secure-scan 1.2.2

package/src/dependencies/database/maliciousPackages.ts

@@ -0,0 +1,286 @@
+/**
+ * Known Malicious Packages Database
+ * Static database of known malicious packages for offline detection
+ * Updated: 2024-01
+ */
+
+import { MaliciousPackageEntry, MalwareIndicator, PackageEcosystem } from '../types';
+
+/**
+ * Database of known malicious packages
+ * Sources: npm security advisories, PyPI reports, Snyk, etc.
+ */
+export const KNOWN_MALICIOUS_PACKAGES: MaliciousPackageEntry[] = [
+  // NPM malicious packages
+  {
+    name: 'event-stream',
+    ecosystem: 'npm',
+    indicators: [MalwareIndicator.STEALER, MalwareIndicator.BACKDOOR],
+    description: 'Compromised package with cryptocurrency wallet stealer (version 3.3.6)',
+    reportedDate: '2018-11-26',
+    references: ['https://blog.npmjs.org/post/180565383195/details-about-the-event-stream-incident'],
+    affectedVersions: '3.3.6'
+  },
+  {
+    name: 'ua-parser-js',
+    ecosystem: 'npm',
+    indicators: [MalwareIndicator.CRYPTOMINER, MalwareIndicator.STEALER],
+    description: 'Hijacked package with cryptominer and password stealer',
+    reportedDate: '2021-10-22',
+    references: ['https://github.com/ArmandPhil662/MALWARE-SAMPLE'],
+    affectedVersions: '0.7.29, 0.8.0, 1.0.0'
+  },
+  {
+    name: 'coa',
+    ecosystem: 'npm',
+    indicators: [MalwareIndicator.STEALER],
+    description: 'Hijacked package used for credential theft',
+    reportedDate: '2021-11-04',
+    references: ['https://blog.sonatype.com/npm-hijacked-supply-chain'],
+    affectedVersions: '2.0.3, 2.0.4, 2.1.1, 2.1.3, 3.0.1, 3.1.3'
+  },
+  {
+    name: 'rc',
+    ecosystem: 'npm',
+    indicators: [MalwareIndicator.STEALER],
+    description: 'Hijacked package used for credential theft',
+    reportedDate: '2021-11-04',
+    references: ['https://blog.sonatype.com/npm-hijacked-supply-chain'],
+    affectedVersions: '1.2.9, 1.3.9, 2.3.9'
+  },
+  {
+    name: 'flatmap-stream',
+    ecosystem: 'npm',
+    indicators: [MalwareIndicator.STEALER, MalwareIndicator.BACKDOOR],
+    description: 'Malicious package injected into event-stream',
+    reportedDate: '2018-11-26',
+    references: ['https://blog.npmjs.org/post/180565383195/details-about-the-event-stream-incident'],
+    affectedVersions: '*'
+  },
+  {
+    name: 'colors',
+    ecosystem: 'npm',
+    indicators: [MalwareIndicator.OBFUSCATED],
+    description: 'Sabotaged by maintainer with infinite loop (protestware)',
+    reportedDate: '2022-01-09',
+    references: ['https://www.bleepingcomputer.com/news/security/dev-corrupts-npm-libs-colors-and-faker-breaking-thousands-of-apps/'],
+    affectedVersions: '1.4.1, 1.4.2'
+  },
+  {
+    name: 'faker',
+    ecosystem: 'npm',
+    indicators: [MalwareIndicator.OBFUSCATED],
+    description: 'Sabotaged by maintainer (protestware)',
+    reportedDate: '2022-01-09',
+    references: ['https://www.bleepingcomputer.com/news/security/dev-corrupts-npm-libs-colors-and-faker-breaking-thousands-of-apps/'],
+    affectedVersions: '6.6.6'
+  },
+  {
+    name: 'node-ipc',
+    ecosystem: 'npm',
+    indicators: [MalwareIndicator.DATA_EXFILTRATION],
+    description: 'Supply chain attack targeting Russian/Belarusian IPs (peacenotwar)',
+    reportedDate: '2022-03-16',
+    references: ['https://snyk.io/blog/peacenotwar-malicious-npm-node-ipc-package-vulnerability/'],
