secure-scan 1.2.2

package/src/dependencies/types.ts

@@ -0,0 +1,330 @@
+/**
+ * Tipos para Análisis de Dependencias
+ * Definiciones de tipos para SCA (Análisis de Composición de Software)
+ */
+
+import { Severity, SecurityStandard } from '../types';
+
+// Re-export for convenience
+export { Severity, SecurityStandard };
+
+/**
+ * Supported package ecosystems
+ */
+export type PackageEcosystem =
+  | 'npm'       // JavaScript/Node.js
+  | 'pip'       // Python
+  | 'composer'  // PHP
+  | 'maven'     // Java
+  | 'gradle'    // Java
+  | 'nuget'     // C#
+  | 'vcpkg'     // C/C++
+  | 'conan'     // C/C++
+  | 'cmake';    // C/C++ (CMakeLists.txt)
+
+/**
+ * Type of dependency relationship
+ */
+export type DependencyType = 'direct' | 'transitive' | 'dev' | 'optional' | 'peer';
+
+/**
+ * Dependency risk category
+ */
+export enum DependencyRiskCategory {
+  VULNERABILITY = 'vulnerability',
+  SUPPLY_CHAIN = 'supply_chain',
+  MALICIOUS = 'malicious',
+  OUTDATED = 'outdated',
+  LICENSE = 'license',
+  MAINTENANCE = 'maintenance'
+}
+
+/**
+ * Supply chain risk indicators
+ */
+export enum SupplyChainRisk {
+  TYPOSQUATTING = 'typosquatting',
+  ABANDONED = 'abandoned',
+  SUSPICIOUS_RELEASE = 'suspicious_release',
+  POST_INSTALL_SCRIPT = 'post_install_script',
+  HIGH_MAINTAINER_TURNOVER = 'high_maintainer_turnover',
+  NEW_PACKAGE = 'new_package',
+  LOW_DOWNLOAD_COUNT = 'low_download_count'
+}
+
+/**
+ * Malware indicator types
+ */
+export enum MalwareIndicator {
+  BACKDOOR = 'backdoor',
+  CRYPTOMINER = 'cryptominer',
+  STEALER = 'stealer',
+  LOADER = 'loader',
+  OBFUSCATED = 'obfuscated',
+  DATA_EXFILTRATION = 'data_exfiltration',
+  KNOWN_MALWARE = 'known_malware'
+}
+
+/**
+ * CVE (Common Vulnerabilities and Exposures) information
+ */
+export interface CVEInfo {
+  /** CVE identifier (e.g., CVE-2021-44228) */
+  id: string;
+  /** CVE description */
+  description: string;
+  /** CVSS score (0-10) */
+  cvssScore: number;
+  /** CVSS vector string */
+  cvssVector?: string;
+  /** Severity based on CVSS */
+  severity: Severity;
+  /** Date published */
+  publishedDate?: string;
+  /** Date last modified */
+  lastModifiedDate?: string;
+  /** Reference URLs */
+  references: string[];
+  /** Affected versions */
+  affectedVersions?: string;
+  /** Fixed version (if available) */
+  fixedVersion?: string;
+  /** CWE identifiers */
+  cwes?: string[];
+  /** Exploit availability */
+  exploitAvailable?: boolean;
+}
+
+/**
+ * Dependency information
+ */
+export interface Dependency {
+  /** Package name */
+  name: string;
+  /** Declared version or version range */
+  version: string;
+  /** Resolved version (if available from lock file) */
+  resolvedVersion?: string;
+  /** Package ecosystem */
+  ecosystem: PackageEcosystem;
+  /** Type of dependency */
+  dependencyType: DependencyType;
+  /** Parent dependency (for transitive) */
+  parent?: string;
+  /** Depth in dependency tree */
+  depth: number;
+  /** Source file where dependency was found */
+  sourceFile: string;
+  /** Line number in source file */
+  lineNumber?: number;
+  /** Package homepage URL */
+  homepage?: string;
+  /** Package repository URL */
+  repository?: string;
+  /** Package license */
+  license?: string;
+  /** Latest available version */
+  latestVersion?: string;
+  /** Is deprecated */
+  deprecated?: boolean;
+  /** Deprecation message */
+  deprecationMessage?: string;
+}
+
+/**
+ * Dependency vulnerability finding
+ */
+export interface DependencyVulnerability {
+  /** Unique finding ID */
+  id: string;
+  /** Affected dependency */
+  dependency: Dependency;
+  /** Vulnerability severity */
+  severity: Severity;
+  /** Risk category */
+  category: DependencyRiskCategory;
+  /** Title of the finding */
+  title: string;
+  /** Detailed description */
+  description: string;
+  /** CVE information (if applicable) */
+  cve?: CVEInfo;
+  /** Supply chain risks (if applicable) */
+  supplyChainRisks?: SupplyChainRisk[];
+  /** Malware indicators (if applicable) */
+  malwareIndicators?: MalwareIndicator[];
+  /** Related security standards */
+  standards: SecurityStandard[];
+  /** Recommendation (upgrade, replace, remove) */
+  recommendation: DependencyRecommendation;
+  /** Recommended action details */
