secure-scan 1.2.2

package/src/dependencies/detectors/securityStandards.ts

@@ -0,0 +1,200 @@
+/**
+ * Security Standards for Dependency Analysis
+ * Maps dependency risks to OWASP, CWE, MITRE, and SANS standards
+ */
+
+import { SecurityStandard } from '../../types';
+import { DependencyRiskCategory } from '../types';
+
+/**
+ * OWASP A06:2021 - Vulnerable and Outdated Components
+ */
+const OWASP_A06: SecurityStandard = {
+  name: 'OWASP',
+  id: 'A06:2021',
+  title: 'Vulnerable and Outdated Components',
+  description: 'Components, such as libraries, frameworks, and other software modules, run with the same privileges as the application. If a vulnerable component is exploited, such an attack can facilitate serious data loss or server takeover.',
+  url: 'https://owasp.org/Top10/A06_2021-Vulnerable_and_Outdated_Components/'
+};
+
+/**
+ * CWE-937 - OWASP Top 10 2017 Category A9 - Using Components with Known Vulnerabilities
+ */
+const CWE_937: SecurityStandard = {
+  name: 'CWE',
+  id: 'CWE-937',
+  title: 'Using Components with Known Vulnerabilities',
+  description: 'The product uses a component that has a known vulnerability.',
+  url: 'https://cwe.mitre.org/data/definitions/937.html'
+};
+
+/**
+ * CWE-1035 - OWASP Top 10 2017 Category A9 - Using Components with Known Vulnerabilities
+ */
+const CWE_1035: SecurityStandard = {
+  name: 'CWE',
+  id: 'CWE-1035',
+  title: 'OWASP Top 10 2017 Category A9',
+  description: 'Weaknesses in this category are related to the A9 category Using Components with Known Vulnerabilities in the OWASP Top 10 2017.',
+  url: 'https://cwe.mitre.org/data/definitions/1035.html'
+};
+
+/**
+ * CWE-506 - Embedded Malicious Code
+ */
+const CWE_506: SecurityStandard = {
+  name: 'CWE',
+  id: 'CWE-506',
+  title: 'Embedded Malicious Code',
+  description: 'The product contains code that appears to be malicious in nature.',
+  url: 'https://cwe.mitre.org/data/definitions/506.html'
+};
+
+/**
+ * CWE-829 - Inclusion of Functionality from Untrusted Control Sphere
+ */
+const CWE_829: SecurityStandard = {
+  name: 'CWE',
+  id: 'CWE-829',
+  title: 'Inclusion of Functionality from Untrusted Control Sphere',
+  description: 'The product imports, requires, or includes executable functionality from a source that is outside of the intended control sphere.',
+  url: 'https://cwe.mitre.org/data/definitions/829.html'
+};
+
+/**
+ * CWE-1104 - Use of Unmaintained Third Party Components
+ */
+const CWE_1104: SecurityStandard = {
+  name: 'CWE',
+  id: 'CWE-1104',
+  title: 'Use of Unmaintained Third Party Components',
+  description: 'The product relies on third-party components that are not actively supported or maintained by the original developer or a trusted proxy.',
+  url: 'https://cwe.mitre.org/data/definitions/1104.html'
+};
+
+/**
+ * MITRE ATT&CK - Supply Chain Compromise
+ */
+const MITRE_SUPPLY_CHAIN: SecurityStandard = {
+  name: 'MITRE',
+  id: 'T1195',
+  title: 'Supply Chain Compromise',
+  description: 'Adversaries may manipulate products or product delivery mechanisms prior to receipt by a final consumer for the purpose of data or system compromise.',
+  url: 'https://attack.mitre.org/techniques/T1195/'
+};
+
+/**
+ * MITRE ATT&CK - Compromise Software Supply Chain
+ */
+const MITRE_T1195_002: SecurityStandard = {
+  name: 'MITRE',
+  id: 'T1195.002',
+  title: 'Compromise Software Supply Chain',
+  description: 'Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise.',
+  url: 'https://attack.mitre.org/techniques/T1195/002/'
+};
+
+/**
+ * SANS Top 25 - Related entries
+ */
+const SANS_UNTRUSTED_INPUT: SecurityStandard = {
+  name: 'SANS',
+  id: 'SANS-1',
+  title: 'Improper Neutralization of Special Elements',
+  description: 'Failure to properly validate and sanitize input from untrusted sources.',
+  url: 'https://www.sans.org/top25-software-errors/'
+};
+
+/**
