND (
+          n.name LIKE '%crypto%'
+          OR n.name LIKE '%hash%'
+          OR n.name LIKE '%cipher%'
+          OR n.name LIKE '%encrypt%'
+          OR n.name LIKE '%digest%'
+          OR n.file_path LIKE '%crypto%'
+          OR n.file_path LIKE '%hash%'
+          OR n.file_path LIKE '%cipher%'
+          OR n.file_path LIKE '%auth%'
+        )
+        AND n.file_path != ''
+    `);
+    return rows.map((row) => ({
+      type: "hardcoded-crypto",
+      severity: "medium",
+      owaspCategory: "A02",
+      filePath: row.file_path,
+      line: row.start_line,
+      symbol: row.caller,
+      description: `Function '${row.caller}' uses weak or deprecated cryptographic algorithm '${row.callee}'.`,
+      recommendation: `Replace with a strong algorithm: SHA-256 or SHA-3 for hashing, AES-256-GCM for symmetric encryption. Avoid MD5 and SHA-1 for security purposes.`
+    }));
+  }
+  // ── Detection: SQL injection ──────────────────────────────────────────────────
+  _detectSqlInjection(rawDb) {
+    const rows = rawDb.all(`
+      SELECT n.name as caller, n.file_path, n.start_line, n2.name as callee
+      FROM edges e
+      JOIN nodes n  ON n.id  = e.source
+      JOIN nodes n2 ON n2.id = e.target
+      WHERE e.kind = 'calls'
+        AND n2.name IN ('query', 'execute', 'exec', 'raw', 'runQuery', 'executeQuery', 'runSql', 'executeSql')
+        AND (
+          n.name LIKE '%handle%'
+          OR n.name LIKE '%controller%'
+          OR n.name LIKE '%route%'
+          OR n.name LIKE '%request%'
+          OR n.name LIKE '%req%'
+          OR n.name LIKE '%endpoint%'
+          OR n.name LIKE '%action%'
+          OR n.name LIKE '%handler%'
+        )
+        AND n.file_path != ''
+    `);
+    const sanitizeCallers = new Set(
+      rawDb.all(`
+        SELECT DISTINCT n.id
+        FROM edges e
+        JOIN nodes n  ON n.id  = e.source
+        JOIN nodes n2 ON n2.id = e.target
+        WHERE e.kind = 'calls'
+          AND (
+            n2.name LIKE '%sanitize%'
+            OR n2.name LIKE '%escape%'
+            OR n2.name LIKE '%parameteriz%'
+            OR n2.name LIKE '%prepared%'
+            OR n2.name LIKE '%placeholder%'
+          )
+      `).map((r) => r.id)
+    );
+    const callerIds = new Map(
+      rawDb.all(`
+        SELECT id, name FROM nodes WHERE kind IN ('function', 'method', 'arrow_function')
+      `).map((r) => [r.name, r.id])
+    );
+    return rows.filter((row) => {
+      const callerId = callerIds.get(row.caller);
+      return !callerId || !sanitizeCallers.has(callerId);
+    }).map((row) => ({
+      type: "sql-injection",
+      severity: "critical",
+      owaspCategory: "A03",
+      filePath: row.file_path,
+      line: row.start_line,
+      symbol: row.caller,
+      description: `Controller/handler '${row.caller}' calls database function '${row.callee}' without apparent input sanitization.`,
+      recommendation: `Use parameterized queries or prepared statements. Never concatenate user input into SQL strings. Consider an ORM with query builders.`
+    }));
+  }
+  // ── Detection: path traversal ─────────────────────────────────────────────────
+  _detectPathTraversal(rawDb) {
+    const rows = rawDb.all(`
+      SELECT n.name as caller, n.file_path, n.start_line, n2.name as callee
+      FROM edges e
+      JOIN nodes n  ON n.id  = e.source
+      JOIN nodes n2 ON n2.id = e.target
+      WHERE e.kind = 'calls'
+        AND n2.name IN ('readFile', 'readFileSync', 'writeFile', 'writeFileSync', 'createReadStream', 'createWriteStream', 'openSync', 'unlink', 'unlinkSync')
+        AND (
+          n.name LIKE '%controller%'
+          OR n.name LIKE '%route%'
+          OR n.name LIKE '%request%'
+          OR n.name LIKE '%download%'
+          OR n.name LIKE '%upload%'
+          OR n.name LIKE '%get%file%'
+          OR n.name LIKE '%fetch%file%'
+          OR n.name LIKE '%serve%file%'
+          OR n.name LIKE '%handle%file%'
