mitnick-cli 1.0.0

package/dist/analyzers/prototype-pollution/index.js

@@ -0,0 +1,257 @@
+/**
+ * Prototype Pollution Analyzer — detects __proto__ access, Object.prototype
+ * mutation, constructor.prototype patterns, and recursive merge/extend
+ * functions without hasOwnProperty guards.
+ */
+import { parseSource, walkAST, getNodeLine, optionalLine } from '../../utils/ast.js';
+import { FileBasedAnalyzer } from '../file-based-analyzer.js';
+// ─── Constants ────────────────────────────────────────────
+/** Names commonly used for recursive merge/extend/assign functions. */
+const MERGE_FUNCTION_NAMES = new Set([
+    'merge',
+    'deepMerge',
+    'deep_merge',
+    'deepmerge',
+    'extend',
+    'deepExtend',
+    'deep_extend',
+    'assign',
+    'deepAssign',
+    'deep_assign',
+    'mixin',
+    'defaults',
+    'deepDefaults',
+    'setPath',
+    'setNested',
+    'set',
+]);
+// ─── Analyzer ─────────────────────────────────────────────
+export class PrototypePollutionAnalyzer extends FileBasedAnalyzer {
+    name = 'prototype-pollution';
+    description = 'Detects prototype pollution vectors including __proto__ access and unsafe merge patterns';
+    analyzeFile(source, relPath) {
+        const findings = [];
+        findings.push(...this.detectProtoAccess(source, relPath));
+        findings.push(...this.detectPrototypeMutation(source, relPath));
+        findings.push(...this.detectConstructorPrototype(source, relPath));
+        findings.push(...this.detectUnsafeMerge(source, relPath));
+        return findings;
+    }
+    detectProtoAccess(source, relPath) {
+        const findings = [];
+        const parsed = parseSource(source, relPath);
+        if (!parsed.ok)
+            return findings;
+        walkAST(parsed.ast, (node) => {
+            if (node.type === 'MemberExpression') {
+                const property = node['property'];
+                if (property?.['type'] === 'Identifier' && property['name'] === '__proto__') {
+                    findings.push({
+                        analyzer: this.name,
+                        severity: 'high',
+                        title: '__proto__ property access',
+                        description: 'Direct access to __proto__ can be used for prototype pollution attacks.',
+                        file: relPath,
+                        ...optionalLine(getNodeLine(node)),
+                        recommendation: 'Avoid __proto__ usage. Use Object.getPrototypeOf() / Object.setPrototypeOf() if needed.',
+                    });
+                }
+                if (node['computed'] === true &&
+                    property?.['type'] === 'Literal' &&
+                    property['value'] === '__proto__') {
+                    findings.push({
+                        analyzer: this.name,
+                        severity: 'high',
+                        title: '__proto__ computed property access',
+                        description: 'Computed access to "__proto__" via bracket notation, a common prototype pollution vector.',
+                        file: relPath,
+                        ...optionalLine(getNodeLine(node)),
+                        recommendation: 'Sanitize property keys to exclude "__proto__".',
+                    });
+                }
+            }
+            if (node.type === 'Property') {
+                const key = node['key'];
+                if ((key?.['type'] === 'Identifier' && key['name'] === '__proto__') ||
+                    (key?.['type'] === 'Literal' && key['value'] === '__proto__')) {
+                    findings.push({
+                        analyzer: this.name,
+                        severity: 'high',
+                        title: '__proto__ property definition',
+                        description: 'An object literal defines a "__proto__" property, which can pollute the prototype chain.',
+                        file: relPath,
+                        ...optionalLine(getNodeLine(node)),
+                        recommendation: 'Avoid defining __proto__ in object literals.',
+                    });
+                }
+            }
+        });
+        return findings;
+    }
+    detectPrototypeMutation(source, relPath) {
+        const findings = [];
+        const parsed = parseSource(source, relPath);
+        if (!parsed.ok)
+            return findings;
+        walkAST(parsed.ast, (node) => {
+            if (node.type !== 'AssignmentExpression')
+                return;
+            const left = node['left'];
+            if (left?.['type'] !== 'MemberExpression')
+                return;
+            const object = left['object'];
+            if (object?.['type'] !== 'MemberExpression')
+                return;
+            const outerObj = object['object'];
+            const outerProp = object['property'];
+            if (outerObj?.['type'] === 'Identifier' &&
+                outerProp?.['type'] === 'Identifier' &&
+                outerProp['name'] === 'prototype') {
+                const targetName = outerObj['name'];
+                if (targetName === 'Object' || targetName === 'Array') {
+                    findings.push({
+                        analyzer: this.name,
+                        severity: 'high',
+                        title: `${targetName}.prototype mutation detected`,