+ * Get standards for a specific CWE
+ */
+function getCWEStandard(cweId: string): SecurityStandard | null {
+  const cweMap: Record<string, SecurityStandard> = {
+    'CWE-937': CWE_937,
+    'CWE-1035': CWE_1035,
+    'CWE-506': CWE_506,
+    'CWE-829': CWE_829,
+    'CWE-1104': CWE_1104
+  };
+
+  if (cweMap[cweId]) {
+    return cweMap[cweId];
+  }
+
+  // Create a generic CWE standard for unknown CWEs
+  const cweNumber = cweId.replace('CWE-', '');
+  return {
+    name: 'CWE',
+    id: cweId,
+    title: `CWE-${cweNumber}`,
+    description: `Common Weakness Enumeration ${cweNumber}`,
+    url: `https://cwe.mitre.org/data/definitions/${cweNumber}.html`
+  };
+}
+
+/**
+ * Get security standards for a dependency risk category
+ */
+export function getStandardsForDependencyRisk(
+  category: DependencyRiskCategory,
+  cwes?: string[]
+): SecurityStandard[] {
+  const standards: SecurityStandard[] = [];
+
+  // Always include OWASP A06 for dependency risks
+  standards.push(OWASP_A06);
+
+  switch (category) {
+    case DependencyRiskCategory.VULNERABILITY:
+      standards.push(CWE_937, CWE_1035);
+      // Add specific CWEs if provided
+      if (cwes) {
+        for (const cwe of cwes) {
+          const cweStandard = getCWEStandard(cwe);
+          if (cweStandard && !standards.some(s => s.id === cweStandard.id)) {
+            standards.push(cweStandard);
+          }
+        }
+      }
+      break;
+
+    case DependencyRiskCategory.MALICIOUS:
+      standards.push(CWE_506, CWE_829, MITRE_SUPPLY_CHAIN, MITRE_T1195_002);
+      break;
+
+    case DependencyRiskCategory.SUPPLY_CHAIN:
+      standards.push(CWE_829, MITRE_SUPPLY_CHAIN, MITRE_T1195_002);
+      break;
+
+    case DependencyRiskCategory.OUTDATED:
+      standards.push(CWE_1104);
+      break;
+
+    case DependencyRiskCategory.MAINTENANCE:
+      standards.push(CWE_1104);
+      break;
+
+    case DependencyRiskCategory.LICENSE:
+      // No specific security standards for license issues
+      break;
+  }
+
+  return standards;
+}
+
+/**
+ * Get all dependency-related security standards
+ */
+export function getAllDependencyStandards(): SecurityStandard[] {
+  return [
+    OWASP_A06,
+    CWE_937,
+    CWE_1035,
+    CWE_506,
+    CWE_829,
+    CWE_1104,
+    MITRE_SUPPLY_CHAIN,
+    MITRE_T1195_002,
+    SANS_UNTRUSTED_INPUT
+  ];
+}

package/src/dependencies/detectors/vulnerabilityDetector.ts

@@ -0,0 +1,343 @@
+/**
+ * Vulnerability Detector
+ * Detects vulnerabilities, supply chain risks, and malicious packages
+ */
+
+import { 
+  Dependency, 
+  DependencyVulnerability, 
+  DependencyRiskCategory,
+  DependencyRecommendation,
+  CVEInfo,
+  SupplyChainRisk,
+  MalwareIndicator,
+  TyposquattingCandidate
+} from '../types';
+import { Severity, SecurityStandard } from '../../types';
+import { generateId } from '../../utils';
+import { getCVEsForPackage } from '../database/cveDatabase';
+import { getMaliciousPackage, isDeprecatedPackage, getPopularPackages } from '../database/maliciousPackages';
+import { getStandardsForDependencyRisk } from './securityStandards';
+import { logger } from '../../utils/logger';
+
+/**
+ * Vulnerability Detector Class
+ * Detects various security issues in dependencies
+ */
+export class VulnerabilityDetector {
+  /**
+   * Analyze a dependency for vulnerabilities and risks
+   */
+  async analyzeDependency(dependency: Dependency): Promise<DependencyVulnerability[]> {
+    const vulnerabilities: DependencyVulnerability[] = [];
+
+    // Check for known malicious packages
+    const maliciousCheck = await this.checkMaliciousPackage(dependency);
+    if (maliciousCheck) {
+      vulnerabilities.push(maliciousCheck);
+    }
+
+    // Check for CVEs
+    const cveVulns = await this.checkCVEs(dependency);
+    vulnerabilities.push(...cveVulns);
+
+    // Check for typosquatting
+    const typosquatCheck = await this.checkTyposquatting(dependency);