+    affectedVersions: '10.1.1, 10.1.2, 10.1.3'
+  },
+  
+  // Python malicious packages
+  {
+    name: 'ctx',
+    ecosystem: 'pip',
+    indicators: [MalwareIndicator.STEALER],
+    description: 'Compromised package stealing environment variables',
+    reportedDate: '2022-05-24',
+    references: ['https://www.bleepingcomputer.com/news/security/pypi-package-ctx-compromised-to-steal-aws-credentials/'],
+    affectedVersions: '0.1.2, 0.2.2, 0.2.6'
+  },
+  {
+    name: 'phpass',
+    ecosystem: 'pip',
+    indicators: [MalwareIndicator.STEALER],
+    description: 'Compromised package stealing environment variables',
+    reportedDate: '2022-05-24',
+    references: ['https://www.bleepingcomputer.com/news/security/pypi-package-ctx-compromised-to-steal-aws-credentials/'],
+    affectedVersions: '*'
+  },
+  {
+    name: 'colourama',
+    ecosystem: 'pip',
+    indicators: [MalwareIndicator.CRYPTOMINER],
+    description: 'Typosquat of colorama with cryptominer',
+    reportedDate: '2019-10-22',
+    references: ['https://www.zdnet.com/article/two-malicious-python-libraries-removed-from-pypi/'],
+    affectedVersions: '*'
+  },
+  {
+    name: 'python3-dateutil',
+    ecosystem: 'pip',
+    indicators: [MalwareIndicator.STEALER],
+    description: 'Typosquat of python-dateutil stealing SSH keys',
+    reportedDate: '2019-12-04',
+    references: ['https://snyk.io/blog/malicious-packages-open-source-code-2019/'],
+    affectedVersions: '*'
+  },
+  {
+    name: 'jeIlyfish',
+    ecosystem: 'pip',
+    indicators: [MalwareIndicator.STEALER],
+    description: 'Typosquat of jellyfish (using capital I instead of l)',
+    reportedDate: '2019-12-04',
+    references: ['https://snyk.io/blog/malicious-packages-open-source-code-2019/'],
+    affectedVersions: '*'
+  },
+  {
+    name: 'libpeshnern',
+    ecosystem: 'pip',
+    indicators: [MalwareIndicator.BACKDOOR],
+    description: 'Reverse shell backdoor',
+    reportedDate: '2021-05-15',
+    references: ['https://blog.sonatype.com/sonatype-catches-new-pypi-ransomware'],
+    affectedVersions: '*'
+  },
+  
+  // PHP malicious packages (Composer)
+  {
+    name: 'phpunit/php-unit',
+    ecosystem: 'composer',
+    indicators: [MalwareIndicator.BACKDOOR],
+    description: 'Typosquat of phpunit/phpunit with backdoor',
+    reportedDate: '2020-01-15',
+    references: ['https://packagist.org/'],
+    affectedVersions: '*'
+  },
+  {
+    name: 'symfony/symf0ny',
+    ecosystem: 'composer',
+    indicators: [MalwareIndicator.BACKDOOR],
+    description: 'Typosquat of symfony packages',
+    reportedDate: '2020-01-15',
+    references: ['https://packagist.org/'],
+    affectedVersions: '*'
+  },
+  
+  // NuGet malicious packages
+  {
+    name: 'SpeechRecognition',
+    ecosystem: 'nuget',
+    indicators: [MalwareIndicator.CRYPTOMINER],
+    description: 'Cryptocurrency miner disguised as legitimate package',
+    reportedDate: '2023-03-20',
+    references: ['https://blog.jfrog.com/nuget-malware'],
+    affectedVersions: '*'
+  },
+
+  // Maven malicious packages
+  {
+    name: 'org.springframework:spring-core',
+    ecosystem: 'maven',
+    indicators: [MalwareIndicator.BACKDOOR],
+    description: 'Note: Legitimate package but check for typosquats',
+    reportedDate: '2023-01-01',
+    references: [],
+    affectedVersions: 'none'
+  }
+];
+
+/**
