secure-scan 1.2.2

package/dist/dependencies/installed/installedScanner.js

@@ -0,0 +1,766 @@
+"use strict";
+/**
+ * Installed Dependencies Scanner
+ * Scans installed packages (node_modules, vendor, venv) for malware
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InstalledDependenciesScanner = void 0;
+exports.scanInstalledDependencies = scanInstalledDependencies;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const malwarePatterns_1 = require("./malwarePatterns");
+const types_1 = require("../types");
+const types_2 = require("../../types");
+const logger_1 = require("../../utils/logger");
+const utils_1 = require("../../utils");
+/**
+ * Default configuration for installed dependencies scanner
+ */
+const DEFAULT_CONFIG = {
+    maxFileSizeBytes: 5 * 1024 * 1024, // 5MB
+    fileExtensions: ['.js', '.ts', '.mjs', '.cjs', '.py', '.php', '.rb', '.sh', '.ps1', '.cmd', '.bat'],
+    verifyIntegrity: true,
+    scanPostInstallScripts: true,
+    maxDepth: 10,
+    verbose: false,
+    parallelScans: 4
+};
+/**
+ * Folder configurations for different ecosystems
+ */
+const DEPENDENCY_FOLDERS = {
+    npm: ['node_modules'],
+    pip: ['venv', '.venv', 'env', '.env', 'site-packages', 'lib/python*/site-packages'],
+    composer: ['vendor'],
+    maven: ['.m2/repository'],
+    gradle: ['.gradle/caches/modules-2/files-2.1'],
+    nuget: ['packages', '.nuget/packages']
+};
+/**
+ * Installed Dependencies Scanner Class
+ */
+class InstalledDependenciesScanner {
+    config;
+    scannedFiles = new Set();
+    stats;
+    constructor(config) {
+        this.config = { ...DEFAULT_CONFIG, ...config };
+        this.stats = this.initializeStats();
+    }
+    /**
+     * Run the installed dependencies scan
+     */
+    async scan() {
+        const startTime = Date.now();
+        logger_1.logger.info('🔍 Starting installed dependencies scan...');
+        const scannedFolders = [];
+        const installedPackages = [];
+        const malwareFindings = [];
+        const integrityIssues = [];
+        const suspiciousScripts = [];
+        // Find and scan dependency folders
+        const foldersToScan = this.config.foldersToScan || this.findDependencyFolders();
+        for (const folderPath of foldersToScan) {
+            if (!fs.existsSync(folderPath))
+                continue;
+            logger_1.logger.info(`📂 Scanning: ${folderPath}`);
+            const folderInfo = await this.scanDependencyFolder(folderPath);
+            scannedFolders.push(folderInfo.scannedFolder);
+            installedPackages.push(...folderInfo.packages);
+            malwareFindings.push(...folderInfo.malwareFindings);
+            suspiciousScripts.push(...folderInfo.suspiciousScripts);
+        }
+        // Verify integrity if enabled
+        if (this.config.verifyIntegrity) {
+            const integrity = await this.verifyPackageIntegrity(installedPackages);
+            integrityIssues.push(...integrity);
+        }
+        // Update statistics
+        const endTime = Date.now();
+        this.stats.duration = endTime - startTime;
+        this.stats.totalFoldersScanned = scannedFolders.length;
+        this.stats.totalPackagesFound = installedPackages.length;
+        this.stats.malwareFindingsCount = malwareFindings.length;
+        this.stats.integrityIssuesCount = integrityIssues.length;
+        this.stats.suspiciousScriptsCount = suspiciousScripts.length;
+        // Count findings by severity
+        for (const finding of malwareFindings) {
+            this.stats.findingsBySeverity[finding.severity] =
+                (this.stats.findingsBySeverity[finding.severity] || 0) + 1;
+        }
+        logger_1.logger.info(`✅ Scan complete: ${malwareFindings.length} malware findings, ${integrityIssues.length} integrity issues`);
+        return {
+            scannedFolders,
+            installedPackages,
+            malwareFindings,
+            integrityIssues,
+            suspiciousScripts,
+            stats: this.stats,
+            timestamp: new Date()
+        };
+    }
+    /**
+     * Find dependency folders in the project
+     */
+    findDependencyFolders() {
+        const folders = [];
+        const projectPath = this.config.projectPath;
+        // Check for node_modules
+        const nodeModules = path.join(projectPath, 'node_modules');
+        if (fs.existsSync(nodeModules)) {
+            folders.push(nodeModules);
+        }
+        // Check for vendor (PHP)
+        const vendor = path.join(projectPath, 'vendor');
+        if (fs.existsSync(vendor)) {
+            folders.push(vendor);
+        }
+        // Check for Python virtual environments
+        for (const venvName of ['venv', '.venv', 'env', '.env']) {
+            const venv = path.join(projectPath, venvName);
+            if (fs.existsSync(venv)) {
+                // Look for site-packages
+                const sitePackages = this.findSitePackages(venv);
