secure-scan 1.2.2

package/src/utils/logger.ts

@@ -0,0 +1,150 @@
+/**
+ * Utilidad de Logging
+ * Registro basado en Winston para entornos de producción
+ */
+
+import winston from 'winston';
+import chalk from 'chalk';
+
+const { combine, timestamp, printf, colorize } = winston.format;
+
+/**
+ * Custom log format for console output
+ */
+const consoleFormat = printf(({ level, message, timestamp }) => {
+  const icons: Record<string, string> = {
+    error: '❌',
+    warn: '⚠️',
+    info: 'ℹ️',
+    debug: '🔍',
+    verbose: '📝'
+  };
+  
+  const icon = icons[level] || '';
+  return `${chalk.gray(timestamp)} ${icon} ${message}`;
+});
+
+/**
+ * Custom log format for file output
+ */
+const fileFormat = printf(({ level, message, timestamp }) => {
+  return `${timestamp} [${level.toUpperCase()}] ${message}`;
+});
+
+/**
+ * Create logger instance
+ */
+export const logger = winston.createLogger({
+  level: process.env.LOG_LEVEL || 'info',
+  format: combine(
+    timestamp({ format: 'YYYY-MM-DD HH:mm:ss' })
+  ),
+  transports: [
+    // Console transport with colors
+    new winston.transports.Console({
+      format: combine(
+        colorize(),
+        consoleFormat
+      )
+    })
+  ]
+});
+
+/**
+ * Add file transport for production
+ */
+export function enableFileLogging(logDir: string): void {
+  logger.add(new winston.transports.File({
+    filename: `${logDir}/error.log`,
+    level: 'error',
+    format: fileFormat
+  }));
+  
+  logger.add(new winston.transports.File({
+    filename: `${logDir}/combined.log`,
+    format: fileFormat
+  }));
+}
+
+/**
+ * Set log level
+ */
+export function setLogLevel(level: string): void {
+  logger.level = level;
+}
+
+/**
+ * Registrar inicio de escaneo
+ */
+export function logScanStart(projectPath: string): void {
+  logger.info(chalk.cyan('═'.repeat(60)));
+  logger.info(chalk.cyan.bold('🔐 Secure-Scan - Herramienta SAST'));
+  logger.info(chalk.cyan('═'.repeat(60)));
+  logger.info(`📁 Scanning project: ${chalk.yellow(projectPath)}`);
+  logger.info(chalk.gray('─'.repeat(60)));
+}
+
+/**
+ * Log scan progress
+ */
+export function logProgress(current: number, total: number, fileName: string): void {
+  const percent = Math.round((current / total) * 100);
+  const bar = '█'.repeat(Math.floor(percent / 5)) + '░'.repeat(20 - Math.floor(percent / 5));
+  logger.info(`[${bar}] ${percent}% - ${fileName}`);
+}
+
+/**
+ * Log finding
+ * @param severity - The severity level of the finding
+ * @param title - Title/description of the finding
+ * @param file - File path where the finding was detected
+ * @param line - Line number of the finding
+ * @param category - Category of the finding (optional)
+ */
+export function logFinding(severity: string, title: string, file: string, line: number, category?: string): void {
+  const severityColors: Record<string, (str: string) => string> = {
+    critical: chalk.bgRed.white,
+    high: chalk.red,
+    medium: chalk.yellow,
+    low: chalk.green,
+    info: chalk.blue
+  };
+  
+  const colorFn = severityColors[severity] || chalk.white;
+  
+  // Add MALWARE label if category is malware
+  const malwareLabel = category === 'malware' ? chalk.bgMagenta.white.bold(' 🦠 MALWARE ') + ' ' : '';
+  
+  logger.info(`${malwareLabel}${colorFn(`[${severity.toUpperCase()}]`)} ${title} at ${chalk.cyan(file)}:${chalk.yellow(line)}`);
+}
+
+/**
+ * Log scan complete
+ */
+export function logScanComplete(
+  totalFiles: number,
+  totalFindings: number,
+  duration: number,
+  riskScore: number
+): void {
+  logger.info(chalk.gray('─'.repeat(60)));
+  logger.info(chalk.cyan.bold('📊 Scan Complete'));
+  logger.info(`   📁 Files scanned: ${chalk.yellow(totalFiles)}`);
+  logger.info(`   🔍 Findings: ${chalk.yellow(totalFindings)}`);
+  logger.info(`   ⏱️  Duration: ${chalk.yellow(`${(duration / 1000).toFixed(2)}s`)}`);
+  logger.info(`   📈 Risk Score: ${getRiskScoreDisplay(riskScore)}`);
+  logger.info(chalk.cyan('═'.repeat(60)));
+}
+
+/**
+ * Get colored risk score display
+ */
+function getRiskScoreDisplay(score: number): string {
+  if (score >= 80) return chalk.bgRed.white(` ${score}/100 CRITICAL `);
+  if (score >= 60) return chalk.red(`${score}/100 HIGH`);
+  if (score >= 40) return chalk.yellow(`${score}/100 MEDIUM`);
+  if (score >= 20) return chalk.green(`${score}/100 LOW`);
+  return chalk.blue(`${score}/100 SAFE`);
+}
+
+export default logger;