+ * Popular package names for typosquatting detection
+ */
+export const POPULAR_PACKAGES: Record<PackageEcosystem, string[]> = {
+  npm: [
+    'lodash', 'express', 'react', 'webpack', 'axios', 'moment', 'chalk',
+    'request', 'commander', 'async', 'debug', 'uuid', 'underscore',
+    'typescript', 'jquery', 'vue', 'angular', 'next', 'eslint', 'babel',
+    'prettier', 'jest', 'mocha', 'gulp', 'grunt', 'nodemon', 'mongoose',
+    'socket.io', 'cheerio', 'passport', 'cors', 'dotenv', 'body-parser',
+    'colors', 'minimist', 'yargs', 'inquirer', 'rxjs', 'bluebird', 'fs-extra',
+    'glob', 'mkdirp', 'rimraf', 'semver', 'nanoid', 'dayjs', 'date-fns'
+  ],
+  pip: [
+    'requests', 'numpy', 'pandas', 'django', 'flask', 'matplotlib', 'tensorflow',
+    'scikit-learn', 'scipy', 'pillow', 'beautifulsoup4', 'selenium', 'pytest',
+    'boto3', 'sqlalchemy', 'celery', 'redis', 'psycopg2', 'paramiko', 'pyyaml',
+    'cryptography', 'jinja2', 'click', 'aiohttp', 'httpx', 'fastapi', 'uvicorn',
+    'colorama', 'tqdm', 'python-dateutil', 'pytz', 'jellyfish', 'pydantic',
+    'setuptools', 'wheel', 'pip', 'virtualenv', 'ipython', 'jupyter', 'black',
+    'pylint', 'mypy', 'flake8', 'isort', 'poetry', 'torch', 'keras', 'nltk'
+  ],
+  composer: [
+    'laravel/framework', 'symfony/symfony', 'guzzlehttp/guzzle', 'monolog/monolog',
+    'phpunit/phpunit', 'doctrine/orm', 'twig/twig', 'vlucas/phpdotenv',
+    'nesbot/carbon', 'ramsey/uuid', 'fzaninotto/faker', 'psr/log', 'swiftmailer/swiftmailer',
+    'league/flysystem', 'predis/predis', 'nikic/fast-route', 'slim/slim'
+  ],
+  maven: [
+    'org.springframework:spring-core', 'com.google.guava:guava', 'org.apache.commons:commons-lang3',
+    'junit:junit', 'org.slf4j:slf4j-api', 'ch.qos.logback:logback-classic',
+    'com.fasterxml.jackson.core:jackson-databind', 'org.apache.httpcomponents:httpclient',
+    'mysql:mysql-connector-java', 'org.postgresql:postgresql', 'org.projectlombok:lombok'
+  ],
+  gradle: [
+    'org.springframework:spring-core', 'com.google.guava:guava', 'org.jetbrains.kotlin:kotlin-stdlib'
+  ],
+  nuget: [
+    'Newtonsoft.Json', 'Microsoft.EntityFrameworkCore', 'Serilog', 'AutoMapper',
+    'Dapper', 'MediatR', 'FluentValidation', 'Polly', 'xunit', 'NUnit', 'Moq'
+  ],
+  vcpkg: [
+    'boost', 'openssl', 'curl', 'zlib', 'fmt', 'nlohmann-json', 'sqlite3',
+    'gtest', 'opencv', 'protobuf', 'grpc', 'abseil', 'cpprestsdk'
+  ],
+  conan: [
+    'boost', 'openssl', 'zlib', 'fmt', 'spdlog', 'gtest', 'catch2', 'nlohmann_json',
+    'abseil', 'protobuf', 'grpc', 'opencv', 'poco', 'cpprestsdk'
+  ],
+  cmake: [
+    'Boost', 'OpenSSL', 'CURL', 'ZLIB', 'GTest', 'OpenCV', 'Protobuf', 'gRPC'
+  ]
+};
+
+/**
+ * Known abandoned/deprecated packages
+ */
+export const DEPRECATED_PACKAGES: Record<string, { ecosystem: PackageEcosystem; replacement?: string; reason: string }> = {
+  'request': { ecosystem: 'npm', replacement: 'axios or node-fetch', reason: 'Deprecated in 2020' },
+  'moment': { ecosystem: 'npm', replacement: 'dayjs or date-fns', reason: 'Deprecated, large bundle size' },
+  'underscore': { ecosystem: 'npm', replacement: 'lodash', reason: 'Maintenance mode' },
+  'node-uuid': { ecosystem: 'npm', replacement: 'uuid', reason: 'Renamed to uuid' },
+  'faker': { ecosystem: 'npm', replacement: '@faker-js/faker', reason: 'Sabotaged, use community fork' },
