pkgxray 0.6.0 → 0.7.0

package/bin/audit.js

@@ -12,7 +12,7 @@ function printUsage() {
       "  pkgxray < evidence.json",
       "  pkgxray --format json < evidence.json",
       "  pkgxray --file evidence.json --format markdown",
-      "  pkgxray guard <npm-package|npm:name@version|./path> [--promote-to dir] [--no-source-scan]",
+      "  pkgxray guard <npm-package|npm:name@version|github:owner/repo[#ref]|./path> [--promote-to dir] [--no-source-scan]",
       "",
       "Evidence JSON fields:",
       "  packageName, npmMetadata, githubMetadata, webPresence, sourceFiles",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pkgxray",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "Zero-dep local CLI and MCP server that scans npm packages for supply-chain risk. OSV vuln pre-check, sandboxed quarantine, tarball-integrity verification, calibrated static heuristics, GitHub provenance cross-check.",
   "license": "MIT",
   "author": "Jack Adams-Lovell",

package/src/auditor.js

@@ -13,25 +13,24 @@ const SEVERITY_ORDER = {
   high: 3
 };
 
+// Suspicious credential / wallet read targets. Each entry is a regex that
+// requires a path or quote boundary so we don't match identifiers like
+// `process.env` or `someObj.ledger`.
 const SUSPICIOUS_READ_TARGETS = [
-  "~/.ssh",
-  ".ssh/",
-  "id_rsa",
-  "id_dsa",
-  "id_ecdsa",
-  "id_ed25519",
-  "~/.aws",
-  ".aws/credentials",
-  ".npmrc",
-  ".env",
-  "keychain",
-  "login.keychain",
-  "cookies.sqlite",
-  "local state",
-  "metamask",
-  "electrum",
-  "exodus",
-  "ledger"
+  { re: /['"`\/\\]\.?ssh\/(?:id_(?:rsa|dsa|ecdsa|ed25519)|authorized_keys)/i, label: "ssh-private-key" },
+  { re: /['"`\/\\]id_(?:rsa|dsa|ecdsa|ed25519)\b/i, label: "ssh-key-file" },
+  { re: /['"`\/\\]\.ssh(?:\/|['"`])/, label: ".ssh-dir" },
+  { re: /['"`\/\\]\.aws\/credentials\b/, label: ".aws/credentials" },
+  { re: /['"`\/\\]\.aws\/(?:config|credentials)\b/, label: ".aws-files" },
+  { re: /['"`\/\\]\.npmrc(?:['"`]|\s|$)/, label: ".npmrc" },
+  { re: /['"`\/\\]\.env(?:\.[a-z]+)?(?:['"`]|\s|$)/i, label: ".env-file" },
+  { re: /['"`]login\.keychain(?:-db)?['"`]/i, label: "macOS keychain" },
+  { re: /\bsecurity\s+find-(?:generic|internet)-password\b/, label: "macOS security CLI" },
+  { re: /['"`]\/?(?:Cookies|Login Data|Web Data|cookies\.sqlite)['"`]/i, label: "browser-creds" },
+  { re: /['"`]Local State['"`]/, label: "browser local-state" },
+  { re: /\bkeytar\.[a-z]+Password\(/i, label: "keytar API" },
+  { re: /\bmetamask['"`\s\/]/i, label: "metamask wallet" },
+  { re: /\b(?:electrum|exodus|ledger live|atomic wallet)\b/i, label: "crypto wallet" }
 ];
 
