npm-scan-plus 1.0.0

package/dist/lib/patterns.js

@@ -0,0 +1,414 @@
+"use strict";
+/**
+ * Detection patterns for malicious code, obfuscation, and suspicious behavior
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CODE_EXTENSIONS = exports.SENSITIVE_FILES = exports.SUSPICIOUS_SCRIPTS = exports.SUSPICIOUS_PATTERNS = exports.OBFUSCATION_PATTERNS = void 0;
+exports.scanFile = scanFile;
+exports.scanPackageJsonScripts = scanPackageJsonScripts;
+exports.scanDirectory = scanDirectory;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+// Patterns that indicate obfuscated code
+const OBFUSCATION_PATTERNS = [
+    {
+        pattern: /eval\s*\(\s*(?:atob|fromCharCode|String\.fromCharCode)/gi,
+        type: 'obfuscation',
+        severity: 'high',
+        message: 'eval() with character code decoding - common obfuscation technique'
+    },
+    {
+        pattern: /eval\s*\(\s*["'`]([A-Za-z0-9+\/=]{100,})["'`]*/gi,
+        type: 'obfuscation',
+        severity: 'high',
+        message: 'eval() with base64-encoded string'
+    },
+    {
+        pattern: /new\s+Function\s*\(\s*(?:atob|fromCharCode)/gi,
+        type: 'obfuscation',
+        severity: 'high',
+        message: 'Dynamic Function with character code decoding'
+    },
+    {
+        pattern: /\\x([0-9a-fA-F]{2})/g,
+        type: 'obfuscation',
+        severity: 'medium',
+        message: 'Hex-encoded characters in code'
+    },
+    {
+        pattern: /\\u([0-9a-fA-F]{4})/g,
+        type: 'obfuscation',
+        severity: 'medium',
+        message: 'Unicode-escaped characters in code'
+    },
+    {
+        pattern: /(?:atob|btoa)\s*\([^)]*\)/g,
+        type: 'obfuscation',
+        severity: 'medium',
+        message: 'Base64 encoding/decoding functions detected'
+    },
+    {
+        pattern: /String\.fromCharCode\((?:\s*\d+\s*,?)+\)/g,
+        type: 'obfuscation',
+        severity: 'medium',
+        message: 'String.fromCharCode() to hide code'
+    },
+    {
+        pattern: /\$_\s*=\s*["'`]/g,
+        type: 'obfuscation',
+        severity: 'low',
+        message: 'Unusual variable naming pattern'
+    }
+];
+exports.OBFUSCATION_PATTERNS = OBFUSCATION_PATTERNS;
+// Patterns that indicate malicious/malware behavior
+const SUSPICIOUS_PATTERNS = [
+    {
+        pattern: /(?:process\.env|process)\s*\.\s*(?:env|argv)\s*\[.*?(?:KEY|SECRET|TOKEN|PASS|Auth|Credential)/gi,
+        type: 'suspicious_code',
+        severity: 'critical',
+        message: 'Accessing environment variables with sensitive keywords'
+    },
+    {
+        pattern: /fetch\s*\(\s*["'](?:https?:)?\/\/(?:[0-9]{1,3}\.){3}[0-9]{1,3}/gi,
+        type: 'suspicious_code',
+        severity: 'high',
+        message: 'Network request to IP address (bypasses DNS)'
+    },
+    {
+        pattern: /https?:\/\/(?:pastebin|hastebin|ipfs\.io|cloudflare|workers\.dev)\.\w+/gi,
+        type: 'suspicious_code',
+        severity: 'high',
+        message: 'Network request to external code hosting service'
+    },
+    {
+        pattern: /child_process\s*\.\s*(?:exec|spawn|sync)\s*\(\s*["'`]/gi,
+        type: 'suspicious_code',
+        severity: 'high',
+        message: 'Executing shell commands from package code'
+    },
+    {
+        pattern: /net\.connect\(|require\s*\(\s*["'](?:net|http|tls|crypto)["']\s*\)/gi,
+        type: 'suspicious_code',
+        severity: 'medium',
+        message: 'Network or crypto module required'
+    },
+    {
+        pattern: /require\s*\(\s*["'](?:child_process|exec|spawn)["']\s*\)/gi,
+        type: 'suspicious_code',
+        severity: 'high',
+        message: 'child_process module required - potential command execution'
+    },
+    {
+        pattern: /setTimeout\s*\(\s*["'`]/gi,
+        type: 'suspicious_code',
+        severity: 'low',
+        message: 'Delayed code execution'
+    },
+    {
+        pattern: /setInterval\s*\(\s*["'`]/gi,
+        type: 'suspicious_code',
+        severity: 'low',
+        message: 'Repeating scheduled code execution'
+    },
+    {
+        pattern: /\.exec\s*\(|child_process\.\s*exec/gi,
