secure-scan 1.2.2

package/src/analyzers/javascript/packageJsonAnalyzer.ts

@@ -0,0 +1,626 @@
+/**
+ * Package.json Security Analyzer
+ * Deep analysis of npm package manifests for supply chain threats
+ * 
+ * Detects typosquatting, malicious scripts, suspicious dependencies
+ */
+
+import { Severity, ThreatType, FindingCategory } from '../../types';
+
+/**
+ * Calculate Levenshtein distance between two strings
+ * (Simple implementation to avoid external dependency)
+ */
+function levenshteinDistance(a: string, b: string): number {
+  const matrix: number[][] = [];
+  
+  for (let i = 0; i <= b.length; i++) {
+    matrix[i] = [i];
+  }
+  for (let j = 0; j <= a.length; j++) {
+    matrix[0][j] = j;
+  }
+  
+  for (let i = 1; i <= b.length; i++) {
+    for (let j = 1; j <= a.length; j++) {
+      if (b.charAt(i - 1) === a.charAt(j - 1)) {
+        matrix[i][j] = matrix[i - 1][j - 1];
+      } else {
+        matrix[i][j] = Math.min(
+          matrix[i - 1][j - 1] + 1, // substitution
+          matrix[i][j - 1] + 1,     // insertion
+          matrix[i - 1][j] + 1      // deletion
+        );
+      }
+    }
+  }
+  
+  return matrix[b.length][a.length];
+}
+
+/**
+ * Package.json analysis finding
+ */
+export interface PackageJsonFinding {
+  /** Finding type */
+  type: PackageJsonFindingType;
+  /** Finding name */
+  name: string;
+  /** Description */
+  description: string;
+  /** Severity */
+  severity: Severity;
+  /** Threat type */
+  threatType: ThreatType;
+  /** Category */
+  category: FindingCategory;
+  /** Affected field */
+  field: string;
+  /** Value that triggered the finding */
+  value: string;
+  /** Confidence 0-100 */
+  confidence: number;
+  /** Remediation advice */
+  remediation: string;
+  /** Additional context */
+  context?: Record<string, string>;
+}
+
+/**
+ * Types of package.json findings
+ */
+export enum PackageJsonFindingType {
+  MALICIOUS_SCRIPT = 'malicious_script',
+  TYPOSQUATTING = 'typosquatting',
+  SUSPICIOUS_DEPENDENCY = 'suspicious_dependency',
+  PRIVATE_REGISTRY = 'private_registry',
+  GIT_DEPENDENCY = 'git_dependency',
+  LOCAL_PATH_DEPENDENCY = 'local_path_dependency',
+  OVERLY_PERMISSIVE_VERSION = 'overly_permissive_version',
+  DANGEROUS_POSTINSTALL = 'dangerous_postinstall',
+  OUTDATED_DEPENDENCY = 'outdated_dependency',
+  DEPRECATED_PACKAGE = 'deprecated_package',
+  INSTALL_SCRIPT_ABUSE = 'install_script_abuse',
+  SUSPICIOUS_MAINTAINER = 'suspicious_maintainer'
+}
+
+/**
+ * Popular packages for typosquatting detection
+ */
+const POPULAR_PACKAGES = [
+  // Core npm packages
+  'lodash', 'underscore', 'express', 'react', 'vue', 'angular',
+  'moment', 'axios', 'request', 'bluebird', 'async', 'chalk',
+  'commander', 'debug', 'dotenv', 'fs-extra', 'glob', 'inquirer',
+  'jest', 'mocha', 'chai', 'webpack', 'babel-core', 'typescript',
+  'eslint', 'prettier', 'nodemon', 'pm2', 'mongoose', 'sequelize',
+  'mysql', 'pg', 'redis', 'socket.io', 'graphql', 'apollo-server',
+  'next', 'nuxt', 'gatsby', 'electron', 'puppeteer', 'cheerio',
+  'uuid', 'jsonwebtoken', 'bcrypt', 'passport', 'cors', 'helmet',
+  'morgan', 'winston', 'pino', 'bunyan', 'body-parser', 'cookie-parser',
+  'multer', 'formidable', 'sharp', 'jimp', 'node-fetch', 'got',
+  'superagent', 'cross-env', 'rimraf', 'mkdirp', 'semver', 'yargs',
+  'minimist', 'ora', 'listr', 'execa', 'shelljs', 'cross-spawn',
+  // React ecosystem
+  'react-dom', 'react-router', 'react-redux', 'redux', 'redux-thunk',
+  'redux-saga', 'mobx', 'mobx-react', 'styled-components', 'emotion',
+  'material-ui', '@mui/material', 'antd', 'bootstrap', 'tailwindcss',
+  // Vue ecosystem
+  'vue-router', 'vuex', 'vuetify', 'element-ui', 'vant',
+  // Angular ecosystem