+                        description: `Assignment to ${targetName}.prototype modifies the prototype of all ${targetName} instances, ` +
+                            'which can lead to prototype pollution affecting the entire runtime.',
+                        file: relPath,
+                        ...optionalLine(getNodeLine(node)),
+                        recommendation: `Avoid modifying ${targetName}.prototype. Use utility functions or classes instead.`,
+                    });
+                }
+            }
+        });
+        return findings;
+    }
+    detectConstructorPrototype(source, relPath) {
+        const findings = [];
+        const parsed = parseSource(source, relPath);
+        if (!parsed.ok)
+            return findings;
+        walkAST(parsed.ast, (node) => {
+            if (node.type !== 'MemberExpression')
+                return;
+            const property = node['property'];
+            if (property?.['type'] !== 'Identifier' || property['name'] !== 'prototype')
+                return;
+            const object = node['object'];
+            if (object?.['type'] !== 'MemberExpression')
+                return;
+            const innerProp = object['property'];
+            if (innerProp?.['type'] === 'Identifier' && innerProp['name'] === 'constructor') {
+                findings.push({
+                    analyzer: this.name,
+                    severity: 'medium',
+                    title: 'constructor.prototype access pattern',
+                    description: 'Access to constructor.prototype can be used to traverse and mutate the prototype chain.',
+                    file: relPath,
+                    ...optionalLine(getNodeLine(node)),
+                    recommendation: 'Review whether this pattern is used safely.',
+                });
+            }
+        });
+        return findings;
+    }
+    detectUnsafeMerge(source, relPath) {
+        const findings = [];
+        const parsed = parseSource(source, relPath);
+        if (!parsed.ok)
+            return findings;
+        walkAST(parsed.ast, (node) => {
+            if (node.type === 'FunctionDeclaration') {
+                const id = node['id'];
+                if (id?.['type'] === 'Identifier' && typeof id['name'] === 'string') {
+                    const fnName = id['name'];
+                    if (MERGE_FUNCTION_NAMES.has(fnName)) {
+                        const hasGuard = this.bodyHasOwnPropertyGuard(node['body']);
+                        if (!hasGuard) {
+                            findings.push({
+                                analyzer: this.name,
+                                severity: 'medium',
+                                title: `Potentially unsafe merge function: ${fnName}()`,
+                                description: `Function "${fnName}" is a merge/extend function without a hasOwnProperty check. ` +
+                                    'This may allow prototype pollution through attacker-controlled input.',
+                                file: relPath,
+                                ...optionalLine(getNodeLine(node)),
+                                recommendation: 'Add hasOwnProperty checks or use Object.keys()/Object.entries() to iterate safely. ' +
+                                    'Also filter out "__proto__", "constructor", and "prototype" keys.',
+                            });
+                        }
+                    }
+                }
+            }
+            if (node.type === 'VariableDeclaration') {
+                const declarations = node['declarations'];
+                if (!Array.isArray(declarations))
+                    return;
+                for (const decl of declarations) {
+                    const declNode = decl;
+                    if (declNode['type'] !== 'VariableDeclarator')
+                        continue;
+                    const id = declNode['id'];
+                    const init = declNode['init'];
+                    if (id?.['type'] === 'Identifier' &&
+                        typeof id['name'] === 'string' &&
+                        MERGE_FUNCTION_NAMES.has(id['name']) &&
+                        init !== undefined &&
+                        (init['type'] === 'ArrowFunctionExpression' || init['type'] === 'FunctionExpression')) {
+                        const hasGuard = this.bodyHasOwnPropertyGuard(init['body']);
+                        if (!hasGuard) {
+                            findings.push({
+                                analyzer: this.name,
+                                severity: 'medium',
+                                title: `Potentially unsafe merge function: ${String(id['name'])}()`,
+                                description: `Function "${String(id['name'])}" appears to be a merge/extend function without ` +
+                                    'a hasOwnProperty check, which may allow prototype pollution.',
+                                file: relPath,
+                                ...optionalLine(getNodeLine(node)),
+                                recommendation: 'Add hasOwnProperty checks and filter dangerous keys like "__proto__".',
+                            });
+                        }
+                    }
+                }
+            }
+        });
+        return findings;
+    }
+    bodyHasOwnPropertyGuard(body) {