+        type: 'suspicious_code',
+        severity: 'high',
+        message: 'Shell command execution'
+    },
+    {
+        pattern: /fs\s*\.\s*(?:readFile|writeFile|appendFile|readFileSync|writeFileSync)\s*\(\s*(?:__dirname|process\.cwd\(\))/gi,
+        type: 'suspicious_code',
+        severity: 'medium',
+        message: 'File system access in package root'
+    },
+    {
+        pattern: /(?:readdirSync|readdir|readFileSync|readlinkSync)\s*\(\s*(?:\.|process\.cwd)/gi,
+        type: 'suspicious_code',
+        severity: 'medium',
+        message: 'Scanning directories outside package'
+    },
+    {
+        pattern: /eval\s*\(\s*process\.env/gi,
+        type: 'suspicious_code',
+        severity: 'critical',
+        message: 'Evaluating environment variables'
+    },
+    {
+        pattern: /require\s*\(\s*["'](?:https?|http)["']\s*\)/gi,
+        type: 'suspicious_code',
+        severity: 'medium',
+        message: 'HTTP/HTTPS module required'
+    },
+    {
+        pattern: /crypto\s*\.\s*createHash\s*\(\s*["'](?:sha|md5)["']\s*\)/gi,
+        type: 'suspicious_code',
+        severity: 'low',
+        message: 'Cryptographic hashing'
+    },
+    {
+        // Crypto mining patterns
+        pattern: /(?:stratum\+tcp|stratum\.bitcoin|cgminer|antminer|cryptonight)/gi,
+        type: 'suspicious_code',
+        severity: 'critical',
+        message: 'Crypto mining pool connection detected'
+    },
+    {
+        // Keylogging patterns
+        pattern: /(?:addEventListener\s*\(\s*["'](?:keydown|keypress|keyup)|onkey)/gi,
+        type: 'suspicious_code',
+        severity: 'high',
+        message: 'Keyboard event listener - potential keylogger'
+    },
+    {
+        pattern: /(?:key|code)\s*:\s*(?:\d{1,3}\s*,?\s*){3,}/gi,
+        type: 'suspicious_code',
+        severity: 'high',
+        message: 'Potential keyboard scanning code'
+    }
+];
+exports.SUSPICIOUS_PATTERNS = SUSPICIOUS_PATTERNS;
+// Suspicious lifecycle scripts in package.json
+const SUSPICIOUS_SCRIPTS = [
+    {
+        script: 'postinstall',
+        severity: 'high',
+        message: 'postinstall script executes automatically after install'
+    },
+    {
+        script: 'preinstall',
+        severity: 'medium',
+        message: 'preinstall script runs before package installs'
+    },
+    {
+        script: 'postpublish',
+        severity: 'medium',
+        message: 'postpublish script runs after package is published'
+    },
+    {
+        script: 'preuninstall',
+        severity: 'low',
+        message: 'preuninstall script runs before uninstall'
+    },
+    {
+        script: 'postuninstall',
+        severity: 'medium',
+        message: 'postuninstall script runs after uninstall'
+    },
+    {
+        script: 'preversion',
+        severity: 'low',
+        message: 'preversion script runs before version bump'
+    },
+    {
+        script: 'postversion',
+        severity: 'low',
+        message: 'postversion script runs after version bump'
+    },
+    {
+        script: 'prepack',
+        severity: 'low',
+        message: 'prepack script runs before packing'
+    },
+    {
+        script: 'postpack',
+        severity: 'low',
+        message: 'postpack script runs after packing'
+    },
+    {
+        script: 'prepare',
+        severity: 'low',
+        message: 'prepare script runs on install and publish'
+    }
+];
+exports.SUSPICIOUS_SCRIPTS = SUSPICIOUS_SCRIPTS;
+// Sensitive files that should not be in packages
+const SENSITIVE_FILES = [
+    /\.env$/,
+    /\.env\.[a-z]+$/,
+    /\.git\/config$/,
+    /\.aws\/credentials$/,
+    /\.ssh\/id_.*$/,
+    /credentials\.json$/,
+    /\.npmrc$/,
+    /\.htpasswd$/,
+    /secrets\.ya?ml$/,
+    /\.pem$/,
+    /\.key$/,
+    /\.p12$/,
+    /\.pfx$/,
+    /id_rsa/,
+    /id_dsa/,
+    /\.bash_history$/,
+    /\.zsh_history$/,
+    /\.history$/,
+    /_history$/,
+    /\.sql$/,
+    /\.db$/
+];
+exports.SENSITIVE_FILES = SENSITIVE_FILES;
+// File extensions that might contain executable code