+        )
+        AND n.file_path != ''
+        AND n.file_path NOT LIKE '%/mcp/%'
+        AND n.file_path NOT LIKE '%/resolution/%'
+        AND n.file_path NOT LIKE '%/security/%'
+        AND n.file_path NOT LIKE '%/extraction/%'
+        AND n.file_path NOT LIKE '%/graph/%'
+        AND n.file_path NOT LIKE '%/architecture/%'
+        AND n.file_path NOT LIKE '%/frameworks/%'
+        AND n.file_path NOT LIKE '%/bridges/%'
+    `);
+    return rows.map((row) => ({
+      type: "path-traversal",
+      severity: "high",
+      owaspCategory: "A01",
+      filePath: row.file_path,
+      line: row.start_line,
+      symbol: row.caller,
+      description: `Handler '${row.caller}' calls file operation '${row.callee}'. Path may be influenced by user input, enabling directory traversal.`,
+      recommendation: `Validate and normalize file paths. Use path.resolve() and verify the result is inside an allowed base directory. Reject paths containing '..'.`
+    }));
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  DataFlowAnalyzer
+});
+//# sourceMappingURL=data-flows.js.map

package/dist/security/data-flows.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/security/data-flows.ts"],
+  "sourcesContent": ["/**\n * KiroGraph SAST-lite: Dangerous Data Flow Detection\n *\n * Detects dangerous patterns by analysing call edges in the graph database.\n * Uses symbol names and callee chains rather than full AST traversal.\n */\n\nimport type { GraphDatabase } from '../db/database';\nimport type { OwaspCategory } from './owasp';\n\n// \u2500\u2500 Types \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nexport interface DataFlowFinding {\n  type: 'sql-injection' | 'path-traversal' | 'xss' | 'dangerous-eval' | 'unsafe-deserialize' | 'hardcoded-crypto';\n  severity: 'critical' | 'high' | 'medium';\n  owaspCategory: OwaspCategory;\n  filePath: string;\n  line: number;\n  symbol: string;\n  description: string;\n  recommendation: string;\n}\n\n// \u2500\u2500 Internal row type returned by the DB queries \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\ninterface CallEdgeRow {\n  caller: string;\n  file_path: string;\n  start_line: number;\n  callee: string;\n}\n\n// \u2500\u2500 hasPatternsData helper \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nfunction hasPatternsData(rawDb: any): boolean {\n  try {\n    const result = rawDb.get(\"SELECT COUNT(*) as cnt FROM pattern_matches\") as { cnt: number } | undefined;\n    return (result?.cnt ?? 0) > 0;\n  } catch {\n    // Table doesn't exist (enablePatterns never ran)\n    return false;\n  }\n}\n\n// \u2500\u2500 DataFlowAnalyzer \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nexport class DataFlowAnalyzer {\n  constructor(private readonly db: GraphDatabase) {}\n\n  async analyze(): Promise<DataFlowFinding[]> {\n    const rawDb = (this.db as any).getRawDb();\n\n    // Always run existing SQL heuristics (unchanged behavior)\n    const sqlFindings = [\n      ...this._detectDangerousEval(rawDb),\n      ...this._detectUnsafeDeserialize(rawDb),\n      ...this._detectHardcodedCrypto(rawDb),\n      ...this._detectSqlInjection(rawDb),\n      ...this._detectPathTraversal(rawDb),\n    ];\n\n    // When pattern_matches has data, merge AST findings (more precise)\n    if (hasPatternsData(rawDb)) {\n      const astFindings = this.analyzeFromPatternMatches(rawDb);\n      // Deduplicate: AST entry wins over SQL entry at same (filePath, line)\n      const astKeys = new Set(astFindings.map(f => `${f.filePath}:${f.line}`));\n      const filteredSql = sqlFindings.filter(f => !astKeys.has(`${f.filePath}:${f.line}`));\n      return [...astFindings, ...filteredSql];\n    }\n\n    return sqlFindings;\n  }\n\n  private analyzeFromPatternMatches(rawDb: any): DataFlowFinding[] {\n    const rows: Array<{\n      file_path: string;\n      pattern_id: string;\n      line: number;\n      col: number;\n      match_text: string;\n      severity: string;\n      