scriptguard 1.0.0 → 1.0.2

package/dist/scanners/ast.js

@@ -0,0 +1,267 @@
+"use strict";
+/** ScriptGuard — AST-based pattern detection (Layer 2) */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.analyzeScriptAST = analyzeScriptAST;
+const acorn_1 = require("acorn");
+const walk = __importStar(require("acorn-walk"));
+/**
+ * Dangerous objects that we want to track access to
+ */
+const DANGEROUS_OBJECTS = new Set([
+    'process',
+    'fs',
+    'child_process',
+    'net',
+    'http',
+    'https',
+    'url',
+    'path',
+    'os',
+    'crypto',
+    'vm',
+    'cluster',
+]);
+/**
+ * Analyze script content using AST to detect structural patterns
+ * that regex cannot see (dynamic require, computed eval, etc.)
+ *
+ * @param scriptContent - The JavaScript code to analyze
+ * @returns Array of AST findings (empty if parse fails or no patterns found)
+ */
+function analyzeScriptAST(scriptContent) {
+    // Skip large scripts (>1MB) to prevent memory issues
+    if (scriptContent.length > 1_000_000) {
+        return [];
+    }
+    let ast;
+    try {
+        ast = (0, acorn_1.parse)(scriptContent, {
+            ecmaVersion: 'latest',
+            sourceType: 'script',
+        });
+    }
+    catch (error) {
+        // Malformed JavaScript — return empty array (graceful degradation)
+        return [];
+    }
+    const findings = [];
+    // Walk the AST and detect patterns
+    walk.simple(ast, {
+        // Detect: require(variable), require(computed), require('child_' + 'process')
+        CallExpression(node) {
+            const callee = node.callee;
+            // Pattern 1: Dynamic require()
+            if (callee.type === 'Identifier' && callee.name === 'require') {
+                if (node.arguments.length > 0) {
+                    const arg = node.arguments[0];
+                    // Flag if argument is NOT a literal string
+                    if (!isLiteral(arg)) {
+                        findings.push({
+                            pattern: 'ast-dynamic-require',
+                            description: 'Dynamic require() with non-literal argument — may load arbitrary modules',
+                            riskLevel: 'high',
+                            nodeType: 'CallExpression',
+                            match: extractMatch(scriptContent, node),
+                        });
+                    }
+                }
+            }
+            // Pattern 2: Computed eval() or Function()
+            if ((callee.type === 'Identifier' && (callee.name === 'eval' || callee.name === 'Function')) ||
+                (callee.type === 'MemberExpression' &&
+                    callee.property.type === 'Identifier' &&
+                    (callee.property.name === 'eval' || callee.property.name === 'Function'))) {
+                if (node.arguments.length > 0) {
+                    const arg = node.arguments[0];
+                    // Flag if argument is NOT a literal string
+                    if (!isLiteral(arg)) {
+                        findings.push({
+                            pattern: 'ast-computed-eval',
+                            description: 'Computed eval() or Function() — may execute arbitrary code',
+                            riskLevel: 'critical',
+                            nodeType: 'CallExpression',
+                            match: extractMatch(scriptContent, node),
+                        });
+                    }
+                }
+            }
+        },
+        // Pattern 3: Computed property access on dangerous objects
+        // Example: process.env[computed], fs['read' + 'File']
+        MemberExpression(node) {
+            if (node.computed) {
+                // Check if object is dangerous
+                const objectName = getObjectName(node.object);
+                if (objectName && DANGEROUS_OBJECTS.has(objectName)) {
+                    // Flag if property is computed (not a literal)
+                    if (!isLiteral(node.property)) {
+                        findings.push({
+                            pattern: 'ast-computed-property',
+                            description: `Computed property access on ${objectName} — may bypass keyword detection`,
+                            riskLevel: 'high',
+                            nodeType: 'MemberExpression',
+                            match: extractMatch(scriptContent, node),
+                        });
+                    }
+                }
+            }
+        },
+        // Pattern 4: String concatenation building dangerous keywords
+        // Example: 'child_' + 'process', 'eval' + variable
+        BinaryExpression(node) {
+            if (node.operator === '+') {
+                const built = tryResolveBinaryExpression(node);
+                if (built && containsDangerousKeyword(built)) {
+                    findings.push({
+                        pattern: 'ast-string-building',
+                        description: 'String concatenation building dangerous keywords — possible obfuscation',
+                        riskLevel: 'medium',
+                        nodeType: 'BinaryExpression',
+                        match: extractMatch(scriptContent, node),
+                    });
+                }
+            }
+        },
+    });
+    return findings;
+}
+/**
+ * Check if an AST node is a literal (string, number, boolean, null)
+ */
+function isLiteral(node) {
+    if (!node)
+        return false;
+    if (node.type === 'Literal') {
+        return true;
+    }
+    // Template literals with no expressions are literals
+    if (node.type === 'TemplateLiteral') {
+        return node.expressions.length === 0;
+    }
+    return false;
+}
+/**
+ * Get the name of an object from a MemberExpression or Identifier
+ */
+function getObjectName(node) {
+    if (!node)
+        return null;
+    if (node.type === 'Identifier') {
+        return node.name;
+    }
+    if (node.type === 'MemberExpression') {
+        return getObjectName(node.object);
+    }
+    return null;
+}
+/**
+ * Try to resolve a binary expression to a string
+ * Returns null if resolution fails
+ */
+function tryResolveBinaryExpression(node) {
+    if (!node)
+        return null;
+    // If it's a literal, return its value
+    if (node.type === 'Literal' && typeof node.value === 'string') {
+        return node.value;
+    }
+    // If it's a binary expression, try to resolve both sides
+    if (node.type === 'BinaryExpression' && node.operator === '+') {
+        const left = tryResolveBinaryExpression(node.left);
+        const right = tryResolveBinaryExpression(node.right);
+        if (left !== null && right !== null) {
+            return left + right;
+        }
+    }
+    return null;
+}
+/**
+ * Check if a string contains dangerous keywords
+ */
+function containsDangerousKeyword(str) {
+    const lower = str.toLowerCase();
+    const dangerousKeywords = [
+        'eval',
+        'function',
+        'require',
+        'exec',
+        'spawn',
+        'child_process',
+        'process.env',
+        'fs.',
+        'http.',
+        'net.',
+    ];
+    for (const keyword of dangerousKeywords) {
+        if (lower.includes(keyword)) {
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * Extract the source code for a given AST node
+ */
+function extractMatch(scriptContent, node) {
+    if (!node || !node.loc) {
+        return '';
+    }
+    try {
+        const lines = scriptContent.split('\n');
+        const startLine = node.loc.start.line - 1; // 0-indexed
+        const endLine = node.loc.end.line - 1;
+        const startCol = node.loc.start.column;
+        const endCol = node.loc.end.column;
+        if (startLine === endLine) {
+            // Single line
+            const line = lines[startLine];
+            return line.substring(startCol, endCol);
+        }
+        else {
+            // Multi-line
+            let result = lines[startLine].substring(startCol);
+            for (let i = startLine + 1; i < endLine; i++) {
+                result += '\n' + lines[i];
+            }
+            result += '\n' + lines[endLine].substring(0, endCol);
+            return result;
+        }
+    }
+    catch {
+        return '';
+    }
+}
+//# sourceMappingURL=ast.js.map