+const CODE_EXTENSIONS = [
+    '.js', '.mjs', '.cjs', '.ts', '.tsx', '.jsx',
+    '.py', '.rb', '.php', '.pl', '.sh', '.bash',
+    '.exe', '.dll', '.so', '.dylib', '.bin',
+    '.wasm', '.class', '.jar'
+];
+exports.CODE_EXTENSIONS = CODE_EXTENSIONS;
+/**
+ * Scan a single file for suspicious patterns
+ */
+function scanFile(filePath, content) {
+    const threats = [];
+    const fileName = path.basename(filePath);
+    const ext = path.extname(filePath).toLowerCase();
+    // Skip node_modules packages themselves
+    if (filePath.includes('node_modules/')) {
+        return [];
+    }
+    // Check for obfuscation patterns
+    for (const { pattern, type, severity, message } of OBFUSCATION_PATTERNS) {
+        const matches = content.match(pattern);
+        if (matches) {
+            threats.push({
+                package: 'scanning',
+                file: fileName,
+                type,
+                severity,
+                message,
+                code: matches[0].substring(0, 100)
+            });
+        }
+    }
+    // Check for suspicious patterns (only in code files)
+    if (CODE_EXTENSIONS.includes(ext)) {
+        for (const { pattern, type, severity, message } of SUSPICIOUS_PATTERNS) {
+            const matches = content.match(pattern);
+            if (matches) {
+                threats.push({
+                    package: 'scanning',
+                    file: fileName,
+                    type,
+                    severity,
+                    message,
+                    code: matches[0].substring(0, 100)
+                });
+            }
+        }
+    }
+    // Check for sensitive files
+    for (const pattern of SENSITIVE_FILES) {
+        if (pattern.test(fileName)) {
+            threats.push({
+                package: 'scanning',
+                file: fileName,
+                type: 'suspicious_code',
+                severity: 'high',
+                message: `Sensitive file detected in package: ${fileName}`
+            });
+        }
+    }
+    return threats;
+}
+/**
+ * Check package.json scripts for suspicious behavior
+ */
+function scanPackageJsonScripts(scripts) {
+    const threats = [];
+    if (!scripts)
+        return threats;
+    for (const [scriptName, scriptContent] of Object.entries(scripts)) {
+        const scriptDef = SUSPICIOUS_SCRIPTS.find(s => s.script === scriptName);
+        if (scriptDef) {
+            // Check if script content is suspicious
+            const isSuspicious = /curl|wget|npm|node|yarn|python|perl|bash|sh|\||&&|\$\(|;/.test(scriptContent) ||
+                scriptContent.length > 200;
+            threats.push({
+                package: 'scanning',
+                file: 'package.json',
+                type: isSuspicious ? 'suspicious_script' : 'supply_chain',
+                severity: isSuspicious ? scriptDef.severity : 'low',
+                message: `${scriptDef.message}: "${scriptName}"`,
+                code: scriptContent.substring(0, 100)
+            });
+        }
+    }
+    return threats;
+}
+/**
+ * Scan directory for all files
+ */
+function scanDirectory(dirPath, extensions) {
+    const files = new Map();
+    const codeExtensions = extensions || CODE_EXTENSIONS;
+    function walkDir(dir, basePath = '') {
+        try {
+            const entries = fs.readdirSync(dir, { withFileTypes: true });
+            for (const entry of entries) {
+                const fullPath = path.join(dir, entry.name);
+                const relativePath = path.join(basePath, entry.name);
+                if (entry.isDirectory()) {
+                    // Skip certain directories
+                    if (['node_modules', '.git', 'test', '__tests__', 'coverage'].includes(entry.name)) {
+                        continue;
+                    }
+                    walkDir(fullPath, relativePath);
+                }
+                else if (entry.isFile()) {
+                    const ext = path.extname(entry.name).toLowerCase();
+                    if (codeExtensions.includes(ext)) {
+                        try {
