quantum-audit 0.1.0

package/.github/workflows/publish.yml

@@ -0,0 +1,19 @@
+name: Publish to npm
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          registry-url: 'https://registry.npmjs.org'
+      - run: npm publish --access public
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

package/README.md

@@ -0,0 +1,8 @@
+# quantum-audit
+
+Scans npm projects for quantum-vulnerable cryptography in their dependency tree. Part of the Chain Audit ecosystem.
+
+## Usage
+
+```bash
+npx quantum-audit

package/bin/cli.js

@@ -0,0 +1,76 @@
+#!/usr/bin/env node
+const fs = require('fs');
+const path = require('path');
+
+const riskDb = require('../data/risk-db.json');
+
+function getAllDependencies(dir) {
+  const pkgPath = path.join(dir, 'package.json');
+  if (!fs.existsSync(pkgPath)) {
+    console.error('No package.json found in this directory.');
+    process.exit(1);
+  }
+  const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
+  const deps = {
+    ...(pkg.dependencies || {}),
+    ...(pkg.devDependencies || {})
+  };
+
+  const nodeModulesPath = path.join(dir, 'node_modules');
+  const allFound = new Set(Object.keys(deps));
+
+  if (fs.existsSync(nodeModulesPath)) {
+    const entries = fs.readdirSync(nodeModulesPath);
+    entries.forEach(entry => allFound.add(entry));
+  }
+
+  return Array.from(allFound);
+}
+
+function auditProject(dir) {
+  const allDeps = getAllDependencies(dir);
+  const flagged = [];
+
+  allDeps.forEach(dep => {
+    if (riskDb[dep]) {
+      flagged.push({ package: dep, ...riskDb[dep] });
+    }
+  });
+
+  return flagged;
+}
+
+function scoreResult(flagged) {
+  const highCount = flagged.filter(f => f.severity === 'high').length;
+  const medCount = flagged.filter(f => f.severity === 'medium').length;
+  const penalty = highCount * 15 + medCount * 5;
+  const score = Math.max(0, 100 - penalty);
+  return score;
+}
+
+function printReport(flagged, score) {
+  console.log('\n=== Quantum-Audit Report ===\n');
+
+  if (flagged.length === 0) {
+    console.log('No known quantum-vulnerable packages detected.');
+  } else {
+    flagged.forEach(f => {
+      console.log(`[${f.severity.toUpperCase()}] ${f.package} — ${f.reason}`);
+    });
+  }
+
+  console.log(`\nQuantum-Readiness Score: ${score}/100\n`);
+}
+
+const targetDir = process.cwd();
+const flagged = auditProject(targetDir);
+const score = scoreResult(flagged);
+printReport(flagged, score);
+
+const jsonReport = {
+  score,
+  flagged,
+  scannedAt: new Date().toISOString()
+};
+fs.writeFileSync(path.join(targetDir, 'quantum-audit-report.json'), JSON.stringify(jsonReport, null, 2));
+console.log('Full report saved to quantum-audit-report.json');

package/data/risk-db.json

@@ -0,0 +1,13 @@
+{
+  "elliptic": { "severity": "high", "reason": "ECC implementation, broken by Shor's algorithm" },
+  "secp256k1": { "severity": "high", "reason": "Elliptic curve crypto, broken by Shor's algorithm" },
+  "eccrypto": { "severity": "high", "reason": "ECC-based encryption, broken by Shor's algorithm" },
+  "node-rsa": { "severity": "high", "reason": "RSA implementation, broken by Shor's algorithm" },
+  "jsrsasign": { "severity": "high", "reason": "RSA/ECDSA toolkit, broken by Shor's algorithm" },
+  "node-forge": { "severity": "medium", "reason": "Supports RSA/ECC; flag if used for those, not just TLS" },
+  "jsonwebtoken": { "severity": "medium", "reason": "Often configured with RS256/ES256 (quantum-vulnerable signing)" },
+  "jose": { "severity": "medium", "reason": "JWT/JWS library, check for RSA/EC algorithm usage" },
+  "tweetnacl": { "severity": "high", "reason": "Curve25519-based, broken by Shor's algorithm" },
+  "bitcoinjs-lib": { "severity": "high", "reason": "Uses secp256k1 ECDSA for signing" },
+  "ethereumjs-util": { "severity": "high", "reason": "Uses secp256k1 ECDSA for signing" }
+}

package/package.json

@@ -0,0 +1,15 @@
+{
+  "name": "quantum-audit",
+  "version": "0.1.0",
+  "description": "Scans npm projects for quantum-vulnerable cryptography in their dependency tree",
+  "main": "index.js",
+  "bin": {
+    "quantum-audit": "./bin/cli.js"
+  },
+  "scripts": {
+    "test": "node bin/cli.js"
+  },
+  "keywords": ["quantum", "cryptography", "security", "npm", "audit", "post-quantum"],
+  "license": "MIT",
+  "author": "Takundanashe Muchena"
+}