package/dist/scanners/ast.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ast.js","sourceRoot":"","sources":["../../src/scanners/ast.ts"],"names":[],"mappings":";AAAA,0DAA0D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+B1D,4CA8GC;AA3ID,iCAA8B;AAC9B,iDAAmC;AAGnC;;GAEG;AACH,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,SAAS;IACT,IAAI;IACJ,eAAe;IACf,KAAK;IACL,MAAM;IACN,OAAO;IACP,KAAK;IACL,MAAM;IACN,IAAI;IACJ,QAAQ;IACR,IAAI;IACJ,SAAS;CACV,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,SAAgB,gBAAgB,CAC9B,aAAqB;IAErB,qDAAqD;IACrD,IAAI,aAAa,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;QACrC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,GAAQ,CAAC;IAEb,IAAI,CAAC;QACH,GAAG,GAAG,IAAA,aAAK,EAAC,aAAa,EAAE;YACzB,WAAW,EAAE,QAAQ;YACrB,UAAU,EAAE,QAAQ;SACrB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,mEAAmE;QACnE,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,QAAQ,GAAiB,EAAE,CAAC;IAElC,mCAAmC;IACnC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE;QACf,8EAA8E;QAC9E,cAAc,CAAC,IAAS;YACtB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;YAE3B,+BAA+B;YAC/B,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC9D,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;oBAE9B,2CAA2C;oBAC3C,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;wBACpB,QAAQ,CAAC,IAAI,CAAC;4BACZ,OAAO,EAAE,qBAAqB;4BAC9B,WAAW,EAAE,0EAA0E;4BACvF,SAAS,EAAE,MAAM;4BACjB,QAAQ,EAAE,gBAAgB;4BAC1B,KAAK,EAAE,YAAY,CAAC,aAAa,EAAE,IAAI,CAAC;yBACzC,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;YAED,2CAA2C;YAC3C,IACE,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC;gBACxF,CAAC,MAAM,CAAC,IAAI,KAAK,kBAAkB;oBACjC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,YAAY;oBACrC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,MAAM,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,EAC3E,CAAC;gBACD,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;oBAE9B,2CAA2C;oBAC3C,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;wBACpB,QAAQ,CAAC,IAAI,CAAC;4BACZ,OAAO,EAAE,mBAAmB;4BAC5B,WAAW,EAAE,4DAA4D;4BACzE,SAAS,EAAE,UAAU;4BACrB,QAAQ,EAAE,gBAAgB;4BAC1B,KAAK,EAAE,YAAY,CAAC,aAAa,EAAE,IAAI,CAAC;yBACzC,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,2DAA2D;QAC3D,sDAAsD;QACtD,gBAAgB,CAAC,IAAS;YACxB,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAClB,+BAA+B;gBAC/B,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAC9C,IAAI,UAAU,IAAI,iBAAiB,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;oBACpD,+CAA+C;oBAC/C,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;wBAC9B,QAAQ,CAAC,IAAI,CAAC;4BACZ,OAAO,EAAE,uBAAuB;4BAChC,WAAW,EAAE,+BAA+B,UAAU,iCAAiC;4BACvF,SAAS,EAAE,MAAM;4BACjB,QAAQ,EAAE,kBAAkB;4BAC5B,KAAK,EAAE,YAAY,CAAC,aAAa,EAAE,IAAI,CAAC;yBACzC,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,8DAA8D;QAC9D,mDAAmD;QACnD,gBAAgB,CAAC,IAAS;YACxB,IAAI,IAAI,CAAC,QAAQ,KAAK,GAAG,EAAE,CAAC;gBAC1B,MAAM,KAAK,GAAG,0BAA0B,CAAC,IAAI,CAAC,CAAC;gBAC/C,IAAI,KAAK,IAAI,wBAAwB,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC7C,QAAQ,CAAC,IAAI,CAAC;wBACZ,OAAO,EAAE,qBAAqB;wBAC9B,WAAW,EAAE,yEAAyE;wBACtF,SAAS,EAAE,QAAQ;wBACnB,QAAQ,EAAE,kBAAkB;wBAC5B,KAAK,EAAE,YAAY,CAAC,aAAa,EAAE,IAAI,CAAC;qBACzC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;KACF,CAAC,CAAC;IAEH,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,SAAS,SAAS,CAAC,IAAS;IAC1B,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAExB,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,qDAAqD;IACrD,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QACpC,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,CAAC;IACvC,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CAAC,IAAS;IAC9B,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,IAAI,IAAI,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;QACrC,OAAO,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,SAAS,0BAA0B,CAAC,IAAS;IAC3C,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,sCAAsC;IACtC,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9D,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED,yDAAyD;IACzD,IAAI,IAAI,CAAC,IAAI,KAAK,kBAAkB,IAAI,IAAI,CAAC,QAAQ,KAAK,GAAG,EAAE,CAAC;QAC9D,MAAM,IAAI,GAAG,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,KAAK,GAAG,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAErD,IAAI,IAAI,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACpC,OAAO,IAAI,GAAG,KAAK,CAAC;QACtB,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,SAAS,wBAAwB,CAAC,GAAW;IAC3C,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAChC,MAAM,iBAAiB,GAAG;QACxB,MAAM;QACN,UAAU;QACV,SAAS;QACT,MAAM;QACN,OAAO;QACP,eAAe;QACf,aAAa;QACb,KAAK;QACL,OAAO;QACP,MAAM;KACP,CAAC;IAEF,KAAK,MAAM,OAAO,IAAI,iBAAiB,EAAE,CAAC;QACxC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,SAAS,YAAY,CAAC,aAAqB,EAAE,IAAS;IACpD,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,YAAY;QACvD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC;QACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC;QACvC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC;QAEnC,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;YAC1B,cAAc;YACd,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;YAC9B,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC1C,CAAC;aAAM,CAAC;YACN,aAAa;YACb,IAAI,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;YAClD,KAAK,IAAI,CAAC,GAAG,SAAS,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC7C,MAAM,IAAI,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YAC5B,CAAC;YACD,MAAM,IAAI,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;YACrD,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/scanners/deobfuscation.d.ts