+  '@angular/core', '@angular/common', '@angular/router', 'rxjs',
+  // Build tools
+  'rollup', 'parcel', 'esbuild', 'vite', 'snowpack',
+  'babel-loader', 'ts-loader', 'css-loader', 'style-loader',
+  // Testing
+  'cypress', 'playwright', '@testing-library/react', 'enzyme',
+  // Security sensitive
+  'crypto-js', 'node-forge', 'bcryptjs', 'argon2'
+];
+
+/**
+ * Suspicious script patterns
+ */
+const SUSPICIOUS_SCRIPT_PATTERNS: Array<{
+  pattern: RegExp;
+  name: string;
+  description: string;
+  severity: Severity;
+  confidence: number;
+}> = [
+  {
+    pattern: /curl\s+[^\s]+\s*\|\s*(?:sh|bash|zsh)/i,
+    name: 'Remote Script Execution',
+    description: 'Downloads and executes a remote script',
+    severity: Severity.CRITICAL,
+    confidence: 95
+  },
+  {
+    pattern: /wget\s+[^\s]+\s*(?:&&|;)\s*(?:sh|bash|chmod)/i,
+    name: 'wget Remote Execution',
+    description: 'Downloads and executes a remote script via wget',
+    severity: Severity.CRITICAL,
+    confidence: 95
+  },
+  {
+    pattern: /node\s+-e\s+["'][^"']*(?:http|https|fetch|require\(['"]child_process)/i,
+    name: 'Inline Node Execution',
+    description: 'Executes inline Node.js code with network or process access',
+    severity: Severity.HIGH,
+    confidence: 85
+  },
+  {
+    pattern: /powershell\s+(?:-(?:e|enc|encodedcommand))/i,
+    name: 'PowerShell Encoded Command',
+    description: 'Executes encoded PowerShell command',
+    severity: Severity.CRITICAL,
+    confidence: 90
+  },
+  {
+    pattern: /echo\s+[A-Za-z0-9+/=]{50,}\s*\|\s*base64\s+-d/i,
+    name: 'Base64 Decode Execution',
+    description: 'Decodes and potentially executes Base64 content',
+    severity: Severity.HIGH,
+    confidence: 85
+  },
+  {
+    pattern: /\$\(curl|`curl|\$\(wget|`wget/i,
+    name: 'Command Substitution Download',
+    description: 'Uses command substitution to download content',
+    severity: Severity.HIGH,
+    confidence: 85
+  },
+  {
+    pattern: /eval\s*["'`]?\$\(/i,
+    name: 'Eval Command Substitution',
+    description: 'Evaluates the output of a command',
+    severity: Severity.CRITICAL,
+    confidence: 90
+  },
+  {
+    pattern: />\s*\/dev\/tcp\//i,
+    name: 'Bash Network Redirect',
+    description: 'Uses bash /dev/tcp for network communication',
+    severity: Severity.CRITICAL,
+    confidence: 95
+  },
+  {
+    pattern: /nc\s+-[^|]*\s+(?:\||&)/i,
+    name: 'Netcat Usage',
+    description: 'Uses netcat for network communication',
+    severity: Severity.HIGH,
+    confidence: 80
+  },
+  {
+    pattern: /rm\s+-rf\s+(?:\/|~|\$HOME)/i,
+    name: 'Dangerous File Deletion',
+    description: 'Recursively deletes important directories',
+    severity: Severity.CRITICAL,
+    confidence: 90
+  },
+  {
+    pattern: /chmod\s+(?:\+s|u\+s|4755|2755)/i,
+    name: 'SetUID/SetGID Modification',
+    description: 'Changes file permissions to setuid/setgid',
+    severity: Severity.HIGH,
+    confidence: 85
+  },
+  {
+    pattern: /(?:\.ssh|id_rsa|authorized_keys)/i,
+    name: 'SSH Key Access',
+    description: 'Script accesses SSH keys or configuration',
+    severity: Severity.HIGH,
+    confidence: 75
+  },
+  {
+    pattern: /(?:\/etc\/passwd|\/etc\/shadow)/i,
+    name: 'System Password File Access',
+    description: 'Script accesses system password files',
+    severity: Severity.CRITICAL,
+    confidence: 90
+  }
+];
+
+/**
+ * Known malicious or suspicious package names
+ */
+const KNOWN_MALICIOUS_PACKAGES = new Set([
+  // Historical malicious packages
+  'event-stream', 'flatmap-stream', 'ua-parser-js', 'coa', 'rc',
+  'colors', 'faker', // These were sabotaged by maintainers
+  // Common typosquatting targets that have been used maliciously
