penthera 1.7.0 → 1.8.0

package/lib/advisories/versions.js

@@ -0,0 +1,65 @@
+/**
+ * Version strings as runtimes and servers print them, and how they compare.
+ *
+ * An upstream version is `major.minor[.patch][letters]`: `8.3.12`, `2.4.62`,
+ * `1.1.1w` (OpenSSL 1.x used letters for patch releases). Anything after it
+ * (`-1ubuntu2.19`, `+deb12u1`, `-fpm-alpine`) is a suffix. On a banner a suffix
+ * means a distribution build, whose security fixes are backported without the
+ * upstream number changing, so the number alone cannot say whether the fix is
+ * in. That case is never reported as affected; see lib/advisories/index.js.
+ */
+
+const VERSION = /^(\d{1,4})(?:\.(\d{1,4})(?:\.(\d{1,6}))?)?([a-z]{1,2})?(.*)$/;
+
+/**
+ * Parse a version string.
+ * @param {string} s
+ * `20`, `v20` and `8.3` parse too, with the missing parts null.
+ * @returns {{ major: number, minor: number|null, patch: number|null, letters: string,
+ *   suffix: string, upstream: string, raw: string } | null}
+ */
+export function parseVersion(s) {
+  if (typeof s !== "string") return null;
+  const m = VERSION.exec(s.trim().replace(/^v(?=\d)/, ""));
+  if (!m) return null;
+  const [, major, minor, patch, letters = "", suffix = ""] = m;
+  // "8.3.12abc" is not a version; letters only follow a full x.y.z.
+  if (letters && patch === undefined) return null;
+  // A suffix starts with a separator: "20-alpine", "8.1.2-1ubuntu2", not "8x".
+  if (suffix && !/^[-+~_ ]/.test(suffix)) return null;
+  const parts = [major, minor, patch].filter((x) => x !== undefined).map(Number);
+  return {
+    major: Number(major),
+    minor: minor === undefined ? null : Number(minor),
+    patch: patch === undefined ? null : Number(patch),
+    letters,
+    suffix,
+    upstream: parts.join(".") + letters,
+    raw: s.trim(),
+  };
+}
+
+/** Compare two parsed versions (or strings). A missing patch sorts as 0. */
+export function compareVersions(a, b) {
+  const x = typeof a === "string" ? parseVersion(a) : a;
+  const y = typeof b === "string" ? parseVersion(b) : b;
+  if (!x || !y) throw new Error(`not a version: ${!x ? a : b}`);
+  if (x.major !== y.major) return x.major < y.major ? -1 : 1;
+  const mx = x.minor ?? 0;
+  const my = y.minor ?? 0;
+  if (mx !== my) return mx < my ? -1 : 1;
+  const px = x.patch ?? 0;
+  const py = y.patch ?? 0;
+  if (px !== py) return px < py ? -1 : 1;
+  if (x.letters !== y.letters) {
+    // OpenSSL: 1.1.1 < 1.1.1a < 1.1.1z < 1.1.1za
+    if (x.letters.length !== y.letters.length) return x.letters.length < y.letters.length ? -1 : 1;
+    return x.letters < y.letters ? -1 : 1;
+  }
+  return 0;
+}
+
+/** Compare branches like "8.3" and "8.10", "20" and "22", "1.1.1" and "3.0". */
+export function compareBranches(a, b) {
+  return compareVersions(a, b);
+}

package/lib/agents/hidden-content.js

@@ -22,6 +22,7 @@
  * Each detector returns hits `{ rule, severity, title, detail, line, count }`.
  * Callers turn hits into findings.
  */
+import { rulesOf, rulesGeneration, packTest, packMatch } from "../rules/index.js";
 