owasp_category: string;\n      language: string;\n    }> = rawDb.all('SELECT file_path, pattern_id, line, col, match_text, severity, owasp_category, language FROM pattern_matches');\n\n    return rows.map(row => {\n      // Map pattern_id prefix to DataFlowFinding type\n      const type = this._patternIdToType(row.pattern_id);\n      // Look up nearest enclosing symbol\n      const symbol = this._findEnclosingSymbol(rawDb, row.file_path, row.line);\n      return {\n        type,\n        severity: row.severity as DataFlowFinding['severity'],\n        owaspCategory: row.owasp_category as DataFlowFinding['owaspCategory'],\n        filePath: row.file_path,\n        line: row.line,\n        symbol: symbol ?? row.pattern_id,\n        description: `[AST pattern: ${row.pattern_id}] ${row.match_text.slice(0, 100)}`,\n        recommendation: this._getRecommendation(type),\n      };\n    });\n  }\n\n  private _patternIdToType(patternId: string): DataFlowFinding['type'] {\n    if (patternId.startsWith('sql-injection')) return 'sql-injection';\n    if (patternId.startsWith('dangerous-eval') || patternId.startsWith('dangerous-exec')) return 'dangerous-eval';\n    if (patternId.startsWith('path-traversal')) return 'path-traversal';\n    if (patternId.startsWith('prototype-pollution')) return 'unsafe-deserialize';\n    if (patternId.startsWith('weak-crypto')) return 'hardcoded-crypto';\n    return 'dangerous-eval'; // fallback\n  }\n\n  private _findEnclosingSymbol(rawDb: any, filePath: string, line: number): string | null {\n    const row = rawDb.get(\n      `SELECT name FROM nodes WHERE file_path = ? AND start_line <= ? AND end_line >= ? AND kind IN ('function', 'method', 'class') ORDER BY (end_line - start_line) ASC LIMIT 1`,\n      [filePath, line, line]\n    ) as { name: string } | undefined;\n    return row?.name ?? null;\n  }\n\n  private _getRecommendation(type: DataFlowFinding['type']): string {\n    const recs: Record<DataFlowFinding['type'], string> = {\n      'sql-injection': 'Use parameterized queries. Never concatenate user input into SQL strings.',\n      'dangerous-eval': 'Remove eval()/exec(). Use structured alternatives.',\n      'path-traversal': 'Use path.resolve() and verify result is within an allowed base directory.',\n      'unsafe-deserialize': 'Validate object keys before merge. Avoid untrusted deserialization.',\n      'hardcoded-crypto': 'Use SHA-256+ for hashing. Use bcrypt/argon2 for passwords.',\n      'xss': 'Sanitize output. Use a trusted template engine with auto-escaping.',\n    };\n    return recs[type] ?? 'Review and fix this security issue.';\n  }\n\n  // \u2500\u2500 Detection: dangerous eval / exec \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n  private _detectDangerousEval(rawDb: any): DataFlowFinding[] {\n    const rows: CallEdgeRow[] = rawDb.all(`\n      SELECT n.name as caller, n.file_path, n.start_line, n2.name as callee\n      FROM edges e\n      JOIN nodes n  ON n.id  = e.source\n      JOIN nodes n2 ON n2.id = e.target\n      WHERE e.kind = 'calls'\n        AND n2.name IN ('eval', 'Function', 'execSync', 'exec', 'spawn', 'spawnSync', 'execFileSync', 'execFile')\n        AND n.file_path != ''\n    `);\n\n    return rows.map((row) => ({\n      type: 'dangerous-eval' as const,\n      severity: 'critical' as const,\n      owaspCategory: 'A03' as const,\n      filePath: row.file_path,\n      line: row.start_line,\n      symbol: row.caller,\n      description: `Function '${row.caller}' calls '${row.callee}', which can execute arbitrary code or OS commands.`,\n      recommendation: `Avoid '${row.callee}'. Use structured APIs or allowlists for dynamic execution. Validate and sanitize all inputs.