secure-scan 1.2.2

package/dist/dependencies/dependencyAnalyzer.js

@@ -0,0 +1,349 @@
+"use strict";
+/**
+ * Dependency Analyzer
+ * Main orchestrator for Software Composition Analysis (SCA)
+ * Analyzes project dependencies without executing any code
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DependencyAnalyzer = void 0;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const types_1 = require("./types");
+const types_2 = require("../types");
+const parsers_1 = require("./parsers");
+const detectors_1 = require("./detectors");
+const logger_1 = require("../utils/logger");
+/**
+ * Manifest file patterns to search for
+ */
+const MANIFEST_PATTERNS = [
+    // JavaScript/Node.js
+    'package.json',
+    'package-lock.json',
+    'yarn.lock',
+    // Python
+    'requirements.txt',
+    'Pipfile',
+    'Pipfile.lock',
+    'pyproject.toml',
+    // PHP
+    'composer.json',
+    'composer.lock',
+    // Java
+    'pom.xml',
+    'build.gradle',
+    // C/C++
+    'vcpkg.json',
+    'conanfile.txt',
+    'CMakeLists.txt',
+    // C#
+    '*.csproj',
+    'packages.config'
+];
+/**
+ * Dependency Analyzer Class
+ * Main entry point for Software Composition Analysis
+ */
+class DependencyAnalyzer {
+    config;
+    vulnerabilityDetector;
+    aiAnalyzer; // Will be integrated with AIAnalyzer
+    constructor(config) {
+        this.config = {
+            ...config,
+            maxDepth: config.maxDepth ?? 5,
+            exclude: config.exclude ?? ['node_modules', 'vendor', 'venv', '.git', 'dist', 'build'],
+            includeDevDependencies: config.includeDevDependencies ?? true,
+            verbose: config.verbose ?? false
+        };
+        this.vulnerabilityDetector = new detectors_1.VulnerabilityDetector();
+    }
+    /**
+     * Run dependency analysis
+     */
+    async analyze() {
+        const startTime = Date.now();
+        logger_1.logger.info('📦 Starting dependency analysis (SCA)...');
+        // Find all manifest files
+        logger_1.logger.info('🔍 Searching for dependency manifests...');
+        const manifestFiles = await this.findManifestFiles();
+        if (manifestFiles.length === 0) {
+            logger_1.logger.warn('⚠️ No dependency manifest files found');
+            return this.createEmptyResult(startTime);
+        }
+        logger_1.logger.info(`📄 Found ${manifestFiles.length} manifest file(s)`);
+        // Parse all manifests
+        const manifests = [];
+        const allDependencies = [];
+        for (const filePath of manifestFiles) {
+            const manifest = await this.parseManifest(filePath);
+            if (manifest) {
+                manifests.push(manifest);
+                allDependencies.push(...manifest.dependencies);
+            }
+        }
+        // Deduplicate dependencies
+        const uniqueDependencies = this.deduplicateDependencies(allDependencies);
+        logger_1.logger.info(`📊 Found ${uniqueDependencies.length} unique dependencies`);
+        // Analyze for vulnerabilities
+        logger_1.logger.info('🔒 Analyzing dependencies for vulnerabilities...');
+        const vulnerabilities = await this.analyzeVulnerabilities(uniqueDependencies);
+        if (vulnerabilities.length > 0) {
+            logger_1.logger.warn(`⚠️ Found ${vulnerabilities.length} vulnerability issue(s)`);
+        }
+        else {
+            logger_1.logger.info('✅ No vulnerabilities detected');
+        }
+        // Calculate statistics
+        const endTime = Date.now();
+        const stats = this.calculateStats(manifests, uniqueDependencies, vulnerabilities, endTime - startTime);
+        // Get ecosystems
+        const ecosystems = [...new Set(manifests.map(m => m.ecosystem))];
+        return {
+            manifests,
+            dependencies: uniqueDependencies,
+            vulnerabilities,
+            stats,
+            ecosystems,
+            timestamp: new Date()
+        };
+    }
+    /**
+     * Find all manifest files in the project
+     */
+    async findManifestFiles() {
+        const manifestFiles = [];
+        const parsers = (0, parsers_1.getAllDependencyParsers)();
+        await this.walkDirectory(this.config.projectPath, 0, (filePath) => {
+            const fileName = path.basename(filePath);
+            // Check if any parser supports this file
+            for (const parser of parsers) {
+                if (parser.supports(fileName)) {
+                    manifestFiles.push(filePath);
+                    if (this.config.verbose) {
+                        logger_1.logger.debug(`Found manifest: ${filePath}`);
+                    }
+                    break;
+                }
+            }
+        });
+        return manifestFiles;
+    }
+    /**
+     * Recursively walk directory
+     */
+    async walkDirectory(dir, depth, callback) {
+        if (depth > (this.config.maxDepth ?? 5))
+            return;
+        try {
+            const entries = fs.readdirSync(dir, { withFileTypes: true });
+            for (const entry of entries) {
+                const fullPath = path.join(dir, entry.name);
+                if (entry.isDirectory()) {
+                    // Check if excluded
+                    if (this.config.exclude?.includes(entry.name))
+                        continue;
+                    await this.walkDirectory(fullPath, depth + 1, callback);
+                }
+                else if (entry.isFile()) {
+                    callback(fullPath);
+                }
+            }
+        }
+        catch (error) {
+            // Ignore permission errors
+            if (this.config.verbose) {
+                logger_1.logger.debug(`Cannot read directory: ${dir}`);
+            }
+        }
+    }
+    /**
+     * Parse a manifest file
+     */
+    async parseManifest(filePath) {
+        const fileName = path.basename(filePath);
+        const parser = (0, parsers_1.getParserForFile)(fileName);
+        if (!parser) {
+            logger_1.logger.debug(`No parser found for: ${fileName}`);