+    if (typosquatCheck) {
+      vulnerabilities.push(typosquatCheck);
+    }
+
+    // Check for deprecated packages
+    const deprecatedCheck = await this.checkDeprecated(dependency);
+    if (deprecatedCheck) {
+      vulnerabilities.push(deprecatedCheck);
+    }
+
+    // Check for supply chain risks
+    const supplyChainRisks = await this.checkSupplyChainRisks(dependency);
+    vulnerabilities.push(...supplyChainRisks);
+
+    return vulnerabilities;
+  }
+
+  /**
+   * Check if package is known malicious
+   */
+  private async checkMaliciousPackage(dependency: Dependency): Promise<DependencyVulnerability | null> {
+    const malicious = getMaliciousPackage(dependency.name, dependency.ecosystem);
+    
+    if (!malicious) return null;
+
+    // Check if affected version
+    if (malicious.affectedVersions && malicious.affectedVersions !== '*') {
+      const version = dependency.resolvedVersion || dependency.version;
+      const affectedVersions = malicious.affectedVersions.split(',').map(v => v.trim());
+      
+      if (!affectedVersions.some(v => v === version || v === '*')) {
+        return null;
+      }
+    }
+
+    logger.debug(`[VulnDetector] Malicious package detected: ${dependency.name}`);
+
+    return {
+      id: generateId(),
+      dependency,
+      severity: Severity.CRITICAL,
+      category: DependencyRiskCategory.MALICIOUS,
+      title: `Known Malicious Package: ${dependency.name}`,
+      description: malicious.description,
+      malwareIndicators: malicious.indicators,
+      standards: getStandardsForDependencyRisk(DependencyRiskCategory.MALICIOUS),
+      recommendation: DependencyRecommendation.REMOVE,
+      recommendationDetails: `Immediately remove ${dependency.name} from your project. This package has been reported as malicious. ${malicious.references.length > 0 ? 'See references for more information.' : ''}`,
+      confidence: 100,
+      timestamp: new Date()
+    };
+  }
+
+  /**
+   * Check for known CVEs
+   */
+  private async checkCVEs(dependency: Dependency): Promise<DependencyVulnerability[]> {
+    const vulnerabilities: DependencyVulnerability[] = [];
+    const version = dependency.resolvedVersion || dependency.version;
+    
+    // Skip if no version specified
+    if (!version || version === '*') {
+      return vulnerabilities;
+    }
+
+    const cves = getCVEsForPackage(dependency.name, dependency.ecosystem, version);
+
+    for (const cve of cves) {
+      logger.debug(`[VulnDetector] CVE detected: ${cve.id} in ${dependency.name}@${version}`);
+
+      vulnerabilities.push({
+        id: generateId(),
+        dependency,
+        severity: cve.severity,
+        category: DependencyRiskCategory.VULNERABILITY,
+        title: `${cve.id}: ${dependency.name}`,
+        description: cve.description,
+        cve,
+        standards: getStandardsForDependencyRisk(DependencyRiskCategory.VULNERABILITY, cve.cwes),
+        recommendation: cve.fixedVersion 
+          ? DependencyRecommendation.UPGRADE 
+          : DependencyRecommendation.REVIEW,
+        recommendationDetails: cve.fixedVersion 
+          ? `Upgrade ${dependency.name} to version ${cve.fixedVersion} or later to fix ${cve.id}.`
+          : `Review the usage of ${dependency.name} and consider alternative packages. No fixed version available.`,
+        confidence: 95,
+        timestamp: new Date()
+      });
+    }
+
+    return vulnerabilities;
+  }
+
+  /**
+   * Check for typosquatting
+   */
+  private async checkTyposquatting(dependency: Dependency): Promise<DependencyVulnerability | null> {
+    const popularPackages = getPopularPackages(dependency.ecosystem);
+    const candidates = this.findTyposquatCandidates(dependency.name, popularPackages);
+
+    if (candidates.length === 0) return null;
+
+    const bestMatch = candidates[0];
+    