+        if (typeof body !== 'object' || body === null)
+            return false;
+        let found = false;
+        walkAST(body, (node) => {
+            if (found)
+                return false;
+            if (node.type === 'CallExpression') {
+                const callee = node['callee'];
+                if (callee?.['type'] === 'MemberExpression') {
+                    const prop = callee['property'];
+                    if (prop?.['type'] === 'Identifier' && prop['name'] === 'hasOwnProperty') {
+                        found = true;
+                        return false;
+                    }
+                    // Object.hasOwn()
+                    const obj = callee['object'];
+                    if (obj?.['type'] === 'Identifier' &&
+                        obj['name'] === 'Object' &&
+                        prop?.['type'] === 'Identifier' &&
+                        prop['name'] === 'hasOwn') {
+                        found = true;
+                        return false;
+                    }
+                    // Object.keys() / Object.entries()
+                    if (obj?.['type'] === 'Identifier' &&
+                        obj['name'] === 'Object' &&
+                        prop?.['type'] === 'Identifier' &&
+                        (prop['name'] === 'keys' || prop['name'] === 'entries')) {
+                        found = true;
+                        return false;
+                    }
+                }
+            }
+            return undefined;
+        });
+        return found;
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/analyzers/prototype-pollution/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/analyzers/prototype-pollution/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACrF,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAE9D,6DAA6D;AAE7D,uEAAuE;AACvE,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC;IACnC,OAAO;IACP,WAAW;IACX,YAAY;IACZ,WAAW;IACX,QAAQ;IACR,YAAY;IACZ,aAAa;IACb,QAAQ;IACR,YAAY;IACZ,aAAa;IACb,OAAO;IACP,UAAU;IACV,cAAc;IACd,SAAS;IACT,WAAW;IACX,KAAK;CACN,CAAC,CAAC;AAEH,6DAA6D;AAE7D,MAAM,OAAO,0BAA2B,SAAQ,iBAAiB;IACtD,IAAI,GAAG,qBAAqB,CAAC;IAC7B,WAAW,GAClB,0FAA0F,CAAC;IAEnF,WAAW,CAAC,MAAc,EAAE,OAAe;QACnD,MAAM,QAAQ,GAAc,EAAE,CAAC;QAE/B,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC1D,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,uBAAuB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAChE,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,0BAA0B,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QACnE,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAE1D,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,iBAAiB,CAAC,MAAc,EAAE,OAAe;QACvD,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,QAAQ,CAAC;QAEhC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE;YAC3B,IAAI,IAAI,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;gBACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAwC,CAAC;gBACzE,IAAI,QAAQ,EAAE,CAAC,MAAM,CAAC,KAAK,YAAY,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,WAAW,EAAE,CAAC;oBAC5E,QAAQ,CAAC,IAAI,CAAC;wBACZ,QAAQ,EAAE,IAAI,CAAC,IAAI;wBACnB,QAAQ,EAAE,MAAM;wBAChB,KAAK,EAAE,2BAA2B;wBAClC,WAAW,EAAE,yEAAyE;wBACtF,IAAI,EAAE,OAAO;wBACb,GAAG,YAAY,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;wBAClC,cAAc,EACZ,yFAAyF;qBAC5F,CAAC,CAAC;gBACL,CAAC;gBAED,IACE,IAAI,CAAC,UAAU,CAAC,KAAK,IAAI;oBACzB,QAAQ,EAAE,CAAC,MAAM,CAAC,KAAK,SAAS;oBAChC,QAAQ,CAAC,OAAO,CAAC,KAAK,WAAW,EACjC,CAAC;oBACD,QAAQ,CAAC,IAAI,CAAC;wBACZ,QAAQ,EAAE,IAAI,CAAC,IAAI;wBACnB,QAAQ,EAAE,MAAM;wBAChB,KAAK,EAAE,oCAAoC;wBAC3C,WAAW,EACT,2FAA2F;wBAC7F,IAAI,EAAE,OAAO;wBACb,GAAG,YAAY,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;wBAClC,cAAc,EAAE,gDAAgD;qBACjE,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAwC,CAAC;gBAC/D,IACE,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,YAAY,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,WAAW,CAAC;oBAC/D,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,SAAS,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,WAAW,CAAC,EAC7D,CAAC;oBACD,QAAQ,CAAC,IAAI,CAAC;wBACZ,QAAQ,EAAE,IAAI,CAAC,IAAI;wBACnB,QAAQ,EAAE,MAAM;wBAChB,KAAK,EAAE,+BAA+B;wBACtC,WAAW,EACT,0FAA0F;wBAC5F,IAAI,EAAE,OAAO;wBACb,GAAG,YAAY,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;wBAClC,cAAc,EAAE,8CAA8C;qBAC/D,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,uBAAuB,CAAC,MAAc,EAAE,OAAe;QAC7D,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,QAAQ,CAAC;QAEhC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE;YAC3B,IAAI,IAAI,CAAC,IAAI,KAAK,sBAAsB;gBAAE,OAAO;YAEjD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAwC,CAAC;YACjE,IAAI,IAAI,EAAE,CAAC,MAAM,CAAC,KAAK,kBAAkB;gBAAE,OAAO;YAElD,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAwC,CAAC;YACrE,IAAI,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,kBAAkB;gBAAE,OAAO;YAEpD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAwC,CAAC;YACzE,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAwC,CAAC;YAE5E,IACE,QAAQ,EAAE,CAAC,MAAM,CAAC,KAAK,YAAY;gBACnC,SAAS,EAAE,CAAC,MAAM,CAAC,KAAK,YAAY;gBACpC,SAAS,CAAC,MAAM,CAAC,KAAK,WAAW,EACjC,CAAC;gBACD,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAW,CAAC;gBAC9C,IAAI,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,OAAO,EAAE,CAAC;oBACtD,QAAQ,CAAC,IAAI,CAAC;wBACZ,QAAQ,EAAE,IAAI,CAAC,IAAI;wBACnB,QAAQ,EAAE,MAAM;wBAChB,KAAK,EAAE,GAAG,UAAU,8BAA8B;wBAClD,WAAW,EACT,iBAAiB,UAAU,4CAA4C,UAAU,cAAc;4BAC/F,qEAAqE;wBACvE,IAAI,EAAE,OAAO;wBACb,GAAG,YAAY,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;wBAClC,cAAc,EAAE,mBAAmB,UAAU,uDAAuD;qBACrG,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,0BAA0B,CAAC,MAAc,EAAE,OAAe;QAChE,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,QAAQ,CAAC;QAEhC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE;YAC3B,IAAI,IAAI,CAAC,IAAI,KAAK,kBAAkB;gBAAE,OAAO;YAE7C,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAwC,CAAC;YACzE,IAAI,QAAQ,EAAE,CAAC,MAAM,CAAC,KAAK,YAAY,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,WAAW;gBAAE,OAAO;YAEpF,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAwC,CAAC;YACrE,IAAI,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,kBAAkB;gBAAE,OAAO;YAEpD,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAwC,CAAC;YAC5E,IAAI,SAAS,EAAE,CAAC,MAAM,CAAC,KAAK,YAAY,IAAI,SAAS,CAAC,MAAM,CAAC,KAAK,aAAa,EAAE,CAAC;gBAChF,QAAQ,CAAC,IAAI,CAAC;oBACZ,QAAQ,EAAE,IAAI,CAAC,IAAI;oBACnB,QAAQ,EAAE,QAAQ;oBAClB,KAAK,EAAE,sCAAsC;oBAC7C,WAAW,EACT,yFAAyF;oBAC3F,IAAI,EAAE,OAAO;oBACb,GAAG,YAAY,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;oBAClC,cAAc,EAAE,6CAA6C;iBAC9D,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,iBAAiB,CAAC,MAAc,EAAE,OAAe;QACvD,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,QAAQ,CAAC;QAEhC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE;YAC3B,IAAI,IAAI,CAAC,IAAI,KAAK,qBAAqB,EAAE,CAAC;gBACxC,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAwC,CAAC;gBAC7D,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,YAAY,IAAI,OAAO,EAAE,CAAC,MAAM,CAAC,KAAK,QAAQ,EAAE,CAAC;oBACpE,MAAM,MAAM,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC;oBAC1B,IAAI,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;wBACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;wBAC5D,IAAI,CAAC,QAAQ,EAAE,CAAC;4BACd,QAAQ,CAAC,IAAI,CAAC;gCACZ,QAAQ,EAAE,IAAI,CAAC,IAAI;gCACnB,QAAQ,EAAE,QAAQ;gCAClB,KAAK,EAAE,sCAAsC,MAAM,IAAI;gCACvD,WAAW,EACT,aAAa,MAAM,+DAA+D;oCAClF,uEAAuE;gCACzE,IAAI,EAAE,OAAO;gCACb,GAAG,YAAY,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;gCAClC,cAAc,EACZ,qFAAqF;oCACrF,mEAAmE;6BACtE,CAAC,CAAC;wBACL,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YAED,IAAI,IAAI,CAAC,IAAI,KAAK,qBAAqB,EAAE,CAAC;gBACxC,MAAM,YAAY,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC;gBAC1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC;oBAAE,OAAO;gBAEzC,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;oBAChC,MAAM,QAAQ,GAAG,IAA+B,CAAC;oBACjD,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,oBAAoB;wBAAE,SAAS;oBAExD,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAwC,CAAC;oBACjE,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAwC,CAAC;oBAErE,IACE,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,YAAY;wBAC7B,OAAO,EAAE,CAAC,MAAM,CAAC,KAAK,QAAQ;wBAC9B,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC;wBACpC,IAAI,KAAK,SAAS;wBAClB,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,yBAAyB,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,oBAAoB,CAAC,EACrF,CAAC;wBACD,MAAM,QAAQ,GAAG,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;wBAC5D,IAAI,CAAC,QAAQ,EAAE,CAAC;4BACd,QAAQ,CAAC,IAAI,CAAC;gCACZ,QAAQ,EAAE,IAAI,CAAC,IAAI;gCACnB,QAAQ,EAAE,QAAQ;gCAClB,KAAK,EAAE,sCAAsC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI;gCACnE,WAAW,EACT,aAAa,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,kDAAkD;oCACjF,8DAA8D;gCAChE,IAAI,EAAE,OAAO;gCACb,GAAG,YAAY,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;gCAClC,cAAc,EACZ,uEAAuE;6BAC1E,CAAC,CAAC;wBACL,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,uBAAuB,CAAC,IAAa;QAC3C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QAE5D,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE;YACrB,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAC;YAExB,IAAI,IAAI,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;gBACnC,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAwC,CAAC;gBACrE,IAAI,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,kBAAkB,EAAE,CAAC;oBAC5C,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAwC,CAAC;oBACvE,IAAI,IAAI,EAAE,CAAC,MAAM,CAAC,KAAK,YAAY,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,gBAAgB,EAAE,CAAC;wBACzE,KAAK,GAAG,IAAI,CAAC;wBACb,OAAO,KAAK,CAAC;oBACf,CAAC;oBAED,kBAAkB;oBAClB,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAwC,CAAC;oBACpE,IACE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,YAAY;wBAC9B,GAAG,CAAC,MAAM,CAAC,KAAK,QAAQ;wBACxB,IAAI,EAAE,CAAC,MAAM,CAAC,KAAK,YAAY;wBAC/B,IAAI,CAAC,MAAM,CAAC,KAAK,QAAQ,EACzB,CAAC;wBACD,KAAK,GAAG,IAAI,CAAC;wBACb,OAAO,KAAK,CAAC;oBACf,CAAC;oBAED,mCAAmC;oBACnC,IACE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,YAAY;wBAC9B,GAAG,CAAC,MAAM,CAAC,KAAK,QAAQ;wBACxB,IAAI,EAAE,CAAC,MAAM,CAAC,KAAK,YAAY;wBAC/B,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,SAAS,CAAC,EACvD,CAAC;wBACD,KAAK,GAAG,IAAI,CAAC;wBACb,OAAO,KAAK,CAAC;oBACf,CAAC;gBACH,CAAC;YACH,CAAC;YAED,OAAO,SAAS,CAAC;QACnB,CAAC,CAAC,CAAC;QAEH,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}

package/dist/analyzers/sensitive-data/index.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Sensitive Data Analyzer — detects access to environment variables,
+ * credential files, sensitive filesystem paths, and secret key files.