 // ── Invisible characters ──────────────────────────────────────────────────
 
@@ -200,7 +201,7 @@ function detectWhitespaceInflation(text, opts) {
 
 // ── Instructions in hidden places ─────────────────────────────────────────
 
-const INSTRUCTION_PATTERNS = [
+export const INSTRUCTION_PATTERNS = [
   /\b(?:ignore|disregard|forget|override)\b[^.\n]{0,40}\b(?:previous|prior|above|earlier|all|any|other)\b[^.\n]{0,20}\b(?:instructions?|rules?|prompts?|guidelines?|directions?)\b/i,
   /\b(?:you|assistant|claude|agent|model|ai|llm)\b[^.\n]{0,30}\b(?:must|should|shall|will|are to|need to|have to)\b/i,
   /\bdo(?:n'?t| not) (?:tell|inform|mention|reveal|show|alert|ask|notify)\b/i,
@@ -208,15 +209,17 @@ const INSTRUCTION_PATTERNS = [
   /\b(?:system prompt|developer message|new instructions?)\b/i,
   /\b(?:run|execute|exec|invoke)\b[^.\n]{0,40}\b(?:command|script|bash|shell|curl|wget|powershell)\b/i,
   /\b(?:send|upload|post|exfiltrat\w*|transmit|forward|copy)\b[^\n]{0,60}(?:https?:\/\/|\btokens?\b|\bsecrets?\b|\bapi keys?\b|\bcredentials?\b|\.env\b|\bssh\b|\bpasswords?\b)/i,
-  /(?:~\/\.ssh|\bid_rsa\b|\bid_ed25519\b|\.aws\/credentials|\.npmrc|\.netrc|\bkeychain\b)/i,
+  // Credential paths: lib/rules/core/agent-instructions.json.
+  ...rulesOf("agent-instruction", { pack: "core" }).map((r) => r.pattern),
 ];
+const packInstructions = () => rulesOf("agent-instruction", { exceptPack: "core" });
 
 // Text addressed to an automated reviewer. Legitimate skills have no reason to
 // talk to a security scanner.
 const SCANNER_DIRECTED = /\b(?:security |safety |skill |code )?(?:scanners?|reviewers?|auditors?|judges?|classifiers?|analy[sz]ers?|moderators?)\b[^.\n]{0,60}\b(?:is|as|are|mark|classify|report|treat|consider|rate|label)\b[^.\n]{0,30}\b(?:safe|benign|harmless|clean|trusted|approved?|pass(?:ed)?|low[- ]risk|false positive)\b/i;
 
 export function looksLikeInstruction(s) {
-  return INSTRUCTION_PATTERNS.some((re) => re.test(s));
+  return INSTRUCTION_PATTERNS.some((re) => re.test(s)) || packInstructions().some((r) => packTest(r, s));
 }
 
 function detectHiddenInstructions(text) {
@@ -250,28 +253,136 @@ function detectHiddenInstructions(text) {
 // ── Code execution patterns ───────────────────────────────────────────────
 