+    // Only flag if similarity is high enough (potential typosquat)
+    if (bestMatch.similarityScore < 80) return null;
+
+    logger.debug(`[VulnDetector] Potential typosquatting: ${dependency.name} similar to ${bestMatch.legitimatePackage}`);
+
+    return {
+      id: generateId(),
+      dependency,
+      severity: Severity.HIGH,
+      category: DependencyRiskCategory.SUPPLY_CHAIN,
+      title: `Potential Typosquatting: ${dependency.name}`,
+      description: `The package "${dependency.name}" is very similar to the popular package "${bestMatch.legitimatePackage}" (${bestMatch.similarityScore}% similarity). This could be a typosquatting attempt.`,
+      supplyChainRisks: [SupplyChainRisk.TYPOSQUATTING],
+      standards: getStandardsForDependencyRisk(DependencyRiskCategory.SUPPLY_CHAIN),
+      recommendation: DependencyRecommendation.REVIEW,
+      recommendationDetails: `Verify that "${dependency.name}" is the intended package and not a typosquat of "${bestMatch.legitimatePackage}". If this is a mistake, replace with the correct package.`,
+      confidence: bestMatch.similarityScore,
+      timestamp: new Date()
+    };
+  }
+
+  /**
+   * Find typosquatting candidates
+   */
+  private findTyposquatCandidates(name: string, popularPackages: string[]): TyposquattingCandidate[] {
+    const candidates: TyposquattingCandidate[] = [];
+    const normalizedName = name.toLowerCase();
+
+    for (const popular of popularPackages) {
+      const normalizedPopular = popular.toLowerCase();
+      
+      // Skip if same package
+      if (normalizedName === normalizedPopular) continue;
+
+      const similarity = this.calculateSimilarity(normalizedName, normalizedPopular);
+      
+      if (similarity >= 70) {
+        const typosquatType = this.detectTyposquatType(normalizedName, normalizedPopular);
+        
+        candidates.push({
+          suspiciousName: name,
+          legitimatePackage: popular,
+          similarityScore: similarity,
+          typosquatType
+        });
+      }
+    }
+
+    // Sort by similarity score descending
+    return candidates.sort((a, b) => b.similarityScore - a.similarityScore);
+  }
+
+  /**
+   * Calculate string similarity (Levenshtein distance based)
+   */
+  private calculateSimilarity(a: string, b: string): number {
+    const distance = this.levenshteinDistance(a, b);
+    const maxLength = Math.max(a.length, b.length);
+    return Math.round((1 - distance / maxLength) * 100);
+  }
+
+  /**
+   * Levenshtein distance algorithm
+   */
+  private levenshteinDistance(a: string, b: string): number {
+    const matrix: number[][] = [];
+
+    for (let i = 0; i <= b.length; i++) {
+      matrix[i] = [i];
+    }
+    for (let j = 0; j <= a.length; j++) {
+      matrix[0][j] = j;
+    }
+
+    for (let i = 1; i <= b.length; i++) {
+      for (let j = 1; j <= a.length; j++) {
+        if (b.charAt(i - 1) === a.charAt(j - 1)) {
+          matrix[i][j] = matrix[i - 1][j - 1];
+        } else {
+          matrix[i][j] = Math.min(
+            matrix[i - 1][j - 1] + 1,
+            matrix[i][j - 1] + 1,
+            matrix[i - 1][j] + 1
+          );
+        }
+      }
+    }
+
+    return matrix[b.length][a.length];
+  }
+
+  /**
+   * Detect type of typosquat
+   */
+  private detectTyposquatType(suspicious: string, legitimate: string): TyposquattingCandidate['typosquatType'] {
+    const lenDiff = Math.abs(suspicious.length - legitimate.length);
+    
+    if (lenDiff === 1) {
+      if (suspicious.length > legitimate.length) {
+        return 'extra_char';
+      } else {
+        return 'missing_char';
+      }
+    }
+    
+    if (lenDiff === 0) {
+      // Check for homograph (e.g., l vs 1, o vs 0)
+      const homographs = [['l', '1'], ['o', '0'], ['i', 'l'], ['rn', 'm']];
+      for (const [a, b] of homographs) {
+        if (suspicious.includes(a) && legitimate.includes(b)) {
+          return 'homograph';
