nsauditor-ai 0.1.84 → 0.1.86

package/README.md

@@ -17,8 +17,13 @@ NSAuditor AI is the open-source core of a privacy-first security intelligence pl
 
 ## What's New
 
-**Latest: CE 0.1.84 + Enterprise 0.15.3** (May 2026)
+**Latest: CE 0.1.86 + Enterprise 0.15.5** (May 2026)
 
+- 🧹 **Dependency-hygiene / institutional-trust patch** (CE 0.1.86 — paired EE 0.15.5) — removes deprecation warnings + advisories from `npm install`. The abandoned `simple-wappalyzer` (→ deprecated, now-commercial `wappalyzer-core`) is replaced by an in-house **zero-dependency** web tech fingerprinter (`utils/tech_fingerprint.mjs` — header/HTML/script-src/cookie/meta signatures; same `{name,categories,confidence,version}` output). `@anthropic-ai/sdk` bumped `^0.82`→`^0.100` (exits the GHSA-p7fg-763f-g4gf range; the Filesystem Memory Tool is never used). The direct `uuid` dependency is dropped in favor of native `crypto.randomUUID()`. NEW `SECURITY.md` documents remaining transitive notices. No feature/behavior change.
+
+
+
+- 🪣 **Non-current-version ACL sampling + public WRITE-vs-READ differentiation** (EE 0.15.4 — paired) — closes the two residuals the 0.15.3 spec carried as deferred. Plugin 1020 gains NEW step 2c-v: on versioning-Enabled/Suspended buckets it samples **non-current** object versions (`ListObjectVersions` first-page, cap-bounded → per-version `GetObjectAcl({VersionId})`, delete-markers skipped) — catching a public ACL that survives on an **overwritten** version still downloadable via `?versionId=` after the current version is made private (CRITICAL via the existing `"publicly accessible"` anchor; PAB `IgnorePublicAcls` → LOW; skipped on `BucketOwnerEnforced`). NEW sibling helper `extractPublicWriteGroups` flags public WRITE/WRITE_ACP/FULL_CONTROL grants (anyone-can-overwrite) distinctly from READ-only, as an enrichment line on the already-CRITICAL finding at bucket/object/version ACL sites. `ListObjectVersions AccessDenied` (distinct `s3:ListBucketVersions` action) + a `GetBucketVersioning AccessDenied` review-fold both degrade to routed LOW evidence-gaps via the existing `"S3 object-ACL evidence-gap"` anchor — never a silent PASS. **Enterprise plugin count UNCHANGED (28); all six coverage matrices UNCHANGED; ZERO framework-JSON edits.** TDD-first, +27 tests; EE regression 6628/6628 GREEN. _(Staged on `main`; awaiting live smoke + trio publish.)_
 - 🪣 **Object-level ACL enumeration + BucketOwnerEnforced short-circuit** (EE 0.15.3 — paired) — closes the 4th and final S3 public-exposure vector (object-level ACLs) documented as a residual in the 0.15.2 closure. Plugin 1020 gains NEW step 2c sampled `GetObjectAcl` enumeration over first-page objects (default cap 10; per-object throttle default 50ms) + NEW step 2a `GetBucketOwnershipControls` upstream short-circuit that skips both 2b (bucket-ACL) and 2c (object-ACL) on `BucketOwnerEnforced` buckets (the default since April 2023; saves 11+ API calls per BOE bucket on modern estates AND closes a false-positive class where BOE buckets with legacy stored public ACL grants previously emitted CRITICAL — they now emit informational because S3 structurally ignores ACL grants under BOE). **INTENTIONAL MATRIX DELTA from 0.15.2** on BOE buckets with pre-BOE legacy grants: CRITICAL → informational. NEW shared `extractPublicGroups` helper used by BOTH step 2b (refactored byte-identical) AND step 2c. 4 LOW evidence-gap emissions via NEW `"S3 object-ACL evidence-gap"` substring anchor on SOC 2 CC7.1 + HIPAA §164.312(b) (substrate-depth on already-covered controls; matrices unchanged). Live AWS smoke all 4 spot-checks PASS (BOE detection; E1 CRITICAL en-dash bytes preserved; cap clamping; objectRateMs throttling). Enterprise plugin count unchanged (28); all six coverage matrices unchanged.
 - 🎯 **Audit-accuracy calibration & CloudTrail hardening** (EE 0.15.2 — paired) — four real-production-account-driven folds: **(1)** plugin 1020 (S3) effective-public-exposure calibration — missing/partial Public Access Block downgraded CRITICAL→MEDIUM (guardrail gap, not current exposure) + NEW `GetBucketAcl` check completing the ACL×policy×PAB join (public AllUsers/AuthenticatedUsers grant → CRITICAL unless neutralized by PAB `IgnorePublicAcls`); **(2)** plugin 1040 (CloudTrail) KMS-CMK calibration — trail-level "KmsKeyId not set" downgraded MEDIUM→LOW when the destination bucket has default SSE-KMS; **(3)** plugin 1040 (CloudTrail) multi-region timeout hardening — an `AbortController` tied to the soft-budget deadline lets a hung disabled-region abort so the plugin finalizes PARTIAL evidence; **(4)** plugin 1221 (Azure NSG) +10 restricted UDP ports + plugin 1222 (Azure Key Vault) F-2 custom-role resolution + F-7.2 HSM dim. Enterprise plugin count unchanged (28); all six coverage matrices unchanged.
 - 🔧 **Azure Key Vault Deep auditor hotfix** (EE 0.15.1 — plugin 1222) — two defects surfaced by the 0.15.0 published-build smoke. **H-1**: the diagnostic-logging dim treated `@azure/arm-monitor`'s `diagnosticSettings.list()` as a paged async-iterator when it actually returns a `{value:[]}` collection object → the dim always degraded to a non-functional evidence-gap; now correctly `await`-ed and read via `.value` (confirmed against live Azure; the unit-test mock was the mock-vs-real-SDK mismatch that masked it). **H-2**: the privileged-access dim flagged inherited subscription/management-group-scope Owner/Contributor as HIGH on every RBAC vault — re-tuned so inherited Owner/User-Access-Admin → MEDIUM, inherited Contributor → LOW, with HIGH reserved for vault-scoped control-plane god roles + Key Vault Administrator. Additive bug-fix only; enterprise plugin count unchanged (28); all six coverage matrices unchanged.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nsauditor-ai",
-  "version": "0.1.84",
+  "version": "0.1.86",
   "description": "Modular AI-assisted network security audit platform — Community Edition",
   "type": "module",
   "private": false,
@@ -27,7 +27,7 @@
     "plugin_manager.mjs"
   ],
   "dependencies": {
-    "@anthropic-ai/sdk": "^0.82.0",
+    "@anthropic-ai/sdk": "^0.100.0",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "dnssd": "^0.4.1",
     "dotenv": "^17.2.1",
@@ -36,10 +36,8 @@
     "node-upnp-utils": "^1.0.3",
     "openai": "^4.104.0",
     "oui-data": "^1.1.427",
-    "simple-wappalyzer": "^1.1.75",
     "snmp-native": "^1.2.0",
     "jose": "^6.2.0",
-    "uuid": "^13.0.0",
     "xml2js": "^0.6.2"
   },
   "optionalDependencies": {