 const SHELL = String.raw`(?:sudo\s+)?(?:env\s+\S*\s*)?(?:ba|z|da|k|fi|c|tc)?sh\b`;
+const INTERPRETER = String.raw`(?:sudo\s+)?(?:python[0-9.]*|node|perl|ruby|php|deno|bun)\b`;
+const PS_DOWNLOAD = String.raw`\b(?:iwr|irm|Invoke-WebRequest|Invoke-RestMethod|DownloadString)\b`;
+
+// The patterns of the form `<source> ... | <sink>` are matched by the helpers
+// below rather than by `re` itself (kept as the definition). As one regex
+// they restart the scan at every <source> on a line, which is quadratic on a
+// line full of them; the helpers return the same match in linear time.
+
+function matchAt(text, start, end) {
+  const m = [text.slice(start, end)];
+  m.index = start;
+  return m;
+}
+
+/** `source[^\n|]*\|\s*sink`: the source sits in the pipeline stage just before the pipe. */
+function pipedFrom(source, sink) {
+  const pipe = new RegExp(String.raw`\|\s*${sink}`, "gi");
+  return (text) => {
+    for (const m of text.matchAll(pipe)) {
+      const start = m.index === 0 ? 0 : Math.max(text.lastIndexOf("|", m.index - 1), text.lastIndexOf("\n", m.index - 1)) + 1;
+      const s = source.exec(text.slice(start, m.index));
+      if (s) return matchAt(text, start + s.index, m.index + m[0].length);
+    }
+    return null;
+  };
+}
+
+/**
+ * `first[^\n]*second`: leftmost `first`, extended to the last `second` that
+ * starts on its line. A `second` that begins with `\|` may run past the line
+ * end (`\|\s*sh` spans a newline), so it is tried at each pipe on the line.
+ */
+function thenOnLine(first, second) {
+  const firstG = new RegExp(first, "gi");
+  const secondG = new RegExp(second, "gi");
+  const secondY = new RegExp(second, "iy");
+  const atPipe = second.startsWith("\\|");
+  const lastOnLine = (text, from, eol) => {
+    let last = null;
+    if (atPipe) {
+      for (let p = text.indexOf("|", from); p >= 0 && p < eol; p = text.indexOf("|", p + 1)) {
+        secondY.lastIndex = p;
+        const b = secondY.exec(text);
+        if (b) last = b;
+      }
+    } else {
+      for (const b of text.slice(from, eol).matchAll(secondG)) last = { 0: b[0], index: from + b.index };
+    }
+    return last;
+  };
+  return (text) => {
+    let skipTo = 0;
+    for (const a of text.matchAll(firstG)) {
+      if (a.index < skipTo) continue;
+      const aEnd = a.index + a[0].length;
+      let eol = text.indexOf("\n", aEnd);
+      if (eol < 0) eol = text.length;
+      // Only the first `first` on a line needs checking: any `second` after a
+      // later one is also after this one.
+      skipTo = eol;
+      const last = lastOnLine(text, aEnd, eol);
+      if (last) return matchAt(text, a.index, last.index + last[0].length);
+    }
+    return null;
+  };
+}
+
+function earliest(...finders) {
+  return (text) => {
+    let best = null;
+    for (const f of finders) {
+      const m = f(text);
+      if (m && (!best || m.index < best.index)) best = m;
+    }
+    return best;
+  };
+}
+
 export const EXEC_PATTERNS = [
-  { rule: "curl-pipe-shell", label: "download piped to a shell", re: new RegExp(String.raw`\b(?:curl|wget|fetch|iwr)\b[^\n|]*\|\s*${SHELL}`, "i") },
-  { rule: "curl-pipe-interpreter", label: "download piped to an interpreter", re: /\b(?:curl|wget)\b[^\n|]*\|\s*(?:sudo\s+)?(?:python[0-9.]*|node|perl|ruby|php|deno|bun)\b/i },
-  { rule: "shell-process-substitution", label: "shell runs a download via process substitution", re: /\b(?:(?:ba|z)?sh|source|\.)\s+<\(\s*(?:curl|wget)\b/i },
-  { rule: "shell-command-substitution", label: "shell -c runs a download", re: /\b(?:ba|z)?sh\s+-c\s+["']?\$\(\s*(?:curl|wget)\b/i },
-  { rule: "base64-pipe-shell", label: "decoded base64 piped to a shell", re: new RegExp(String.raw`base64\s+(?:-d|--decode|-D)\b[^\n]*\|\s*${SHELL}`, "i") },
+  {
+    rule: "curl-pipe-shell", label: "download piped to a shell",
+    re: new RegExp(String.raw`\b(?:curl|wget|fetch|iwr)\b[^\n|]*\|\s*${SHELL}`, "i"),
+    match: pipedFrom(/\b(?:curl|wget|fetch|iwr)\b/i, SHELL),
+  },
+  {
+    rule: "curl-pipe-interpreter", label: "download piped to an interpreter",
+    re: /\b(?:curl|wget)\b[^\n|]*\|\s*(?:sudo\s+)?(?:python[0-9.]*|node|perl|ruby|php|deno|bun)\b/i,
+    match: pipedFrom(/\b(?:curl|wget)\b/i, INTERPRETER),
+  },
+  // Process and command substitution: lib/rules/core/agent-exec.json.
+  ...rulesOf("agent-exec", { pack: "core" }).map((r) => ({ rule: r.id, label: r.label, re: r.pattern })),
+  {
+    rule: "base64-pipe-shell", label: "decoded base64 piped to a shell",
+    re: new RegExp(String.raw`base64\s+(?:-d|--decode|-D)\b[^\n]*\|\s*${SHELL}`, "i"),
+    match: thenOnLine(String.raw`base64\s+(?:-d|--decode|-D)\b`, String.raw`\|\s*${SHELL}`),
+  },
   { rule: "shell-eval", label: "eval of command output", re: /\beval\s+["']?\$\(/ },
   { rule: "js-eval-remote", label: "eval of fetched or decoded content", re: /\b(?:eval|Function)\s*\(\s*(?:await\s+)?(?:atob|Buffer\.from|fetch|require\(\s*["']child_process|\(await fetch)/ },
   { rule: "py-exec-remote", label: "exec of fetched or decoded content", re: /\bexec\s*\(\s*(?:base64\.b64decode|__import__|compile|urllib|requests\.get|zlib\.decompress|marshal\.loads|bytes\.fromhex)/ },
-  { rule: "powershell-iex", label: "PowerShell Invoke-Expression of a download", re: /\b(?:iex|Invoke-Expression)\b[^\n]*\b(?:iwr|irm|Invoke-WebRequest|Invoke-RestMethod|DownloadString)\b|\b(?:iwr|irm|Invoke-WebRequest|Invoke-RestMethod|DownloadString)\b[^\n]*\|\s*(?:iex|Invoke-Expression)\b/i },
+  {
+    rule: "powershell-iex", label: "PowerShell Invoke-Expression of a download",
+    re: /\b(?:iex|Invoke-Expression)\b[^\n]*\b(?:iwr|irm|Invoke-WebRequest|Invoke-RestMethod|DownloadString)\b|\b(?:iwr|irm|Invoke-WebRequest|Invoke-RestMethod|DownloadString)\b[^\n]*\|\s*(?:iex|Invoke-Expression)\b/i,
+    match: earliest(
+      thenOnLine(String.raw`\b(?:iex|Invoke-Expression)\b`, PS_DOWNLOAD),
+      thenOnLine(PS_DOWNLOAD, String.raw`\|\s*(?:iex|Invoke-Expression)\b`),
+    ),
+  },
 ];
 