+                            const content = fs.readFileSync(fullPath, 'utf-8');
+                            if (content.length < 1_000_000) { // Skip files > 1MB
+                                files.set(relativePath, content);
+                            }
+                        }
+                        catch (e) {
+                            // Skip binary or unreadable files
+                        }
+                    }
+                }
+            }
+        }
+        catch (e) {
+            // Skip inaccessible directories
+        }
+    }
+    walkDir(dirPath);
+    return files;
+}
+//# sourceMappingURL=patterns.js.map

package/dist/lib/patterns.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"patterns.js","sourceRoot":"","sources":["../../src/lib/patterns.ts"],"names":[],"mappings":";AAAA;;GAEG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuQH,4BAwDC;AAKD,wDAyBC;AAKD,sCAuCC;AAvYD,uCAAyB;AACzB,2CAA6B;AAG7B,yCAAyC;AACzC,MAAM,oBAAoB,GAAG;IAC3B;QACE,OAAO,EAAE,0DAA0D;QACnE,IAAI,EAAE,aAA2B;QACjC,QAAQ,EAAE,MAAe;QACzB,OAAO,EAAE,oEAAoE;KAC9E;IACD;QACE,OAAO,EAAE,kDAAkD;QAC3D,IAAI,EAAE,aAA2B;QACjC,QAAQ,EAAE,MAAe;QACzB,OAAO,EAAE,mCAAmC;KAC7C;IACD;QACE,OAAO,EAAE,+CAA+C;QACxD,IAAI,EAAE,aAA2B;QACjC,QAAQ,EAAE,MAAe;QACzB,OAAO,EAAE,+CAA+C;KACzD;IACD;QACE,OAAO,EAAE,sBAAsB;QAC/B,IAAI,EAAE,aAA2B;QACjC,QAAQ,EAAE,QAAiB;QAC3B,OAAO,EAAE,gCAAgC;KAC1C;IACD;QACE,OAAO,EAAE,sBAAsB;QAC/B,IAAI,EAAE,aAA2B;QACjC,QAAQ,EAAE,QAAiB;QAC3B,OAAO,EAAE,oCAAoC;KAC9C;IACD;QACE,OAAO,EAAE,4BAA4B;QACrC,IAAI,EAAE,aAA2B;QACjC,QAAQ,EAAE,QAAiB;QAC3B,OAAO,EAAE,6CAA6C;KACvD;IACD;QACE,OAAO,EAAE,2CAA2C;QACpD,IAAI,EAAE,aAA2B;QACjC,QAAQ,EAAE,QAAiB;QAC3B,OAAO,EAAE,oCAAoC;KAC9C;IACD;QACE,OAAO,EAAE,kBAAkB;QAC3B,IAAI,EAAE,aAA2B;QACjC,QAAQ,EAAE,KAAc;QACxB,OAAO,EAAE,iCAAiC;KAC3C;CACF,CAAC;AAoVA,oDAAoB;AAlVtB,oDAAoD;AACpD,MAAM,mBAAmB,GAAG;IAC1B;QACE,OAAO,EAAE,iGAAiG;QAC1G,IAAI,EAAE,iBAA+B;QACrC,QAAQ,EAAE,UAAmB;QAC7B,OAAO,EAAE,yDAAyD;KACnE;IACD;QACE,OAAO,EAAE,kEAAkE;QAC3E,IAAI,EAAE,iBAA+B;QACrC,QAAQ,EAAE,MAAe;QACzB,OAAO,EAAE,8CAA8C;KACxD;IACD;QACE,OAAO,EAAE,0EAA0E;QACnF,IAAI,EAAE,iBAA+B;QACrC,QAAQ,EAAE,MAAe;QACzB,OAAO,EAAE,kDAAkD;KAC5D;IACD;QACE,OAAO,EAAE,yDAAyD;QAClE,IAAI,EAAE,iBAA+B;QACrC,QAAQ,EAAE,MAAe;QACzB,OAAO,EAAE,4CAA4C;KACtD;IACD;QACE,OAAO,EAAE,sEAAsE;QAC/E,IAAI,EAAE,iBAA+B;QACrC,QAAQ,EAAE,QAAiB;QAC3B,OAAO,EAAE,mCAAmC;KAC7C;IACD;QACE,OAAO,EAAE,4DAA4D;QACrE,IAAI,EAAE,iBAA+B;QACrC,QAAQ,EAAE,MAAe;QACzB,OAAO,EAAE,6DAA6D;KACvE;IACD;QACE,OAAO,EAAE,2BAA2B;QACpC,IAAI,EAAE,iBAA+B;QACrC,QAAQ,EAAE,KAAc;QACxB,OAAO,EAAE,wBAAwB;KAClC;IACD;QACE,OAAO,EAAE,4BAA4B;QACrC,IAAI,EAAE,iBAA+B;QACrC,QAAQ,EAAE,KAAc;QACxB,OAAO,EAAE,oCAAoC;KAC9C;IACD;QACE,OAAO,EAAE,sCAAsC;QAC/C,IAAI,EAAE,iBAA+B;QACrC,QAAQ,EAAE,MAAe;QACzB,OAAO,EAAE,yBAAyB;KACnC;IACD;QACE,OAAO,EAAE,gHAAgH;QACzH,IAAI,EAAE,iBAA+B;QACrC,QAAQ,EAAE,QAAiB;QAC3B,OAAO,EAAE,oCAAoC;KAC9C;IACD;QACE,OAAO,EAAE,gFAAgF;QACzF,IAAI,EAAE,iBAA+B;QACrC,QAAQ,EAAE,QAAiB;QAC3B,OAAO,EAAE,sCAAsC;KAChD;IACD;QACE,OAAO,EAAE,4BAA4B;QACrC,IAAI,EAAE,iBAA+B;QACrC,QAAQ,EAAE,UAAmB;QAC7B,OAAO,EAAE,kCAAkC;KAC5C;IACD;QACE,OAAO,EAAE,+CAA+C;QACxD,IAAI,EAAE,iBAA+B;QACrC,QAAQ,EAAE,QAAiB;QAC3B,OAAO,EAAE,4BAA4B;KACtC;IACD;QACE,OAAO,EAAE,4DAA4D;QACrE,IAAI,EAAE,iBAA+B;QACrC,QAAQ,EAAE,KAAc;QACxB,OAAO,EAAE,uBAAuB;KACjC;IACD;QACE,yBAAyB;QACzB,OAAO,EAAE,kEAAkE;QAC3E,IAAI,EAAE,iBAA+B;QACrC,QAAQ,EAAE,UAAmB;QAC7B,OAAO,EAAE,wCAAwC;KAClD;IACD;QACE,sBAAsB;QACtB,OAAO,EAAE,oEAAoE;QAC7E,IAAI,EAAE,iBAA+B;QACrC,QAAQ,EAAE,MAAe;QACzB,OAAO,EAAE,+CAA+C;KACzD;IACD;QACE,OAAO,EAAE,8CAA8C;QACvD,IAAI,EAAE,iBAA+B;QACrC,QAAQ,EAAE,MAAe;QACzB,OAAO,EAAE,kCAAkC;KAC5C;CACF,CAAC;AAyOA,kDAAmB;AAvOrB,+CAA+C;AAC/C,MAAM,kBAAkB,GAAG;IACzB;QACE,MAAM,EAAE,aAAa;QACrB,QAAQ,EAAE,MAAe;QACzB,OAAO,EAAE,yDAAyD;KACnE;IACD;QACE,MAAM,EAAE,YAAY;QACpB,QAAQ,EAAE,QAAiB;QAC3B,OAAO,EAAE,gDAAgD;KAC1D;IACD;QACE,MAAM,EAAE,aAAa;QACrB,QAAQ,EAAE,QAAiB;QAC3B,OAAO,EAAE,oDAAoD;KAC9D;IACD;QACE,MAAM,EAAE,cAAc;QACtB,QAAQ,EAAE,KAAc;QACxB,OAAO,EAAE,2CAA2C;KACrD;IACD;QACE,MAAM,EAAE,eAAe;QACvB,QAAQ,EAAE,QAAiB;QAC3B,OAAO,EAAE,2CAA2C;KACrD;IACD;QACE,MAAM,EAAE,YAAY;QACpB,QAAQ,EAAE,KAAc;QACxB,OAAO,EAAE,4CAA4C;KACtD;IACD;QACE,MAAM,EAAE,aAAa;QACrB,QAAQ,EAAE,KAAc;QACxB,OAAO,EAAE,4CAA4C;KACtD;IACD;QACE,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE,KAAc;QACxB,OAAO,EAAE,oCAAoC;KAC9C;IACD;QACE,MAAM,EAAE,UAAU;QAClB,QAAQ,EAAE,KAAc;QACxB,OAAO,EAAE,oCAAoC;KAC9C;IACD;QACE,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE,KAAc;QACxB,OAAO,EAAE,4CAA4C;KACtD;CACF,CAAC;AAoLA,gDAAkB;AAlLpB,iDAAiD;AACjD,MAAM,eAAe,GAAG;IACtB,QAAQ;IACR,gBAAgB;IAChB,gBAAgB;IAChB,qBAAqB;IACrB,eAAe;IACf,oBAAoB;IACpB,UAAU;IACV,aAAa;IACb,iBAAiB;IACjB,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,iBAAiB;IACjB,gBAAgB;IAChB,YAAY;IACZ,WAAW;IACX,QAAQ;IACR,OAAO;CACR,CAAC;AA4JA,0CAAe;AA1JjB,qDAAqD;AACrD,MAAM,eAAe,GAAG;IACtB,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM;IAC5C,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO;IAC3C,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM;IACvC,OAAO,EAAE,QAAQ,EAAE,MAAM;CAC1B,CAAC;AAqJA,0CAAe;AA5IjB;;GAEG;AACH,SAAgB,QAAQ,CAAC,QAAgB,EAAE,OAAe;IACxD,MAAM,OAAO,GAAiB,EAAE,CAAC;IACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IAEjD,wCAAwC;IACxC,IAAI,QAAQ,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;QACvC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,iCAAiC;IACjC,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,oBAAoB,EAAE,CAAC;QACxE,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,IAAI,CAAC;gBACX,OAAO,EAAE,UAAU;gBACnB,IAAI,EAAE,QAAQ;gBACd,IAAI;gBACJ,QAAQ;gBACR,OAAO;gBACP,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC;aACnC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,qDAAqD;IACrD,IAAI,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAClC,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,mBAAmB,EAAE,CAAC;YACvE,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACvC,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,CAAC,IAAI,CAAC;oBACX,OAAO,EAAE,UAAU;oBACnB,IAAI,EAAE,QAAQ;oBACd,IAAI;oBACJ,QAAQ;oBACR,OAAO;oBACP,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC;iBACnC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,4BAA4B;IAC5B,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;QACtC,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3B,OAAO,CAAC,IAAI,CAAC;gBACX,OAAO,EAAE,UAAU;gBACnB,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,iBAAiB;gBACvB,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,uCAAuC,QAAQ,EAAE;aAC3D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,SAAgB,sBAAsB,CAAC,OAA+B;IACpE,MAAM,OAAO,GAAiB,EAAE,CAAC;IAEjC,IAAI,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC;IAE7B,KAAK,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAClE,MAAM,SAAS,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC;QAExE,IAAI,SAAS,EAAE,CAAC;YACd,wCAAwC;YACxC,MAAM,YAAY,GAAG,0DAA0D,CAAC,IAAI,CAAC,aAAa,CAAC;gBACjG,aAAa,CAAC,MAAM,GAAG,GAAG,CAAC;YAE7B,OAAO,CAAC,IAAI,CAAC;gBACX,OAAO,EAAE,UAAU;gBACnB,IAAI,EAAE,cAAc;gBACpB,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,cAAc;gBACzD,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK;gBACnD,OAAO,EAAE,GAAG,SAAS,CAAC,OAAO,MAAM,UAAU,GAAG;gBAChD,IAAI,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC;aACtC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,SAAgB,aAAa,CAAC,OAAe,EAAE,UAAqB;IAClE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,MAAM,cAAc,GAAG,UAAU,IAAI,eAAe,CAAC;IAErD,SAAS,OAAO,CAAC,GAAW,EAAE,WAAmB,EAAE;QACjD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;YAE7D,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;gBAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;gBAC5C,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;gBAErD,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;oBACxB,2BAA2B;oBAC3B,IAAI,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;wBACnF,SAAS;oBACX,CAAC;oBACD,OAAO,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;gBAClC,CAAC;qBAAM,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;oBAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;oBACnD,IAAI,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;wBACjC,IAAI,CAAC;4BACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;4BACnD,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC,CAAC,mBAAmB;gCACnD,KAAK,CAAC,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;4BACnC,CAAC;wBACH,CAAC;wBAAC,OAAO,CAAC,EAAE,CAAC;4BACX,kCAAkC;wBACpC,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,gCAAgC;QAClC,CAAC;IACH,CAAC;IAED,OAAO,CAAC,OAAO,CAAC,CAAC;IACjB,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/lib/registry.d.ts