+  'crypto': { ecosystem: 'pip', replacement: 'cryptography', reason: 'Deprecated, use cryptography' },
+  'pycrypto': { ecosystem: 'pip', replacement: 'pycryptodome', reason: 'Unmaintained since 2012' },
+  'nose': { ecosystem: 'pip', replacement: 'pytest', reason: 'Unmaintained since 2016' },
+  'phpmailer/phpmailer': { ecosystem: 'composer', replacement: 'Check for security updates', reason: 'Had critical RCE vulnerabilities' }
+};
+
+/**
+ * Packages known to have dangerous post-install scripts
+ */
+export const DANGEROUS_POSTINSTALL_PACKAGES: string[] = [
+  // These are examples - some packages legitimately need postinstall
+  // but unusual ones should be flagged for review
+];
+
+/**
+ * Get malicious package entry if exists
+ */
+export function getMaliciousPackage(name: string, ecosystem: PackageEcosystem): MaliciousPackageEntry | undefined {
+  return KNOWN_MALICIOUS_PACKAGES.find(p => 
+    p.name.toLowerCase() === name.toLowerCase() && p.ecosystem === ecosystem
+  );
+}
+
+/**
+ * Check if package is deprecated
+ */
+export function isDeprecatedPackage(name: string): { deprecated: boolean; info?: typeof DEPRECATED_PACKAGES[string] } {
+  const info = DEPRECATED_PACKAGES[name.toLowerCase()];
+  return { deprecated: !!info, info };
+}
+
+/**
+ * Get popular packages for an ecosystem (for typosquatting detection)
+ */
+export function getPopularPackages(ecosystem: PackageEcosystem): string[] {
+  return POPULAR_PACKAGES[ecosystem] || [];
+}

package/src/dependencies/dependencyAnalyzer.ts

@@ -0,0 +1,394 @@
+/**
+ * Dependency Analyzer
+ * Main orchestrator for Software Composition Analysis (SCA)
+ * Analyzes project dependencies without executing any code
+ */
+
+import * as fs from 'fs';
+import * as path from 'path';
+import { 
+  DependencyAnalysisResult, 
+  DependencyManifest, 
+  Dependency,
+  DependencyVulnerability,
+  DependencyAnalysisStats,
+  PackageEcosystem,
+  DependencyRiskCategory
+} from './types';
+import { Severity, ScanConfig, AIConfig } from '../types';
+import { getAllDependencyParsers, getParserForFile, getSupportedManifestFiles } from './parsers';
+import { VulnerabilityDetector } from './detectors';
+import { logger } from '../utils/logger';
+import { generateId } from '../utils';
+
+/**
+ * Manifest file patterns to search for
+ */
+const MANIFEST_PATTERNS = [
+  // JavaScript/Node.js
+  'package.json',
+  'package-lock.json',
+  'yarn.lock',
+  // Python
+  'requirements.txt',
+  'Pipfile',
+  'Pipfile.lock',
+  'pyproject.toml',
+  // PHP
+  'composer.json',
+  'composer.lock',
+  // Java
+  'pom.xml',
+  'build.gradle',
+  // C/C++
+  'vcpkg.json',
+  'conanfile.txt',
+  'CMakeLists.txt',
+  // C#
+  '*.csproj',
+  'packages.config'
+];
+
+/**
+ * Dependency Analyzer Configuration
+ */
+export interface DependencyAnalyzerConfig {
+  /** Project path to analyze */
+  projectPath: string;
+  /** Enable AI-assisted analysis */
+  useAI?: boolean;
+  /** AI configuration */
+  aiConfig?: AIConfig;
+  /** Maximum depth to search for manifests */
+  maxDepth?: number;
+  /** Directories to exclude */
+  exclude?: string[];
+  /** Include dev dependencies in analysis */
+  includeDevDependencies?: boolean;
+  /** Verbose logging */
+  verbose?: boolean;
+}
+
+/**
+ * Dependency Analyzer Class
+ * Main entry point for Software Composition Analysis
+ */
+export class DependencyAnalyzer {