`,\n    }));\n  }\n\n  // \u2500\u2500 Detection: unsafe deserialization \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n  private _detectUnsafeDeserialize(rawDb: any): DataFlowFinding[] {\n    const rows: CallEdgeRow[] = rawDb.all(`\n      SELECT n.name as caller, n.file_path, n.start_line, n2.name as callee\n      FROM edges e\n      JOIN nodes n  ON n.id  = e.source\n      JOIN nodes n2 ON n2.id = e.target\n      WHERE e.kind = 'calls'\n        AND (\n          n2.name IN ('unserialize', 'deserialize', 'fromJson', 'loads')\n          OR n2.name LIKE '%pickle%'\n          OR n2.name LIKE '%marshal%'\n          OR n2.name = 'yaml.load'\n        )\n        AND n.file_path != ''\n    `);\n\n    return rows.map((row) => ({\n      type: 'unsafe-deserialize' as const,\n      severity: 'high' as const,\n      owaspCategory: 'A08' as const,\n      filePath: row.file_path,\n      line: row.start_line,\n      symbol: row.caller,\n      description: `Function '${row.caller}' calls '${row.callee}', which may deserialize untrusted data unsafely.`,\n      recommendation: `Validate data before deserialization. Use safe alternatives (e.g. yaml.safe_load, JSON schema validation). Never deserialize data from untrusted sources.`,\n    }));\n  }\n\n  // \u2500\u2500 Detection: hardcoded weak crypto \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n  private _detectHardcodedCrypto(rawDb: any): DataFlowFinding[] {\n    const rows: CallEdgeRow[] = rawDb.all(`\n      SELECT n.name as caller, n.file_path, n.start_line, n2.name as callee\n      FROM edges e\n      JOIN nodes n  ON n.id  = e.source\n      JOIN nodes n2 ON n2.id = e.target\n      WHERE e.kind = 'calls'\n        AND (\n          n2.name LIKE '%md5%'\n          OR n2.name LIKE '%sha1%'\n          OR n2.name LIKE '%des%'\n          OR n2.name LIKE '%rc4%'\n          OR n2.name LIKE '%blowfish%'\n        )\n        AND (\n          n.name LIKE '%crypto%'\n          OR n.name LIKE '%hash%'\n          OR n.name LIKE '%cipher%'\n          OR n.name LIKE '%encrypt%'\n          OR n.name LIKE '%digest%'\n          OR n.file_path LIKE '%crypto%'\n          OR n.file_path LIKE '%hash%'\n          OR n.file_path LIKE '%cipher%'\n          OR n.file_path LIKE '%auth%'\n        )\n        AND n.file_path != ''\n    `);\n\n    return rows.map((row) => ({\n      type: 'hardcoded-crypto' as const,\n      severity: 'medium' as const,\n      owaspCategory: 'A02' as const,\n      filePath: row.file_path,\n      line: row.start_line,\n      symbol: row.caller,\n      description: `Function '${row.caller}' uses weak or deprecated cryptographic algorithm '${row.callee}'.`,\n      recommendation: `Replace with a strong algorithm: SHA-256 or SHA-3 for hashing, AES-256-GCM for symmetric encryption. Avoid MD5 and SHA-1 for security purposes.`,\n    }));\n  }\n\n  // \u2500\u2500 Detection: SQL injection \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n  private _detectSqlInjection(rawDb: any): DataFlowFinding[] {\n    // Find functions that:\n    //  (a) call a known DB query function\n    //  (b) AND whose name suggests user-input handling (controller/route/request context)\n    const rows: CallEdgeRow[] = rawDb.all(`\n      SELECT n.name as caller, n.file_path, n.start_line, n2.name as callee\n      FROM edges e\n      JOIN nodes n  ON n.id  = e.source\n      JOIN nodes n2 ON n2.id = e.target\n      WHERE e.kind = 'calls'\n        AND n2.name IN ('query', 'execute', 'exec', 'raw', 'runQuery', 'executeQuery', 'runSql', 'executeSql')\n        AND (\n          n.name LIKE '%handle%'\n          OR n.name LIKE '%controller%'\n          OR n.name LIKE '%route%'\n          OR n.name LIKE '%request%'\n          OR n.name LIKE '%req%'\n          OR n.name LIKE '%endpoint%'\n          OR n.name LIKE '%action%'\n          OR n.name LIKE '%handler%'\n        )\n        AND n.file_path != ''\n    `);\n\n    // Only report entries that do NOT also have a sanitize/escape call in the same scope\n    const sanitizeCallers: Set<string> = new Set<string>(\n      (rawDb.all(`\n        SELECT DISTINCT n.id\n        FROM edges e\n        JOIN nodes n  ON n.id  = e.source\n        JOIN nodes n2 ON n2.id = e.target\n        WHERE e.kind = 'calls'\n          