@@ -0,0 +1,42 @@
+/**
+ * npm registry API client
+ * Fetches package metadata and tarballs from npm registry
+ */
+import type { PackageMetadata, ScanOptions } from './types';
+export declare class RegistryClient {
+    private registry;
+    private cache;
+    constructor(options?: {
+        registry?: string;
+    });
+    /**
+     * Fetch package metadata from npm registry
+     */
+    getPackageMetadata(packageName: string, version?: string): Promise<PackageMetadata>;
+    /**
+     * Normalize npm registry response to our PackageMetadata type
+     */
+    private normalizeMetadata;
+    /**
+     * Download and extract package tarball to temp directory
+     */
+    downloadPackage(packageName: string, version?: string): Promise<{
+        tempDir: string;
+        files: string[];
+        integrity: string;
+    }>;
+    /**
+     * Recursively get all files in directory
+     */
+    private getAllFiles;
+    /**
+     * Clean up temp directory
+     */
+    cleanup(tempDir: string): void;
+    /**
+     * Get all available versions of a package
+     */
+    getVersions(packageName: string): Promise<string[]>;
+}
+export declare function createRegistryClient(options?: ScanOptions): RegistryClient;
+//# sourceMappingURL=registry.d.ts.map

package/dist/lib/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/lib/registry.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAQH,OAAO,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAI5D,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,KAAK,CAA2C;gBAE5C,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE;IAI3C;;OAEG;IACG,kBAAkB,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IA6BzF;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAwBzB;;OAEG;IACG,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QACpE,OAAO,EAAE,MAAM,CAAC;QAChB,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;IA2CF;;OAEG;IACH,OAAO,CAAC,WAAW;IAoBnB;;OAEG;IACH,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAQ9B;;OAEG;IACG,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;CAS1D;AAED,wBAAgB,oBAAoB,CAAC,OAAO,CAAC,EAAE,WAAW,GAAG,cAAc,CAE1E"}

package/dist/lib/registry.js

@@ -0,0 +1,157 @@
+"use strict";
+/**
+ * npm registry API client
+ * Fetches package metadata and tarballs from npm registry using native fetch
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RegistryClient = void 0;
+exports.createRegistryClient = createRegistryClient;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const os = __importStar(require("os"));
+const tar = __importStar(require("tar"));
+const crypto = __importStar(require("crypto"));
+const DEFAULT_REGISTRY = 'https://registry.npmjs.org';
+class RegistryClient {
+    registry;
+    cache = new Map();
+    constructor(options) {
+        this.registry = options?.registry || DEFAULT_REGISTRY;
+    }
+    /**
+     * Fetch package metadata from npm registry
+     */
+    async getPackageMetadata(packageName, version) {
+        const cacheKey = `${packageName}@${version || 'latest'}`;
+        if (this.cache.has(cacheKey)) {
+            return this.cache.get(cacheKey);
+        }
+        const url = `${this.registry}/${packageName}${version ? `/${version}` : ''}`;
+        try {
+            const response = await fetch(url);
+            if (!response.ok) {
+                if (response.status === 404) {
+                    throw new Error(`Package not found: ${packageName}`);
+                }
+                throw new Error(`Failed to fetch ${packageName}: ${response.statusText}`);
+            }
+            const data = await response.json();