+  private config: DependencyAnalyzerConfig;
+  private vulnerabilityDetector: VulnerabilityDetector;
+  private aiAnalyzer?: any; // Will be integrated with AIAnalyzer
+
+  constructor(config: DependencyAnalyzerConfig) {
+    this.config = {
+      ...config,
+      maxDepth: config.maxDepth ?? 5,
+      exclude: config.exclude ?? ['node_modules', 'vendor', 'venv', '.git', 'dist', 'build'],
+      includeDevDependencies: config.includeDevDependencies ?? true,
+      verbose: config.verbose ?? false
+    };
+    this.vulnerabilityDetector = new VulnerabilityDetector();
+  }
+
+  /**
+   * Run dependency analysis
+   */
+  async analyze(): Promise<DependencyAnalysisResult> {
+    const startTime = Date.now();
+    logger.info('📦 Starting dependency analysis (SCA)...');
+
+    // Find all manifest files
+    logger.info('🔍 Searching for dependency manifests...');
+    const manifestFiles = await this.findManifestFiles();
+    
+    if (manifestFiles.length === 0) {
+      logger.warn('⚠️ No dependency manifest files found');
+      return this.createEmptyResult(startTime);
+    }
+
+    logger.info(`📄 Found ${manifestFiles.length} manifest file(s)`);
+
+    // Parse all manifests
+    const manifests: DependencyManifest[] = [];
+    const allDependencies: Dependency[] = [];
+
+    for (const filePath of manifestFiles) {
+      const manifest = await this.parseManifest(filePath);
+      if (manifest) {
+        manifests.push(manifest);
+        allDependencies.push(...manifest.dependencies);
+      }
+    }
+
+    // Deduplicate dependencies
+    const uniqueDependencies = this.deduplicateDependencies(allDependencies);
+    logger.info(`📊 Found ${uniqueDependencies.length} unique dependencies`);
+
+    // Analyze for vulnerabilities
+    logger.info('🔒 Analyzing dependencies for vulnerabilities...');
+    const vulnerabilities = await this.analyzeVulnerabilities(uniqueDependencies);
+    
+    if (vulnerabilities.length > 0) {
+      logger.warn(`⚠️ Found ${vulnerabilities.length} vulnerability issue(s)`);
+    } else {
+      logger.info('✅ No vulnerabilities detected');
+    }
+
+    // Calculate statistics
+    const endTime = Date.now();
+    const stats = this.calculateStats(manifests, uniqueDependencies, vulnerabilities, endTime - startTime);
+
+    // Get ecosystems
+    const ecosystems = [...new Set(manifests.map(m => m.ecosystem))];
+
+    return {
+      manifests,
+      dependencies: uniqueDependencies,
+      vulnerabilities,
+      stats,
+      ecosystems,
+      timestamp: new Date()
+    };
+  }
+
+  /**
+   * Find all manifest files in the project
+   */
+  private async findManifestFiles(): Promise<string[]> {
+    const manifestFiles: string[] = [];
+    const parsers = getAllDependencyParsers();
+    
+    await this.walkDirectory(this.config.projectPath, 0, (filePath) => {
+      const fileName = path.basename(filePath);
+      
+      // Check if any parser supports this file
+      for (const parser of parsers) {
+        if (parser.supports(fileName)) {
+          manifestFiles.push(filePath);
+          if (this.config.verbose) {
+            logger.debug(`Found manifest: ${filePath}`);
+          }
+          break;
+        }
+      }
+    });
+
+    return manifestFiles;
+  }
+
+  /**
+   * Recursively walk directory
+   */
+  private async walkDirectory(
+    dir: string, 
+    depth: number, 