package/plugins/webapp_detector.mjs

@@ -1,13 +1,11 @@
 // plugins/webapp_detector.mjs
 // New plugin: Webapp Detector
-// Uses `simple-wappalyzer` to fingerprint web applications present on a host.
+// Uses the in-house zero-dep fingerprinter (utils/tech_fingerprint.mjs) to identify
+// web applications present on a host.
 // Tries HTTPS first (port 443), then HTTP (port 80), and can also try custom ports via opts.ports.
 // NOTE: Unlike http_probe, undici/fetch cannot ignore TLS easily per-request, so self-signed
 // HTTPS will usually fail and the plugin will fall back to HTTP.
 //
-// Add to package.json (dependencies):
-//   "simple-wappalyzer": "^1.14.0"   // or latest
-//
 // Example use (plugin manager):
 //   webappDetector.run("192.168.1.1")
 //
@@ -29,7 +27,7 @@
 //   apps: [ { name, categories, confidence, version?, slug, ... }, ... ]
 // }
 
-import wappalyzer from 'simple-wappalyzer';
+import { fingerprint } from '../utils/tech_fingerprint.mjs';
 
 const DEBUG =
   String(process.env.DEBUG_MODE || '').toLowerCase() === '1' ||
@@ -107,18 +105,18 @@ async function tryDetectAt(url) {
   }
 }
 