+            this.cache.set(cacheKey, data);
+            return data;
+        }
+        catch (error) {
+            throw new Error(`Failed to fetch ${packageName}: ${error.message}`);
+        }
+    }
+    /**
+     * Download and extract package tarball to temp directory
+     */
+    async downloadPackage(packageName, version) {
+        const metadata = await this.getPackageMetadata(packageName, version);
+        const dist = metadata.dist || {};
+        if (!dist.tarball) {
+            throw new Error(`No tarball found for ${packageName}`);
+        }
+        const tempDir = path.join(os.tmpdir(), `npm-scan-${Date.now()}-${Math.random().toString(36).substr(2, 9)}`);
+        fs.mkdirSync(tempDir, { recursive: true });
+        const tarballPath = path.join(tempDir, 'package.tgz');
+        // Download tarball
+        const response = await fetch(dist.tarball);
+        const arrayBuffer = await response.arrayBuffer();
+        const buffer = Buffer.from(arrayBuffer);
+        fs.writeFileSync(tarballPath, buffer);
+        // Calculate integrity hash (sha512)
+        const integrity = 'sha512-' + crypto.createHash('sha512').update(buffer).digest('base64');
+        // Extract tarball
+        const extractDir = path.join(tempDir, 'package');
+        fs.mkdirSync(extractDir, { recursive: true });
+        await tar.extract({
+            file: tarballPath,
+            cwd: extractDir
+        });
+        // Get list of extracted files
+        const files = this.getAllFiles(extractDir);
+        return { tempDir, files, integrity };
+    }
+    /**
+     * Recursively get all files in directory
+     */
+    getAllFiles(dir, baseDir) {
+        const files = [];
+        const base = baseDir || dir;
+        try {
+            const entries = fs.readdirSync(dir, { withFileTypes: true });
+            for (const entry of entries) {
+                const fullPath = path.join(dir, entry.name);
+                const relativePath = path.relative(base, fullPath);
+                if (entry.isDirectory()) {
+                    files.push(...this.getAllFiles(fullPath, base));
+                }
+                else if (entry.isFile()) {
+                    files.push(relativePath);
+                }
+            }
+        }
+        catch (e) {
+            // Skip inaccessible
+        }
+        return files;
+    }
+    /**
+     * Clean up temp directory
+     */
+    cleanup(tempDir) {
+        try {
+            fs.rmSync(tempDir, { recursive: true, force: true });
+        }
+        catch (e) {
+            // Ignore cleanup errors
+        }
+    }
+    /**
+     * Get all available versions of a package
+     */
+    async getVersions(packageName) {
+        const response = await fetch(`${this.registry}/${packageName}`);
+        const data = await response.json();
+        return Object.keys(data.versions || {}).sort();
+    }
+}
+exports.RegistryClient = RegistryClient;
+function createRegistryClient(options) {
+    return new RegistryClient({ registry: options?.registry });
+}
+//# sourceMappingURL=registry.js.map

package/dist/lib/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/lib/registry.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4IH,oDAEC;AA5ID,uCAAyB;AACzB,2CAA6B;AAC7B,uCAAyB;AACzB,yCAA2B;AAC3B,+CAAiC;AAEjC,MAAM,gBAAgB,GAAG,4BAA4B,CAAC;AAEtD,MAAa,cAAc;IACjB,QAAQ,CAAS;IACjB,KAAK,GAAQ,IAAI,GAAG,EAAE,CAAC;IAE/B,YAAY,OAA+B;QACzC,IAAI,CAAC,QAAQ,GAAG,OAAO,EAAE,QAAQ,IAAI,gBAAgB,CAAC;IACxD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,kBAAkB,CAAC,WAAmB,EAAE,OAAgB;QAC5D,MAAM,QAAQ,GAAG,GAAG,WAAW,IAAI,OAAO,IAAI,QAAQ,EAAE,CAAC;QAEzD,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAClC,CAAC;QAED,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,QAAQ,IAAI,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QAE7E,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;YAElC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBAC5B,MAAM,IAAI,KAAK,CAAC,sBAAsB,WAAW,EAAE,CAAC,CAAC;gBACvD,CAAC;gBACD,MAAM,IAAI,KAAK,CAAC,mBAAmB,WAAW,KAAK,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