 /** Find remote-code-execution patterns in a string (a file, a hook command). */
 export function findExecPatterns(text) {
   const out = [];
-  for (const p of EXEC_PATTERNS) {
-    const m = text.match(p.re);
+  for (const p of execPatterns()) {
+    const m = p.pack ? packMatch(p.pack, text) : p.match ? p.match(text) : text.match(p.re);
     if (m) out.push({ rule: p.rule, label: p.label, match: m[0], index: m.index });
   }
   return out;
 }
 
+// Built-ins, then rules from other packs (bundled or --rules).
+let _exec = null;
+let _execGen = -1;
+function execPatterns() {
+  if (_execGen !== rulesGeneration()) {
+    _exec = [...EXEC_PATTERNS, ...rulesOf("agent-exec", { exceptPack: "core" }).map((r) => ({ rule: r.id, label: r.label, re: r.pattern, pack: r }))];
+    _execGen = rulesGeneration();
+  }
+  return _exec;
+}
+
 function detectExec(text) {
   return findExecPatterns(text).map((m) => ({
     rule: m.rule,

package/lib/agents/index.js

@@ -157,6 +157,26 @@ export function gradeFindings(findings) {
 
 // ── Scan ──────────────────────────────────────────────────────────────────
 
+/**
+ * Run `check` on each item; one file that throws (hostile nesting, a parser
+ * edge case) is reported and skipped instead of aborting the whole audit.
+ */
+function eachChecked(items, hits, fileOf, check) {
+  for (const item of items) {
+    try {
+      check(item);
+    } catch (e) {
+      hits.push({
+        rule: "config-unparsed",
+        severity: "medium",
+        title: "File could not be checked",
+        detail: `${e?.message || e}. Review it by hand.`,
+        url: fileOf(item),
+      });
+    }
+  }
+}
+
 /**
  * Audit agent configuration.
  * @param {string} root
@@ -171,24 +191,24 @@ export async function scanAgents(root, opts = {}) {
   const hits = [];
 