+ */
+import type { Finding } from '../../core/types.js';
+import { FileBasedAnalyzer } from '../file-based-analyzer.js';
+export declare class SensitiveDataAnalyzer extends FileBasedAnalyzer {
+    readonly name = "sensitive-data";
+    readonly description = "Detects access to environment variables, credentials, and sensitive file paths";
+    protected analyzeFile(source: string, relPath: string): Finding[];
+    private detectProcessEnvAccess;
+    private detectSensitivePaths;
+    private detectSensitiveFilePatterns;
+    private detectEnvHarvesting;
+}
+//# sourceMappingURL=index.d.ts.map

package/dist/analyzers/sensitive-data/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/analyzers/sensitive-data/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAGnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAuD9D,qBAAa,qBAAsB,SAAQ,iBAAiB;IAC1D,QAAQ,CAAC,IAAI,oBAAoB;IACjC,QAAQ,CAAC,WAAW,oFAC+D;IAEnF,SAAS,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,EAAE;IAWjE,OAAO,CAAC,sBAAsB;IAkI9B,OAAO,CAAC,oBAAoB;IA2B5B,OAAO,CAAC,2BAA2B;IA0BnC,OAAO,CAAC,mBAAmB;CAmC5B"}

package/dist/analyzers/sensitive-data/index.js

@@ -0,0 +1,254 @@
+/**
+ * Sensitive Data Analyzer — detects access to environment variables,
+ * credential files, sensitive filesystem paths, and secret key files.
+ */
+import { parseSource, walkAST, extractStringLiterals, isMemberAccess } from '../../utils/ast.js';
+import { truncate } from '../../utils/strings.js';
+import { FileBasedAnalyzer } from '../file-based-analyzer.js';
+// ─── Constants ────────────────────────────────────────────
+/** Sensitive filesystem paths. */
+const SENSITIVE_PATHS = [
+    '~/.ssh',
+    '~/.aws',
+    '~/.npmrc',
+    '~/.gnupg',
+    '~/.config',
+    '~/.netrc',
+    '~/.bash_history',
+    '~/.zsh_history',
+    '/etc/passwd',
+    '/etc/shadow',
+    '/etc/hosts',
+    '.env',
+    '.env.local',
+    '.env.production',
+];
+/** File patterns that commonly contain secrets. */
+const SENSITIVE_FILE_PATTERNS = [
+    /\.pem$/i,
+    /\.key$/i,
+    /\bid_rsa\b/i,
+    /\bid_ed25519\b/i,
+    /\bid_ecdsa\b/i,
+    /\bcredentials\.json\b/i,
+    /\bservice[_-]?account\.json\b/i,
+    /\b\.env\b/,
+    /\btoken\.json\b/i,
+    /\bsecrets?\.(json|ya?ml|toml)\b/i,
+    /\bkeystore\b/i,
+    /\bknown_hosts\b/i,
+];
+/** Sensitive-sounding environment variable name fragments. */
+const SENSITIVE_ENV_NAMES = [
+    'SECRET',
+    'TOKEN',
+    'API_KEY',
+    'APIKEY',
+    'PASSWORD',
+    'PASSWD',
+    'PRIVATE_KEY',
+    'ACCESS_KEY',
+    'AWS_SECRET',
+    'DATABASE_URL',
+    'DB_PASSWORD',
+];
+// ─── Analyzer ─────────────────────────────────────────────
+export class SensitiveDataAnalyzer extends FileBasedAnalyzer {
+    name = 'sensitive-data';
+    description = 'Detects access to environment variables, credentials, and sensitive file paths';
+    analyzeFile(source, relPath) {
+        const findings = [];
+        findings.push(...this.detectProcessEnvAccess(source, relPath));
+        findings.push(...this.detectSensitivePaths(source, relPath));
+        findings.push(...this.detectSensitiveFilePatterns(source, relPath));
+        findings.push(...this.detectEnvHarvesting(source, relPath));
+        return findings;
+    }
+    detectProcessEnvAccess(source, relPath) {
+        const findings = [];
+        const parsed = parseSource(source, relPath);
+        if (!parsed.ok)
+            return findings;
+        let envAccessCount = 0;
+        const state = { bulkEnvAccess: false };
+        walkAST(parsed.ast, (node) => {
+            // process.env
+            if (isMemberAccess(node, 'process', 'env')) {
+                envAccessCount++;
+                // Check if this is the object in a further member expression (process.env.SECRET_KEY)
+                // We count them; too many distinct env accesses is suspicious
+            }
+            // Object.keys(process.env) or Object.entries(process.env) — bulk harvesting
+            if (node.type === 'CallExpression') {
+                const callee = node['callee'];
+                if (typeof callee === 'object' && callee !== null) {
+                    const calleeNode = callee;
+                    if (calleeNode['type'] === 'MemberExpression') {
+                        const obj = calleeNode['object'];
+                        const prop = calleeNode['property'];
+                        if (obj?.['type'] === 'Identifier' &&
+                            obj['name'] === 'Object' &&
+                            prop?.['type'] === 'Identifier' &&
+                            (prop['name'] === 'keys' || prop['name'] === 'entries' || prop['name'] === 'values')) {
+                            const args = node['arguments'];
+                            if (Array.isArray(args) && args.length > 0) {
+                                const firstArg = args[0];
+                                if (firstArg?.['type'] === 'MemberExpression' &&
+                                    typeof firstArg['object'] === 'object' &&
+                                    firstArg['object'] !== null) {
+                                    const argObj = firstArg['object'];
+                                    const argProp = firstArg['property'];
+                                    if (argObj['type'] === 'Identifier' &&