+  recommendationDetails: string;
+  /** Confidence level (0-100) */
+  confidence: number;
+  /** Detection timestamp */
+  timestamp: Date;
+  /** AI explanation (if available) */
+  aiExplanation?: string;
+}
+
+/**
+ * Recommendation type for dependency issues
+ */
+export enum DependencyRecommendation {
+  UPGRADE = 'upgrade',
+  REPLACE = 'replace',
+  REMOVE = 'remove',
+  REVIEW = 'review',
+  MONITOR = 'monitor'
+}
+
+/**
+ * Dependency manifest file information
+ */
+export interface DependencyManifest {
+  /** File path */
+  filePath: string;
+  /** File type */
+  fileType: ManifestFileType;
+  /** Package ecosystem */
+  ecosystem: PackageEcosystem;
+  /** Parsed dependencies */
+  dependencies: Dependency[];
+  /** Parse errors (if any) */
+  parseErrors?: string[];
+  /** Is lock file */
+  isLockFile: boolean;
+}
+
+/**
+ * Types of manifest files
+ */
+export type ManifestFileType =
+  // JavaScript/Node.js
+  | 'package.json'
+  | 'package-lock.json'
+  | 'yarn.lock'
+  // Python
+  | 'requirements.txt'
+  | 'Pipfile'
+  | 'Pipfile.lock'
+  | 'pyproject.toml'
+  // PHP
+  | 'composer.json'
+  | 'composer.lock'
+  // Java
+  | 'pom.xml'
+  | 'build.gradle'
+  // C/C++
+  | 'vcpkg.json'
+  | 'conanfile.txt'
+  | 'CMakeLists.txt'
+  // C#
+  | 'csproj'
+  | 'packages.config';
+
+/**
+ * Dependency analysis result
+ */
+export interface DependencyAnalysisResult {
+  /** All detected manifests */
+  manifests: DependencyManifest[];
+  /** All dependencies (direct + transitive) */
+  dependencies: Dependency[];
+  /** All vulnerabilities found */
+  vulnerabilities: DependencyVulnerability[];
+  /** Analysis statistics */
+  stats: DependencyAnalysisStats;
+  /** Ecosystems detected */
+  ecosystems: PackageEcosystem[];
+  /** Analysis timestamp */
+  timestamp: Date;
+}
+
+/**
+ * Dependency analysis statistics
+ */
+export interface DependencyAnalysisStats {
+  /** Total manifests analyzed */
+  totalManifests: number;
+  /** Total dependencies found */
+  totalDependencies: number;
+  /** Direct dependencies */
+  directDependencies: number;
+  /** Transitive dependencies */
+  transitiveDependencies: number;
+  /** Dependencies with vulnerabilities */
+  vulnerableDependencies: number;
+  /** Vulnerabilities by severity */
+  vulnerabilitiesBySeverity: Record<Severity, number>;
+  /** Vulnerabilities by category */
+  vulnerabilitiesByCategory: Record<DependencyRiskCategory, number>;
+  /** Ecosystems analyzed */
+  ecosystemsAnalyzed: string[];
+  /** Analysis duration in milliseconds */
+  duration: number;
+}
+
+/**
+ * Known malicious package database entry
+ */
+export interface MaliciousPackageEntry {
+  /** Package name */
+  name: string;
+  /** Package ecosystem */
+  ecosystem: PackageEcosystem;
+  /** Malware type indicators */
+  indicators: MalwareIndicator[];
+  /** Description of malicious behavior */
+  description: string;
+  /** Date reported */
+  reportedDate: string;
+  /** Reference URLs */
+  references: string[];
+  /** Affected versions */
+  affectedVersions?: string;
+}
+
+/**
+ * Typosquatting candidate
+ */
+export interface TyposquattingCandidate {
+  /** Suspicious package name */
+  suspiciousName: string;
+  /** Likely legitimate package */
+  legitimatePackage: string;
+  /** Similarity score (0-100) */
+  similarityScore: number;
+  /** Type of typosquat */
+  typosquatType: 'character_swap' | 'missing_char' | 'extra_char' | 'homograph' | 'bit_flip';
+}
+
+/**
+ * Dependency parser interface
+ */
+export interface DependencyParser {
+  /** Parser name */
+  name: string;
+  /** Supported file types */
+  supportedFiles: ManifestFileType[];
+  /** Ecosystem */
+  ecosystem: PackageEcosystem;
+  /** Parse manifest file */
+  parse(filePath: string, content: string): Promise<DependencyManifest>;
+  /** Check if file is supported */
+  supports(fileName: string): boolean;
+}
+
+/**
+ * Vulnerability database interface
+ */
+export interface VulnerabilityDatabase {
+  /** Database name */
+  name: string;
+  /** Check dependency for vulnerabilities */
+  checkVulnerabilities(dependency: Dependency): Promise<CVEInfo[]>;
+  /** Get CVE details */
+  getCVEDetails(cveId: string): Promise<CVEInfo | null>;
+  /** Refresh database */
+  refresh(): Promise<void>;
+}