+            return null;
+        }
+        try {
+            const content = fs.readFileSync(filePath, 'utf-8');
+            const manifest = await parser.parse(filePath, content);
+            if (manifest.parseErrors && manifest.parseErrors.length > 0) {
+                logger_1.logger.warn(`⚠️ Parse errors in ${filePath}: ${manifest.parseErrors.join(', ')}`);
+            }
+            return manifest;
+        }
+        catch (error) {
+            logger_1.logger.debug(`Failed to parse ${filePath}: ${error}`);
+            return null;
+        }
+    }
+    /**
+     * Deduplicate dependencies across manifests
+     */
+    deduplicateDependencies(dependencies) {
+        const seen = new Map();
+        for (const dep of dependencies) {
+            const key = `${dep.ecosystem}:${dep.name}`;
+            if (!seen.has(key)) {
+                seen.set(key, dep);
+            }
+            else {
+                // Keep the one with more information (resolved version, etc.)
+                const existing = seen.get(key);
+                if (dep.resolvedVersion && !existing.resolvedVersion) {
+                    seen.set(key, dep);
+                }
+            }
+        }
+        return Array.from(seen.values());
+    }
+    /**
+     * Analyze dependencies for vulnerabilities
+     */
+    async analyzeVulnerabilities(dependencies) {
+        const vulnerabilities = [];
+        for (const dep of dependencies) {
+            // Skip dev dependencies if configured
+            if (!this.config.includeDevDependencies && dep.dependencyType === 'dev') {
+                continue;
+            }
+            const depVulns = await this.vulnerabilityDetector.analyzeDependency(dep);
+            vulnerabilities.push(...depVulns);
+            // Log critical vulnerabilities
+            for (const vuln of depVulns) {
+                if (vuln.severity === types_2.Severity.CRITICAL || vuln.severity === types_2.Severity.HIGH) {
+                    logger_1.logger.warn(`🚨 ${vuln.severity.toUpperCase()}: ${vuln.title}`);
+                }
+            }
+        }
+        // Sort by severity
+        return this.sortVulnerabilities(vulnerabilities);
+    }
+    /**
+     * Sort vulnerabilities by severity
+     */
+    sortVulnerabilities(vulnerabilities) {
+        const severityOrder = {
+            [types_2.Severity.CRITICAL]: 0,
+            [types_2.Severity.HIGH]: 1,
+            [types_2.Severity.MEDIUM]: 2,
+            [types_2.Severity.LOW]: 3,
+            [types_2.Severity.INFO]: 4
+        };
+        return vulnerabilities.sort((a, b) => severityOrder[a.severity] - severityOrder[b.severity]);
+    }
+    /**
+     * Calculate analysis statistics
+     */
+    calculateStats(manifests, dependencies, vulnerabilities, duration) {
+        const directDeps = dependencies.filter(d => d.dependencyType === 'direct');
+        const transitiveDeps = dependencies.filter(d => d.dependencyType === 'transitive');
+        const vulnerableDeps = new Set(vulnerabilities.map(v => `${v.dependency.ecosystem}:${v.dependency.name}`));
+        const vulnBySeverity = {
+            [types_2.Severity.CRITICAL]: 0,
+            [types_2.Severity.HIGH]: 0,
+            [types_2.Severity.MEDIUM]: 0,
+            [types_2.Severity.LOW]: 0,
+            [types_2.Severity.INFO]: 0
+        };
+        const vulnByCategory = {
+            [types_1.DependencyRiskCategory.VULNERABILITY]: 0,
+            [types_1.DependencyRiskCategory.SUPPLY_CHAIN]: 0,
+            [types_1.DependencyRiskCategory.MALICIOUS]: 0,
+            [types_1.DependencyRiskCategory.OUTDATED]: 0,
+            [types_1.DependencyRiskCategory.LICENSE]: 0,
+            [types_1.DependencyRiskCategory.MAINTENANCE]: 0
+        };
+        for (const vuln of vulnerabilities) {
+            vulnBySeverity[vuln.severity]++;
+            vulnByCategory[vuln.category]++;
+        }
+        const ecosystems = [...new Set(manifests.map(m => m.ecosystem))];
+        return {
+            totalManifests: manifests.length,
+            totalDependencies: dependencies.length,
+            directDependencies: directDeps.length,
+            transitiveDependencies: transitiveDeps.length,
+            vulnerableDependencies: vulnerableDeps.size,
+            vulnerabilitiesBySeverity: vulnBySeverity,
+            vulnerabilitiesByCategory: vulnByCategory,
+            ecosystemsAnalyzed: ecosystems,
+            duration
+        };
+    }
+    /**
+     * Create empty result when no manifests found
+     */
+    createEmptyResult(startTime) {
+        return {
+            manifests: [],
+            dependencies: [],
+            vulnerabilities: [],
+            stats: {
+                totalManifests: 0,
+                totalDependencies: 0,
+                directDependencies: 0,
+                transitiveDependencies: 0,
+                vulnerableDependencies: 0,
+                vulnerabilitiesBySeverity: {
+                    [types_2.Severity.CRITICAL]: 0,
+                    [types_2.Severity.HIGH]: 0,
+                    [types_2.Severity.MEDIUM]: 0,
+                    [types_2.Severity.LOW]: 0,
+                    [types_2.Severity.INFO]: 0
+                },
+                vulnerabilitiesByCategory: {
+                    [types_1.DependencyRiskCategory.VULNERABILITY]: 0,
+                    [types_1.DependencyRiskCategory.SUPPLY_CHAIN]: 0,
+                    [types_1.DependencyRiskCategory.MALICIOUS]: 0,
+                    [types_1.DependencyRiskCategory.OUTDATED]: 0,
+                    [types_1.DependencyRiskCategory.LICENSE]: 0,
+                    [types_1.DependencyRiskCategory.MAINTENANCE]: 0
+                },
+                ecosystemsAnalyzed: [],
+                duration: Date.now() - startTime
+            },
+            ecosystems: [],
+            timestamp: new Date()
+        };
+    }
+}
+exports.DependencyAnalyzer = DependencyAnalyzer;
+exports.default = DependencyAnalyzer;
+//# sourceMappingURL=dependencyAnalyzer.js.map

