muaddib-scanner 1.2.7 → 1.3.0

package/action.yml

@@ -0,0 +1,97 @@
+name: 'MUAD''DIB Scanner'
+description: 'Supply-chain threat detection and response for npm. Detects malicious packages, typosquatting, credential theft, and more.'
+author: 'DNSZLSK'
+
+branding:
+  icon: 'shield'
+  color: 'orange'
+
+inputs:
+  path:
+    description: 'Path to the project to scan'
+    required: false
+    default: '.'
+  fail-on:
+    description: 'Minimum severity to fail the workflow (critical, high, medium, low)'
+    required: false
+    default: 'high'
+  sarif:
+    description: 'Generate SARIF output file at this path'
+    required: false
+    default: ''
+  paranoid:
+    description: 'Enable paranoid mode for ultra-strict detection'
+    required: false
+    default: 'false'
+
+outputs:
+  sarif-file:
+    description: 'Path to the generated SARIF file (if sarif input was provided)'
+    value: ${{ steps.scan.outputs.sarif_file }}
+  risk-score:
+    description: 'Risk score from 0 to 100'
+    value: ${{ steps.scan.outputs.risk_score }}
+  threats-count:
+    description: 'Number of threats detected'
+    value: ${{ steps.scan.outputs.threats_count }}
+  exit-code:
+    description: 'Exit code of the scan (0 = clean, 1+ = threats found)'
+    value: ${{ steps.scan.outputs.exit_code }}
+
+runs:
+  using: 'composite'
+  steps:
+    - name: Setup Node.js
+      uses: actions/setup-node@v4
+      with:
+        node-version: '20'
+
+    - name: Install MUAD'DIB
+      shell: bash
+      run: npm install -g muaddib-scanner
+
+    - name: Run MUAD'DIB scan
+      id: scan
+      shell: bash
+      run: |
+        # Build command
+        CMD="muaddib scan ${{ inputs.path }} --fail-on ${{ inputs.fail-on }}"
+
+        # Add SARIF output if requested
+        SARIF_PATH="${{ inputs.sarif }}"
+        if [ -n "$SARIF_PATH" ]; then
+          CMD="$CMD --sarif $SARIF_PATH"
+          echo "sarif_file=$SARIF_PATH" >> $GITHUB_OUTPUT
+        fi
+
+        # Add paranoid mode if enabled
+        if [ "${{ inputs.paranoid }}" = "true" ]; then
+          CMD="$CMD --paranoid"
+        fi
+
+        # Run scan and capture output
+        set +e
+        OUTPUT=$($CMD --json 2>&1)
+        EXIT_CODE=$?
+        set -e
+
+        # Extract metrics from JSON output
+        RISK_SCORE=$(echo "$OUTPUT" | grep -o '"score":[0-9]*' | head -1 | cut -d':' -f2 || echo "0")
+        THREATS_COUNT=$(echo "$OUTPUT" | grep -o '"threats":\[' | wc -l || echo "0")
+
+        echo "risk_score=$RISK_SCORE" >> $GITHUB_OUTPUT
+        echo "threats_count=$THREATS_COUNT" >> $GITHUB_OUTPUT
+        echo "exit_code=$EXIT_CODE" >> $GITHUB_OUTPUT
+
+        # Re-run without --json for human-readable output
+        $CMD || true
+
+        # Exit with the original code
+        exit $EXIT_CODE
+
+    - name: Upload SARIF to GitHub Security
+      if: inputs.sarif != '' && always()
+      uses: github/codeql-action/upload-sarif@v3
+      with:
+        sarif_file: ${{ inputs.sarif }}
+      continue-on-error: true

package/bin/muaddib.js

@@ -1,4 +1,5 @@
-#!/usr/bin/env node
+#!/usr/bin/env node
+const { execSync } = require('child_process');
 const { run } = require('../src/index.js');
 const { updateIOCs } = require('../src/ioc/updater.js');
 const { watch } = require('../src/watch.js');
@@ -47,6 +48,20 @@ for (let i = 0; i < options.length; i++) {
   }
 }
 
+// Version check (non-blocking, skip for machine-readable output)
+if (!jsonOutput && !sarifOutput) {
+  try {
+    const currentVersion = require('../package.json').version;
+    const latest = execSync('npm view muaddib-scanner version', { timeout: 5000 }).toString().trim();
+    if (latest !== currentVersion) {
+      console.log(`\n[UPDATE] New version available: ${currentVersion} -> ${latest}`);
+      console.log(`  Run: npm install -g muaddib-scanner@latest\n`);
+    }
+  } catch {
+    // No network or npm unavailable, skip silently
+  }
+}
+
 // Interactive menu
 async function interactiveMenu() {
   const { select, input, confirm } = await import('@inquirer/prompts');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muaddib-scanner",
-  "version": "1.2.7",
+  "version": "1.3.0",
   "description": "Supply-chain threat detection & response for npm",
   "main": "src/index.js",
   "bin": {
@@ -37,16 +37,16 @@
     "node": ">=18.0.0"
   },
   "dependencies": {
-    "@inquirer/prompts": "8.1.0",
-    "acorn": "8.14.0",
+    "@inquirer/prompts": "8.2.0",
+    "acorn": "8.15.0",
     "acorn-walk": "8.3.4",
     "chalk": "5.6.2",
-    "js-yaml": "4.1.0",
+    "js-yaml": "4.1.1",
     "yargs": "18.0.0"
   },
   "devDependencies": {
     "@eslint/js": "9.39.2",
     "eslint": "9.39.2",
-    "globals": "17.0.0"
+    "globals": "17.3.0"
   }
 }