package/test-installed-scanner.ts

@@ -0,0 +1,136 @@
+/**
+ * Test Script for Installed Dependencies Scanner
+ * Run with: npx ts-node test-installed-scanner.ts
+ * 
+ */
+
+import { InstalledDependenciesScanner, scanInstalledDependencies } from './src/dependencies/installed';
+import { generateInstalledDependenciesSection } from './src/reports/installedDepsReportGenerator';
+import * as fs from 'fs';
+import * as path from 'path';
+
+async function runTest() {
+  console.log('🔍 Testing Installed Dependencies Scanner\n');
+  console.log('='.repeat(60));
+
+  // Test with fake-node_modules folder
+  const testPath = path.join(__dirname, 'test-samples');
+  
+  console.log(`\n📂 Scanning test samples at: ${testPath}\n`);
+
+  const scanner = new InstalledDependenciesScanner({
+    projectPath: testPath,
+    foldersToScan: [path.join(testPath, 'fake-node_modules')],
+    verbose: true,
+    verifyIntegrity: false, // No lock file for test samples
+    scanPostInstallScripts: true
+  });
+
+  const result = await scanner.scan();
+
+  // Print results
+  console.log('\n' + '='.repeat(60));
+  console.log('📊 SCAN RESULTS');
+  console.log('='.repeat(60));
+
+  console.log(`\n📦 Packages scanned: ${result.stats.totalPackagesFound}`);
+  console.log(`📄 Files scanned: ${result.stats.totalFilesScanned}`);
+  console.log(`⏱️  Duration: ${result.stats.duration}ms`);
+
+  console.log('\n🦠 MALWARE FINDINGS:');
+  console.log('-'.repeat(40));
+  
+  if (result.malwareFindings.length === 0) {
+    console.log('   No malware detected');
+  } else {
+    for (const finding of result.malwareFindings) {
+      console.log(`\n   [${finding.severity.toUpperCase()}] ${finding.title}`);
+      console.log(`   Package: ${finding.package.name}@${finding.package.version}`);
+      console.log(`   File: ${finding.filePath}`);
+      if (finding.lineNumber) {
+        console.log(`   Line: ${finding.lineNumber}`);
+      }
+      console.log(`   Indicators: ${finding.indicators.join(', ')}`);
+      console.log(`   Confidence: ${finding.confidence}%`);
+    }
+  }
+
+  console.log('\n\n⚠️ SUSPICIOUS POST-INSTALL SCRIPTS:');
+  console.log('-'.repeat(40));
+  
+  if (result.suspiciousScripts.length === 0) {
+    console.log('   No suspicious scripts detected');
+  } else {
+    for (const script of result.suspiciousScripts) {
+      console.log(`\n   [${script.severity.toUpperCase()}] ${script.packageName}`);
+      console.log(`   Script type: ${script.script.type}`);
+      console.log(`   Command: ${script.script.command}`);
+      console.log(`   Risk indicators: ${script.riskIndicators.length}`);
+    }
+  }
+
+  console.log('\n\n📁 SCANNED FOLDERS:');
+  console.log('-'.repeat(40));
+  
+  for (const folder of result.scannedFolders) {
+    console.log(`\n   ${folder.path}`);
+    console.log(`   Type: ${folder.type}`);
+    console.log(`   Ecosystem: ${folder.ecosystem}`);
+    console.log(`   Packages: ${folder.packageCount}`);
+    console.log(`   Files scanned: ${folder.filesScanned}`);
+  }
+
+  // Generate HTML report section
+  console.log('\n\n📝 Generating HTML report section...');
+  const htmlSection = generateInstalledDependenciesSection(result, 'es');
+  
+  const reportPath = path.join(testPath, 'installed-deps-report.html');
+  const fullHtml = `
+<!DOCTYPE html>
+<html lang="es">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <title>Installed Dependencies Malware Scan Report</title>
+  <style>
+    * { margin: 0; padding: 0; box-sizing: border-box; }
+    body { 
+      font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;
+      background: #0d1117;
+      color: #c9d1d9;
+      padding: 40px;
+      min-height: 100vh;
+    }
+    h1 {
+      color: #58a6ff;
+      margin-bottom: 30px;
+      text-align: center;
+    }
+  </style>
+</head>
+<body>
+  <h1>🔐 Secure-Scan: Installed Dependencies Malware Report</h1>
+  ${htmlSection}
+</body>
+</html>
+  `;
+  
+  fs.writeFileSync(reportPath, fullHtml);
+  console.log(`   Report saved to: ${reportPath}`);
+
+  console.log('\n' + '='.repeat(60));
+  console.log('✅ Test complete!');
+  console.log('='.repeat(60) + '\n');
+
+  // Summary
+  console.log('📊 SUMMARY:');
+  console.log(`   Total malware findings: ${result.malwareFindings.length}`);
+  console.log(`   Suspicious scripts: ${result.suspiciousScripts.length}`);
+  console.log(`   Integrity issues: ${result.integrityIssues.length}`);
+  
+  if (result.malwareFindings.length > 0) {
+    console.log('\n   ⚠️  Malware detected! Review the report for details.');
+  }
+}
+
+runTest().catch(console.error);

package/tsconfig.json

@@ -0,0 +1,30 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "commonjs",
+    "lib": ["ES2022"],
+    "outDir": "./dist",
+    "rootDir": "./src",
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "forceConsistentCasingInFileNames": true,
+    "resolveJsonModule": true,
+    "declaration": true,
+    "declarationMap": true,
+    "sourceMap": true,
+    "moduleResolution": "node",
+    "baseUrl": "./src",
+    "paths": {
+      "@core/*": ["core/*"],
+      "@analyzers/*": ["analyzers/*"],
+      "@rules/*": ["rules/*"],
+      "@ai/*": ["ai/*"],
+      "@reports/*": ["reports/*"],
+      "@utils/*": ["utils/*"],
+      "@types/*": ["types/*"]
+    }
+  },
+  "include": ["src/**/*"],
+  "exclude": ["node_modules", "dist", "**/*.test.ts"]
+}