+  'loadsh', 'lodahs', 'lodashs', 'crossenv', 'cross-env.js',
+  'babelcli', 'http-proxy.js', 'mongose', 'mongoos',
+  'mssql.js', 'mssql-node', 'mysqljs', 'node-fabric',
+  'node-opencv', 'node-opensl', 'node-openssl', 'node-sqlite',
+  'node-tkinter', 'nodefabric', 'nodeffmpeg', 'nodemailer-js',
+  'noderequest', 'nodesass', 'nodesqlite', 'opencv.js',
+  'openssl.js', 'proxy.js', 'shadowsock', 'smb', 'sqlite.js',
+  'sqliter', 'sqlserver', 'tkinter'
+]);
+
+/**
+ * Suspicious package name patterns
+ */
+const SUSPICIOUS_PACKAGE_PATTERNS = [
+  { pattern: /^@[^/]+\/[^/]+--[^/]+$/, reason: 'Double hyphen in scoped package' },
+  { pattern: /^[a-z]+-[0-9]+$/, reason: 'Package name with trailing numbers' },
+  { pattern: /^node-(?!gyp|fetch|forge|uuid|notifier|schedule|html)/, reason: 'Suspicious node- prefix' },
+  { pattern: /^js-(?!yaml|cookie|beautify)/, reason: 'Suspicious js- prefix' },
+  { pattern: /\.(js|ts|json|node)$/, reason: 'Package name with file extension' },
+  { pattern: /^npm-|^yarn-/i, reason: 'Package prefixed with package manager name' }
+];
+
+/**
+ * Package.json Analyzer Class
+ */
+export class PackageJsonAnalyzer {
+  private findings: PackageJsonFinding[] = [];
+
+  /**
+   * Analyze a package.json file
+   */
+  analyze(content: string, filePath: string): PackageJsonFinding[] {
+    this.findings = [];
+
+    let pkg: Record<string, unknown>;
+    try {
+      pkg = JSON.parse(content);
+    } catch {
+      // Invalid JSON
+      return [];
+    }
+
+    // Analyze scripts
+    if (pkg.scripts && typeof pkg.scripts === 'object') {
+      this.analyzeScripts(pkg.scripts as Record<string, string>);
+    }
+
+    // Analyze dependencies
+    const depFields = ['dependencies', 'devDependencies', 'peerDependencies', 'optionalDependencies'];
+    for (const field of depFields) {
+      if (pkg[field] && typeof pkg[field] === 'object') {
+        this.analyzeDependencies(pkg[field] as Record<string, string>, field);
+      }
+    }
+
+    // Check for bundledDependencies with version specifiers (unusual)
+    if (pkg.bundledDependencies || pkg.bundleDependencies) {
+      this.checkBundledDependencies(
+        (pkg.bundledDependencies || pkg.bundleDependencies) as string[]
+      );
+    }
+
+    // Check for suspicious package metadata
+    this.analyzeMetadata(pkg);
+
+    return this.findings;
+  }
+
+  /**
+   * Analyze npm scripts for malicious patterns
+   */
+  private analyzeScripts(scripts: Record<string, string>): void {
+    // High-risk lifecycle scripts
+    const lifecycleScripts = ['preinstall', 'install', 'postinstall', 'preuninstall', 'postuninstall'];
+    
+    for (const [scriptName, scriptContent] of Object.entries(scripts)) {
+      // Check lifecycle scripts more strictly
+      const isLifecycle = lifecycleScripts.includes(scriptName);
+      
+      // Check against suspicious patterns
+      for (const { pattern, name, description, severity, confidence } of SUSPICIOUS_SCRIPT_PATTERNS) {
+        if (pattern.test(scriptContent)) {
+          this.findings.push({
+            type: PackageJsonFindingType.MALICIOUS_SCRIPT,
+            name: `${name} in ${scriptName}`,
+            description: `${description} found in npm script "${scriptName}"`,
+            severity: isLifecycle ? Severity.CRITICAL : severity,
+            threatType: ThreatType.MALICIOUS_LOADER,
+            category: FindingCategory.MALWARE,
+            field: `scripts.${scriptName}`,
+            value: scriptContent,
+            confidence: isLifecycle ? Math.min(confidence + 10, 100) : confidence,
+            remediation: isLifecycle 
+              ? 'Remove or thoroughly review this lifecycle script. Use npm config set ignore-scripts true for untrusted packages.'