package/src/i18n/index.ts

@@ -0,0 +1 @@
+export * from './translations';

package/src/i18n/translations.ts

@@ -0,0 +1,194 @@
+/**
+ * Internationalization (i18n) - Translations
+ * Supports Spanish (default) and English
+ */
+
+export type Language = 'es' | 'en';
+
+export interface Translations {
+  // Report Header
+  reportTitle: string;
+  project: string;
+  scanId: string;
+  date: string;
+  
+  // Warnings
+  malwareDetected: string;
+  malwareDescription: (count: number) => string;
+  criticalVulnerabilities: string;
+  criticalDescription: (count: number) => string;
+  
+  // Cards
+  riskScore: string;
+  totalFindings: string;
+  filesScanned: string;
+  linesOfCode: string;
+  scanDuration: string;
+  
+  // Sections
+  securityFindings: string;
+  issues: string;
+  scanStatistics: string;
+  remediation: string;
+  noIssuesFound: string;
+  
+  // Severity
+  critical: string;
+  high: string;
+  medium: string;
+  low: string;
+  info: string;
+  malware: string;
+  
+  // Footer
+  generatedBy: string;
+  securityReport: string;
+  
+  // CLI
+  scanComplete: string;
+  scanSummary: string;
+  severityBreakdown: string;
+  reportSavedTo: string;
+  scanFailed: string;
+  initSuccess: string;
+  configExists: string;
+  rulesAvailable: string;
+  
+  // Categories
+  vulnerability: string;
+  vulnerabilities: string;
+  
+  // Malware details
+  affectedFiles: string;
+  analyzersUsed: string;
+}
+
+export const translations: Record<Language, Translations> = {
+  es: {
+    // Encabezado del reporte
+    reportTitle: 'Reporte de Seguridad',
+    project: 'Proyecto',
+    scanId: 'ID de Escaneo',
+    date: 'Fecha',
+    
+    // Advertencias
+    malwareDetected: '¡Malware Detectado!',
+    malwareDescription: (count) => `Se encontraron ${count} patrón(es) de código potencialmente malicioso. Se requiere investigación inmediata.`,
+    criticalVulnerabilities: 'Vulnerabilidades Críticas Encontradas',
+    criticalDescription: (count) => `${count} problema(s) de seguridad crítico(s) requieren atención inmediata.`,
+    
+    // Tarjetas
+    riskScore: 'Puntuación de Riesgo',
+    totalFindings: 'Hallazgos Totales',
+    filesScanned: 'Archivos Escaneados',
+    linesOfCode: 'Líneas de Código',
+    scanDuration: 'Duración del Escaneo',
+    
+    // Secciones
+    securityFindings: '🔍 Hallazgos de Seguridad',
+    issues: 'problemas',
+    scanStatistics: '📊 Estadísticas del Escaneo',
+    remediation: '💡 Remediación',
+    noIssuesFound: '✅ ¡No se encontraron problemas de seguridad!',
+    
+    // Severidad
+    critical: 'Crítico',
+    high: 'Alto',
+    medium: 'Medio',
+    low: 'Bajo',
+    info: 'Info',
+    malware: 'Malware',
+    
+    // Pie de página
+    generatedBy: 'Generado por',
+    securityReport: 'Reporte de Análisis de Seguridad',
+    
+    // CLI
+    scanComplete: '¡Escaneo completado!',
+    scanSummary: '📊 Resumen del Escaneo',
+    severityBreakdown: 'Desglose por Severidad:',
+    reportSavedTo: '📄 Reporte guardado en:',