   progress(`Scanning ${inv.skills.length} skill(s) for hidden content...`);
-  for (const s of inv.skills) {
+  eachChecked(inv.skills, hits, (s) => inv.display(s.skillFile), (s) => {
     scanSkillFolder(s, inv, hits);
     hits.push(...checkAllowedTools(inv.display(s.skillFile), s.frontmatter, `Skill "${s.name}"`));
-  }
+  });
 
   progress("Scanning instruction and rule files...");
-  for (const f of inv.instructionFiles) {
+  eachChecked(inv.instructionFiles, hits, (f) => f.display, (f) => {
     scanTextFile(f.path, f.display, hits);
     if (/\.mdc?$/i.test(f.path)) {
       let text = "";
       try { text = readFileSync(f.path, "utf-8"); } catch { /* unreadable */ }
       hits.push(...checkAllowedTools(f.display, parseFrontmatter(text), "Command"));
     }
-  }
+  });
 
   progress(`Checking ${inv.mcpServers.length} MCP server(s), ${inv.hooks.length} hook(s), permissions and plugins...`);
-  for (const m of inv.mcpServers) hits.push(...checkMcpServer(m));
-  for (const h of inv.hooks) hits.push(...checkHook(h));
+  eachChecked(inv.mcpServers, hits, (m) => m.file, (m) => hits.push(...checkMcpServer(m)));
+  eachChecked(inv.hooks, hits, (h) => h.file, (h) => hits.push(...checkHook(h)));
   hits.push(...checkPermissions(inv));
   hits.push(...checkMarketplaces(inv));
   for (const e of inv.errors) {

package/lib/agents/lock.js

@@ -18,13 +18,41 @@ function sha256(data) {
   return createHash("sha256").update(data).digest("hex");
 }
 
-/** Stable JSON: object keys sorted at every level. */
+/**
+ * Stable JSON: object keys sorted at every level.
+ *
+ * Iterative (an explicit stack, not recursion) so a config nested hundreds of
+ * thousands of levels deep hashes instead of overflowing the call stack.
+ */
 export function canonicalJson(value) {
-  if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
-  if (value && typeof value === "object") {
-    return `{${Object.keys(value).sort().map((k) => `${JSON.stringify(k)}:${canonicalJson(value[k])}`).join(",")}}`;
+  const out = [];
+  // Pending work, popped from the end: a string is emitted as is, a
+  // { v } is a value still to serialise.
+  const stack = [{ v: value }];
+  while (stack.length) {
+    const item = stack.pop();
+    if (typeof item === "string") { out.push(item); continue; }
+    const v = item.v;
+    if (Array.isArray(v)) {
+      out.push("[");
+      stack.push("]");
+      for (let i = v.length - 1; i >= 0; i--) {
+        stack.push({ v: v[i] });
+        if (i > 0) stack.push(",");
+      }
+    } else if (v && typeof v === "object") {
+      const keys = Object.keys(v).sort();
+      out.push("{");
+      stack.push("}");
+      for (let i = keys.length - 1; i >= 0; i--) {
+        stack.push({ v: v[keys[i]] });
+        stack.push(`${i > 0 ? "," : ""}${JSON.stringify(keys[i])}:`);
+      }
+    } else {
+      out.push(JSON.stringify(v ?? null));
+    }
   }
-  return JSON.stringify(value ?? null);
+  return out.join("");
 }
 