package/dist/dependencies/dependencyAnalyzer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dependencyAnalyzer.js","sourceRoot":"","sources":["../../src/dependencies/dependencyAnalyzer.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,uCAAyB;AACzB,2CAA6B;AAC7B,mCAQiB;AACjB,oCAA0D;AAC1D,uCAAiG;AACjG,2CAAoD;AACpD,4CAAyC;AAGzC;;GAEG;AACH,MAAM,iBAAiB,GAAG;IACxB,qBAAqB;IACrB,cAAc;IACd,mBAAmB;IACnB,WAAW;IACX,SAAS;IACT,kBAAkB;IAClB,SAAS;IACT,cAAc;IACd,gBAAgB;IAChB,MAAM;IACN,eAAe;IACf,eAAe;IACf,OAAO;IACP,SAAS;IACT,cAAc;IACd,QAAQ;IACR,YAAY;IACZ,eAAe;IACf,gBAAgB;IAChB,KAAK;IACL,UAAU;IACV,iBAAiB;CAClB,CAAC;AAsBF;;;GAGG;AACH,MAAa,kBAAkB;IACrB,MAAM,CAA2B;IACjC,qBAAqB,CAAwB;IAC7C,UAAU,CAAO,CAAC,qCAAqC;IAE/D,YAAY,MAAgC;QAC1C,IAAI,CAAC,MAAM,GAAG;YACZ,GAAG,MAAM;YACT,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,CAAC;YAC9B,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC;YACtF,sBAAsB,EAAE,MAAM,CAAC,sBAAsB,IAAI,IAAI;YAC7D,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,KAAK;SACjC,CAAC;QACF,IAAI,CAAC,qBAAqB,GAAG,IAAI,iCAAqB,EAAE,CAAC;IAC3D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO;QACX,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,eAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;QAExD,0BAA0B;QAC1B,eAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;QACxD,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAErD,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,eAAM,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;YACrD,OAAO,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAC3C,CAAC;QAED,eAAM,CAAC,IAAI,CAAC,YAAY,aAAa,CAAC,MAAM,mBAAmB,CAAC,CAAC;QAEjE,sBAAsB;QACtB,MAAM,SAAS,GAAyB,EAAE,CAAC;QAC3C,MAAM,eAAe,GAAiB,EAAE,CAAC;QAEzC,KAAK,MAAM,QAAQ,IAAI,aAAa,EAAE,CAAC;YACrC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;YACpD,IAAI,QAAQ,EAAE,CAAC;gBACb,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACzB,eAAe,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC;YACjD,CAAC;QACH,CAAC;QAED,2BAA2B;QAC3B,MAAM,kBAAkB,GAAG,IAAI,CAAC,uBAAuB,CAAC,eAAe,CAAC,CAAC;QACzE,eAAM,CAAC,IAAI,CAAC,YAAY,kBAAkB,CAAC,MAAM,sBAAsB,CAAC,CAAC;QAEzE,8BAA8B;QAC9B,eAAM,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC;QAChE,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,CAAC;QAE9E,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/B,eAAM,CAAC,IAAI,CAAC,YAAY,eAAe,CAAC,MAAM,yBAAyB,CAAC,CAAC;QAC3E,CAAC;aAAM,CAAC;YACN,eAAM,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;QAC/C,CAAC;QAED,uBAAuB;QACvB,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,kBAAkB,EAAE,eAAe,EAAE,OAAO,GAAG,SAAS,CAAC,CAAC;QAEvG,iBAAiB;QACjB,MAAM,UAAU,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAEjE,OAAO;YACL,SAAS;YACT,YAAY,EAAE,kBAAkB;YAChC,eAAe;YACf,KAAK;YACL,UAAU;YACV,SAAS,EAAE,IAAI,IAAI,EAAE;SACtB,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,iBAAiB;QAC7B,MAAM,aAAa,GAAa,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,IAAA,iCAAuB,GAAE,CAAC;QAE1C,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC,QAAQ,EAAE,EAAE;YAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAEzC,yCAAyC;YACzC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAC9B,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;oBAC7B,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;wBACxB,eAAM,CAAC,KAAK,CAAC,mBAAmB,QAAQ,EAAE,CAAC,CAAC;oBAC9C,CAAC;oBACD,MAAM;gBACR,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,OAAO,aAAa,CAAC;IACvB,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,aAAa,CACzB,GAAW,EACX,KAAa,EACb,QAAoC;QAEpC,IAAI,KAAK,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC;YAAE,OAAO;QAEhD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;YAE7D,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;gBAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;gBAE5C,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;oBACxB,oBAAoB;oBACpB,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;wBAAE,SAAS;oBAExD,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,KAAK,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC;gBAC1D,CAAC;qBAAM,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;oBAC1B,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBACrB,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,2BAA2B;YAC3B,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACxB,eAAM,CAAC,KAAK,CAAC,0BAA0B,GAAG,EAAE,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,aAAa,CAAC,QAAgB;QAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,IAAA,0BAAgB,EAAC,QAAQ,CAAC,CAAC;QAE1C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,eAAM,CAAC,KAAK,CAAC,wBAAwB,QAAQ,EAAE,CAAC,CAAC;YACjD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACnD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAEvD,IAAI,QAAQ,CAAC,WAAW,IAAI,QAAQ,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5D,eAAM,CAAC,IAAI,CAAC,sBAAsB,QAAQ,KAAK,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACpF,CAAC;YAED,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,eAAM,CAAC,KAAK,CAAC,mBAAmB,QAAQ,KAAK,KAAK,EAAE,CAAC,CAAC;YACtD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACK,uBAAuB,CAAC,YAA0B;QACxD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAsB,CAAC;QAE3C,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;YAC/B,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YAE3C,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACnB,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACrB,CAAC;iBAAM,CAAC;gBACN,8DAA8D;gBAC9D,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC;gBAChC,IAAI,GAAG,CAAC,eAAe,IAAI,CAAC,QAAQ,CAAC,eAAe,EAAE,CAAC;oBACrD,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBACrB,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACnC,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,sBAAsB,CAAC,YAA0B;QAC7D,MAAM,eAAe,GAA8B,EAAE,CAAC;QAEtD,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;YAC/B,sCAAsC;YACtC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,sBAAsB,IAAI,GAAG,CAAC,cAAc,KAAK,KAAK,EAAE,CAAC;gBACxE,SAAS;YACX,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;YACzE,eAAe,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC;YAElC,+BAA+B;YAC/B,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;gBAC5B,IAAI,IAAI,CAAC,QAAQ,KAAK,gBAAQ,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,KAAK,gBAAQ,CAAC,IAAI,EAAE,CAAC;oBAC3E,eAAM,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;gBAClE,CAAC;YACH,CAAC;QACH,CAAC;QAED,mBAAmB;QACnB,OAAO,IAAI,CAAC,mBAAmB,CAAC,eAAe,CAAC,CAAC;IACnD,CAAC;IAED;;OAEG;IACK,mBAAmB,CAAC,eAA0C;QACpE,MAAM,aAAa,GAA6B;YAC9C,CAAC,gBAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtB,CAAC,gBAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAClB,CAAC,gBAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACpB,CAAC,gBAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACjB,CAAC,gBAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;SACnB,CAAC;QAEF,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACnC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CACtD,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,cAAc,CACpB,SAA+B,EAC/B,YAA0B,EAC1B,eAA0C,EAC1C,QAAgB;QAEhB,MAAM,UAAU,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC;QAC3E,MAAM,cAAc,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,KAAK,YAAY,CAAC,CAAC;QAEnF,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,SAAS,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAE3G,MAAM,cAAc,GAA6B;YAC/C,CAAC,gBAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtB,CAAC,gBAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAClB,CAAC,gBAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACpB,CAAC,gBAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACjB,CAAC,gBAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;SACnB,CAAC;QAEF,MAAM,cAAc,GAA2C;YAC7D,CAAC,8BAAsB,CAAC,aAAa,CAAC,EAAE,CAAC;YACzC,CAAC,8BAAsB,CAAC,YAAY,CAAC,EAAE,CAAC;YACxC,CAAC,8BAAsB,CAAC,SAAS,CAAC,EAAE,CAAC;YACrC,CAAC,8BAAsB,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpC,CAAC,8BAAsB,CAAC,OAAO,CAAC,EAAE,CAAC;YACnC,CAAC,8BAAsB,CAAC,WAAW,CAAC,EAAE,CAAC;SACxC,CAAC;QAEF,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;YACnC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClC,CAAC;QAED,MAAM,UAAU,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAEjE,OAAO;YACL,cAAc,EAAE,SAAS,CAAC,MAAM;YAChC,iBAAiB,EAAE,YAAY,CAAC,MAAM;YACtC,kBAAkB,EAAE,UAAU,CAAC,MAAM;YACrC,sBAAsB,EAAE,cAAc,CAAC,MAAM;YAC7C,sBAAsB,EAAE,cAAc,CAAC,IAAI;YAC3C,yBAAyB,EAAE,cAAc;YACzC,yBAAyB,EAAE,cAAc;YACzC,kBAAkB,EAAE,UAAU;YAC9B,QAAQ;SACT,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,iBAAiB,CAAC,SAAiB;QACzC,OAAO;YACL,SAAS,EAAE,EAAE;YACb,YAAY,EAAE,EAAE;YAChB,eAAe,EAAE,EAAE;YACnB,KAAK,EAAE;gBACL,cAAc,EAAE,CAAC;gBACjB,iBAAiB,EAAE,CAAC;gBACpB,kBAAkB,EAAE,CAAC;gBACrB,sBAAsB,EAAE,CAAC;gBACzB,sBAAsB,EAAE,CAAC;gBACzB,yBAAyB,EAAE;oBACzB,CAAC,gBAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACtB,CAAC,gBAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;oBAClB,CAAC,gBAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;oBACpB,CAAC,gBAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;oBACjB,CAAC,gBAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;iBACnB;gBACD,yBAAyB,EAAE;oBACzB,CAAC,8BAAsB,CAAC,aAAa,CAAC,EAAE,CAAC;oBACzC,CAAC,8BAAsB,CAAC,YAAY,CAAC,EAAE,CAAC;oBACxC,CAAC,8BAAsB,CAAC,SAAS,CAAC,EAAE,CAAC;oBACrC,CAAC,8BAAsB,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACpC,CAAC,8BAAsB,CAAC,OAAO,CAAC,EAAE,CAAC;oBACnC,CAAC,8BAAsB,CAAC,WAAW,CAAC,EAAE,CAAC;iBACxC;gBACD,kBAAkB,EAAE,EAAE;gBACtB,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACjC;YACD,UAAU,EAAE,EAAE;YACd,SAAS,EAAE,IAAI,IAAI,EAAE;SACtB,CAAC;IACJ,CAAC;CACF;AA5TD,gDA4TC;AAED,kBAAe,kBAAkB,CAAC"}