+              : 'Review and remove suspicious commands from the script.',
+            context: { scriptName }
+          });
+        }
+      }
+
+      // Check for scripts that look obfuscated
+      if (this.looksObfuscated(scriptContent)) {
+        this.findings.push({
+          type: PackageJsonFindingType.MALICIOUS_SCRIPT,
+          name: 'Obfuscated Script',
+          description: `Script "${scriptName}" appears to contain obfuscated code`,
+          severity: isLifecycle ? Severity.CRITICAL : Severity.HIGH,
+          threatType: ThreatType.OBFUSCATED_CODE,
+          category: FindingCategory.MALWARE,
+          field: `scripts.${scriptName}`,
+          value: scriptContent.substring(0, 200),
+          confidence: 75,
+          remediation: 'Deobfuscate and analyze the script content.',
+          context: { scriptName }
+        });
+      }
+    }
+  }
+
+  /**
+   * Analyze dependencies for security issues
+   */
+  private analyzeDependencies(deps: Record<string, string>, field: string): void {
+    for (const [name, version] of Object.entries(deps)) {
+      // Check for known malicious packages
+      if (KNOWN_MALICIOUS_PACKAGES.has(name)) {
+        this.findings.push({
+          type: PackageJsonFindingType.SUSPICIOUS_DEPENDENCY,
+          name: 'Known Malicious Package',
+          description: `Package "${name}" has been flagged as malicious or compromised`,
+          severity: Severity.CRITICAL,
+          threatType: ThreatType.MALICIOUS_LOADER,
+          category: FindingCategory.MALWARE,
+          field: `${field}.${name}`,
+          value: `${name}@${version}`,
+          confidence: 95,
+          remediation: 'Remove this package immediately and find a legitimate alternative.'
+        });
+      }
+
+      // Check for typosquatting
+      const typosquatResult = this.checkTyposquatting(name);
+      if (typosquatResult) {
+        this.findings.push({
+          type: PackageJsonFindingType.TYPOSQUATTING,
+          name: 'Potential Typosquatting',
+          description: `Package "${name}" may be a typosquat of "${typosquatResult.target}"`,
+          severity: Severity.HIGH,
+          threatType: ThreatType.MALICIOUS_LOADER,
+          category: FindingCategory.MALWARE,
+          field: `${field}.${name}`,
+          value: `${name}@${version}`,
+          confidence: typosquatResult.confidence,
+          remediation: `Verify you intended to install "${name}" and not "${typosquatResult.target}".`,
+          context: { similarTo: typosquatResult.target }
+        });
+      }
+
+      // Check for suspicious package name patterns
+      for (const { pattern, reason } of SUSPICIOUS_PACKAGE_PATTERNS) {
+        if (pattern.test(name)) {
+          this.findings.push({
+            type: PackageJsonFindingType.SUSPICIOUS_DEPENDENCY,
+            name: 'Suspicious Package Name',
+            description: `Package "${name}" has a suspicious name pattern: ${reason}`,
+            severity: Severity.MEDIUM,
+            threatType: ThreatType.MALICIOUS_LOADER,
+            category: FindingCategory.MALWARE,
+            field: `${field}.${name}`,
+            value: `${name}@${version}`,
+            confidence: 60,
+            remediation: 'Verify this is the intended package before installing.'