AND (\n            n2.name LIKE '%sanitize%'\n            OR n2.name LIKE '%escape%'\n            OR n2.name LIKE '%parameteriz%'\n            OR n2.name LIKE '%prepared%'\n            OR n2.name LIKE '%placeholder%'\n          )\n      `) as Array<{ id: string }>).map((r) => r.id),\n    );\n\n    // Cross-reference: look up caller node IDs to filter sanitized callers\n    const callerIds: Map<string, string> = new Map(\n      (rawDb.all(`\n        SELECT id, name FROM nodes WHERE kind IN ('function', 'method', 'arrow_function')\n      `) as Array<{ id: string; name: string }>).map((r) => [r.name, r.id]),\n    );\n\n    return rows\n      .filter((row) => {\n        const callerId = callerIds.get(row.caller);\n        return !callerId || !sanitizeCallers.has(callerId);\n      })\n      .map((row) => ({\n        type: 'sql-injection' as const,\n        severity: 'critical' as const,\n        owaspCategory: 'A03' as const,\n        filePath: row.file_path,\n        line: row.start_line,\n        symbol: row.caller,\n        description: `Controller/handler '${row.caller}' calls database function '${row.callee}' without apparent input sanitization.`,\n        recommendation: `Use parameterized queries or prepared statements. Never concatenate user input into SQL strings. Consider an ORM with query builders.`,\n      }));\n  }\n\n  // \u2500\u2500 Detection: path traversal \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n  private _detectPathTraversal(rawDb: any): DataFlowFinding[] {\n    // Find functions that call file I/O operations and look like they handle requests.\n    // Exclusions:\n    //   - Internal analysis/infrastructure paths (mcp, resolution, security, extraction, graph, architecture)\n    //   - 'open' is excluded from file ops because KiroGraph.open() (DB) triggers false positives\n    //   - Class names ending in 'Handler' or 'Server' are excluded (too broad \u2014 use more specific patterns)\n    const rows: CallEdgeRow[] = rawDb.all(`\n      SELECT n.name as caller, n.file_path, n.start_line, n2.name as callee\n      FROM edges e\n      JOIN nodes n  ON n.id  = e.source\n      JOIN nodes n2 ON n2.id = e.target\n      WHERE e.kind = 'calls'\n        AND n2.name IN ('readFile', 'readFileSync', 'writeFile', 'writeFileSync', 'createReadStream', 'createWriteStream', 'openSync', 'unlink', 'unlinkSync')\n        AND (\n          n.name LIKE '%controller%'\n          OR n.name LIKE '%route%'\n          OR n.name LIKE '%request%'\n          OR n.name LIKE '%download%'\n          OR n.name LIKE '%upload%'\n          OR n.name LIKE '%get%file%'\n          OR n.name LIKE '%fetch%file%'\n          OR n.name LIKE '%serve%file%'\n          OR n.name LIKE '%handle%file%'\n        )\n        AND n.file_path != ''\n        AND n.file_path NOT LIKE '%/mcp/%'\n        AND n.file_path NOT LIKE '%/resolution/%'\n        AND n.file_path NOT LIKE '%/security/%'\n        AND n.file_path NOT LIKE '%/extraction/%'\n        AND n.file_path NOT LIKE '%/graph/%'\n        AND n.file_path NOT LIKE '%/architecture/%'\n        AND n.file_path NOT LIKE '%/frameworks/%'\n        AND n.file_path NOT LIKE '%/bridges/%'\n    `);\n\n    return rows.map((row) => ({\n      type: 'path-traversal' as const,\n      severity: 'high' as const,\n      owaspCategory: 'A01' as const,\n      filePath: row.file_path,\n      line: row.start_line,\n      symbol: row.caller,\n      description: `Handler '${row.caller}' calls file operation '${row.callee}'. Path may be influenced by user input, enabling directory traversal.`,\n      recommendation: `Validate and normalize file paths. Use path.resolve() and verify the result is inside an allowed base directory. Reject paths containing '..'.