;YAC5E,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YAC/B,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,mBAAmB,WAAW,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,eAAe,CAAC,WAAmB,EAAE,OAAgB;QAKzD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QACrE,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC;QAEjC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,wBAAwB,WAAW,EAAE,CAAC,CAAC;QACzD,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,YAAY,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QAC5G,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAE3C,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QAEtD,mBAAmB;QACnB,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC3C,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC;QACjD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACxC,EAAE,CAAC,aAAa,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAEtC,oCAAoC;QACpC,MAAM,SAAS,GAAG,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAE1F,kBAAkB;QAClB,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACjD,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAE9C,MAAM,GAAG,CAAC,OAAO,CAAC;YAChB,IAAI,EAAE,WAAW;YACjB,GAAG,EAAE,UAAU;SAChB,CAAC,CAAC;QAEH,8BAA8B;QAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;QAE3C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IACvC,CAAC;IAED;;OAEG;IACK,WAAW,CAAC,GAAW,EAAE,OAAgB;QAC/C,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,OAAO,IAAI,GAAG,CAAC;QAE5B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;YAE7D,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;gBAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;gBAC5C,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;gBAEnD,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;oBACxB,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;gBAClD,CAAC;qBAAM,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;oBAC1B,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;gBAC3B,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,oBAAoB;QACtB,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,OAAe;QACrB,IAAI,CAAC;YACH,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACvD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,wBAAwB;QAC1B,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CAAC,WAAmB;QACnC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,QAAQ,IAAI,WAAW,EAAE,CAAC,CAAC;QAChE,MAAM,IAAI,GAAQ,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACxC,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACjD,CAAC;CACF;AAhID,wCAgIC;AAED,SAAgB,oBAAoB,CAAC,OAAa;IAChD,OAAO,IAAI,cAAc,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;AAC7D,CAAC"}

package/dist/lib/scanner.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Core scanner module
+ * Pre and post-install security scanning for npm packages
+ */
+import type { ScanResult, ScanOptions, PostInstallScanResult } from '../types';
+/**
+ * Main scanner class
+ */
+export declare class Scanner {
+    private registry;
+    private options;
+    constructor(options?: ScanOptions);
+    /**
+     * Pre-install scan: Check a package before installation
+     */
+    preInstallScan(packageName: string, version?: string): Promise<ScanResult>;
+    /**
+     * Post-install scan: Scan downloaded packages
+     */
+    postInstallScan(folderPath?: string): Promise<PostInstallScanResult>;
+    /**
+     * Full scan: Pre-scan, then install, then post-scan
+     */
+    fullScan(packageName: string, version?: string, folderPath?: string): Promise<{
+        pre: ScanResult;
+        post: PostInstallScanResult;
+    }>;
+    /**
+     * Find all packages in node_modules
+     */
+    private findPackages;
+    /**
+     * Determine overall status from threats and score
+     */
+    private determineStatus;
+}
+export declare function createScanner(options?: ScanOptions): Scanner;
+declare const _default: {
+    Scanner: typeof Scanner;
+    createScanner: typeof createScanner;
+};
+export default _default;
+//# sourceMappingURL=scanner.d.ts.map