 // Persistence destinations. Each pattern requires a quote/slash boundary
@@ -607,16 +606,16 @@ const BULK_ENV_REGEXES = [
 
 function inspectCredentialAccess(file, content, lower, findings) {
   for (const target of SUSPICIOUS_READ_TARGETS) {
-    const index = lower.indexOf(target.toLowerCase());
-    if (index === -1) continue;
-    if (!looksLikeCredentialRead(content, lower, index)) continue;
+    const match = target.re.exec(content);
+    if (!match) continue;
+    if (!looksLikeCredentialRead(content, lower, match.index)) continue;
     findings.push({
       severity: "high",
       category: "credential-access",
       file: file.path,
-      snippet: clipAround(file.content, index),
+      snippet: clipAround(file.content, match.index),
       rationale:
-        "Package reads (or constructs a path to) a credential / wallet / key store in proximity to a filesystem read primitive."
+        `Reads or references ${target.label} near a filesystem read primitive.`
     });
     return;
   }

package/src/quarantine.js

@@ -158,6 +158,10 @@ async function stageReference(reference, stagedPath, options) {
     return resolveNpmPackage(parsed.specifier, options);
   }
 
+  if (parsed.type === "github") {
+    return resolveGithubRepo(parsed, options);
+  }
+
   throw new Error(`Unsupported reference type: ${reference}`);
 }
 
@@ -170,6 +174,21 @@ function parseReference(reference) {
     return { type: "local", path: path.resolve(reference.slice("file:".length)) };
   }
 
+  if (reference.startsWith("github:")) {
+    return parseGithubReference(reference.slice("github:".length));
+  }
+
+  // github.com URLs as a convenience shorthand
+  const ghMatch = reference.match(/^https?:\/\/github\.com\/([^/]+)\/([^/?#]+?)(?:\.git)?(?:#(.+))?$/);
+  if (ghMatch) {
+    return {
+      type: "github",
+      owner: ghMatch[1],
+      repo: ghMatch[2],
+      ref: ghMatch[3] || null
+    };
+  }
+
   if (
     reference.startsWith(".") ||
     reference.startsWith("/") ||
@@ -184,6 +203,62 @@ function parseReference(reference) {
   return { type: "npm", specifier: reference };
 }
 
+function parseGithubReference(spec) {
+  // Supports owner/repo[#ref] and owner/repo[@ref]
+  const match = spec.match(/^([^/#@]+)\/([^/#@]+?)(?:[#@](.+))?$/);
+  if (!match) throw new Error(`Invalid github reference: github:${spec}`);
+  return {
+    type: "github",
+    owner: match[1],
+    repo: match[2].replace(/\.git$/, ""),
+    ref: match[3] || null
+  };
+}
+
+async function resolveGithubRepo(parsed, options) {
+  // Resolve default branch if no ref pinned. Uses the existing GitHub metadata
+  // helper which is already cached + parallel-safe.
+  const { fetchRepoMetadata } = require("./github");
+  let ref = parsed.ref;
+  let resolvedMeta = null;
+  if (!ref) {
+    const meta = await fetchRepoMetadata(`https://github.com/${parsed.owner}/${parsed.repo}`).catch(() => null);
+    if (meta && meta.found === false && meta.reason === "not-found") {
+      throw new Error(`GitHub repository not found: ${parsed.owner}/${parsed.repo}`);
+    }
+    if (meta && meta.found) {
+      ref = meta.default_branch || "HEAD";
+      resolvedMeta = meta;
+    } else {
+      ref = "HEAD";
+    }
+  }
+
+  // GitHub's "codeload" endpoint returns a .tar.gz of the repo at the given
+  // ref. Works for branch names, tags, and commit SHAs.
+  const tarballUrl = `https://codeload.github.com/${parsed.owner}/${parsed.repo}/tar.gz/${encodeURIComponent(ref)}`;
+
+  return {
+    type: "github",
+    owner: parsed.owner,
+    repo: parsed.repo,
+    ref,
+    needsDownload: true,
+    tarballUrl,
+    packageName: `${parsed.owner}/${parsed.repo}`,
+    githubArchive: true,
+    npmMetadata: resolvedMeta
+      ? {
+          // Synthetic shape so the downstream auditor still sees a repository
+          // URL and the github cross-check finds the same data we already have.
+          name: parsed.repo,
+          repository: { url: resolvedMeta.html_url, type: "git" },
+          maintainers: []
+        }
+      : null
+  };
+}
+
 async function copyLocalPath(sourcePath, stagedPath) {
   const stat = await fsp.stat(sourcePath);
   if (!stat.isDirectory()) {