-/** Run wappalyzer on provided HTML/headers. */
+/** Run in-house fingerprinter on provided HTML/headers. */
 async function detectFromHtml(url, html, statusCode, headers) {
   try {
-    const result = await wappalyzer({ url, html, statusCode, headers });
+    const result = fingerprint({ url, html, statusCode, headers });
     if (Array.isArray(result) && result.length) {
-      log('wappalyzer apps=', result.map(a => a.name).join(', '));
+      log('fingerprint apps=', result.map(a => a.name).join(', '));
     } else {
-      log('wappalyzer apps=∅');
+      log('fingerprint apps=∅');
     }
     return result || [];
   } catch (e) {
-    log('wappalyzer error:', e?.message || e);
+    log('fingerprint error:', e?.message || e);
     return [];
   }
 }
@@ -137,7 +135,7 @@ function summarizeApps(apps) {
 export default {
   id: '010',
   name: 'Webapp Detector',
-  description: 'Identifies web applications and frameworks using simple-wappalyzer (tries HTTPS then HTTP).',
+  description: 'Identifies web applications and frameworks using the in-house fingerprinter (tries HTTPS then HTTP).',
   priority: 55, // run near HTTP probe
   requirements: { host: 'up', tcp_open: [80, 443] }, // heuristic gate; still attempts both
   protocols: ['tcp'],
@@ -156,7 +154,7 @@ export default {
       os: null,
       type: 'webapp',
       data: [],
-      apps: [], // raw simple-wappalyzer results
+      apps: [], // raw fingerprinter results
     };
 
     let target = normalizeTarget(host);
@@ -244,3 +242,5 @@ export async function conclude({ host, result }) {
     authoritative: false,
   }));
 }
+
+export { detectFromHtml, summarizeApps };

package/plugins/wsd_scanner.mjs

@@ -5,7 +5,6 @@
 
 import dgram from 'dgram';
 import { parseString } from 'xml2js';
-import { v4 as uuidv4 } from 'uuid';
 import { isPrivateLike } from '../utils/net_validation.mjs';
 
 const DEBUG = /^(1|true|yes|on)$/i.test(String(process.env.DEBUG_MODE || process.env.WSD_DEBUG || ""));
@@ -28,7 +27,7 @@ function discoverWsDiscoveryDevices(targetHost, timeout = 5000) {
     const client = dgram.createSocket('udp4');
     const devices = [];
     const knownAddresses = new Set();
-    const probeMessageId = `urn:uuid:${uuidv4()}`;
+    const probeMessageId = `urn:uuid:${crypto.randomUUID()}`;
     const includeNonMatched = /^(1|true|yes|on)$/i.test(String(process.env.WSD_INCLUDE_NON_MATCHED || ""));
 
     // The multicast address and port for WS-Discovery

package/utils/finding_schema.mjs

@@ -1,5 +1,4 @@
 // utils/finding_schema.mjs
-import { v4 as uuidv4 } from 'uuid';
 
 export const FINDING_CATEGORIES = ['AUTH', 'CRYPTO', 'CONFIG', 'SERVICE', 'EXPOSURE', 'CVE'];
 export const FINDING_STATUSES   = ['UNVERIFIED', 'VERIFIED', 'POTENTIAL', 'FALSE_POSITIVE'];
@@ -62,5 +61,5 @@ export function validateFinding(f) {
  * UUID-based — no counter to reset, no collision risk across restarts.
  */
 export function generateFindingId() {
-  return `F-${uuidv4()}`;
+  return `F-${crypto.randomUUID()}`;
 }