package/dist/dependencies/detectors/index.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Detectors Module Exports
+ */
+export * from './vulnerabilityDetector';
+export * from './securityStandards';
+export { default as VulnerabilityDetector } from './vulnerabilityDetector';
+//# sourceMappingURL=index.d.ts.map

package/dist/dependencies/detectors/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/dependencies/detectors/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,cAAc,yBAAyB,CAAC;AACxC,cAAc,qBAAqB,CAAC;AACpC,OAAO,EAAE,OAAO,IAAI,qBAAqB,EAAE,MAAM,yBAAyB,CAAC"}

package/dist/dependencies/detectors/index.js

@@ -0,0 +1,28 @@
+"use strict";
+/**
+ * Detectors Module Exports
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.VulnerabilityDetector = void 0;
+__exportStar(require("./vulnerabilityDetector"), exports);
+__exportStar(require("./securityStandards"), exports);
+var vulnerabilityDetector_1 = require("./vulnerabilityDetector");
+Object.defineProperty(exports, "VulnerabilityDetector", { enumerable: true, get: function () { return __importDefault(vulnerabilityDetector_1).default; } });
+//# sourceMappingURL=index.js.map

package/dist/dependencies/detectors/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/dependencies/detectors/index.ts"],"names":[],"mappings":";AAAA;;GAEG;;;;;;;;;;;;;;;;;;;;AAEH,0DAAwC;AACxC,sDAAoC;AACpC,iEAA2E;AAAlE,+IAAA,OAAO,OAAyB"}

package/dist/dependencies/detectors/securityStandards.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Security Standards for Dependency Analysis
+ * Maps dependency risks to OWASP, CWE, MITRE, and SANS standards
+ */
+import { SecurityStandard } from '../../types';
+import { DependencyRiskCategory } from '../types';
+/**
+ * Get security standards for a dependency risk category
+ */
+export declare function getStandardsForDependencyRisk(category: DependencyRiskCategory, cwes?: string[]): SecurityStandard[];
+/**
+ * Get all dependency-related security standards
+ */
+export declare function getAllDependencyStandards(): SecurityStandard[];
+//# sourceMappingURL=securityStandards.d.ts.map

package/dist/dependencies/detectors/securityStandards.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"securityStandards.d.ts","sourceRoot":"","sources":["../../../src/dependencies/detectors/securityStandards.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAC;AAgIlD;;GAEG;AACH,wBAAgB,6BAA6B,CAC3C,QAAQ,EAAE,sBAAsB,EAChC,IAAI,CAAC,EAAE,MAAM,EAAE,GACd,gBAAgB,EAAE,CA0CpB;AAED;;GAEG;AACH,wBAAgB,yBAAyB,IAAI,gBAAgB,EAAE,CAY9D"}