+    callback: (filePath: string) => void
+  ): Promise<void> {
+    if (depth > (this.config.maxDepth ?? 5)) return;
+
+    try {
+      const entries = fs.readdirSync(dir, { withFileTypes: true });
+
+      for (const entry of entries) {
+        const fullPath = path.join(dir, entry.name);
+
+        if (entry.isDirectory()) {
+          // Check if excluded
+          if (this.config.exclude?.includes(entry.name)) continue;
+          
+          await this.walkDirectory(fullPath, depth + 1, callback);
+        } else if (entry.isFile()) {
+          callback(fullPath);
+        }
+      }
+    } catch (error) {
+      // Ignore permission errors
+      if (this.config.verbose) {
+        logger.debug(`Cannot read directory: ${dir}`);
+      }
+    }
+  }
+
+  /**
+   * Parse a manifest file
+   */
+  private async parseManifest(filePath: string): Promise<DependencyManifest | null> {
+    const fileName = path.basename(filePath);
+    const parser = getParserForFile(fileName);
+
+    if (!parser) {
+      logger.debug(`No parser found for: ${fileName}`);
+      return null;
+    }
+
+    try {
+      const content = fs.readFileSync(filePath, 'utf-8');
+      const manifest = await parser.parse(filePath, content);
+
+      if (manifest.parseErrors && manifest.parseErrors.length > 0) {
+        logger.warn(`⚠️ Parse errors in ${filePath}: ${manifest.parseErrors.join(', ')}`);
+      }
+
+      return manifest;
+    } catch (error) {
+      logger.debug(`Failed to parse ${filePath}: ${error}`);
+      return null;
+    }
+  }
+
+  /**
+   * Deduplicate dependencies across manifests
+   */
+  private deduplicateDependencies(dependencies: Dependency[]): Dependency[] {
+    const seen = new Map<string, Dependency>();
+
+    for (const dep of dependencies) {
+      const key = `${dep.ecosystem}:${dep.name}`;
+      
+      if (!seen.has(key)) {
+        seen.set(key, dep);
+      } else {
+        // Keep the one with more information (resolved version, etc.)
+        const existing = seen.get(key)!;
+        if (dep.resolvedVersion && !existing.resolvedVersion) {
+          seen.set(key, dep);
+        }
+      }
+    }
+
+    return Array.from(seen.values());
+  }
+
+  /**
+   * Analyze dependencies for vulnerabilities
+   */
+  private async analyzeVulnerabilities(dependencies: Dependency[]): Promise<DependencyVulnerability[]> {
+    const vulnerabilities: DependencyVulnerability[] = [];
+
+    for (const dep of dependencies) {
+      // Skip dev dependencies if configured
+      if (!this.config.includeDevDependencies && dep.dependencyType === 'dev') {
+        continue;
+      }
+
+      const depVulns = await this.vulnerabilityDetector.analyzeDependency(dep);
+      vulnerabilities.push(...depVulns);
+
+      // Log critical vulnerabilities
+      for (const vuln of depVulns) {
+        if (vuln.severity === Severity.CRITICAL || vuln.severity === Severity.HIGH) {
+          logger.warn(`🚨 ${vuln.severity.toUpperCase()}: ${vuln.title}`);
+        }
+      }
+    }
+
+    // Sort by severity
+    return this.sortVulnerabilities(vulnerabilities);
+  }
+
+  /**
+   * Sort vulnerabilities by severity
+   */
+  private sortVulnerabilities(vulnerabilities: DependencyVulnerability[]): DependencyVulnerability[] {
+    const severityOrder: Record<Severity, number> = {
+      [Severity.CRITICAL]: 0,
+      [Severity.HIGH]: 1,