+          });
+        }
+      }
+
+      // Check for git dependencies (can be risky)
+      if (version.startsWith('git') || version.startsWith('github:') || version.includes('://')) {
+        this.findings.push({
+          type: PackageJsonFindingType.GIT_DEPENDENCY,
+          name: 'Git URL Dependency',
+          description: `Package "${name}" is installed from a git URL instead of npm registry`,
+          severity: Severity.MEDIUM,
+          threatType: ThreatType.SECURITY_MISCONFIGURATION,
+          category: FindingCategory.VULNERABILITY,
+          field: `${field}.${name}`,
+          value: `${name}@${version}`,
+          confidence: 70,
+          remediation: 'Use npm registry versions when possible. Audit the git repository.'
+        });
+      }
+
+      // Check for local file dependencies
+      if (version.startsWith('file:') || version.startsWith('./') || version.startsWith('../')) {
+        this.findings.push({
+          type: PackageJsonFindingType.LOCAL_PATH_DEPENDENCY,
+          name: 'Local Path Dependency',
+          description: `Package "${name}" uses a local file path`,
+          severity: Severity.LOW,
+          threatType: ThreatType.SECURITY_MISCONFIGURATION,
+          category: FindingCategory.CODE_SMELL,
+          field: `${field}.${name}`,
+          value: `${name}@${version}`,
+          confidence: 80,
+          remediation: 'Consider publishing the package or using a workspace configuration.'
+        });
+      }
+
+      // Check for overly permissive version ranges
+      if (version === '*' || version === 'latest' || /^>=?\s*0\./.test(version)) {
+        this.findings.push({
+          type: PackageJsonFindingType.OVERLY_PERMISSIVE_VERSION,
+          name: 'Overly Permissive Version',
+          description: `Package "${name}" uses "${version}" which could install any version`,
+          severity: Severity.MEDIUM,
+          threatType: ThreatType.VULNERABLE_DEPENDENCY,
+          category: FindingCategory.BEST_PRACTICE,
+          field: `${field}.${name}`,
+          value: `${name}@${version}`,
+          confidence: 85,
+          remediation: 'Use a specific version or a caret/tilde range.'
+        });
+      }
+    }
+  }
+
+  /**
+   * Check for typosquatting against popular packages
+   */
+  private checkTyposquatting(packageName: string): { target: string; confidence: number } | null {
+    const lowerName = packageName.toLowerCase();
+    
+    // Skip if it's a popular package itself
+    if (POPULAR_PACKAGES.includes(lowerName)) {
+      return null;
+    }
+
+    // Skip scoped packages for now (they're harder to typosquat)
+    if (packageName.startsWith('@')) {
+      return null;
+    }
+
+    for (const popular of POPULAR_PACKAGES) {
+      const distance = levenshteinDistance(lowerName, popular.toLowerCase());
+      const maxLength = Math.max(lowerName.length, popular.length);
+      const similarity = 1 - (distance / maxLength);
+
+      // If very similar but not exact
+      if (distance > 0 && distance <= 2 && similarity > 0.8) {
+        const confidence = Math.round(similarity * 100);
+        return { target: popular, confidence };
+      }
+
+      // Check for common typosquatting patterns
+      const patterns = [
+        `${popular}-js`,
+        `${popular}js`,
+        `${popular}.js`,
+        `js-${popular}`,
+        `node-${popular}`,
+        `${popular}-node`,
+        `${popular}2`,
+        `${popular}-v2`,
+        popular.replace(/-/g, ''),
+        popular.replace(/-/g, '_')
+      ];
+
+      for (const pattern of patterns) {
+        if (lowerName === pattern.toLowerCase() && lowerName !== popular.toLowerCase()) {
+          return { target: popular, confidence: 75 };
+        }
+      }
+    }
+
+    return null;
+  }
+
+  /**
+   * Check bundled dependencies
+   */
+  private checkBundledDependencies(bundled: string[]): void {
+    if (!Array.isArray(bundled)) return;
+
+    for (const name of bundled) {
+      if (typeof name !== 'string') continue;
+
+      // Check for known malicious packages
+      if (KNOWN_MALICIOUS_PACKAGES.has(name)) {
+        this.findings.push({
+          type: PackageJsonFindingType.SUSPICIOUS_DEPENDENCY,
+          name: 'Malicious Bundled Dependency',
+          description: `Bundled package "${name}" is known to be malicious`,
+          severity: Severity.CRITICAL,
+          threatType: ThreatType.MALICIOUS_LOADER,
+          category: FindingCategory.MALWARE,
+          field: 'bundledDependencies',
+          value: name,
+          confidence: 95,
+          remediation: 'Remove this bundled dependency immediately.'