package/utils/tech_fingerprint.mjs

@@ -0,0 +1,249 @@
+/**
+ * tech_fingerprint.mjs — zero-dependency web-technology fingerprinter.
+ * Replaces the abandoned `simple-wappalyzer` / deprecated `wappalyzer-core`.
+ * Returns wappalyzer-shaped results: [{ name, categories, confidence, version }].
+ */
+
+// ---------------------------------------------------------------------------
+// Signature table
+// Each entry defines detection surfaces (OR semantics — any one match detects).
+// Surfaces:
+//   header    — [headerName, regex]        tested against that header's value
+//   altHeader — [headerName, regex]        secondary header (also OR'd in)
+//   meta      — [metaName, regex]          tested against <meta name=… content=…>
+//   script    — [regex, …]                 tested against each <script src="…"> URL
+//   cookie    — [regex, …]                 tested against Set-Cookie header value
+// versionFrom — { surface, key?, regex }  → capture group 1 becomes version
+// implies    — [name, …]                  → inject those techs at confidence 50
+// ---------------------------------------------------------------------------
+const SIGS = [
+  {
+    name: 'Nginx',
+    categories: ['Web servers'],
+    header: ['server', /nginx/i],
+    versionFrom: { surface: 'header', key: 'server', regex: /nginx\/([\d.]+)/i },
+  },
+  {
+    name: 'Apache',
+    categories: ['Web servers'],
+    header: ['server', /apache/i],
+    versionFrom: { surface: 'header', key: 'server', regex: /apache\/([\d.]+)/i },
+  },
+  {
+    name: 'IIS',
+    categories: ['Web servers'],
+    header: ['server', /(?:microsoft-)?iis/i],
+  },
+  {
+    name: 'PHP',
+    categories: ['Programming languages'],
+    header: ['x-powered-by', /php/i],
+    versionFrom: { surface: 'header', key: 'x-powered-by', regex: /php\/([\d.]+)/i },
+  },
+  {
+    name: 'ASP.NET',
+    categories: ['Web frameworks'],
+    header: ['x-powered-by', /asp\.net/i],
+    altHeader: ['x-aspnet-version', /.+/],
+    versionFrom: { surface: 'header', key: 'x-aspnet-version', regex: /([\d.]+)/ },
+  },
+  {
+    name: 'Express',
+    categories: ['Web frameworks'],
+    header: ['x-powered-by', /express/i],
+  },
+  {
+    name: 'WordPress',
+    categories: ['CMS'],
+    meta: ['generator', /wordpress/i],
+    script: [/\/wp-(?:content|includes)\//i],
+    versionFrom: { surface: 'meta', key: 'generator', regex: /wordpress\s+([\d.]+)/i },
+    implies: ['PHP'],
+  },
+  {
+    name: 'Drupal',
+    categories: ['CMS'],
+    meta: ['generator', /drupal/i],
+    altHeader: ['x-generator', /drupal/i],
+  },
+  {
+    name: 'Joomla',
+    categories: ['CMS'],
+    meta: ['generator', /joomla/i],
+  },
+  {
+    name: 'jQuery',
+    categories: ['JavaScript libraries'],
+    script: [/jquery[.-]([\d.]+)(?:\.min)?\.js/i],
+    versionFrom: { surface: 'script', regex: /jquery[.-]([\d]+(?:\.[\d]+)*)/i },
+  },
+  {
+    name: 'React',
+    categories: ['JavaScript frameworks'],
+    script: [/\breact(?:\.production|\.development)?(?:\.min)?\.js/i],
+  },
+  {
+    name: 'Vue.js',
+    categories: ['JavaScript frameworks'],
+    script: [/\bvue(?:@[\d.]+)?(?:\.global|\.runtime)?(?:\.min)?\.js/i],
+  },
+  {
+    name: 'Cloudflare',
+    categories: ['CDN'],
+    header: ['server', /cloudflare/i],
+    altHeader: ['cf-ray', /.+/],
+  },
+];
+
+// Build a lookup map from name → sig for implies resolution.
+const SIG_BY_NAME = new Map(SIGS.map(s => [s.name, s]));
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+/** Normalise headers: lowercase keys, join array values. */
+function normaliseHeaders(raw = {}) {
+  const out = {};
+  for (const [k, v] of Object.entries(raw)) {
+    out[k.toLowerCase()] = Array.isArray(v) ? v.join('; ') : String(v);
+  }
+  return out;
+}
+
+/** Extract all <script src="…"> URLs from HTML (case-insensitive). */
+function extractScriptSrcs(html) {
+  const srcs = [];
+  const re = /<script[^>]+\bsrc\s*=\s*["']([^"']+)["']/gi;
+  let m;
+  while ((m = re.exec(html)) !== null) srcs.push(m[1]);
+  return srcs;
+}
+