package/dist/dependencies/detectors/securityStandards.js

@@ -0,0 +1,178 @@
+"use strict";
+/**
+ * Security Standards for Dependency Analysis
+ * Maps dependency risks to OWASP, CWE, MITRE, and SANS standards
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getStandardsForDependencyRisk = getStandardsForDependencyRisk;
+exports.getAllDependencyStandards = getAllDependencyStandards;
+const types_1 = require("../types");
+/**
+ * OWASP A06:2021 - Vulnerable and Outdated Components
+ */
+const OWASP_A06 = {
+    name: 'OWASP',
+    id: 'A06:2021',
+    title: 'Vulnerable and Outdated Components',
+    description: 'Components, such as libraries, frameworks, and other software modules, run with the same privileges as the application. If a vulnerable component is exploited, such an attack can facilitate serious data loss or server takeover.',
+    url: 'https://owasp.org/Top10/A06_2021-Vulnerable_and_Outdated_Components/'
+};
+/**
+ * CWE-937 - OWASP Top 10 2017 Category A9 - Using Components with Known Vulnerabilities
+ */
+const CWE_937 = {
+    name: 'CWE',
+    id: 'CWE-937',
+    title: 'Using Components with Known Vulnerabilities',
+    description: 'The product uses a component that has a known vulnerability.',
+    url: 'https://cwe.mitre.org/data/definitions/937.html'
+};
+/**
+ * CWE-1035 - OWASP Top 10 2017 Category A9 - Using Components with Known Vulnerabilities
+ */
+const CWE_1035 = {
+    name: 'CWE',
+    id: 'CWE-1035',
+    title: 'OWASP Top 10 2017 Category A9',
+    description: 'Weaknesses in this category are related to the A9 category Using Components with Known Vulnerabilities in the OWASP Top 10 2017.',
+    url: 'https://cwe.mitre.org/data/definitions/1035.html'
+};
+/**
+ * CWE-506 - Embedded Malicious Code
+ */
+const CWE_506 = {
+    name: 'CWE',
+    id: 'CWE-506',
+    title: 'Embedded Malicious Code',
+    description: 'The product contains code that appears to be malicious in nature.',
+    url: 'https://cwe.mitre.org/data/definitions/506.html'
+};
+/**
+ * CWE-829 - Inclusion of Functionality from Untrusted Control Sphere
+ */
+const CWE_829 = {
+    name: 'CWE',
+    id: 'CWE-829',
+    title: 'Inclusion of Functionality from Untrusted Control Sphere',
+    description: 'The product imports, requires, or includes executable functionality from a source that is outside of the intended control sphere.',
+    url: 'https://cwe.mitre.org/data/definitions/829.html'
+};
+/**
+ * CWE-1104 - Use of Unmaintained Third Party Components
+ */
+const CWE_1104 = {
+    name: 'CWE',
+    id: 'CWE-1104',
+    title: 'Use of Unmaintained Third Party Components',
+    description: 'The product relies on third-party components that are not actively supported or maintained by the original developer or a trusted proxy.',
+    url: 'https://cwe.mitre.org/data/definitions/1104.html'
+};
+/**
+ * MITRE ATT&CK - Supply Chain Compromise
+ */
+const MITRE_SUPPLY_CHAIN = {
+    name: 'MITRE',
+    id: 'T1195',
+    title: 'Supply Chain Compromise',
+    description: 'Adversaries may manipulate products or product delivery mechanisms prior to receipt by a final consumer for the purpose of data or system compromise.',
+    url: 'https://attack.mitre.org/techniques/T1195/'
+};
+/**
+ * MITRE ATT&CK - Compromise Software Supply Chain
+ */
+const MITRE_T1195_002 = {
+    name: 'MITRE',
+    id: 'T1195.002',
+    title: 'Compromise Software Supply Chain',
+    description: 'Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise.',
+    url: 'https://attack.mitre.org/techniques/T1195/002/'
+};
+/**
+ * SANS Top 25 - Related entries
+ */
+const SANS_UNTRUSTED_INPUT = {
+    name: 'SANS',
+    id: 'SANS-1',
+    title: 'Improper Neutralization of Special Elements',
+    description: 'Failure to properly validate and sanitize input from untrusted sources.',
+    url: 'https://www.sans.org/top25-software-errors/'
+};
+/**
+ * Get standards for a specific CWE
+ */
+function getCWEStandard(cweId) {
+    const cweMap = {
+        'CWE-937': CWE_937,
+        'CWE-1035': CWE_1035,
+        'CWE-506': CWE_506,
+        'CWE-829': CWE_829,
+        'CWE-1104': CWE_1104
+    };
+    if (cweMap[cweId]) {
+        return cweMap[cweId];
+    }
+    // Create a generic CWE standard for unknown CWEs
+    const cweNumber = cweId.replace('CWE-', '');
+    return {
+        name: 'CWE',
+        id: cweId,
+        title: `CWE-${cweNumber}`,
+        description: `Common Weakness Enumeration ${cweNumber}`,
+        url: `https://cwe.mitre.org/data/definitions/${cweNumber}.html`
+    };
+}
+/**
+ * Get security standards for a dependency risk category
+ */
+function getStandardsForDependencyRisk(category, cwes) {
+    const standards = [];
+    // Always include OWASP A06 for dependency risks
+    standards.push(OWASP_A06);
+    switch (category) {
+        case types_1.DependencyRiskCategory.VULNERABILITY:
+            standards.push(CWE_937, CWE_1035);
+            // Add specific CWEs if provided
+            if (cwes) {
+                for (const cwe of cwes) {
+                    const cweStandard = getCWEStandard(cwe);
+                    if (cweStandard && !standards.some(s => s.id === cweStandard.id)) {
+                        standards.push(cweStandard);
+                    }
+                }
+            }
+            break;
+        case types_1.DependencyRiskCategory.MALICIOUS:
+            standards.push(CWE_506, CWE_829, MITRE_SUPPLY_CHAIN, MITRE_T1195_002);
+            break;
+        case types_1.DependencyRiskCategory.SUPPLY_CHAIN:
+            standards.push(CWE_829, MITRE_SUPPLY_CHAIN, MITRE_T1195_002);
+            break;
+        case types_1.DependencyRiskCategory.OUTDATED:
+            standards.push(CWE_1104);
+            break;
+        case types_1.DependencyRiskCategory.MAINTENANCE:
+            standards.push(CWE_1104);
+            break;
+        case types_1.DependencyRiskCategory.LICENSE:
+            // No specific security standards for license issues
+            break;
+    }
+    return standards;
+}
+/**
+ * Get all dependency-related security standards
+ */
+function getAllDependencyStandards() {
+    return [
+        OWASP_A06,
+        CWE_937,
+        CWE_1035,
+        CWE_506,
+        CWE_829,
+        CWE_1104,
+        MITRE_SUPPLY_CHAIN,
+        MITRE_T1195_002,
+        SANS_UNTRUSTED_INPUT
+    ];
+}
+//# sourceMappingURL=securityStandards.js.map