+                if (sitePackages) {
+                    folders.push(sitePackages);
+                }
+            }
+        }
+        return folders;
+    }
+    /**
+     * Find site-packages in a Python virtual environment
+     */
+    findSitePackages(venvPath) {
+        // Windows: venv/Lib/site-packages
+        const windowsPath = path.join(venvPath, 'Lib', 'site-packages');
+        if (fs.existsSync(windowsPath)) {
+            return windowsPath;
+        }
+        // Unix: venv/lib/pythonX.X/site-packages
+        const libPath = path.join(venvPath, 'lib');
+        if (fs.existsSync(libPath)) {
+            try {
+                const entries = fs.readdirSync(libPath);
+                for (const entry of entries) {
+                    if (entry.startsWith('python')) {
+                        const sitePackages = path.join(libPath, entry, 'site-packages');
+                        if (fs.existsSync(sitePackages)) {
+                            return sitePackages;
+                        }
+                    }
+                }
+            }
+            catch {
+                // Ignore errors
+            }
+        }
+        return null;
+    }
+    /**
+     * Scan a dependency folder
+     */
+    async scanDependencyFolder(folderPath) {
+        const packages = [];
+        const malwareFindings = [];
+        const suspiciousScripts = [];
+        const folderType = this.getFolderType(folderPath);
+        const ecosystem = this.getEcosystemFromFolder(folderPath);
+        let totalSize = 0;
+        let filesScanned = 0;
+        // Get all packages in the folder
+        const packageDirs = await this.getPackageDirectories(folderPath, ecosystem);
+        for (const packageDir of packageDirs) {
+            const pkg = await this.parseInstalledPackage(packageDir, ecosystem);
+            if (pkg) {
+                packages.push(pkg);
+                totalSize += pkg.sizeBytes;
+                // Scan package files for malware
+                const findings = await this.scanPackageForMalware(pkg, packageDir);
+                malwareFindings.push(...findings.malwareFindings);
+                filesScanned += findings.filesScanned;
+                // Check post-install scripts
+                if (this.config.scanPostInstallScripts && pkg.hasPostInstallScripts) {
+                    const scriptFindings = this.analyzePostInstallScripts(pkg);
+                    suspiciousScripts.push(...scriptFindings);
+                }
+                // Update ecosystem stats
+                this.stats.packagesByEcosystem[ecosystem] =
+                    (this.stats.packagesByEcosystem[ecosystem] || 0) + 1;
+            }
+        }
+        this.stats.totalFilesScanned += filesScanned;
+        this.stats.totalBytesScanned += totalSize;
+        return {
+            scannedFolder: {
+                path: folderPath,
+                type: folderType,
+                ecosystem,
+                packageCount: packages.length,
+                totalSizeBytes: totalSize,
+                filesScanned
+            },
+            packages,
+            malwareFindings,
+            suspiciousScripts
+        };
+    }
+    /**
+     * Get folder type from path
+     */
+    getFolderType(folderPath) {
+        const folderName = path.basename(folderPath);
+        if (folderName === 'node_modules')
+            return 'node_modules';
+        if (folderName === 'vendor')
+            return 'vendor';
+        if (folderName === 'site-packages')
+            return 'site-packages';
+        if (['venv', '.venv', 'env', '.env'].includes(folderName))
+            return 'venv';
+        if (folderName === 'packages')
+            return 'packages';
+        return 'other';
+    }
+    /**
+     * Get ecosystem from folder path
+     */
+    getEcosystemFromFolder(folderPath) {
+        if (folderPath.includes('node_modules'))
+            return 'npm';
+        if (folderPath.includes('vendor'))
+            return 'composer';
+        if (folderPath.includes('site-packages') || folderPath.includes('venv'))
+            return 'pip';
+        if (folderPath.includes('.nuget') || folderPath.includes('packages'))
+            return 'nuget';
+        return 'npm'; // Default
+    }
+    /**
+     * Get package directories in a dependency folder
+     */
+    async getPackageDirectories(folderPath, ecosystem) {
+        const packageDirs = [];
+        try {
+            const entries = fs.readdirSync(folderPath, { withFileTypes: true });
+            for (const entry of entries) {
+                if (!entry.isDirectory())
+                    continue;
+                const fullPath = path.join(folderPath, entry.name);
+                // Handle scoped packages for npm (@scope/package)
+                if (ecosystem === 'npm' && entry.name.startsWith('@')) {