 /** Hash a folder: every file's path and content hash, plus symlink targets. */

package/lib/agents/rules.js

@@ -52,8 +52,24 @@ export function npmSpecPinned(spec) {
 /** True if a Python spec (`pkg==1.2.3`, `pkg@1.2.3`) pins an exact version. */
 export function pySpecPinned(spec) {
   if (/^(?:\.{0,2}\/|file:|git\+|https?:)/.test(spec)) return true;
-  const m = spec.match(/(?:==|@)([^,;\s]+)$/);
-  return !!m && /^\d+(?:\.\d+)*(?:[-.+]?[A-Za-z0-9.]+)?$/.test(m[1]) && !/[<>~^*]/.test(spec);
+  const version = pinnedVersion(spec);
+  // Same language as /^\d+(?:\.\d+)*(?:[-.+]?[A-Za-z0-9.]+)?$/, without its quadratic overlap.
+  return version != null && /^(?:\d[A-Za-z0-9.]*|\d+(?:\.\d+)*[-+][A-Za-z0-9.]+)$/.test(version) && !/[<>~^*]/.test(spec);
+}
+
+/**
+ * The text after the first `==` or `@` in the spec's last run of
+ * non-separator characters: what `/(?:==|@)([^,;\s]+)$/` captures, found in
+ * linear time (that regex rescans the tail from every `@`).
+ */
+function pinnedVersion(spec) {
+  let start = spec.length;
+  while (start > 0 && !/[,;\s]/.test(spec[start - 1])) start--;
+  const tail = spec.slice(start);
+  const at = tail.search(/==|@/);
+  if (at < 0) return null;
+  const version = tail.slice(at + (tail[at] === "@" ? 1 : 2));
+  return version || null;
 }
 
 const RUNNERS = [
@@ -260,9 +276,22 @@ export function checkAllowedTools(display, frontmatter, label) {
 
 // ── Hooks ─────────────────────────────────────────────────────────────────
 
-const AUTO_APPROVE = /["']?(?:permissionDecision|behavior)["']?\s*\\?["']?\s*:\s*\\?["']?\s*allow\b|["']?decision["']?\s*\\?["']?\s*:\s*\\?["']?\s*approve\b/i;
+// Whitespace, an optional (escaped) quote, whitespace. Written so the two
+// whitespace runs cannot split one run of spaces between them, which made the
+// former `\s*\\?["']?\s*` quadratic on long whitespace.
+const QSEP = String.raw`\s*(?:\\?["']\s*|\\\s*)?`;
+const AUTO_APPROVE = new RegExp(String.raw`["']?(?:permissionDecision|behavior)["']?${QSEP}:${QSEP}allow\b|["']?decision["']?${QSEP}:${QSEP}approve\b`, "i");
 const PIPE_TO_SHELL = /\|\s*(?:sudo\s+)?(?:ba|z|da|k)?sh\b(?:\s|$|;|&|\))/;
 
+/** The line holding the first pipe into a shell, for a finding's detail. */
+function pipeToShellLine(text) {
+  const m = /\|\s*(?:sudo\s+)?(?:ba|z|da|k)?sh\b/.exec(text);
+  if (!m) return null;
+  const start = text.lastIndexOf("\n", m.index) + 1;
+  const end = text.indexOf("\n", m.index + m[0].length);
+  return text.slice(start, end < 0 ? text.length : end);
+}
+
 function hookScript(hook, command) {
   const env = {
     CLAUDE_PROJECT_DIR: hook.baseDir,
@@ -306,7 +335,7 @@ export function checkHook(h) {
         rule: "hook-pipe-shell",
         severity: "high",
         title: `${where} hook pipes into a shell`,
-        detail: `Hook ${s.label} pipes data into \`sh\`/\`bash\`: \`${preview(s.text.match(/[^\n]*\|\s*(?:sudo\s+)?(?:ba|z|da|k)?sh\b[^\n]*/)?.[0] || s.text, 120)}\`. Whatever produces that input controls the commands.`,
+        detail: `Hook ${s.label} pipes data into \`sh\`/\`bash\`: \`${preview(pipeToShellLine(s.text) || s.text, 120)}\`. Whatever produces that input controls the commands.`,
         url: h.file,
       });
       break;