@@ -0,0 +1,12 @@
+/** ScriptGuard — Simplified deobfuscation (Layer 3, decode-only, NO code execution) */
+import type { DeobfuscationResult } from '../types/index.js';
+/**
+ * Deobfuscate a script by decoding obvious encoding layers.
+ * This is a DECODE-ONLY approach — NO code execution.
+ *
+ * @param scriptContent - The obfuscated JavaScript code
+ * @param maxIterations - Maximum decode iterations (default: 2)
+ * @returns Deobfuscation result with deobfuscated code and metadata
+ */
+export declare function deobfuscateScript(scriptContent: string, maxIterations?: number): DeobfuscationResult;
+//# sourceMappingURL=deobfuscation.d.ts.map

package/dist/scanners/deobfuscation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deobfuscation.d.ts","sourceRoot":"","sources":["../../src/scanners/deobfuscation.ts"],"names":[],"mappings":"AAAA,uFAAuF;AAGvF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAE7D;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,aAAa,EAAE,MAAM,EACrB,aAAa,GAAE,MAAU,GACxB,mBAAmB,CAiFrB"}

package/dist/scanners/deobfuscation.js

@@ -0,0 +1,169 @@
+"use strict";
+/** ScriptGuard — Simplified deobfuscation (Layer 3, decode-only, NO code execution) */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deobfuscateScript = deobfuscateScript;
+const acorn_1 = require("acorn");
+/**
+ * Deobfuscate a script by decoding obvious encoding layers.
+ * This is a DECODE-ONLY approach — NO code execution.
+ *
+ * @param scriptContent - The obfuscated JavaScript code
+ * @param maxIterations - Maximum decode iterations (default: 2)
+ * @returns Deobfuscation result with deobfuscated code and metadata
+ */
+function deobfuscateScript(scriptContent, maxIterations = 2) {
+    // Skip large scripts (>1MB) to prevent memory issues
+    if (scriptContent.length > 1_000_000) {
+        return {
+            deobfuscated: scriptContent,
+            iterations: 0,
+            techniques: [],
+            success: false,
+        };
+    }
+    let current = scriptContent;
+    const techniques = [];
+    let iterations = 0;
+    for (let i = 0; i < maxIterations; i++) {
+        const previous = current;
+        const iterationTechniques = [];
+        // Layer 1: Base64 decoding
+        current = decodeBase64Layers(current, iterationTechniques);
+        // Layer 2: Hex escape decoding
+        current = decodeHexEscapes(current, iterationTechniques);
+        // Layer 3: Unicode escape decoding
+        current = decodeUnicodeEscapes(current, iterationTechniques);
+        // Check if we made progress
+        if (current === previous) {
+            break;
+        }
+        techniques.push(...iterationTechniques);
+        iterations++;
+        // Safety: Stop if script becomes too large (exponential unpacking prevention)
+        if (current.length > scriptContent.length * 10) {
+            // Script grew too much — potential unpacking bomb
+            return {
+                deobfuscated: scriptContent, // Return original
+                iterations: 0,
+                techniques: [],
+                success: false,
+            };
+        }
+    }
+    // Validate that deobfuscated code is still valid JavaScript
+    if (iterations > 0) {
+        try {
+            (0, acorn_1.parse)(current, {
+                ecmaVersion: 'latest',
+                sourceType: 'script',
+            });
+            // Deobfuscated successfully and is valid JS
+            return {
+                deobfuscated: current,
+                iterations,
+                techniques,
+                success: true,
+            };
+        }
+        catch {
+            // Deobfuscation produced invalid syntax — return original
+            return {
+                deobfuscated: scriptContent,
+                iterations: 0,
+                techniques: [],
+                success: false,
+            };
+        }
+    }
+    // No deobfuscation occurred
+    return {
+        deobfuscated: scriptContent,
+        iterations: 0,
+        techniques: [],
+        success: false,
+    };
+}
+/**
+ * Decode base64-encoded strings in the script.
+ * Detects: atob(...), Buffer.from(..., 'base64'), base64 -d patterns
+ *
+ * Only decodes OBVIOUS patterns (no nested expressions) to avoid false positives.
+ */
+function decodeBase64Layers(script, techniques) {
+    let result = script;
+    // Pattern 1: atob('base64string')
+    const atobPattern = /atob\s*\(\s*(['"`])([A-Za-z0-9+/=]+)\1\s*\)/g;
+    result = result.replace(atobPattern, (match, quote, base64) => {
+        try {
+            const decoded = Buffer.from(base64, 'base64').toString('utf-8');
+            // Only replace if decoded looks like valid text (no control characters)
+            if (/^[\x20-\x7E\s]*$/.test(decoded)) {
+                techniques.push('base64-atob');
+                return JSON.stringify(decoded); // Return as quoted string
+            }
+        }
+        catch {
+            // Invalid base64 — return original
+        }
+        return match;
+    });
+    // Pattern 2: Buffer.from('base64string', 'base64')
+    const bufferPattern = /Buffer\.from\s*\(\s*(['"`])([A-Za-z0-9+/=]+)\1\s*,\s*['"`]base64['"`]\s*\)/g;
+    result = result.replace(bufferPattern, (match, quote, base64) => {
+        try {
+            const decoded = Buffer.from(base64, 'base64').toString('utf-8');
+            if (/^[\x20-\x7E\s]*$/.test(decoded)) {
+                techniques.push('base64-buffer');
+                return JSON.stringify(decoded);
+            }
+        }
+        catch {
+            // Invalid base64
+        }
+        return match;
+    });
+    // Pattern 3: .toString('base64') chains (reverse)
+    // This is more complex and may produce false positives, so be conservative
+    const toStringPattern = /\.toString\s*\(\s*['"`]base64['"`]\s*\)/g;
+    // Don't auto-replace these — they're harder to detect safely
+    return result;
+}
+/**
+ * Decode hexadecimal escape sequences: \xNN
+ */
+function decodeHexEscapes(script, techniques) {
+    let result = script;
+    let hasDecoded = false;
+    // Match \xNN patterns (where NN are hex digits)
+    const hexPattern = /\\x([0-9a-fA-F]{2})/g;
+    result = result.replace(hexPattern, (match, hex) => {
+        const charCode = parseInt(hex, 16);
+        const char = String.fromCharCode(charCode);
+        hasDecoded = true;
+        return char;
+    });
+    if (hasDecoded) {
+        techniques.push('hex-escape');
+    }
+    return result;
+}
+/**
+ * Decode Unicode escape sequences: \uNNNN
+ */
+function decodeUnicodeEscapes(script, techniques) {
+    let result = script;
+    let hasDecoded = false;
+    // Match \uNNNN patterns (where NNNN are hex digits)
+    const unicodePattern = /\\u([0-9a-fA-F]{4})/g;
+    result = result.replace(unicodePattern, (match, hex) => {
+        const charCode = parseInt(hex, 16);
+        const char = String.fromCharCode(charCode);
+        hasDecoded = true;
+        return char;
+    });
+    if (hasDecoded) {
+        techniques.push('unicode-escape');
+    }
+    return result;
+}
+//# sourceMappingURL=deobfuscation.js.map