+                    const scopedEntries = fs.readdirSync(fullPath, { withFileTypes: true });
+                    for (const scopedEntry of scopedEntries) {
+                        if (scopedEntry.isDirectory()) {
+                            packageDirs.push(path.join(fullPath, scopedEntry.name));
+                        }
+                    }
+                }
+                else if (!entry.name.startsWith('.')) {
+                    packageDirs.push(fullPath);
+                }
+            }
+        }
+        catch (error) {
+            logger_1.logger.debug(`Error reading directory ${folderPath}: ${error}`);
+        }
+        return packageDirs;
+    }
+    /**
+     * Parse an installed package directory
+     */
+    async parseInstalledPackage(packageDir, ecosystem) {
+        try {
+            let name = path.basename(packageDir);
+            let version = 'unknown';
+            let metadata = {};
+            let hasPostInstallScripts = false;
+            let postInstallScripts = [];
+            // Handle scoped packages
+            const parentDir = path.basename(path.dirname(packageDir));
+            if (parentDir.startsWith('@')) {
+                name = `${parentDir}/${name}`;
+            }
+            // Parse package.json for npm
+            if (ecosystem === 'npm') {
+                const packageJsonPath = path.join(packageDir, 'package.json');
+                if (fs.existsSync(packageJsonPath)) {
+                    const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, 'utf-8'));
+                    name = packageJson.name || name;
+                    version = packageJson.version || version;
+                    metadata = {
+                        author: typeof packageJson.author === 'string' ? packageJson.author : packageJson.author?.name,
+                        license: packageJson.license,
+                        homepage: packageJson.homepage,
+                        repository: typeof packageJson.repository === 'string' ? packageJson.repository : packageJson.repository?.url,
+                        description: packageJson.description,
+                        main: packageJson.main,
+                        binaries: packageJson.bin ? Object.keys(packageJson.bin) : undefined
+                    };
+                    // Check for post-install scripts
+                    const scripts = packageJson.scripts || {};
+                    for (const scriptType of ['preinstall', 'install', 'postinstall', 'preuninstall', 'postuninstall']) {
+                        if (scripts[scriptType]) {
+                            hasPostInstallScripts = true;
+                            const scriptInfo = this.analyzeScript(scriptType, scripts[scriptType], packageDir);
+                            postInstallScripts.push(scriptInfo);
+                        }
+                    }
+                }
+            }
+            // Parse for pip/Python
+            if (ecosystem === 'pip') {
+                // Try to find PKG-INFO or METADATA
+                const metadataPath = path.join(packageDir, 'PKG-INFO');
+                const distInfoDir = this.findDistInfoDir(packageDir);
+                if (distInfoDir) {
+                    const metaPath = path.join(distInfoDir, 'METADATA');
+                    if (fs.existsSync(metaPath)) {
+                        const content = fs.readFileSync(metaPath, 'utf-8');
+                        const parsed = this.parsePythonMetadata(content);
+                        name = parsed.name || name;
+                        version = parsed.version || version;
+                        metadata = {
+                            author: parsed.author,
+                            license: parsed.license,
+                            homepage: parsed.homepage,
+                            description: parsed.summary
+                        };
+                    }
+                }
+            }
+            // Calculate size and file count
+            const sizeInfo = this.calculateDirectorySize(packageDir);
+            return {
+                name,
+                version,
+                ecosystem,
+                installPath: packageDir,
+                sizeBytes: sizeInfo.size,
+                fileCount: sizeInfo.fileCount,
+                hasPostInstallScripts,
+                postInstallScripts: postInstallScripts.length > 0 ? postInstallScripts : undefined,
+                metadata
+            };
+        }
+        catch (error) {
+            logger_1.logger.debug(`Error parsing package at ${packageDir}: ${error}`);
+            return null;
+        }
+    }
+    /**
+     * Find .dist-info directory for Python packages
+     */
+    findDistInfoDir(packageDir) {
+        const parentDir = path.dirname(packageDir);
+        const packageName = path.basename(packageDir);
+        try {