+        });
+      }
+    }
+  }
+
+  /**
+   * Analyze package metadata for suspicious patterns
+   */
+  private analyzeMetadata(pkg: Record<string, unknown>): void {
+    // Check for suspicious repository URLs
+    if (pkg.repository) {
+      const repoUrl = typeof pkg.repository === 'string' 
+        ? pkg.repository 
+        : (pkg.repository as Record<string, string>).url;
+
+      if (repoUrl) {
+        // Check for IP-based repository URLs
+        if (/https?:\/\/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/.test(repoUrl)) {
+          this.findings.push({
+            type: PackageJsonFindingType.SUSPICIOUS_DEPENDENCY,
+            name: 'IP-Based Repository URL',
+            description: 'Repository uses a raw IP address instead of a domain',
+            severity: Severity.HIGH,
+            threatType: ThreatType.SUSPICIOUS_NETWORK,
+            category: FindingCategory.MALWARE,
+            field: 'repository',
+            value: repoUrl,
+            confidence: 75,
+            remediation: 'Verify the repository is legitimate.'
+          });
+        }
+
+        // Check for non-standard git hosts
+        const trustedHosts = ['github.com', 'gitlab.com', 'bitbucket.org', 'dev.azure.com'];
+        const isStandardHost = trustedHosts.some(host => repoUrl.includes(host));
+        if (!isStandardHost && repoUrl.includes('://')) {
+          this.findings.push({
+            type: PackageJsonFindingType.SUSPICIOUS_DEPENDENCY,
+            name: 'Non-Standard Repository Host',
+            description: 'Repository is hosted on a non-standard git host',
+            severity: Severity.LOW,
+            threatType: ThreatType.SECURITY_MISCONFIGURATION,
+            category: FindingCategory.CODE_SMELL,
+            field: 'repository',
+            value: repoUrl,
+            confidence: 50,
+            remediation: 'Verify the repository host is trustworthy.'
+          });
+        }
+      }
+    }
+
+    // Check for very new package (less relevant for static analysis, but worth noting)
+    // This would normally require npm API access
+
+    // Check for private registry configuration
+    if (pkg.publishConfig && typeof pkg.publishConfig === 'object') {
+      const publishConfig = pkg.publishConfig as Record<string, string>;
+      if (publishConfig.registry && !publishConfig.registry.includes('registry.npmjs.org')) {
+        this.findings.push({
+          type: PackageJsonFindingType.PRIVATE_REGISTRY,
+          name: 'Private Registry Configuration',
+          description: 'Package is configured to publish to a private registry',
+          severity: Severity.INFO,
+          threatType: ThreatType.SECURITY_MISCONFIGURATION,
+          category: FindingCategory.CODE_SMELL,
+          field: 'publishConfig.registry',
+          value: publishConfig.registry,
+          confidence: 60,
+          remediation: 'Verify the registry configuration is intentional.'
+        });
+      }
+    }
+  }
+
+  /**
+   * Check if content looks obfuscated
+   */
+  private looksObfuscated(content: string): boolean {
+    // Check for base64-like patterns
+    if (/[A-Za-z0-9+/=]{100,}/.test(content)) return true;
+    
+    // Check for heavy use of hex escapes
+    if (/(?:\\x[0-9a-f]{2}){20,}/i.test(content)) return true;
+    
+    // Check for unicode escapes
+    if (/(?:\\u[0-9a-f]{4}){15,}/i.test(content)) return true;
+    
+    // Check for very long single-line strings
+    if (content.length > 500 && !content.includes(' ') && !content.includes('\n')) return true;
+
+    return false;
+  }
+}
+
+export default PackageJsonAnalyzer;