+        }
+        if (suspicious.includes(b) && legitimate.includes(a)) {
+          return 'homograph';
+        }
+      }
+      return 'character_swap';
+    }
+    
+    return 'bit_flip';
+  }
+
+  /**
+   * Check for deprecated packages
+   */
+  private async checkDeprecated(dependency: Dependency): Promise<DependencyVulnerability | null> {
+    const { deprecated, info } = isDeprecatedPackage(dependency.name);
+    
+    if (!deprecated || !info) return null;
+
+    // Check ecosystem match
+    if (info.ecosystem !== dependency.ecosystem) return null;
+
+    logger.debug(`[VulnDetector] Deprecated package: ${dependency.name}`);
+
+    return {
+      id: generateId(),
+      dependency,
+      severity: Severity.LOW,
+      category: DependencyRiskCategory.OUTDATED,
+      title: `Deprecated Package: ${dependency.name}`,
+      description: `The package "${dependency.name}" is deprecated. ${info.reason}`,
+      standards: getStandardsForDependencyRisk(DependencyRiskCategory.OUTDATED),
+      recommendation: info.replacement 
+        ? DependencyRecommendation.REPLACE 
+        : DependencyRecommendation.REVIEW,
+      recommendationDetails: info.replacement 
+        ? `Replace ${dependency.name} with ${info.replacement}.`
+        : `Review usage of ${dependency.name} and consider alternatives.`,
+      confidence: 90,
+      timestamp: new Date()
+    };
+  }
+
+  /**
+   * Check for supply chain risks
+   */
+  private async checkSupplyChainRisks(dependency: Dependency): Promise<DependencyVulnerability[]> {
+    const vulnerabilities: DependencyVulnerability[] = [];
+    const risks: SupplyChainRisk[] = [];
+
+    // Check for suspicious version patterns
+    const version = dependency.resolvedVersion || dependency.version;
+    
+    // Flag 0.0.x versions as potentially new/untested
+    if (version && /^0\.0\.\d+/.test(version)) {
+      risks.push(SupplyChainRisk.NEW_PACKAGE);
+    }
+
+    // Flag packages with very recent versions (could be suspicious release)
+    // Note: This would need actual publish date data in production
+
+    if (risks.length > 0) {
+      vulnerabilities.push({
+        id: generateId(),
+        dependency,
+        severity: Severity.INFO,
+        category: DependencyRiskCategory.SUPPLY_CHAIN,
+        title: `Supply Chain Risk: ${dependency.name}`,
+        description: `The package "${dependency.name}" has potential supply chain risks: ${risks.join(', ')}`,
+        supplyChainRisks: risks,
+        standards: getStandardsForDependencyRisk(DependencyRiskCategory.SUPPLY_CHAIN),
+        recommendation: DependencyRecommendation.MONITOR,
+        recommendationDetails: `Monitor ${dependency.name} for any suspicious activity or updates. Consider pinning to a specific trusted version.`,
+        confidence: 60,
+        timestamp: new Date()
+      });
+    }
+
+    return vulnerabilities;
+  }
+}
+
+export default VulnerabilityDetector;

package/src/dependencies/index.ts

@@ -0,0 +1,27 @@
+/**
+ * Dependency Analysis Module Exports
+ * Software Composition Analysis (SCA) for Secure-Scan
+ */
+
+// Types
+export * from './types';
+
+// Parsers
+export * from './parsers';
+
+// Detectors
+export * from './detectors';
+
+// Database
+export * from './database';
+
+// Main analyzer
+export * from './dependencyAnalyzer';
+export { default as DependencyAnalyzer } from './dependencyAnalyzer';
+
+// AI Analyzer
+export * from './aiDependencyAnalyzer';
+export { default as AIDependencyAnalyzer } from './aiDependencyAnalyzer';
+
+// Installed Dependencies Scanner (Malware Detection)
+export * from './installed';

package/src/dependencies/installed/index.ts

@@ -0,0 +1,8 @@
+/**
+ * Installed Dependencies Module
+ * Exports for scanning installed packages for malware
+ */
+
+export * from './types';
+export * from './installedScanner';
+export * from './malwarePatterns';