`,\n    }));\n  }\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAkCA,SAAS,gBAAgB,OAAqB;AAC5C,MAAI;AACF,UAAM,SAAS,MAAM,IAAI,6CAA6C;AACtE,YAAQ,QAAQ,OAAO,KAAK;AAAA,EAC9B,QAAQ;AAEN,WAAO;AAAA,EACT;AACF;AAIO,MAAM,iBAAiB;AAAA,EAC5B,YAA6B,IAAmB;AAAnB;AAAA,EAAoB;AAAA,EAEjD,MAAM,UAAsC;AAC1C,UAAM,QAAS,KAAK,GAAW,SAAS;AAGxC,UAAM,cAAc;AAAA,MAClB,GAAG,KAAK,qBAAqB,KAAK;AAAA,MAClC,GAAG,KAAK,yBAAyB,KAAK;AAAA,MACtC,GAAG,KAAK,uBAAuB,KAAK;AAAA,MACpC,GAAG,KAAK,oBAAoB,KAAK;AAAA,MACjC,GAAG,KAAK,qBAAqB,KAAK;AAAA,IACpC;AAGA,QAAI,gBAAgB,KAAK,GAAG;AAC1B,YAAM,cAAc,KAAK,0BAA0B,KAAK;AAExD,YAAM,UAAU,IAAI,IAAI,YAAY,IAAI,OAAK,GAAG,EAAE,QAAQ,IAAI,EAAE,IAAI,EAAE,CAAC;AACvE,YAAM,cAAc,YAAY,OAAO,OAAK,CAAC,QAAQ,IAAI,GAAG,EAAE,QAAQ,IAAI,EAAE,IAAI,EAAE,CAAC;AACnF,aAAO,CAAC,GAAG,aAAa,GAAG,WAAW;AAAA,IACxC;AAEA,WAAO;AAAA,EACT;AAAA,EAEQ,0BAA0B,OAA+B;AAC/D,UAAM,OASD,MAAM,IAAI,8GAA8G;AAE7H,WAAO,KAAK,IAAI,SAAO;AAErB,YAAM,OAAO,KAAK,iBAAiB,IAAI,UAAU;AAEjD,YAAM,SAAS,KAAK,qBAAqB,OAAO,IAAI,WAAW,IAAI,IAAI;AACvE,aAAO;AAAA,QACL;AAAA,QACA,UAAU,IAAI;AAAA,QACd,eAAe,IAAI;AAAA,QACnB,UAAU,IAAI;AAAA,QACd,MAAM,IAAI;AAAA,QACV,QAAQ,UAAU,IAAI;AAAA,QACtB,aAAa,iBAAiB,IAAI,UAAU,KAAK,IAAI,WAAW,MAAM,GAAG,GAAG,CAAC;AAAA,QAC7E,gBAAgB,KAAK,mBAAmB,IAAI;AAAA,MAC9C;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEQ,iBAAiB,WAA4C;AACnE,QAAI,UAAU,WAAW,eAAe,EAAG,QAAO;AAClD,QAAI,UAAU,WAAW,gBAAgB,KAAK,UAAU,WAAW,gBAAgB,EAAG,QAAO;AAC7F,QAAI,UAAU,WAAW,gBAAgB,EAAG,QAAO;AACnD,QAAI,UAAU,WAAW,qBAAqB,EAAG,QAAO;AACxD,QAAI,UAAU,WAAW,aAAa,EAAG,QAAO;AAChD,WAAO;AAAA,EACT;AAAA,EAEQ,qBAAqB,OAAY,UAAkB,MAA6B;AACtF,UAAM,MAAM,MAAM;AAAA,MAChB;AAAA,MACA,CAAC,UAAU,MAAM,IAAI;AAAA,IACvB;AACA,WAAO,KAAK,QAAQ;AAAA,EACtB;AAAA,EAEQ,mBAAmB,MAAuC;AAChE,UAAM,OAAgD;AAAA,MACpD,iBAAiB;AAAA,MACjB,kBAAkB;AAAA,MAClB,kBAAkB;AAAA,MAClB,sBAAsB;AAAA,MACtB,oBAAoB;AAAA,MACpB,OAAO;AAAA,IACT;AACA,WAAO,KAAK,IAAI,KAAK;AAAA,EACvB;AAAA;AAAA,EAIQ,qBAAqB,OAA+B;AAC1D,UAAM,OAAsB,MAAM,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,KAQrC;AAED,WAAO,KAAK,IAAI,CAAC,SAAS;AAAA,MACxB,MAAM;AAAA,MACN,UAAU;AAAA,MACV,eAAe;AAAA,MACf,UAAU,IAAI;AAAA,MACd,MAAM,IAAI;AAAA,MACV,QAAQ,IAAI;AAAA,MACZ,aAAa,aAAa,IAAI,MAAM,YAAY,IAAI,MAAM;AAAA,MAC1D,gBAAgB,UAAU,IAAI,MAAM;AAAA,IACtC,EAAE;AAAA,EACJ;AAAA;AAAA,EAIQ,yBAAyB,OAA+B;AAC9D,UAAM,OAAsB,MAAM,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,KAarC;AAED,WAAO,KAAK,IAAI,CAAC,SAAS;AAAA,MACxB,MAAM;AAAA,MACN,UAAU;AAAA,MACV,eAAe;AAAA,MACf,UAAU,IAAI;AAAA,MACd,MAAM,IAAI;AAAA,MACV,QAAQ,IAAI;AAAA,MACZ,aAAa,aAAa,IAAI,MAAM,YAAY,IAAI,MAAM;AAAA,MAC1D,gBAAgB;AAAA,IAClB,EAAE;AAAA,EACJ;AAAA;AAAA,EAIQ,uBAAuB,OAA+B;AAC5D,UAAM,OAAsB,MAAM,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,KAyBrC;AAED,WAAO,KAAK,IAAI,CAAC,SAAS;AAAA,MACxB,MAAM;AAAA,MACN,UAAU;AAAA,MACV,eAAe;AAAA,MACf,UAAU,IAAI;AAAA,MACd,MAAM,IAAI;AAAA,MACV,QAAQ,IAAI;AAAA,MACZ,aAAa,aAAa,IAAI,MAAM,sDAAsD,IAAI,MAAM;AAAA,MACpG,gBAAgB;AAAA,IAClB,EAAE;AAAA,EACJ;AAAA;AAAA,EAIQ,oBAAoB,OAA+B;AAIzD,UAAM,OAAsB,MAAM,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,KAkBrC;AAGD,UAAM,kBAA+B,IAAI;AAAA,MACtC,MAAM,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,OAaV,EAA4B,IAAI,CAAC,MAAM,EAAE,EAAE;AAAA,IAC9C;AAGA,UAAM,YAAiC,IAAI;AAAA,MACxC,MAAM,IAAI;AAAA;AAAA,OAEV,EAA0C,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC;AAAA,IACtE;AAEA,WAAO,KACJ,OAAO,CAAC,QAAQ;AACf,YAAM,WAAW,UAAU,IAAI,IAAI,MAAM;AACzC,aAAO,CAAC,YAAY,CAAC,gBAAgB,IAAI,QAAQ;AAAA,IACnD,CAAC,EACA,IAAI,CAAC,SAAS;AAAA,MACb,MAAM;AAAA,MACN,UAAU;AAAA,MACV,eAAe;AAAA,MACf,UAAU,IAAI;AAAA,MACd,MAAM,IAAI;AAAA,MACV,QAAQ,IAAI;AAAA,MACZ,aAAa,uBAAuB,IAAI,MAAM,8BAA8B,IAAI,MAAM;AAAA,MACtF,gBAAgB;AAAA,IAClB,EAAE;AAAA,EACN;AAAA;AAAA,EAIQ,qBAAqB,OAA+B;AAM1D,UAAM,OAAsB,MAAM,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,KA2BrC;AAED,WAAO,KAAK,IAAI,CAAC,SAAS;AAAA,MACxB,MAAM;AAAA,MACN,UAAU;AAAA,MACV,eAAe;AAAA,MACf,UAAU,IAAI;AAAA,MACd,MAAM,IAAI;AAAA,MACV,QAAQ,IAAI;AAAA,MACZ,aAAa,YAAY,IAAI,MAAM,2BAA2B,IAAI,MAAM;AAAA,MACxE,gBAAgB;AAAA,IAClB,EAAE;AAAA,EACJ;AACF;",
+  "names": []
+}

package/dist/security/dep-confusion.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Dependency Confusion Checker
+ *
+ * Detects internal packages whose names exist in public registries
+ * (a supply chain attack vector), and flags typosquatting candidates.