package/dist/scanners/deobfuscation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deobfuscation.js","sourceRoot":"","sources":["../../src/scanners/deobfuscation.ts"],"names":[],"mappings":";AAAA,uFAAuF;;AAavF,8CAoFC;AA/FD,iCAA8B;AAG9B;;;;;;;GAOG;AACH,SAAgB,iBAAiB,CAC/B,aAAqB,EACrB,gBAAwB,CAAC;IAEzB,qDAAqD;IACrD,IAAI,aAAa,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;QACrC,OAAO;YACL,YAAY,EAAE,aAAa;YAC3B,UAAU,EAAE,CAAC;YACb,UAAU,EAAE,EAAE;YACd,OAAO,EAAE,KAAK;SACf,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,GAAG,aAAa,CAAC;IAC5B,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,IAAI,UAAU,GAAG,CAAC,CAAC;IAEnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,aAAa,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,QAAQ,GAAG,OAAO,CAAC;QACzB,MAAM,mBAAmB,GAAa,EAAE,CAAC;QAEzC,2BAA2B;QAC3B,OAAO,GAAG,kBAAkB,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;QAE3D,+BAA+B;QAC/B,OAAO,GAAG,gBAAgB,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;QAEzD,mCAAmC;QACnC,OAAO,GAAG,oBAAoB,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;QAE7D,4BAA4B;QAC5B,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;YACzB,MAAM;QACR,CAAC;QAED,UAAU,CAAC,IAAI,CAAC,GAAG,mBAAmB,CAAC,CAAC;QACxC,UAAU,EAAE,CAAC;QAEb,8EAA8E;QAC9E,IAAI,OAAO,CAAC,MAAM,GAAG,aAAa,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YAC/C,kDAAkD;YAClD,OAAO;gBACL,YAAY,EAAE,aAAa,EAAE,kBAAkB;gBAC/C,UAAU,EAAE,CAAC;gBACb,UAAU,EAAE,EAAE;gBACd,OAAO,EAAE,KAAK;aACf,CAAC;QACJ,CAAC;IACH,CAAC;IAED,4DAA4D;IAC5D,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;QACnB,IAAI,CAAC;YACH,IAAA,aAAK,EAAC,OAAO,EAAE;gBACb,WAAW,EAAE,QAAQ;gBACrB,UAAU,EAAE,QAAQ;aACrB,CAAC,CAAC;YAEH,4CAA4C;YAC5C,OAAO;gBACL,YAAY,EAAE,OAAO;gBACrB,UAAU;gBACV,UAAU;gBACV,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,0DAA0D;YAC1D,OAAO;gBACL,YAAY,EAAE,aAAa;gBAC3B,UAAU,EAAE,CAAC;gBACb,UAAU,EAAE,EAAE;gBACd,OAAO,EAAE,KAAK;aACf,CAAC;QACJ,CAAC;IACH,CAAC;IAED,4BAA4B;IAC5B,OAAO;QACL,YAAY,EAAE,aAAa;QAC3B,UAAU,EAAE,CAAC;QACb,UAAU,EAAE,EAAE;QACd,OAAO,EAAE,KAAK;KACf,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,MAAc,EAAE,UAAoB;IAC9D,IAAI,MAAM,GAAG,MAAM,CAAC;IAEpB,kCAAkC;IAClC,MAAM,WAAW,GAAG,8CAA8C,CAAC;IACnE,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC5D,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAChE,wEAAwE;YACxE,IAAI,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBACrC,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;gBAC/B,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,0BAA0B;YAC5D,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,mCAAmC;QACrC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;IAEH,mDAAmD;IACnD,MAAM,aAAa,GAAG,6EAA6E,CAAC;IACpG,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC9D,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAChE,IAAI,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBACrC,UAAU,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;gBACjC,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YACjC,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB;QACnB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;IAEH,kDAAkD;IAClD,2EAA2E;IAC3E,MAAM,eAAe,GAAG,0CAA0C,CAAC;IACnE,6DAA6D;IAE7D,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,SAAS,gBAAgB,CAAC,MAAc,EAAE,UAAoB;IAC5D,IAAI,MAAM,GAAG,MAAM,CAAC;IACpB,IAAI,UAAU,GAAG,KAAK,CAAC;IAEvB,gDAAgD;IAChD,MAAM,UAAU,GAAG,sBAAsB,CAAC;IAE1C,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QACjD,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACnC,MAAM,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC3C,UAAU,GAAG,IAAI,CAAC;QAClB,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,IAAI,UAAU,EAAE,CAAC;QACf,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAChC,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,SAAS,oBAAoB,CAAC,MAAc,EAAE,UAAoB;IAChE,IAAI,MAAM,GAAG,MAAM,CAAC;IACpB,IAAI,UAAU,GAAG,KAAK,CAAC;IAEvB,oDAAoD;IACpD,MAAM,cAAc,GAAG,sBAAsB,CAAC;IAE9C,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QACrD,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACnC,MAAM,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC3C,UAAU,GAAG,IAAI,CAAC;QAClB,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,IAAI,UAAU,EAAE,CAAC;QACf,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACpC,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/scanners/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/scanners/index.ts"],"names":[],"mappings":"AAAA,sCAAsC;AAEtC,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,eAAe,EAAE,SAAS,EAAkB,MAAM,mBAAmB,CAAC;AAsDxH,wBAAsB,WAAW,CAAC,OAAO,EAAE,WAAW,GAAG;IAAE,EAAE,CAAC,EAAE,SAAS,CAAA;CAAE,GAAG,OAAO,CAAC,UAAU,CAAC,CAiBhG;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,WAAW,GAAG,UAAU,CAIhE;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,UAAU,CAS5D;AAED,wBAAgB,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,EAAE,SAAS,GAAG,OAAO,CAM7E;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,eAAe,EAAE,EAAE,QAAQ,EAAE,SAAS,GAAG,eAAe,EAAE,CAQrG"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/scanners/index.ts"],"names":[],"mappings":"AAAA,sCAAsC;AAEtC,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,eAAe,EAAE,SAAS,EAAkB,MAAM,mBAAmB,CAAC;AAsDxH,wBAAsB,WAAW,CAAC,OAAO,EAAE,WAAW,GAAG;IAAE,EAAE,CAAC,EAAE,SAAS,CAAA;CAAE,GAAG,OAAO,CAAC,UAAU,CAAC,CAqBhG;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,WAAW,GAAG,UAAU,CAIhE;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,UAAU,CAS5D;AAED,wBAAgB,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,EAAE,SAAS,GAAG,OAAO,CAM7E;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,eAAe,EAAE,EAAE,QAAQ,EAAE,SAAS,GAAG,eAAe,EAAE,CAQrG"}

package/dist/scanners/index.js

@@ -86,7 +86,7 @@ function aggregateResults(analyses, startTime) {
 }
 async function scanProject(options) {
     const startTime = Date.now();
-    const analyses = (0, lifecycle_js_1.scanInstalledPackages)(options.path, options.includeDev);
+    const analyses = (0, lifecycle_js_1.scanInstalledPackages)(options.path, options.includeDev, { ast: options.ast, deobfuscate: options.deobfuscate });
     let result = aggregateResults(analyses, startTime);
     // Phase 2: AI analysis (opt-in)
     if (options.ai?.enabled) {

package/dist/scanners/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/scanners/index.ts"],"names":[],"mappings":";AAAA,sCAAsC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwDtC,kCAiBC;AAED,0CAIC;AAED,0CASC;AAED,gCAMC;AAED,8CAQC;AAzGD,iDAAuE;AACvE,6CAAiD;AACjD,4CAA8B;AAC9B,gDAAkC;AAElC,MAAM,gBAAgB,GAA8B;IAClD,GAAG,EAAE,CAAC;IACN,MAAM,EAAE,CAAC;IACT,IAAI,EAAE,CAAC;IACP,QAAQ,EAAE,CAAC;CACZ,CAAC;AAEF,SAAS,gBAAgB,CACvB,QAA2B,EAC3B,SAAiB;IAEjB,MAAM,aAAa,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC9E,MAAM,eAAe,GAA8B,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IAE/F,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;YAC3B,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC;QACjC,CAAC;IACH,CAAC;IAED,MAAM,mBAAmB,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;IAE7F,IAAI,gBAAgB,GAAG,CAAC,CAAC;IACzB,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;QAChE,gBAAgB,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;QACvD,wBAAwB;QACxB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;QAC/D,gBAAgB,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,gBAAgB,GAAG,GAAG,GAAG,QAAQ,GAAG,GAAG,CAAC,CAAC,CAAC;IACxF,CAAC;IAED,IAAI,gBAAgB,GAAc,KAAK,CAAC;IACxC,IAAI,eAAe,CAAC,QAAQ,GAAG,CAAC;QAAE,gBAAgB,GAAG,UAAU,CAAC;SAC3D,IAAI,eAAe,CAAC,IAAI,GAAG,CAAC;QAAE,gBAAgB,GAAG,MAAM,CAAC;SACxD,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC;QAAE,gBAAgB,GAAG,QAAQ,CAAC;IAEjE,OAAO;QACL,aAAa,EAAE,QAAQ,CAAC,MAAM;QAC9B,mBAAmB;QACnB,QAAQ;QACR,aAAa;QACb,eAAe;QACf,gBAAgB;QAChB,gBAAgB;QAChB,cAAc,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;KACvC,CAAC;AACJ,CAAC;AAEM,KAAK,UAAU,WAAW,CAAC,OAAyC;IACzE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAG,IAAA,oCAAqB,EAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IACzE,IAAI,MAAM,GAAG,gBAAgB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAEnD,gCAAgC;IAChC,IAAI,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,iEAAiE;YACjE,OAAO,CAAC,IAAI,CAAC,+BAA+B,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAC7D,OAAO,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAgB,eAAe,CAAC,OAAoB;IAClD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAG,IAAA,oCAAqB,EAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IACzE,OAAO,gBAAgB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;AAC/C,CAAC;AAED,SAAgB,eAAe,CAAC,QAAgB;IAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,IAAA,6BAAc,EAC7B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,EACjE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,OAAO,IAAI,SAAS,EACxC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,OAAO,IAAI,EAAE,CAClC,CAAC;IACF,OAAO,gBAAgB,CAAC,CAAC,QAAQ,CAAC,EAAE,SAAS,CAAC,CAAC;AACjD,CAAC;AAED,SAAgB,UAAU,CAAC,MAAkB,EAAE,SAAqB;IAClE,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7B,MAAM,SAAS,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;IAC9C,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAChC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,CACnE,CAAC;AACJ,CAAC;AAED,SAAgB,iBAAiB,CAAC,QAA2B,EAAE,QAAmB;IAChF,MAAM,SAAS,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC7C,OAAO,QAAQ;SACZ,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACX,GAAG,CAAC;QACJ,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC;KAC/E,CAAC,CAAC;SACF,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,YAAY,CAAC,MAAkB,EAAE,SAAoB;IAClE,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE/B,8EAA8E;IAC9E,MAAM,iBAAiB,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAC9C,