+/** Extract <meta name="…" content="…"> into a lowercased-name → content map. */
+function extractMetas(html) {
+  const map = {};
+  const re = /<meta[^>]+>/gi; // NOTE: stops at first '>'; meta content containing '>' is not handled (no current signature needs it)
+  let m;
+  while ((m = re.exec(html)) !== null) {
+    const tag = m[0];
+    const nameM = /\bname\s*=\s*["']([^"']+)["']/i.exec(tag);
+    const contM = /\bcontent\s*=\s*["']([^"']*)["']/i.exec(tag);
+    if (nameM && contM) map[nameM[1].toLowerCase()] = contM[1];
+  }
+  return map;
+}
+
+// ---------------------------------------------------------------------------
+// Core export
+// ---------------------------------------------------------------------------
+
+/**
+ * Fingerprint a web response.
+ * @param {{ url?, html?, statusCode?, headers? }} probe
+ * @returns {{ name, categories, confidence, version }[]}
+ */
+export function fingerprint({ url, html = '', statusCode, headers = {} } = {}) {
+  const hdrs  = normaliseHeaders(headers);
+  const srcs  = extractScriptSrcs(html);
+  const metas = extractMetas(html);
+  // url + statusCode reserved for future per-URL / status-code rules
+  const cookie = hdrs['set-cookie'] ?? ''; // set-cookie is multi-valued; joined for regex matching — cookie patterns should match anywhere in the joined string.
+
+  /** Resolve version for a detected sig given the surfaces already parsed. */
+  function resolveVersion(sig) {
+    const vf = sig.versionFrom;
+    if (!vf) return undefined;
+    let haystack = '';
+    if (vf.surface === 'header') {
+      haystack = hdrs[vf.key ?? ''] ?? '';
+    } else if (vf.surface === 'meta') {
+      haystack = metas[vf.key ?? ''] ?? '';
+    } else if (vf.surface === 'script') {
+      // Test every src URL; return the first capture.
+      for (const src of srcs) {
+        const vm = vf.regex.exec(src);
+        if (vm) return vm[1];
+      }
+      return undefined;
+    }
+    const vm = vf.regex.exec(haystack);
+    return vm ? vm[1] : undefined;
+  }
+
+  /** Count how many distinct surfaces match for a sig. */
+  function countSurfaces(sig) {
+    let count = 0;
+
+    // header
+    if (sig.header) {
+      const [hName, hRe] = sig.header;
+      if (hdrs[hName] && hRe.test(hdrs[hName])) count++;
+    }
+
+    // altHeader — only counts if it's a different surface from header
+    if (sig.altHeader) {
+      const [hName, hRe] = sig.altHeader;
+      if (hdrs[hName] && hRe.test(hdrs[hName])) count++;
+    }
+
+    // meta
+    if (sig.meta) {
+      const [mName, mRe] = sig.meta;
+      const val = metas[mName.toLowerCase()];
+      if (val && mRe.test(val)) count++;
+    }
+
+    // script — counts as 1 surface if any src URL matches any pattern
+    if (sig.script) {
+      const scriptHit = sig.script.some(re => srcs.some(src => re.test(src)));
+      if (scriptHit) count++;
+    }
+
+    // cookie — counts as 1 surface if any pattern matches
+    if (sig.cookie) {
+      const cookieHit = sig.cookie.some(re => re.test(cookie));
+      if (cookieHit) count++;
+    }
+
+    return count;
+  }
+
+  // --- Detect ---
+  const detected = new Map(); // name → result object
+
+  for (const sig of SIGS) {
+    const surfaces = countSurfaces(sig);
+    if (surfaces < 1) continue;
+
+    const confidence = Math.min(100, 25 + 25 * surfaces);
+    const version    = resolveVersion(sig);
+
+    detected.set(sig.name, {
+      name: sig.name,
+      categories: [...sig.categories],
+      confidence,
+      version,
+    });
+  }
+
+  // --- Resolve implies ---
+  for (const sig of SIGS) {
+    if (!sig.implies || !detected.has(sig.name)) continue;
+    for (const impliedName of sig.implies) {
+      if (detected.has(impliedName)) continue;
+      const impliedSig = SIG_BY_NAME.get(impliedName);
+      if (!impliedSig) continue;
+      detected.set(impliedName, {
+        name: impliedName,
+        categories: [...impliedSig.categories],
+        confidence: 50,
+        version: undefined,
+      });
+    }
+  }
+
+  return Array.from(detected.values());
+}
+
+export default fingerprint;