+                                        argObj['name'] === 'process' &&
+                                        argProp?.['type'] === 'Identifier' &&
+                                        argProp['name'] === 'env') {
+                                        state.bulkEnvAccess = true;
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+            // JSON.stringify(process.env)
+            if (node.type === 'CallExpression') {
+                const callee = node['callee'];
+                if (typeof callee === 'object' && callee !== null) {
+                    const calleeNode = callee;
+                    if (calleeNode['type'] === 'MemberExpression') {
+                        const obj = calleeNode['object'];
+                        const prop = calleeNode['property'];
+                        if (obj?.['type'] === 'Identifier' &&
+                            obj['name'] === 'JSON' &&
+                            prop?.['type'] === 'Identifier' &&
+                            prop['name'] === 'stringify') {
+                            const args = node['arguments'];
+                            if (Array.isArray(args) && args.length > 0) {
+                                const firstArg = args[0];
+                                if (firstArg?.['type'] === 'MemberExpression' &&
+                                    typeof firstArg['object'] === 'object' &&
+                                    firstArg['object'] !== null) {
+                                    const argObj = firstArg['object'];
+                                    const argProp = firstArg['property'];
+                                    if (argObj['type'] === 'Identifier' &&
+                                        argObj['name'] === 'process' &&
+                                        argProp?.['type'] === 'Identifier' &&
+                                        argProp['name'] === 'env') {
+                                        state.bulkEnvAccess = true;
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+        });
+        if (state.bulkEnvAccess) {
+            findings.push({
+                analyzer: this.name,
+                severity: 'high',
+                title: 'Bulk environment variable harvesting detected',
+                description: 'The package accesses the entire process.env object (via Object.keys, Object.entries, or JSON.stringify). ' +
+                    'This may be used to exfiltrate secrets.',
+                file: relPath,
+                recommendation: 'Investigate what the package does with the full environment.',
+            });
+        }
+        else if (envAccessCount > 5) {
+            findings.push({
+                analyzer: this.name,
+                severity: 'high',
+                title: `Excessive process.env access (${envAccessCount} occurrences)`,
+                description: `The package accesses process.env ${envAccessCount} times, which may indicate environment harvesting.`,
+                file: relPath,
+                recommendation: 'Review which environment variables are being read and why.',
+            });
+        }
+        else if (envAccessCount > 0) {
+            findings.push({
+                analyzer: this.name,
+                severity: 'info',
+                title: `process.env access detected (${envAccessCount} occurrences)`,
+                description: `The package reads environment variables (${envAccessCount} access points).`,
+                file: relPath,
+                recommendation: 'Verify the package only reads expected configuration variables.',
+            });
+        }
+        return findings;
+    }
+    detectSensitivePaths(source, relPath) {
+        const findings = [];
+        const strings = extractStringLiterals(source, relPath);
+        const flagged = new Set();
+        for (const str of strings) {
+            for (const sensitivePath of SENSITIVE_PATHS) {
+                if (str.includes(sensitivePath) && !flagged.has(sensitivePath)) {
+                    flagged.add(sensitivePath);
+                    findings.push({
+                        analyzer: this.name,
+                        severity: 'critical',
+                        title: `Access to sensitive path: ${sensitivePath}`,
+                        description: `The package contains a reference to "${sensitivePath}", ` +
+                            'which may indicate credential theft or reconnaissance.',
+                        file: relPath,
+                        recommendation: 'Investigate why the package accesses this sensitive path.',
+                    });
+                }
+            }
+        }
+        return findings;
+    }
+    detectSensitiveFilePatterns(source, relPath) {
+        const findings = [];
+        const strings = extractStringLiterals(source, relPath);
+        const flagged = new Set();
+        for (const str of strings) {
+            for (const pattern of SENSITIVE_FILE_PATTERNS) {
+                if (pattern.test(str) && !flagged.has(str)) {
+                    flagged.add(str);
+                    findings.push({
+                        analyzer: this.name,
+                        severity: 'critical',
+                        title: `Credential file reference: ${truncate(str, 60)}`,