+ */
+import type { GraphDatabase } from '../db/database';
+export interface DepConfusionFinding {
+    packageName: string;
+    ecosystem: string;
+    internalSource: string;
+    publicExists: boolean;
+    publicVersion: string | null;
+    publicPublishedAt: string | null;
+    riskLevel: 'critical' | 'high' | 'medium';
+    explanation: string;
+}
+export declare class DepConfusionChecker {
+    private readonly db;
+    constructor(db: GraphDatabase);
+    check(): Promise<DepConfusionFinding[]>;
+}
+//# sourceMappingURL=dep-confusion.d.ts.map

package/dist/security/dep-confusion.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dep-confusion.d.ts","sourceRoot":"","sources":["../../src/security/dep-confusion.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAIpD,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,OAAO,CAAC;IACtB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,SAAS,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,CAAC;IAC1C,WAAW,EAAE,MAAM,CAAC;CACrB;AAoKD,qBAAa,mBAAmB;IAClB,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAAF,EAAE,EAAE,aAAa;IAExC,KAAK,IAAI,OAAO,CAAC,mBAAmB,EAAE,CAAC;CA0G9C"}

package/dist/security/dep-confusion.js

@@ -0,0 +1,255 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var dep_confusion_exports = {};
+__export(dep_confusion_exports, {
+  DepConfusionChecker: () => DepConfusionChecker
+});
+module.exports = __toCommonJS(dep_confusion_exports);
+var import_errors = require("../errors");
+const WELL_KNOWN_NPM = [
+  "lodash",
+  "express",
+  "react",
+  "axios",
+  "webpack",
+  "babel",
+  "moment",
+  "next",
+  "vue",
+  "angular"
+];
+function levenshtein(a, b) {
+  if (a === b) return 0;
+  if (a.length === 0) return b.length;
+  if (b.length === 0) return a.length;
+  const matrix = [];
+  for (let i = 0; i <= b.length; i++) matrix[i] = [i];
+  for (let j = 0; j <= a.length; j++) matrix[0][j] = j;
+  for (let i = 1; i <= b.length; i++) {
+    for (let j = 1; j <= a.length; j++) {
+      const cost = a[j - 1] === b[i - 1] ? 0 : 1;
+      matrix[i][j] = Math.min(
+        matrix[i - 1][j] + 1,
+        // deletion
+        matrix[i][j - 1] + 1,
+        // insertion
+        matrix[i - 1][j - 1] + cost
+        // substitution
+      );
+    }
+  }
+  return matrix[b.length][a.length];
+}
+function isTyposquatCandidate(name, wellKnown) {
+  const base = name.startsWith("@") ? name.split("/")[1] ?? name : name;
+  for (const known of wellKnown) {
+    const dist = levenshtein(base.toLowerCase(), known.toLowerCase());
+    if (dist > 0 && dist <= 2) return known;
+  }
+  return null;
+}
+const TIMEOUT_MS = 1e4;
+async function checkNpmPublic(name) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), TIMEOUT_MS);
+  try {
+    const encoded = encodeURIComponent(name);
+    const resp = await fetch(`https://registry.npmjs.org/${encoded}/latest`, {
+      method: "GET",
+      signal: controller.signal,
+      headers: { "Accept": "application/json" }
+    });
+    if (!resp.ok) return { exists: false, version: null, publishedAt: null };
+    const data = await resp.json();
+    const version = data["version"] ?? null;
+    const full = await fetch(`https://registry.npmjs.org/${encoded}`, {
+      headers: { "Accept": "application/json" }
+    });
+    let publishedAt = null;
+    if (full.ok) {
+      const fullData = await full.json();
+      const time = fullData["time"] ?? {};
+      publishedAt = time["created"] ?? null;
+    }
+    return { exists: true, version, publishedAt };
+  } catch {
+    return { exists: false, version: null, publishedAt: null };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function checkPypiPublic(name) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), TIMEOUT_MS);
+  try {
+    const resp = await fetch(`https://pypi.org/pypi/${encodeURIComponent(name)}/json`, {
+      signal: controller.signal,
+      headers: { "Accept": "application/json" }
+    });
+    if (!resp.ok) return { exists: false, version: null, publishedAt: null };
+    const data = await resp.json();
+    const info = data["info"];
+    const version = info["version"] ?? null;
+    return { exists: true, version, publishedAt: null };
+  } catch {
+    return { exists: false, version: null, publishedAt: null };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function checkPublicRegistry(ecosystem, name) {
+  const eco = ecosystem.toLowerCase();
+  switch (eco) {
+    case "npm":
+      return checkNpmPublic(name);
+    case "pypi":
+    case "pip":
+      return checkPypiPublic(name);
+    default:
+      return { exists: false, version: null, publishedAt: null };
+  }
+}
