securitywatch 0.0.1-security → 1.0.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +95 -0
- package/package.json +54 -6
package/README.md
ADDED
|
@@ -0,0 +1,95 @@
|
|
|
1
|
+
# SecurityWatch
|
|
2
|
+
|
|
3
|
+
[](https://www.npmjs.com/package/securitywatch)
|
|
4
|
+
[](https://www.npmjs.com/package/securitywatch)
|
|
5
|
+
[](https://github.com/sandeepsharmacode/securitywatch/blob/main/LICENSE)
|
|
6
|
+
|
|
7
|
+
Score-based runtime security middleware for Express. Detects SQL injection, XSS, brute force, rate limit abuse, and suspicious request patterns.
|
|
8
|
+
|
|
9
|
+
## Install
|
|
10
|
+
|
|
11
|
+
```bash
|
|
12
|
+
npm install securitywatch
|
|
13
|
+
```
|
|
14
|
+
|
|
15
|
+
```ts
|
|
16
|
+
import express from "express";
|
|
17
|
+
import { securityWatch } from "securitywatch";
|
|
18
|
+
|
|
19
|
+
const app = express();
|
|
20
|
+
app.use(securityWatch());
|
|
21
|
+
app.listen(3000);
|
|
22
|
+
```
|
|
23
|
+
|
|
24
|
+
## How it works
|
|
25
|
+
|
|
26
|
+
Each incoming request is scanned by multiple detection rules. Every rule returns a numeric score (not a binary yes/no). Scores are summed, multiplied by route sensitivity, and compared against thresholds:
|
|
27
|
+
|
|
28
|
+
- **0-4** — allow
|
|
29
|
+
- **5-9** — warn (request passes, threat info attached to `req.securityWatch`)
|
|
30
|
+
- **10-14** — throttle (429 response)
|
|
31
|
+
- **15+** — block (403 response)
|
|
32
|
+
|
|
33
|
+
This reduces false positives compared to binary blocking.
|
|
34
|
+
|
|
35
|
+
## Configuration
|
|
36
|
+
|
|
37
|
+
```ts
|
|
38
|
+
app.use(securityWatch({
|
|
39
|
+
sqlInjection: true,
|
|
40
|
+
xss: true,
|
|
41
|
+
bruteForce: {
|
|
42
|
+
maxAttempts: 5,
|
|
43
|
+
windowMs: 5 * 60_000,
|
|
44
|
+
blockDurationMs: 15 * 60_000,
|
|
45
|
+
authRoutes: ["/login", "/auth"],
|
|
46
|
+
},
|
|
47
|
+
rateLimit: {
|
|
48
|
+
windowMs: 60_000,
|
|
49
|
+
maxRequests: 100,
|
|
50
|
+
routes: { "/login": 5, "/api": 60 },
|
|
51
|
+
},
|
|
52
|
+
suspiciousBehavior: true,
|
|
53
|
+
payloadAnomaly: true,
|
|
54
|
+
ipReputation: true,
|
|
55
|
+
|
|
56
|
+
// low=0.5x, medium=1x (default), high=1.5x, critical=2x
|
|
57
|
+
routeSensitivity: {
|
|
58
|
+
"/admin": "critical",
|
|
59
|
+
"/login": "high",
|
|
60
|
+
"/search": "low",
|
|
61
|
+
},
|
|
62
|
+
|
|
63
|
+
thresholds: { warn: 5, throttle: 10, block: 15 },
|
|
64
|
+
whitelist: ["127.0.0.1"],
|
|
65
|
+
trustProxy: false, // set true only behind a trusted reverse proxy
|
|
66
|
+
|
|
67
|
+
alerts: {
|
|
68
|
+
console: true,
|
|
69
|
+
slackWebhookUrl: "https://hooks.slack.com/services/...",
|
|
70
|
+
},
|
|
71
|
+
|
|
72
|
+
onBlock: (req, info) => console.log(`Blocked: ${info.ip}`),
|
|
73
|
+
onWarn: (req, info) => console.log(`Warning: ${info.ip}`),
|
|
74
|
+
}));
|
|
75
|
+
```
|
|
76
|
+
|
|
77
|
+
## Detection rules
|
|
78
|
+
|
|
79
|
+
## Security notes
|
|
80
|
+
|
|
81
|
+
- All regex uses bounded quantifiers. Input truncated to 20K chars before scanning.