+                        description: `The package references a file matching sensitive credential pattern: "${truncate(str, 120)}".`,
+                        file: relPath,
+                        recommendation: 'Verify why the package needs access to credential files.',
+                    });
+                    break; // Only match first pattern per string
+                }
+            }
+        }
+        return findings;
+    }
+    detectEnvHarvesting(source, relPath) {
+        const findings = [];
+        const strings = extractStringLiterals(source, relPath);
+        const foundSensitiveEnvs = [];
+        for (const str of strings) {
+            const upperStr = str.toUpperCase();
+            for (const envName of SENSITIVE_ENV_NAMES) {
+                if (upperStr.includes(envName)) {
+                    foundSensitiveEnvs.push(str);
+                    break;
+                }
+            }
+        }
+        // Only flag if process.env is also accessed
+        if (foundSensitiveEnvs.length > 0 && source.includes('process.env')) {
+            findings.push({
+                analyzer: this.name,
+                severity: 'high',
+                title: 'Sensitive environment variable names detected',
+                description: `The package references sensitive-sounding env variable names: ` +
+                    `${foundSensitiveEnvs
+                        .slice(0, 5)
+                        .map((s) => `"${s}"`)
+                        .join(', ')}`,
+                file: relPath,
+                recommendation: 'Verify the package is not exfiltrating secret values.',
+            });
+        }
+        return findings;
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/analyzers/sensitive-data/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/analyzers/sensitive-data/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACjG,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAE9D,6DAA6D;AAE7D,kCAAkC;AAClC,MAAM,eAAe,GAAsB;IACzC,QAAQ;IACR,QAAQ;IACR,UAAU;IACV,UAAU;IACV,WAAW;IACX,UAAU;IACV,iBAAiB;IACjB,gBAAgB;IAChB,aAAa;IACb,aAAa;IACb,YAAY;IACZ,MAAM;IACN,YAAY;IACZ,iBAAiB;CAClB,CAAC;AAEF,mDAAmD;AACnD,MAAM,uBAAuB,GAAsB;IACjD,SAAS;IACT,SAAS;IACT,aAAa;IACb,iBAAiB;IACjB,eAAe;IACf,wBAAwB;IACxB,gCAAgC;IAChC,WAAW;IACX,kBAAkB;IAClB,kCAAkC;IAClC,eAAe;IACf,kBAAkB;CACnB,CAAC;AAEF,8DAA8D;AAC9D,MAAM,mBAAmB,GAAsB;IAC7C,QAAQ;IACR,OAAO;IACP,SAAS;IACT,QAAQ;IACR,UAAU;IACV,QAAQ;IACR,aAAa;IACb,YAAY;IACZ,YAAY;IACZ,cAAc;IACd,aAAa;CACd,CAAC;AAEF,6DAA6D;AAE7D,MAAM,OAAO,qBAAsB,SAAQ,iBAAiB;IACjD,IAAI,GAAG,gBAAgB,CAAC;IACxB,WAAW,GAClB,gFAAgF,CAAC;IAEzE,WAAW,CAAC,MAAc,EAAE,OAAe;QACnD,MAAM,QAAQ,GAAc,EAAE,CAAC;QAE/B,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,sBAAsB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC/D,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC7D,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,2BAA2B,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QACpE,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAE5D,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,sBAAsB,CAAC,MAAc,EAAE,OAAe;QAC5D,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,QAAQ,CAAC;QAEhC,IAAI,cAAc,GAAG,CAAC,CAAC;QACvB,MAAM,KAAK,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;QAEvC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE;YAC3B,cAAc;YACd,IAAI,cAAc,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE,CAAC;gBAC3C,cAAc,EAAE,CAAC;gBAEjB,sFAAsF;gBACtF,8DAA8D;YAChE,CAAC;YAED,4EAA4E;YAC5E,IAAI,IAAI,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;gBACnC,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAC9B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;oBAClD,MAAM,UAAU,GAAG,MAAiC,CAAC;oBACrD,IAAI,UAAU,CAAC,MAAM,CAAC,KAAK,kBAAkB,EAAE,CAAC;wBAC9C,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAwC,CAAC;wBACxE,MAAM,IAAI,GAAG,UAAU,CAAC,UAAU,CAAwC,CAAC;wBAC3E,IACE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,YAAY;4BAC9B,GAAG,CAAC,MAAM,CAAC,KAAK,QAAQ;4BACxB,IAAI,EAAE,CAAC,MAAM,CAAC,KAAK,YAAY;4BAC/B,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,EACpF,CAAC;4BACD,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;4BAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gCAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAwC,CAAC;gCAChE,IACE,QAAQ,EAAE,CAAC,MAAM,CAAC,KAAK,kBAAkB;oCACzC,OAAO,QAAQ,CAAC,QAAQ,CAAC,KAAK,QAAQ;oCACtC,QAAQ,CAAC,QAAQ,CAAC,KAAK,IAAI,EAC3B,CAAC;oCACD,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAA4B,CAAC;oCAC7D,MAAM,OAAO,GAAG,QAAQ,CAAC,UAAU,CAAwC,CAAC;oCAC5E,IACE,MAAM,CAAC,MAAM,CAAC,KAAK,YAAY;wCAC/B,MAAM,CAAC,MAAM,CAAC,KAAK,SAAS;wCAC5B,OAAO,EAAE,CAAC,MAAM,CAAC,KAAK,YAAY;wCAClC,OAAO,CAAC,MAAM,CAAC,KAAK,KAAK,EACzB,CAAC;wCACD,KAAK,CAAC,aAAa,GAAG,IAAI,CAAC;oCAC7B,CAAC;gCACH,CAAC;4BACH,CAAC;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YAED,8BAA8B;YAC9B,IAAI,IAAI,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;gBACnC,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAC9B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;oBAClD,MAAM,UAAU,GAAG,MAAiC,CAAC;oBACrD,IAAI,UAAU,CAAC,MAAM,CAAC,KAAK,kBAAkB,EAAE,CAAC;wBAC9C,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAwC,CAAC;wBACxE,MAAM,IAAI,GAAG,UAAU,CAAC,UAAU,CAAwC,CAAC;wBAC3E,IACE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,YAAY;4BAC9B,GAAG,CAAC,MAAM,CAAC,KAAK,MAAM;4BACtB,IAAI,EAAE,CAAC,MAAM,CAAC,KAAK,YAAY;4BAC/B,IAAI,CAAC,MAAM,CAAC,KAAK,WAAW,EAC5B,CAAC;4BACD,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;4BAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gCAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAwC,CAAC;gCAChE,IACE,QAAQ,EAAE,CAAC,MAAM,CAAC,KAAK,kBAAkB;oCACzC,OAAO,QAAQ,CAAC,QAAQ,CAAC,KAAK,QAAQ;oCACtC,QAAQ,CAAC,QAAQ,CAAC,KAAK,IAAI,EAC3B,CAAC;oCACD,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAA4B,CAAC;oCAC7D,MAAM,OAAO,GAAG,QAAQ,CAAC,UAAU,CAAwC,CAAC;oCAC5E,IACE,MAAM,CAAC,MAAM,CAAC,KAAK,YAAY;wCAC/B,MAAM,CAAC,MAAM,CAAC,KAAK,SAAS;wCAC5B,OAAO,EAAE,CAAC,MAAM,CAAC,KAAK,YAAY;wCAClC,OAAO,CAAC,MAAM,CAAC,KAAK,KAAK,EACzB,CAAC;wCACD,KAAK,CAAC,aAAa,GAAG,IAAI,CAAC;oCAC7B,CAAC;gCACH,CAAC;4BACH,CAAC;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;YACxB,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,IAAI,CAAC,IAAI;gBACnB,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,+CAA+C;gBACtD,WAAW,EACT,2GAA2G;oBAC3G,yCAAyC;gBAC3C,IAAI,EAAE,OAAO;gBACb,cAAc,EAAE,8DAA8D;aAC/E,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,cAAc,GAAG,CAAC,EAAE,CAAC;YAC9B,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,IAAI,CAAC,IAAI;gBACnB,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,iCAAiC,cAAc,eAAe;gBACrE,WAAW,EAAE,oCAAoC,cAAc,oDAAoD;gBACnH,IAAI,EAAE,OAAO;gBACb,cAAc,EAAE,4DAA4D;aAC7E,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,cAAc,GAAG,CAAC,EAAE,CAAC;YAC9B,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,IAAI,CAAC,IAAI;gBACnB,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,gCAAgC,cAAc,eAAe;gBACpE,WAAW,EAAE,4CAA4C,cAAc,kBAAkB;gBACzF,IAAI,EAAE,OAAO;gBACb,cAAc,EAAE,iEAAiE;aAClF,CAAC,CAAC;QACL,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,oBAAoB,CAAC,MAAc,EAAE,OAAe;QAC1D,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,qBAAqB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAEvD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAElC,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,KAAK,MAAM,aAAa,IAAI,eAAe,EAAE,CAAC;gBAC5C,IAAI,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;oBAC/D,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;oBAC3B,QAAQ,CAAC,IAAI,CAAC;wBACZ,QAAQ,EAAE,IAAI,CAAC,IAAI;wBACnB,QAAQ,EAAE,UAAU;wBACpB,KAAK,EAAE,6BAA6B,aAAa,EAAE;wBACnD,WAAW,EACT,wCAAwC,aAAa,KAAK;4BAC1D,wDAAwD;wBAC1D,IAAI,EAAE,OAAO;wBACb,cAAc,EAAE,2DAA2D;qBAC5E,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,2BAA2B,CAAC,MAAc,EAAE,OAAe;QACjE,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,qBAAqB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAEvD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAElC,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,KAAK,MAAM,OAAO,IAAI,uBAAuB,EAAE,CAAC;gBAC9C,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC3C,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;oBACjB,QAAQ,CAAC,IAAI,CAAC;wBACZ,QAAQ,EAAE,IAAI,CAAC,IAAI;wBACnB,QAAQ,EAAE,UAAU;wBACpB,KAAK,EAAE,8BAA8B,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE;wBACxD,WAAW,EAAE,yEAAyE,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI;wBAC5G,IAAI,EAAE,OAAO;wBACb,cAAc,EAAE,0DAA0D;qBAC3E,CAAC,CAAC;oBACH,MAAM,CAAC,sCAAsC;gBAC/C,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,mBAAmB,CAAC,MAAc,EAAE,OAAe;QACzD,MAAM,QAAQ,GAAc,EAAE,CAAC;QAE/B,MAAM,OAAO,GAAG,qBAAqB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACvD,MAAM,kBAAkB,GAAa,EAAE,CAAC;QAExC,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;YACnC,KAAK,MAAM,OAAO,IAAI,mBAAmB,EAAE,CAAC;gBAC1C,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC/B,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBAC7B,MAAM;gBACR,CAAC;YACH,CAAC;QACH,CAAC;QAED,4CAA4C;QAC5C,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YACpE,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,IAAI,CAAC,IAAI;gBACnB,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,+CAA+C;gBACtD,WAAW,EACT,gEAAgE;oBAChE,GAAG,kBAAkB;yBAClB,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;yBACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC;yBACpB,IAAI,CAAC,IAAI,CAAC,EAAE;gBACjB,IAAI,EAAE,OAAO;gBACb,cAAc,EAAE,uDAAuD;aACxE,CAAC,CAAC;QACL,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF"}

package/dist/analyzers/typosquatting/index.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Typosquatting Analyzer — detects package names that are suspiciously
+ * similar to popular npm packages via Levenshtein distance and common
+ * character substitutions.
+ */
+import type { Analyzer } from '../analyzer.interface.js';
+import type { AnalysisContext, AnalyzerResult } from '../../core/types.js';
+export declare class TyposquattingAnalyzer implements Analyzer {
+    readonly name = "typosquatting";
+    readonly description = "Detects package names that may be typosquatting popular npm packages";
+    analyze(context: AnalysisContext): Promise<AnalyzerResult>;
+    private createFinding;
+}
+//# sourceMappingURL=index.d.ts.map

package/dist/analyzers/typosquatting/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/analyzers/typosquatting/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAqB,MAAM,qBAAqB,CAAC;AAsE9F,qBAAa,qBAAsB,YAAW,QAAQ;IACpD,QAAQ,CAAC,IAAI,mBAAmB;IAChC,QAAQ,CAAC,WAAW,0EAA0E;IAE9F,OAAO,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC;IAkE1D,OAAO,CAAC,aAAa;CAgBtB"}