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAChE,CAAC;IAEF,IAAI,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,sBAAsB;IACtB,MAAM,YAAY,GAAmB;QACnC,QAAQ,EAAE,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACpC,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,QAAQ,EAAE,CAAC,CAAC,QAAQ;SACrB,CAAC,CAAC;QACH,IAAI,EAAE,SAAS,CAAC,IAAI,IAAI,UAAU;KACnC,CAAC;IAEF,kBAAkB;IAClB,MAAM,MAAM,GAAG,IAAA,0BAAe,EAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACjD,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;IAE3D,sCAAsC;IACtC,MAAM,UAAU,GAAG,IAAI,GAAG,CACxB,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAC/D,CAAC;IAEF,IAAI,2BAA2B,GAAG,CAAC,CAAC;IACpC,IAAI,uBAAuB,GAAG,CAAC,CAAC;IAEhC,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,GAAG,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACnD,MAAM,UAAU,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEvC,IAAI,UAAU,EAAE,CAAC;YACf,8BAA8B;YAC9B,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;gBACxC,OAAO,CAAC,UAAU,GAAG,UAAU,CAAC;YAClC,CAAC;YAED,2BAA2B,IAAI,UAAU,CAAC,sBAAsB,CAAC;YACjE,uBAAuB,IAAI,UAAU,CAAC,kBAAkB,CAAC;YAEzD,yCAAyC;YACzC,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACnC,MAAM,kBAAkB,GAAG,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE;oBACrE,MAAM,aAAa,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;oBAClE,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;gBACxD,CAAC,EAAE,CAAC,CAAC,CAAC;gBAEN,2CAA2C;gBAC3C,IAAI,kBAAkB,IAAI,CAAC,IAAI,UAAU,CAAC,UAAU,GAAG,GAAG,EAAE,CAAC;oBAC3D,QAAQ,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,SAAS,GAAG,EAAE,CAAC,CAAC;gBAC9D,CAAC;qBAAM,IAAI,kBAAkB,KAAK,CAAC,IAAI,UAAU,CAAC,sBAAsB,GAAG,CAAC,EAAE,CAAC;oBAC7E,8CAA8C;oBAC9C,QAAQ,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,SAAS,GAAG,EAAE,CAAC,CAAC;gBAC5D,CAAC;gBAED,yBAAyB;gBACzB,IAAI,QAAQ,CAAC,SAAS,IAAI,EAAE;oBAAE,QAAQ,CAAC,SAAS,GAAG,UAAU,CAAC;qBACzD,IAAI,QAAQ,CAAC,SAAS,IAAI,EAAE;oBAAE,QAAQ,CAAC,SAAS,GAAG,MAAM,CAAC;qBAC1D,IAAI,QAAQ,CAAC,SAAS,IAAI,EAAE;oBAAE,QAAQ,CAAC,SAAS,GAAG,QAAQ,CAAC;;oBAC5D,QAAQ,CAAC,SAAS,GAAG,KAAK,CAAC;YAClC,CAAC;QACH,CAAC;IACH,CAAC;IAED,2BAA2B;IAC3B,MAAM,CAAC,UAAU,GAAG;QAClB,eAAe,EAAE,UAAU,CAAC,eAAe;QAC3C,2BAA2B;QAC3B,uBAAuB;QACvB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW;KACrC,CAAC;IAEF,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/scanners/index.ts"],"names":[],"mappings":";AAAA,sCAAsC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwDtC,kCAqBC;AAED,0CAIC;AAED,0CASC;AAED,gCAMC;AAED,8CAQC;AA7GD,iDAAuE;AACvE,6CAAiD;AACjD,4CAA8B;AAC9B,gDAAkC;AAElC,MAAM,gBAAgB,GAA8B;IAClD,GAAG,EAAE,CAAC;IACN,MAAM,EAAE,CAAC;IACT,IAAI,EAAE,CAAC;IACP,QAAQ,EAAE,CAAC;CACZ,CAAC;AAEF,SAAS,gBAAgB,CACvB,QAA2B,EAC3B,SAAiB;IAEjB,MAAM,aAAa,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC9E,MAAM,eAAe,GAA8B,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IAE/F,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;YAC3B,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC;QACjC,CAAC;IACH,CAAC;IAED,MAAM,mBAAmB,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;IAE7F,IAAI,gBAAgB,GAAG,CAAC,CAAC;IACzB,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;QAChE,gBAAgB,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;QACvD,wBAAwB;QACxB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;QAC/D,gBAAgB,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,gBAAgB,GAAG,GAAG,GAAG,QAAQ,GAAG,GAAG,CAAC,CAAC,CAAC;IACxF,CAAC;IAED,IAAI,gBAAgB,GAAc,KAAK,CAAC;IACxC,IAAI,eAAe,CAAC,QAAQ,GAAG,CAAC;QAAE,gBAAgB,GAAG,UAAU,CAAC;SAC3D,IAAI,eAAe,CAAC,IAAI,GAAG,CAAC;QAAE,gBAAgB,GAAG,MAAM,CAAC;SACxD,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC;QAAE,gBAAgB,GAAG,QAAQ,CAAC;IAEjE,OAAO;QACL,aAAa,EAAE,QAAQ,CAAC,MAAM;QAC9B,mBAAmB;QACnB,QAAQ;QACR,aAAa;QACb,eAAe;QACf,gBAAgB;QAChB,gBAAgB;QAChB,cAAc,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;KACvC,CAAC;AACJ,CAAC;AAEM,KAAK,UAAU,WAAW,CAAC,OAAyC;IACzE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAG,IAAA,oCAAqB,EACpC,OAAO,CAAC,IAAI,EACZ,OAAO,CAAC,UAAU,EAClB,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CACvD,CAAC;IACF,IAAI,MAAM,GAAG,gBAAgB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAEnD,gCAAgC;IAChC,IAAI,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,iEAAiE;YACjE,OAAO,CAAC,IAAI,CAAC,+BAA+B,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAC7D,OAAO,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAgB,eAAe,CAAC,OAAoB;IAClD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAG,IAAA,oCAAqB,EAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IACzE,OAAO,gBAAgB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;AAC/C,CAAC;AAED,SAAgB,eAAe,CAAC,QAAgB;IAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,IAAA,6BAAc,EAC7B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,EACjE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,OAAO,IAAI,SAAS,EACxC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,OAAO,IAAI,EAAE,CAClC,CAAC;IACF,OAAO,gBAAgB,CAAC,CAAC,QAAQ,CAAC,EAAE,SAAS,CAAC,CAAC;AACjD,CAAC;AAED,SAAgB,UAAU,CAAC,MAAkB,EAAE,SAAqB;IAClE,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7B,MAAM,SAAS,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;IAC9C,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAChC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,CACnE,CAAC;AACJ,CAAC;AAED,SAAgB,iBAAiB,CAAC,QAA2B,EAAE,QAAmB;IAChF,MAAM,SAAS,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC7C,OAAO,QAAQ;SACZ,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACX,GAAG,CAAC;QACJ,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC;KAC/E,CAAC,CAAC;SACF,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,YAAY,CAAC,MAAkB,EAAE,SAAoB;IAClE,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE/B,8EAA8E;IAC9E,MAAM,iBAAiB,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAC9C,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAChE,CAAC;IAEF,IAAI,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,sBAAsB;IACtB,MAAM,YAAY,GAAmB;QACnC,QAAQ,EAAE,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACpC,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,QAAQ,EAAE,CAAC,CAAC,QAAQ;SACrB,CAAC,CAAC;QACH,IAAI,EAAE,SAAS,CAAC,IAAI,IAAI,UAAU;KACnC,CAAC;IAEF,kBAAkB;IAClB,MAAM,MAAM,GAAG,IAAA,0BAAe,EAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACjD,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;IAE3D,sCAAsC;IACtC,MAAM,UAAU,GAAG,IAAI,GAAG,CACxB,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAC/D,CAAC;IAEF,IAAI,2BAA2B,GAAG,CAAC,CAAC;IACpC,IAAI,uBAAuB,GAAG,CAAC,CAAC;IAEhC,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,GAAG,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACnD,MAAM,UAAU,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEvC,IAAI,UAAU,EAAE,CAAC;YACf,8BAA8B;YAC9B,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;gBACxC,OAAO,CAAC,UAAU,GAAG,UAAU,CAAC;YAClC,CAAC;YAED,2BAA2B,IAAI,UAAU,CAAC,sBAAsB,CAAC;YACjE,uBAAuB,IAAI,UAAU,CAAC,kBAAkB,CAAC;YAEzD,yCAAyC;YACzC,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACnC,MAAM,kBAAkB,GAAG,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE;oBACrE,MAAM,aAAa,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;oBAClE,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;gBACxD,CAAC,EAAE,CAAC,CAAC,CAAC;gBAEN,2CAA2C;gBAC3C,IAAI,kBAAkB,IAAI,CAAC,IAAI,UAAU,CAAC,UAAU,GAAG,GAAG,EAAE,CAAC;oBAC3D,QAAQ,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,SAAS,GAAG,EAAE,CAAC,CAAC;gBAC9D,CAAC;qBAAM,IAAI,kBAAkB,KAAK,CAAC,IAAI,UAAU,CAAC,sBAAsB,GAAG,CAAC,EAAE,CAAC;oBAC7E,8CAA8C;oBAC9C,QAAQ,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,SAAS,GAAG,EAAE,CAAC,CAAC;gBAC5D,CAAC;gBAED,yBAAyB;gBACzB,IAAI,QAAQ,CAAC,SAAS,IAAI,EAAE;oBAAE,QAAQ,CAAC,SAAS,GAAG,UAAU,CAAC;qBACzD,IAAI,QAAQ,CAAC,SAAS,IAAI,EAAE;oBAAE,QAAQ,CAAC,SAAS,GAAG,MAAM,CAAC;qBAC1D,IAAI,QAAQ,CAAC,SAAS,IAAI,EAAE;oBAAE,QAAQ,CAAC,SAAS,GAAG,QAAQ,CAAC;;oBAC5D,QAAQ,CAAC,SAAS,GAAG,KAAK,CAAC;YAClC,CAAC;QACH,CAAC;IACH,CAAC;IAED,2BAA2B;IAC3B,MAAM,CAAC,UAAU,GAAG;QAClB,eAAe,EAAE,UAAU,CAAC,eAAe;QAC3C,2BAA2B;QAC3B,uBAAuB;QACvB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW;KACrC,CAAC;IAEF,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/scanners/lifecycle.d.ts