|
|
82
|
+
- `X-Forwarded-For` ignored by default. Set `trustProxy: true` only behind a trusted proxy.
|
|
83
|
+
- Slack webhook URLs validated against `hooks.slack.com` (HTTPS only).
|
|
84
|
+
- Internal errors are caught and logged. Requests proceed normally (fail-open).
|
|
85
|
+
- Headers scanned: Referer, User-Agent, Cookie, Origin.
|
|
86
|
+
- Memory bounded: IP tracking capped at 10K, route tracking at 100/IP, rate-limit keys normalized.
|
|
87
|
+
|
|
88
|
+
## Requirements
|
|
89
|
+
|
|
90
|
+
- Node.js >= 18
|
|
91
|
+
- Express >= 5
|
|
92
|
+
|
|
93
|
+
## License
|
|
94
|
+
|
|
95
|
+
MIT
|
package/package.json
CHANGED
|
@@ -1,11 +1,59 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "securitywatch",
|
|
3
|
-
"version": "
|
|
4
|
-
"
|
|
3
|
+
"version": "1.0.1",
|
|
4
|
+
"description": "Score-based runtime security middleware for Express. SQL injection, XSS, brute force, rate limiting, IP reputation.",
|
|
5
|
+
"main": "dist/index.js",
|
|
6
|
+
"types": "dist/index.d.ts",
|
|
7
|
+
"publishConfig": {
|
|
8
|
+
"access": "public"
|
|
9
|
+
},
|
|
10
|
+
"files": [
|
|
11
|
+
"dist"
|
|
12
|
+
],
|
|
5
13
|
"scripts": {
|
|
6
|
-
"
|
|
14
|
+
"build": "tsc",
|
|
15
|
+
"dev": "tsc --watch",
|
|
16
|
+
"start": "node dist/index.js",
|
|
17
|
+
"demo": "npx tsx examples/demo-server.ts",
|
|
18
|
+
"test": "vitest run",
|
|
19
|
+
"test:watch": "vitest",
|
|
20
|
+
"prepublishOnly": "npm run build"
|
|
21
|
+
},
|
|
22
|
+
"keywords": [
|
|
23
|
+
"security",
|
|
24
|
+
"middleware",
|
|
25
|
+
"express",
|
|
26
|
+
"sql-injection",
|
|
27
|
+
"xss",
|
|
28
|
+
"rate-limit",
|
|
29
|
+
"brute-force",
|
|
30
|
+
"waf",
|
|
31
|
+
"ip-reputation"
|
|
32
|
+
],
|
|
33
|
+
"author": "Sandeep Sharma",
|
|
34
|
+
"license": "MIT",
|
|
35
|
+
"repository": {
|
|
36
|
+
"type": "git",
|
|
37
|
+
"url": "git+https://github.com/sandeep9526/securitywatch.git"
|
|
38
|
+
},
|
|
39
|
+
"homepage": "https://github.com/sandeep9526/securitywatch#readme",
|
|
40
|
+
"bugs": {
|
|
41
|
+
"url": "https://github.com/sandeep9526/securitywatch/issues"
|
|
42
|
+
},
|
|
43
|
+
"engines": {
|
|
44
|
+
"node": ">=18.0.0"
|
|
45
|
+
},
|
|
46
|
+
"peerDependencies": {
|
|
47
|
+
"express": "^5.2.1"
|
|
48
|
+
},
|
|
49
|
+
"devDependencies": {
|
|
50
|
+
"@types/express": "^5.0.6",
|
|
51
|
+
"@types/node": "^25.5.0",
|
|
52
|
+
"typescript": "^6.0.2",
|
|
53
|
+
"vitest": "^4.1.2"
|
|
7
54
|
},
|
|
8
|
-
"
|
|
9
|
-
|
|
10
|
-
|
|
55
|
+
"dependencies": {
|
|
56
|
+
"@sandeepsharmadev/securitywatch": "file:sandeepsharmadev-securitywatch-1.0.0.tgz",
|
|
57
|
+
"securitywatch": "file:sandeepsharmadev-securitywatch-1.0.0.tgz"
|
|
58
|
+
}
|
|
11
59
|
}
|