+            const entries = fs.readdirSync(parentDir);
+            for (const entry of entries) {
+                if (entry.startsWith(packageName.replace(/-/g, '_')) && entry.endsWith('.dist-info')) {
+                    return path.join(parentDir, entry);
+                }
+            }
+        }
+        catch {
+            // Ignore
+        }
+        return null;
+    }
+    /**
+     * Parse Python package metadata
+     */
+    parsePythonMetadata(content) {
+        const result = {};
+        const lines = content.split('\n');
+        for (const line of lines) {
+            const match = line.match(/^([A-Za-z-]+):\s*(.+)$/);
+            if (match) {
+                const key = match[1].toLowerCase().replace(/-/g, '_');
+                result[key] = match[2].trim();
+            }
+        }
+        return {
+            name: result.name,
+            version: result.version,
+            author: result.author,
+            license: result.license,
+            homepage: result.home_page,
+            summary: result.summary
+        };
+    }
+    /**
+     * Analyze a post-install script
+     */
+    analyzeScript(type, command, packageDir) {
+        const riskIndicators = [];
+        let riskLevel = types_2.Severity.INFO;
+        let scriptContent;
+        let scriptPath;
+        // Check for file reference
+        const fileMatch = command.match(/node\s+([^\s]+)/);
+        if (fileMatch) {
+            const possiblePath = path.join(packageDir, fileMatch[1]);
+            if (fs.existsSync(possiblePath)) {
+                scriptPath = possiblePath;
+                try {
+                    scriptContent = fs.readFileSync(possiblePath, 'utf-8');
+                }
+                catch {
+                    // Ignore read errors
+                }
+            }
+        }
+        // Analyze command and content for suspicious patterns
+        const contentToAnalyze = scriptContent || command;
+        for (const pattern of malwarePatterns_1.SUSPICIOUS_SCRIPT_PATTERNS) {
+            if (pattern.test(contentToAnalyze)) {
+                riskIndicators.push(pattern.source);
+                if (riskLevel === types_2.Severity.INFO)
+                    riskLevel = types_2.Severity.LOW;
+            }
+        }
+        // Check for high-risk patterns
+        if (/curl.*\|.*sh|wget.*\|.*bash|rm\s+-rf/.test(contentToAnalyze)) {
+            riskLevel = types_2.Severity.CRITICAL;
+        }
+        else if (/eval|exec|subprocess|child_process/.test(contentToAnalyze)) {
+            riskLevel = types_2.Severity.HIGH;
+        }
+        else if (/http|fetch|request/.test(contentToAnalyze)) {
+            riskLevel = types_2.Severity.MEDIUM;
+        }
+        return {
+            type,
+            command,
+            scriptPath,
+            content: scriptContent,
+            riskLevel,
+            riskIndicators
+        };
+    }
+    /**
+     * Analyze post-install scripts for a package
+     */
+    analyzePostInstallScripts(pkg) {
+        const findings = [];
+        if (!pkg.postInstallScripts)
+            return findings;
+        for (const script of pkg.postInstallScripts) {
+            if (script.riskLevel !== 'info' && script.riskIndicators.length > 0) {
+                findings.push({
+                    packageName: pkg.name,
+                    script,
+                    severity: script.riskLevel,
+                    description: `Suspicious ${script.type} script detected in package ${pkg.name}`,
+                    riskIndicators: script.riskIndicators
+                });
+            }
+        }
+        return findings;
+    }
+    /**
+     * Calculate directory size
+     */
+    calculateDirectorySize(dirPath) {
+        let size = 0;
+        let fileCount = 0;
+        const calculate = (dir, depth = 0) => {
+            if (depth > 5)
+                return; // Limit recursion depth
+            try {
+                const entries = fs.readdirSync(dir, { withFileTypes: true });
+                for (const entry of entries) {
+                    const fullPath = path.join(dir, entry.name);
+                    if (entry.isDirectory()) {
+                        calculate(fullPath, depth + 1);
+                    }
+                    else if (entry.isFile()) {
+                        const stats = fs.statSync(fullPath);
+                        size += stats.size;
+                        fileCount++;
+                    }
+                }
+            }
+            catch {
+                // Ignore permission errors
+            }
+        };
+        calculate(dirPath);
+        return { size, fileCount };
+    }
+    /**
+     * Scan a package for malware
+     */
+    async scanPackageForMalware(pkg, packageDir) {
+        const malwareFindings = [];
+        let filesScanned = 0;
+        const scanFile = (filePath) => {