@@ -3,8 +3,14 @@ import type { PackageAnalysis, RiskLevel } from '../types/index.js';
 declare function extractLifecycleScripts(scripts: Record<string, string>): Record<string, string>;
 declare function calculateRiskScore(findings: PackageAnalysis['findings']): number;
 declare function riskLevelFromScore(score: number): RiskLevel;
-export declare function analyzePackage(name: string, version: string, scripts: Record<string, string>): PackageAnalysis;
-export declare function scanInstalledPackages(projectPath: string, includeDev?: boolean): PackageAnalysis[];
+export declare function analyzePackage(name: string, version: string, scripts: Record<string, string>, options?: {
+    ast?: boolean;
+    deobfuscate?: boolean;
+}): PackageAnalysis;
+export declare function scanInstalledPackages(projectPath: string, includeDev?: boolean, options?: {
+    ast?: boolean;
+    deobfuscate?: boolean;
+}): PackageAnalysis[];
 export declare function scanSinglePackage(pkgJsonContent: string): PackageAnalysis;
 export { extractLifecycleScripts, calculateRiskScore, riskLevelFromScore };
 //# sourceMappingURL=lifecycle.d.ts.map

package/dist/scanners/lifecycle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lifecycle.d.ts","sourceRoot":"","sources":["../../src/scanners/lifecycle.ts"],"names":[],"mappings":"AAAA,yFAAyF;AAIzF,OAAO,KAAK,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAoCpE,iBAAS,uBAAuB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAQxF;AA4BD,iBAAS,kBAAkB,CAAC,QAAQ,EAAE,eAAe,CAAC,UAAU,CAAC,GAAG,MAAM,CAKzE;AAED,iBAAS,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAKpD;AAED,wBAAgB,cAAc,CAC5B,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC9B,eAAe,CAgCjB;AAED,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,UAAQ,GAAG,eAAe,EAAE,CAuDhG;AAED,wBAAgB,iBAAiB,CAAC,cAAc,EAAE,MAAM,GAAG,eAAe,CAOzE;AAED,OAAO,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,CAAC"}
+{"version":3,"file":"lifecycle.d.ts","sourceRoot":"","sources":["../../src/scanners/lifecycle.ts"],"names":[],"mappings":"AAAA,yFAAyF;AAIzF,OAAO,KAAK,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAsCpE,iBAAS,uBAAuB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAQxF;AAmGD,iBAAS,kBAAkB,CAAC,QAAQ,EAAE,eAAe,CAAC,UAAU,CAAC,GAAG,MAAM,CAKzE;AAED,iBAAS,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAKpD;AAED,wBAAgB,cAAc,CAC5B,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,OAAO,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,OAAO,CAAA;CAAE,GACjD,eAAe,CAgCjB;AAED,wBAAgB,qBAAqB,CACnC,WAAW,EAAE,MAAM,EACnB,UAAU,UAAQ,EAClB,OAAO,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,OAAO,CAAA;CAAE,GACjD,eAAe,EAAE,CAuDnB;AAED,wBAAgB,iBAAiB,CAAC,cAAc,EAAE,MAAM,GAAG,eAAe,CAOzE;AAED,OAAO,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,CAAC"}

package/dist/scanners/lifecycle.js

@@ -43,6 +43,8 @@ exports.riskLevelFromScore = riskLevelFromScore;
 const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
 const patterns_js_1 = require("./patterns.js");
+const ast_js_1 = require("./ast.js");
+const deobfuscation_js_1 = require("./deobfuscation.js");
 const LIFECYCLE_SCRIPTS = [
     'preinstall',
     'install',
@@ -83,8 +85,9 @@ function extractLifecycleScripts(scripts) {
     }
     return result;
 }
-function analyzeScriptContent(packageName, version, scriptName, scriptContent) {
+function analyzeScriptContent(packageName, version, scriptName, scriptContent, options) {
     const findings = [];
+    // Layer 1: Regex pattern matching (existing)
     for (const rule of patterns_js_1.PATTERN_RULES) {
         const match = rule.pattern.exec(scriptContent);
         if (match) {
@@ -99,6 +102,61 @@ function analyzeScriptContent(packageName, version, scriptName, scriptContent) {
             });
         }
     }
+    // Layer 2: AST analysis (only if regex found something AND AST is enabled)
+    if (findings.length > 0 && options?.ast !== false) {
+        try {
+            const astFindings = (0, ast_js_1.analyzeScriptAST)(scriptContent);
+            if (astFindings.length > 0) {
+                // Add AST findings
+                findings.push(...astFindings.map((f) => ({
+                    package: packageName,
+                    scriptName,
+                    scriptContent,
+                    pattern: f.pattern,
+                    description: f.description,
+                    riskLevel: f.riskLevel,
+                    match: f.match,
+                })));
+                // Add AST findings metadata to first regex finding
+                if (findings.length > 0) {
+                    findings[0].astFindings = astFindings;
+                }
+                // Layer 3: Deobfuscation (only if AST found something AND deobfuscation is enabled)
+                const deobf = options?.deobfuscate === false
+                    ? { deobfuscated: scriptContent, iterations: 0, techniques: [], success: false }
+                    : (0, deobfuscation_js_1.deobfuscateScript)(scriptContent);
+                if (deobf.success && deobf.iterations > 0) {
+                    // Mark all findings with deobfuscation metadata
+                    for (const f of findings) {
+                        f.deobfuscation = deobf;
+                    }
+                    // Re-analyze deobfuscated code (recursive call with deobfuscated content)
+                    // This catches patterns that were hidden by encoding
+                    try {
+                        const deobfFindings = analyzeScriptContent(packageName, version, scriptName, deobf.deobfuscated);
+                        // Add deobfuscated findings if they're different
+                        for (const deobfFinding of deobfFindings) {
+                            // Check if this pattern was already found
+                            const alreadyFound = findings.some((f) => f.pattern === deobfFinding.pattern);
+                            if (!alreadyFound) {
+                                // Mark as found via deobfuscation
+                                deobfFinding.pattern = `${deobfFinding.pattern}-deobfuscated`;
+                                findings.push(deobfFinding);
+                            }
+                        }
+                    }
+                    catch {
+                        // Recursive analysis failed — continue with original findings
+                    }
+                }
+            }
+        }
+        catch (error) {
+            // AST/deobfuscation failed — continue with regex-only
+            // Log warning but don't break the scan
+            console.warn(`AST/deobfuscation analysis failed for ${packageName}:${scriptName}: ${error.message}`);
+        }
+    }
     return findings;
 }
 function calculateRiskScore(findings) {
@@ -117,11 +175,11 @@ function riskLevelFromScore(score) {
         return 'medium';
     return 'low';
 }
-function analyzePackage(name, version, scripts) {
+function analyzePackage(name, version, scripts, options) {
     const lifecycleScripts = extractLifecycleScripts(scripts);
     const allFindings = [];
     for (const [scriptName, scriptContent] of Object.entries(lifecycleScripts)) {
-        const scriptFindings = analyzeScriptContent(name, version, scriptName, scriptContent);
+        const scriptFindings = analyzeScriptContent(name, version, scriptName, scriptContent, options);
         allFindings.push(...scriptFindings);
         // Flag any lifecycle script that exists without findings as "low" info
         if (scriptFindings.length === 0 && ['postinstall', 'preinstall', 'install'].includes(scriptName)) {
@@ -146,7 +204,7 @@ function analyzePackage(name, version, scripts) {
         riskLevel: riskLevelFromScore(riskScore),
     };
 }
-function scanInstalledPackages(projectPath, includeDev = false) {
+function scanInstalledPackages(projectPath, includeDev = false, options) {
     const nodeModulesPath = path.join(projectPath, 'node_modules');
     if (!fs.existsSync(nodeModulesPath)) {
         throw new Error(`No node_modules found at ${nodeModulesPath}`);
@@ -174,7 +232,7 @@ function scanInstalledPackages(projectPath, includeDev = false) {
                             continue;
                         visited.add(pkgKey);
                         if (pkgJson.scripts && Object.keys(pkgJson.scripts).length > 0) {
-                            analyses.push(analyzePackage(pkgJson.name || entry.name, pkgJson.version || 'unknown', pkgJson.scripts));
+                            analyses.push(analyzePackage(pkgJson.name || entry.name, pkgJson.version || 'unknown', pkgJson.scripts, options));
                         }
                     }
                     catch {