+      [Severity.MEDIUM]: 2,
+      [Severity.LOW]: 3,
+      [Severity.INFO]: 4
+    };
+
+    return vulnerabilities.sort((a, b) => 
+      severityOrder[a.severity] - severityOrder[b.severity]
+    );
+  }
+
+  /**
+   * Calculate analysis statistics
+   */
+  private calculateStats(
+    manifests: DependencyManifest[],
+    dependencies: Dependency[],
+    vulnerabilities: DependencyVulnerability[],
+    duration: number
+  ): DependencyAnalysisStats {
+    const directDeps = dependencies.filter(d => d.dependencyType === 'direct');
+    const transitiveDeps = dependencies.filter(d => d.dependencyType === 'transitive');
+    
+    const vulnerableDeps = new Set(vulnerabilities.map(v => `${v.dependency.ecosystem}:${v.dependency.name}`));
+
+    const vulnBySeverity: Record<Severity, number> = {
+      [Severity.CRITICAL]: 0,
+      [Severity.HIGH]: 0,
+      [Severity.MEDIUM]: 0,
+      [Severity.LOW]: 0,
+      [Severity.INFO]: 0
+    };
+
+    const vulnByCategory: Record<DependencyRiskCategory, number> = {
+      [DependencyRiskCategory.VULNERABILITY]: 0,
+      [DependencyRiskCategory.SUPPLY_CHAIN]: 0,
+      [DependencyRiskCategory.MALICIOUS]: 0,
+      [DependencyRiskCategory.OUTDATED]: 0,
+      [DependencyRiskCategory.LICENSE]: 0,
+      [DependencyRiskCategory.MAINTENANCE]: 0
+    };
+
+    for (const vuln of vulnerabilities) {
+      vulnBySeverity[vuln.severity]++;
+      vulnByCategory[vuln.category]++;
+    }
+
+    const ecosystems = [...new Set(manifests.map(m => m.ecosystem))];
+
+    return {
+      totalManifests: manifests.length,
+      totalDependencies: dependencies.length,
+      directDependencies: directDeps.length,
+      transitiveDependencies: transitiveDeps.length,
+      vulnerableDependencies: vulnerableDeps.size,
+      vulnerabilitiesBySeverity: vulnBySeverity,
+      vulnerabilitiesByCategory: vulnByCategory,
+      ecosystemsAnalyzed: ecosystems,
+      duration
+    };
+  }
+
+  /**
+   * Create empty result when no manifests found
+   */
+  private createEmptyResult(startTime: number): DependencyAnalysisResult {
+    return {
+      manifests: [],
+      dependencies: [],
+      vulnerabilities: [],
+      stats: {
+        totalManifests: 0,
+        totalDependencies: 0,
+        directDependencies: 0,
+        transitiveDependencies: 0,
+        vulnerableDependencies: 0,
+        vulnerabilitiesBySeverity: {
+          [Severity.CRITICAL]: 0,
+          [Severity.HIGH]: 0,
+          [Severity.MEDIUM]: 0,
+          [Severity.LOW]: 0,
+          [Severity.INFO]: 0
+        },
+        vulnerabilitiesByCategory: {
+          [DependencyRiskCategory.VULNERABILITY]: 0,
+          [DependencyRiskCategory.SUPPLY_CHAIN]: 0,
+          [DependencyRiskCategory.MALICIOUS]: 0,
+          [DependencyRiskCategory.OUTDATED]: 0,
+          [DependencyRiskCategory.LICENSE]: 0,
+          [DependencyRiskCategory.MAINTENANCE]: 0
+        },
+        ecosystemsAnalyzed: [],
+        duration: Date.now() - startTime
+      },
+      ecosystems: [],
+      timestamp: new Date()
+    };
+  }
+}
+
+export default DependencyAnalyzer;

package/src/dependencies/detectors/index.ts

@@ -0,0 +1,7 @@
+/**
+ * Detectors Module Exports
+ */
+
+export * from './vulnerabilityDetector';
+export * from './securityStandards';
+export { default as VulnerabilityDetector } from './vulnerabilityDetector';