package/lib/compliance/index.js

@@ -32,13 +32,13 @@ const NIS2_MEASURES = [
     probes: [], categories: [],
     note: "Organisational, outside a scanner's reach." },
   { id: "d", title: "Supply-chain security", level: "partial",
-    probes: ["retirejs", "secret-scanning"],
-    categories: ["cve", "secrets", "js-vulnerability"],
-    note: "JS dependency CVEs (Retire.js), leaked credentials (secret scan), a CycloneDX SBOM (--sbom), and passive supplier rating (--suppliers)." },
+    probes: ["retirejs", "secret-scanning", "runtime-advisories"],
+    categories: ["cve", "secrets", "js-vulnerability", "runtime-advisory"],
+    note: "JS dependency CVEs (Retire.js), runtime and server advisories (PHP, nginx, Apache, Node.js, Python, OpenSSL), leaked credentials (secret scan), a CycloneDX SBOM (--sbom), and passive supplier rating (--suppliers)." },
   { id: "e", title: "Secure acquisition, development & maintenance; vulnerability handling", level: "strong",
     probes: ["reachability", "endpoint-discovery", "openapi", "sensitive-files", "cors",
       "security-headers", "email-dns", "sqli", "ssti", "ssrf", "xss", "cmdi", "open-redirect",
-      "api-fuzzing", "risky-patterns"],
+      "api-fuzzing", "risky-patterns", "runtime-advisories"],
     categories: ["*"],
     note: "The core scan: black- and white-box testing mapped to OWASP WSTG, with SARIF and baseline regression." },
   { id: "f", title: "Assessing the effectiveness of measures", level: "evidence",

package/lib/crawler.js

@@ -10,7 +10,7 @@
  *   - ffuf, wordlist-based endpoint brute-forcing
  */
 
-import { safeFetch } from "../src/utils/http.js";
+import { safeFetch, readBody } from "../src/utils/http.js";
 
 const DEFAULT_TIMEOUT = 8_000;
 
@@ -101,7 +101,7 @@ export async function discoverEndpoints(baseUrl, opts = {}) {
         // which is often absent on chunked responses. This matches the unit the
         // calibration baseline uses (text.length) so the noise filter in
         // autoCalibrate compares like with like instead of header-vs-body.
-        const body = await res.text().catch(() => "");
+        const body = await readBody(res).catch(() => "");
         return {
           path,
           status: res.status,
@@ -145,6 +145,11 @@ export async function fingerprint(baseUrl) {
   if (!res) return tech;
 
   tech.headers = Object.fromEntries(res.headers.entries());
+  // Cookie names only (never values): PHPSESSID says PHP even when the version is hidden.
+  tech.cookieNames = (res.headers.getSetCookie?.() || [])
+    .map((c) => c.split("=")[0].trim())
+    .filter((n) => /^[\w.-]{1,64}$/.test(n))
+    .slice(0, 20);
 
   // Server detection
   const server = res.headers.get("server") || "";
@@ -167,13 +172,16 @@ export async function fingerprint(baseUrl) {
 
   // Next.js detection from HTML
   try {
-    const html = await res.text();
+    const html = await readBody(res);
     if (html.includes("/_next/static") || html.includes("__NEXT_DATA__")) {
       tech.framework = "Next.js";
     }
     if (html.includes("__nuxt")) tech.framework = "Nuxt";
     if (html.includes("ng-version")) tech.framework = "Angular";
     if (html.includes("data-reactroot") || html.includes("__react")) tech.framework = "React";
+    // First same-site link to a .php page, as evidence that PHP serves the site.
+    const php = /\shref=["']((?:\/|\.\/|(?![a-z][a-z0-9+.-]*:))[^"'\s>]{0,200}?\.php(?:[?#][^"'\s>]{0,100})?)["']/i.exec(html);
+    tech.phpLink = php ? php[1] : null;
   } catch { /* ignore */ }
 
   // Security header audit
@@ -208,7 +216,7 @@ export async function autoCalibrate(baseUrl) {
   ]) {
     const res = await safeFetch(`${baseUrl}${garbage}`, { timeout: DEFAULT_TIMEOUT, probe: "endpoint-discovery" });
     if (res) {
-      const text = await res.text().catch(() => "");
+      const text = await readBody(res).catch(() => "");
       baselines.push({
         status: res.status,
         size: text.length,
@@ -234,14 +242,3 @@ export async function autoCalibrate(baseUrl) {
   };
 }
 