+    scanFailed: '❌ Error en el escaneo:',
+    initSuccess: '✅ Archivo secure-scan.config.json creado',
+    configExists: '⚠️ El archivo de configuración ya existe: secure-scan.config.json',
+    rulesAvailable: 'reglas disponibles',
+    
+    // Categorías
+    vulnerability: 'Vulnerabilidad',
+    vulnerabilities: 'Vulnerabilidades',
+    
+    // Detalles de malware
+    affectedFiles: 'Archivos afectados',
+    analyzersUsed: 'Analizadores utilizados',
+  },
+  
+  en: {
+    // Report Header
+    reportTitle: 'Security Report',
+    project: 'Project',
+    scanId: 'Scan ID',
+    date: 'Date',
+    
+    // Warnings
+    malwareDetected: 'Malware Detected!',
+    malwareDescription: (count) => `${count} potentially malicious code pattern(s) found. Immediate investigation required.`,
+    criticalVulnerabilities: 'Critical Vulnerabilities Found',
+    criticalDescription: (count) => `${count} critical security issue(s) require immediate attention.`,
+    
+    // Cards
+    riskScore: 'Risk Score',
+    totalFindings: 'Total Findings',
+    filesScanned: 'Files Scanned',
+    linesOfCode: 'Lines of Code',
+    scanDuration: 'Scan Duration',
+    
+    // Sections
+    securityFindings: '🔍 Security Findings',
+    issues: 'issues',
+    scanStatistics: '📊 Scan Statistics',
+    remediation: '💡 Remediation',
+    noIssuesFound: '✅ No security issues found!',
+    
+    // Severity
+    critical: 'Critical',
+    high: 'High',
+    medium: 'Medium',
+    low: 'Low',
+    info: 'Info',
+    malware: 'Malware',
+    
+    // Footer
+    generatedBy: 'Generated by',
+    securityReport: 'Security Analysis Report',
+    
+    // CLI
+    scanComplete: 'Scan complete!',
+    scanSummary: '📊 Scan Summary',
+    severityBreakdown: 'Severity Breakdown:',
+    reportSavedTo: '📄 Report saved to:',
+    scanFailed: '❌ Scan failed:',
+    initSuccess: '✅ Created secure-scan.config.json',
+    configExists: '⚠️ Configuration file already exists: secure-scan.config.json',
+    rulesAvailable: 'rules available',
+    
+    // Categories
+    vulnerability: 'Vulnerability',
+    vulnerabilities: 'Vulnerabilities',
+    
+    // Malware details
+    affectedFiles: 'Affected files',
+    analyzersUsed: 'Analyzers used',
+  }
+};
+
+/**
+ * Get translations for a language
+ */
+export function getTranslations(lang: Language = 'es'): Translations {
+  return translations[lang] || translations.es;
+}
+
+/**
+ * Default language
+ */
+export const defaultLanguage: Language = 'es';

package/src/index.ts

@@ -0,0 +1,16 @@
+/**
+ * Secure-Scan Main Entry Point
+ */
+
+export * from './types';
+export * from './analyzers';
+export * from './ai';
+export * from './reports';
+export * from './utils';
+export * from './dependencies';
+
+// Re-export main classes for convenience
+export { SecurityScanner } from './analyzers/core/securityScanner';
+export { HtmlReportGenerator } from './reports/htmlReportGenerator';
+export { AIAnalyzer } from './ai/aiAnalyzer';
+export { DependencyAnalyzer } from './dependencies/dependencyAnalyzer';