+            if (this.scannedFiles.has(filePath))
+                return;
+            this.scannedFiles.add(filePath);
+            const ext = path.extname(filePath).toLowerCase();
+            if (!this.config.fileExtensions?.includes(ext))
+                return;
+            try {
+                const stats = fs.statSync(filePath);
+                if (stats.size > (this.config.maxFileSizeBytes ?? 5 * 1024 * 1024))
+                    return;
+                const content = fs.readFileSync(filePath, 'utf-8');
+                filesScanned++;
+                // Get patterns applicable to this file type
+                const patterns = (0, malwarePatterns_1.getPatternsForFile)(filePath);
+                for (const pattern of patterns) {
+                    for (const regex of pattern.patterns) {
+                        // Reset regex state
+                        regex.lastIndex = 0;
+                        const match = regex.exec(content);
+                        if (match) {
+                            // Find line number
+                            const beforeMatch = content.substring(0, match.index);
+                            const lineNumber = beforeMatch.split('\n').length;
+                            // Extract code snippet
+                            const lines = content.split('\n');
+                            const startLine = Math.max(0, lineNumber - 2);
+                            const endLine = Math.min(lines.length, lineNumber + 2);
+                            const codeSnippet = lines.slice(startLine, endLine).join('\n');
+                            malwareFindings.push({
+                                id: (0, utils_1.generateId)(),
+                                package: pkg,
+                                filePath,
+                                lineNumber,
+                                indicators: [pattern.indicator],
+                                severity: pattern.severity,
+                                title: pattern.name,
+                                description: pattern.description,
+                                matchedPattern: pattern.id,
+                                codeSnippet,
+                                standards: pattern.standards,
+                                recommendation: this.getRecommendation(pattern.indicator),
+                                confidence: pattern.confidence,
+                                timestamp: new Date()
+                            });
+                            // Only report first match per pattern per file
+                            break;
+                        }
+                    }
+                }
+            }
+            catch (error) {
+                // Ignore file read errors (binary files, etc.)
+            }
+        };
+        const scanDirectory = (dir, depth = 0) => {
+            if (depth > (this.config.maxDepth ?? 10))
+                return;
+            try {
+                const entries = fs.readdirSync(dir, { withFileTypes: true });
+                for (const entry of entries) {
+                    const fullPath = path.join(dir, entry.name);
+                    if (entry.isDirectory()) {
+                        // Skip nested node_modules
+                        if (entry.name === 'node_modules' && depth > 0)
+                            continue;
+                        scanDirectory(fullPath, depth + 1);
+                    }
+                    else if (entry.isFile()) {
+                        scanFile(fullPath);
+                    }
+                }
+            }
+            catch {
+                // Ignore permission errors
+            }
+        };
+        scanDirectory(packageDir);
+        return { malwareFindings, filesScanned };
+    }
+    /**
+     * Get recommendation for malware indicator
+     */
+    getRecommendation(indicator) {
+        const recommendations = {
+            [types_1.MalwareIndicator.BACKDOOR]: 'Remove this package immediately. It contains backdoor code that allows remote access.',
+            [types_1.MalwareIndicator.CRYPTOMINER]: 'Remove this package. It contains cryptocurrency mining code that steals computational resources.',
+            [types_1.MalwareIndicator.STEALER]: 'Remove this package immediately. It attempts to steal credentials or sensitive data.',
+            [types_1.MalwareIndicator.LOADER]: 'Remove this package. It downloads and executes code from external sources.',
+            [types_1.MalwareIndicator.OBFUSCATED]: 'Review this package carefully. Heavily obfuscated code may hide malicious functionality.',
+            [types_1.MalwareIndicator.DATA_EXFILTRATION]: 'Remove this package. It attempts to send sensitive data to external servers.',
+            [types_1.MalwareIndicator.KNOWN_MALWARE]: 'Remove this package immediately. It has been identified as known malware.'