-/**
- * Compare crawled endpoints with filesystem-discovered routes.
- * Returns "shadow" endpoints, routes that exist at runtime but aren't in source.
- */
-export function findShadowEndpoints(crawledPaths, filesystemRoutes) {
-  const knownPaths = new Set(filesystemRoutes.map(r => r.url));
-  return crawledPaths.filter(ep => {
-    const normalized = ep.path.replace(/\/$/, "");
-    return !knownPaths.has(normalized) && ep.status !== 404;
-  });
-}

package/lib/deps/capabilities.js

@@ -79,7 +79,10 @@ const SEV_RANK = { critical: 4, high: 3, medium: 2, low: 1, info: 0 };
 export const maxSeverity = (sevs) => sevs.reduce((m, s) => (SEV_RANK[s] > SEV_RANK[m] ? s : m), "info");
 
 const JS_EXT = /\.(c|m)?jsx?$/i;
-const MAX_JS_BYTES = 8 * 1024 * 1024;
+// Large enough for real bundles (typescript.js and editor workers are 9-13 MB),
+// and the same as the tarball reader's per-file cap (source.js MAX_FILE_BYTES).
+// A file over it is not read, and the package is then unscanned, never clean.
+const MAX_JS_BYTES = 64 * 1024 * 1024;
 const MAX_EVIDENCE = 5;
 const EXFIL_WINDOW = 40; // lines
 const NEAR_WINDOW = 30; // lines
@@ -451,11 +454,13 @@ export function nodeScriptTargets(cmd) {
 
 /**
  * Scan a package through a source (see source.js).
- * @param {{ files(): string[], read(rel): Buffer, size(rel): number }} source
- * @param {{ prefix?: string }} opts prefix is prepended to evidence paths (e.g. node_modules/foo/)
- * @returns {{ name, version, capabilities, installScripts, exfil, filesScanned, skipped, unscanned }}
+ * @param {{ files(): string[], read(rel): Buffer, size(rel): number, anomaly?: string, truncated?: boolean }} source
+ * @param {{ prefix?: string, iocs?: ReturnType<import("./iocs.js").loadIocs> }} opts prefix is
+ *   prepended to evidence paths (e.g. node_modules/foo/); iocs are rule-pack indicators to look for
+ * @returns {{ name, version, capabilities, installScripts, exfil, filesScanned, skipped, unscanned, iocHits }}
  *   unscanned: why the package could not be fully read (archive anomaly, no
- *   package.json), else null. Callers must not treat such a package as clean.
+ *   package.json, a code file too large to scan, more files than the source
+ *   lists), else null. Callers must not treat such a package as clean.
  */
 export function scanPackage(source, opts = {}) {
   const prefix = opts.prefix || "";
@@ -474,6 +479,8 @@ export function scanPackage(source, opts = {}) {
     pkg = {};
     unscanned = unscanned || "package.json is missing or not valid JSON, so its install scripts are unknown";
   }
+  const iocs = opts.iocs || null;
+  const iocHits = iocs ? [...iocs.scanFiles(files, source, prefix), ...iocs.scanText(pkgText, `${prefix}package.json`)] : [];
 
   const installScripts = {};
   for (const hook of INSTALL_HOOKS) {
@@ -507,12 +514,20 @@ export function scanPackage(source, opts = {}) {
     let src;
     try { src = source.read(f).toString("utf-8"); } catch { continue; }
     filesScanned++;
+    if (iocs) iocHits.push(...iocs.scanText(src, `${prefix}${f}`));
     const r = scanSource(src, `${prefix}${f}`);
     fileCaps[f] = Object.keys(r.caps);
     if (r.aiConfigProject) aiConfigProject[f] = r.aiConfigProject;
     mergeCaps(caps, r.caps);
     if (r.exfil) exfil.push(r.exfil);
   }
+  // Code that was never read is not clean code: fail closed.
+  if (source.truncated) {
+    unscanned = unscanned || `the package has more than ${source.maxFiles} files, so some were never read`;
+  }
+  if (skipped.length) {
+    unscanned = unscanned || `${skipped.length} code file(s) over ${MAX_JS_BYTES / 1024 / 1024} MB were not scanned (${skipped.slice(0, 3).join(", ")}${skipped.length > 3 ? ", ..." : ""})`;
+  }
 
   // Install scripts that are themselves suspicious: shell download pipes, or a
   // `node file.js` hook whose file reaches the network, decodes payloads, etc.
@@ -556,5 +571,6 @@ export function scanPackage(source, opts = {}) {
     filesScanned,
     skipped,
     unscanned,
+    iocHits,
   };
 }