+function detectInternal(packageName, sourceManifests, declaredConstraint) {
+  if (declaredConstraint.startsWith("file:") || declaredConstraint.startsWith("./") || declaredConstraint.startsWith("../")) {
+    return { isInternal: true, source: "local path" };
+  }
+  if (declaredConstraint.startsWith("git+") || declaredConstraint.startsWith("git://")) {
+    return { isInternal: true, source: "git dependency" };
+  }
+  for (const manifest of sourceManifests) {
+    if (manifest.includes(".kirograph/local") || manifest.includes("local/")) {
+      return { isInternal: true, source: "local registry" };
+    }
+  }
+  const wellKnownScopes = /* @__PURE__ */ new Set([
+    "@types",
+    "@babel",
+    "@jest",
+    "@testing-library",
+    "@angular",
+    "@vue",
+    "@react",
+    "@emotion",
+    "@mui",
+    "@chakra-ui",
+    "@tailwindcss",
+    "@storybook",
+    "@vitejs",
+    "@rollup",
+    "@esbuild",
+    "@swc",
+    "@aws-sdk",
+    "@google-cloud"
+  ]);
+  if (packageName.startsWith("@")) {
+    const scope = packageName.split("/")[0];
+    if (!wellKnownScopes.has(scope)) {
+      return { isInternal: true, source: `private scope ${scope}` };
+    }
+  }
+  return { isInternal: false, source: "public registry" };
+}
+class DepConfusionChecker {
+  constructor(db) {
+    this.db = db;
+  }
+  async check() {
+    const rawDb = this.db.getRawDb();
+    const rows = rawDb.all(
+      `SELECT node_id, package_name, ecosystem, declared_constraint, source_manifests, scope
+       FROM sec_dependencies
+       WHERE scope = 'production'`
+    );
+    const findings = [];
+    const seen = /* @__PURE__ */ new Set();
+    for (const row of rows) {
+      const key = `${row.ecosystem}:${row.package_name}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      let manifests = [];
+      try {
+        manifests = JSON.parse(row.source_manifests);
+      } catch {
+      }
+      const { isInternal, source } = detectInternal(
+        row.package_name,
+        manifests,
+        row.declared_constraint
+      );
+      if (isInternal) {
+        let publicInfo = { exists: false, version: null, publishedAt: null };
+        try {
+          let nameToCheck = row.package_name;
+          if (nameToCheck.startsWith("@")) {
+            nameToCheck = nameToCheck.split("/")[1] ?? nameToCheck;
+          }
+          publicInfo = await checkPublicRegistry(row.ecosystem, nameToCheck);
+        } catch (err) {
+          const msg = err instanceof Error ? err.message : String(err);
+          (0, import_errors.logWarn)(`[dep-confusion] Registry check failed for ${row.package_name}: ${msg}`);
+        }
+        if (publicInfo.exists) {
+          findings.push({
+            packageName: row.package_name,
+            ecosystem: row.ecosystem,
+            internalSource: source,
+            publicExists: true,
+            publicVersion: publicInfo.version,
+            publicPublishedAt: publicInfo.publishedAt,
+            riskLevel: "critical",
+            explanation: `Package "${row.package_name}" appears to be an internal dependency (${source}) but a public package with the same name exists in the ${row.ecosystem} registry (version ${publicInfo.version ?? "unknown"}). This is a potential dependency confusion attack vector.`
+          });
+          continue;
+        }
+        findings.push({
+          packageName: row.package_name,
+          ecosystem: row.ecosystem,
+          internalSource: source,
+          publicExists: false,
+          publicVersion: null,
+          publicPublishedAt: null,
+          riskLevel: "medium",
+          explanation: `Package "${row.package_name}" appears to be an internal dependency (${source}). No public package found with the same name, but this should be monitored.`
+        });
+        continue;
+      }
+      if (row.ecosystem.toLowerCase() === "npm") {
+        const similar = isTyposquatCandidate(row.package_name, WELL_KNOWN_NPM);
+        if (similar) {
+          findings.push({
+            packageName: row.package_name,
+            ecosystem: row.ecosystem,
+            internalSource: "public registry",
+            publicExists: true,
+            publicVersion: null,
+            publicPublishedAt: null,
+            riskLevel: "high",
+            explanation: `Package "${row.package_name}" has a name very similar to the well-known package "${similar}" (Levenshtein distance \u2264 2). This may be a typosquatting attempt.`
+          });
+        }
+      }
+    }
+    return findings;
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  DepConfusionChecker
+});
+//# sourceMappingURL=dep-confusion.js.map