package/dist/dependencies/detectors/securityStandards.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"securityStandards.js","sourceRoot":"","sources":["../../../src/dependencies/detectors/securityStandards.ts"],"names":[],"mappings":";AAAA;;;GAGG;;AAsIH,sEA6CC;AAKD,8DAYC;AAjMD,oCAAkD;AAElD;;GAEG;AACH,MAAM,SAAS,GAAqB;IAClC,IAAI,EAAE,OAAO;IACb,EAAE,EAAE,UAAU;IACd,KAAK,EAAE,oCAAoC;IAC3C,WAAW,EAAE,qOAAqO;IAClP,GAAG,EAAE,sEAAsE;CAC5E,CAAC;AAEF;;GAEG;AACH,MAAM,OAAO,GAAqB;IAChC,IAAI,EAAE,KAAK;IACX,EAAE,EAAE,SAAS;IACb,KAAK,EAAE,6CAA6C;IACpD,WAAW,EAAE,8DAA8D;IAC3E,GAAG,EAAE,iDAAiD;CACvD,CAAC;AAEF;;GAEG;AACH,MAAM,QAAQ,GAAqB;IACjC,IAAI,EAAE,KAAK;IACX,EAAE,EAAE,UAAU;IACd,KAAK,EAAE,+BAA+B;IACtC,WAAW,EAAE,kIAAkI;IAC/I,GAAG,EAAE,kDAAkD;CACxD,CAAC;AAEF;;GAEG;AACH,MAAM,OAAO,GAAqB;IAChC,IAAI,EAAE,KAAK;IACX,EAAE,EAAE,SAAS;IACb,KAAK,EAAE,yBAAyB;IAChC,WAAW,EAAE,mEAAmE;IAChF,GAAG,EAAE,iDAAiD;CACvD,CAAC;AAEF;;GAEG;AACH,MAAM,OAAO,GAAqB;IAChC,IAAI,EAAE,KAAK;IACX,EAAE,EAAE,SAAS;IACb,KAAK,EAAE,0DAA0D;IACjE,WAAW,EAAE,mIAAmI;IAChJ,GAAG,EAAE,iDAAiD;CACvD,CAAC;AAEF;;GAEG;AACH,MAAM,QAAQ,GAAqB;IACjC,IAAI,EAAE,KAAK;IACX,EAAE,EAAE,UAAU;IACd,KAAK,EAAE,4CAA4C;IACnD,WAAW,EAAE,0IAA0I;IACvJ,GAAG,EAAE,kDAAkD;CACxD,CAAC;AAEF;;GAEG;AACH,MAAM,kBAAkB,GAAqB;IAC3C,IAAI,EAAE,OAAO;IACb,EAAE,EAAE,OAAO;IACX,KAAK,EAAE,yBAAyB;IAChC,WAAW,EAAE,uJAAuJ;IACpK,GAAG,EAAE,4CAA4C;CAClD,CAAC;AAEF;;GAEG;AACH,MAAM,eAAe,GAAqB;IACxC,IAAI,EAAE,OAAO;IACb,EAAE,EAAE,WAAW;IACf,KAAK,EAAE,kCAAkC;IACzC,WAAW,EAAE,oIAAoI;IACjJ,GAAG,EAAE,gDAAgD;CACtD,CAAC;AAEF;;GAEG;AACH,MAAM,oBAAoB,GAAqB;IAC7C,IAAI,EAAE,MAAM;IACZ,EAAE,EAAE,QAAQ;IACZ,KAAK,EAAE,6CAA6C;IACpD,WAAW,EAAE,yEAAyE;IACtF,GAAG,EAAE,6CAA6C;CACnD,CAAC;AAEF;;GAEG;AACH,SAAS,cAAc,CAAC,KAAa;IACnC,MAAM,MAAM,GAAqC;QAC/C,SAAS,EAAE,OAAO;QAClB,UAAU,EAAE,QAAQ;QACpB,SAAS,EAAE,OAAO;QAClB,SAAS,EAAE,OAAO;QAClB,UAAU,EAAE,QAAQ;KACrB,CAAC;IAEF,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAClB,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAED,iDAAiD;IACjD,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC5C,OAAO;QACL,IAAI,EAAE,KAAK;QACX,EAAE,EAAE,KAAK;QACT,KAAK,EAAE,OAAO,SAAS,EAAE;QACzB,WAAW,EAAE,+BAA+B,SAAS,EAAE;QACvD,GAAG,EAAE,0CAA0C,SAAS,OAAO;KAChE,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAgB,6BAA6B,CAC3C,QAAgC,EAChC,IAAe;IAEf,MAAM,SAAS,GAAuB,EAAE,CAAC;IAEzC,gDAAgD;IAChD,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAE1B,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,8BAAsB,CAAC,aAAa;YACvC,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YAClC,gCAAgC;YAChC,IAAI,IAAI,EAAE,CAAC;gBACT,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;oBACvB,MAAM,WAAW,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;oBACxC,IAAI,WAAW,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,WAAW,CAAC,EAAE,CAAC,EAAE,CAAC;wBACjE,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;oBAC9B,CAAC;gBACH,CAAC;YACH,CAAC;YACD,MAAM;QAER,KAAK,8BAAsB,CAAC,SAAS;YACnC,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,kBAAkB,EAAE,eAAe,CAAC,CAAC;YACtE,MAAM;QAER,KAAK,8BAAsB,CAAC,YAAY;YACtC,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,kBAAkB,EAAE,eAAe,CAAC,CAAC;YAC7D,MAAM;QAER,KAAK,8BAAsB,CAAC,QAAQ;YAClC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACzB,MAAM;QAER,KAAK,8BAAsB,CAAC,WAAW;YACrC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACzB,MAAM;QAER,KAAK,8BAAsB,CAAC,OAAO;YACjC,oDAAoD;YACpD,MAAM;IACV,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,SAAgB,yBAAyB;IACvC,OAAO;QACL,SAAS;QACT,OAAO;QACP,QAAQ;QACR,OAAO;QACP,OAAO;QACP,QAAQ;QACR,kBAAkB;QAClB,eAAe;QACf,oBAAoB;KACrB,CAAC;AACJ,CAAC"}