+        };
+        return recommendations[indicator] || 'Review this package and consider removing it.';
+    }
+    /**
+     * Verify package integrity
+     */
+    async verifyPackageIntegrity(packages) {
+        const issues = [];
+        // Try to load lock file
+        const lockFileData = await this.loadLockFile();
+        if (!lockFileData) {
+            logger_1.logger.debug('No lock file found for integrity verification');
+            return issues;
+        }
+        for (const pkg of packages) {
+            const expectedVersion = lockFileData.packages[pkg.name];
+            if (!expectedVersion) {
+                // Package not in lock file
+                issues.push({
+                    packageName: pkg.name,
+                    issueType: 'unexpected_package',
+                    severity: types_2.Severity.MEDIUM,
+                    description: `Package ${pkg.name} is installed but not in lock file`,
+                    actual: pkg.version
+                });
+            }
+            else if (expectedVersion !== pkg.version) {
+                // Version mismatch
+                issues.push({
+                    packageName: pkg.name,
+                    issueType: 'version_mismatch',
+                    severity: types_2.Severity.HIGH,
+                    description: `Package ${pkg.name} version mismatch - possible tampering`,
+                    expected: expectedVersion,
+                    actual: pkg.version
+                });
+            }
+            // Update package integrity status
+            pkg.integrityStatus = {
+                status: expectedVersion === pkg.version ? 'verified' :
+                    expectedVersion ? 'mismatch' : 'unknown',
+                expectedVersion,
+                installedVersion: pkg.version
+            };
+        }
+        // Check for missing packages
+        for (const [pkgName, version] of Object.entries(lockFileData.packages)) {
+            const installed = packages.find(p => p.name === pkgName);
+            if (!installed) {
+                issues.push({
+                    packageName: pkgName,
+                    issueType: 'missing_package',
+                    severity: types_2.Severity.LOW,
+                    description: `Package ${pkgName} is in lock file but not installed`,
+                    expected: version
+                });
+            }
+        }
+        return issues;
+    }
+    /**
+     * Load lock file data
+     */
+    async loadLockFile() {
+        const projectPath = this.config.projectPath;
+        const packages = {};
+        // Try package-lock.json
+        const packageLockPath = path.join(projectPath, 'package-lock.json');
+        if (fs.existsSync(packageLockPath)) {
+            try {
+                const lockFile = JSON.parse(fs.readFileSync(packageLockPath, 'utf-8'));
+                // Handle npm v3 format
+                if (lockFile.packages) {
+                    for (const [key, value] of Object.entries(lockFile.packages)) {
+                        if (key && key !== '') {
+                            const name = key.replace(/^node_modules\//, '');
+                            packages[name] = value.version;
+                        }
+                    }
+                }
+                // Handle npm v1/v2 format
+                if (lockFile.dependencies) {
+                    for (const [name, value] of Object.entries(lockFile.dependencies)) {
+                        packages[name] = value.version;
+                    }
+                }
+                return { packages };
+            }
+            catch {
+                logger_1.logger.debug('Error parsing package-lock.json');
+            }
+        }
+        // Try yarn.lock (simplified parsing)
+        const yarnLockPath = path.join(projectPath, 'yarn.lock');
+        if (fs.existsSync(yarnLockPath)) {
+            try {
+                const content = fs.readFileSync(yarnLockPath, 'utf-8');
+                const lines = content.split('\n');
+                let currentPackage = '';
+                for (const line of lines) {
+                    const pkgMatch = line.match(/^"?(@?[^@\s]+)@/);
+                    if (pkgMatch) {
+                        currentPackage = pkgMatch[1];
+                    }
+                    const versionMatch = line.match(/^\s+version:?\s+"?([^"\s]+)"?/);
+                    if (versionMatch && currentPackage) {
+                        packages[currentPackage] = versionMatch[1];
+                    }
+                }
+                return { packages };
+            }
+            catch {
+                logger_1.logger.debug('Error parsing yarn.lock');
+            }
+        }
+        return null;
+    }
+    /**
+     * Initialize statistics
+     */
+    initializeStats() {
+        return {
+            totalFoldersScanned: 0,
+            totalPackagesFound: 0,
+            totalFilesScanned: 0,
+            totalBytesScanned: 0,
+            malwareFindingsCount: 0,
+            integrityIssuesCount: 0,
+            suspiciousScriptsCount: 0,
+            packagesByEcosystem: {},
+            findingsBySeverity: {},
+            duration: 0
+        };
+    }
+}
+exports.InstalledDependenciesScanner = InstalledDependenciesScanner;
+/**
+ * Quick scan function
+ */
+async function scanInstalledDependencies(projectPath) {
+    const scanner = new InstalledDependenciesScanner({ projectPath });
+    return scanner.scan();
+}
+//# sourceMappingURL=installedScanner.js.map