package/dist/dependencies/detectors/vulnerabilityDetector.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Vulnerability Detector
+ * Detects vulnerabilities, supply chain risks, and malicious packages
+ */
+import { Dependency, DependencyVulnerability } from '../types';
+/**
+ * Vulnerability Detector Class
+ * Detects various security issues in dependencies
+ */
+export declare class VulnerabilityDetector {
+    /**
+     * Analyze a dependency for vulnerabilities and risks
+     */
+    analyzeDependency(dependency: Dependency): Promise<DependencyVulnerability[]>;
+    /**
+     * Check if package is known malicious
+     */
+    private checkMaliciousPackage;
+    /**
+     * Check for known CVEs
+     */
+    private checkCVEs;
+    /**
+     * Check for typosquatting
+     */
+    private checkTyposquatting;
+    /**
+     * Find typosquatting candidates
+     */
+    private findTyposquatCandidates;
+    /**
+     * Calculate string similarity (Levenshtein distance based)
+     */
+    private calculateSimilarity;
+    /**
+     * Levenshtein distance algorithm
+     */
+    private levenshteinDistance;
+    /**
+     * Detect type of typosquat
+     */
+    private detectTyposquatType;
+    /**
+     * Check for deprecated packages
+     */
+    private checkDeprecated;
+    /**
+     * Check for supply chain risks
+     */
+    private checkSupplyChainRisks;
+}
+export default VulnerabilityDetector;
+//# sourceMappingURL=vulnerabilityDetector.d.ts.map

package/dist/dependencies/detectors/vulnerabilityDetector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vulnerabilityDetector.d.ts","sourceRoot":"","sources":["../../../src/dependencies/detectors/vulnerabilityDetector.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,UAAU,EACV,uBAAuB,EAOxB,MAAM,UAAU,CAAC;AAQlB;;;GAGG;AACH,qBAAa,qBAAqB;IAChC;;OAEG;IACG,iBAAiB,CAAC,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC;IAgCnF;;OAEG;YACW,qBAAqB;IAiCnC;;OAEG;YACW,SAAS;IAqCvB;;OAEG;YACW,kBAAkB;IA6BhC;;OAEG;IACH,OAAO,CAAC,uBAAuB;IA4B/B;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAM3B;;OAEG;IACH,OAAO,CAAC,mBAAmB;IA2B3B;;OAEG;IACH,OAAO,CAAC,mBAAmB;IA4B3B;;OAEG;YACW,eAAe;IA6B7B;;OAEG;YACW,qBAAqB;CAkCpC;AAED,eAAe,qBAAqB,CAAC"}