securitywatch 1.0.3 → 1.0.4

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Sandeep Sharma
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/core/engine.d.ts

@@ -0,0 +1,23 @@
+import type { SecurityConfig, ThreatInfo, Store } from "../types.js";
+export declare class DetectionEngine {
+    private config;
+    private thresholds;
+    private scorer;
+    private detectBruteForce;
+    private detectRateLimit;
+    private detectSuspicious;
+    constructor(config: SecurityConfig, store: Store);
+    analyze(params: {
+        ip: string;
+        path: string;
+        method: string;
+        body?: string;
+        query?: string;
+        headers?: string;
+    }): ThreatInfo;
+    recordResponse(ip: string, path: string, statusCode: number): void;
+    private decide;
+    private getRouteSensitivity;
+    isWhitelisted(ip: string): boolean;
+    destroy(): void;
+}

package/dist/core/engine.js

@@ -0,0 +1,93 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DetectionEngine = void 0;
+const index_js_1 = require("./rules/index.js");
+const scorer_js_1 = require("./scorer.js");
+const DEFAULT_THRESHOLDS = { warn: 5, throttle: 10, block: 15 };
+const SENSITIVITY_MULTIPLIER = {
+    low: 0.5, medium: 1, high: 1.5, critical: 2,
+};
+class DetectionEngine {
+    config;
+    thresholds;
+    scorer;
+    detectBruteForce;
+    detectRateLimit;
+    detectSuspicious;
+    constructor(config, store) {
+        this.config = config;
+        this.thresholds = { ...DEFAULT_THRESHOLDS, ...config.thresholds };
+        this.scorer = config.ipReputation !== false ? new scorer_js_1.IPScorer(store) : null;
+        const bfConfig = typeof config.bruteForce === "object" ? config.bruteForce : undefined;
+        this.detectBruteForce = (0, index_js_1.createBruteForceDetector)(store, bfConfig);
+        const rlConfig = typeof config.rateLimit === "object" ? config.rateLimit : undefined;
+        this.detectRateLimit = (0, index_js_1.createRateLimiter)(store, rlConfig);
+        this.detectSuspicious = (0, index_js_1.createSuspiciousBehaviorDetector)(store);
+    }
+    analyze(params) {
+        const { ip, path, method, body, query, headers } = params;
+        const results = [];
+        const payloadInputs = [body, query].filter(Boolean);
+        const combinedPayload = payloadInputs.join(" ");
+        const fullInput = headers ? `${combinedPayload} ${headers}` : combinedPayload;
+        if (this.config.sqlInjection !== false)
+            results.push((0, index_js_1.detectSQLInjection)(fullInput));
+        if (this.config.xss !== false)
+            results.push((0, index_js_1.detectXSS)(fullInput));
+        if (this.config.bruteForce !== false)
+            results.push(this.detectBruteForce(ip, path));
+        if (this.config.rateLimit !== false)
+            results.push(this.detectRateLimit(ip, path));
+        if (this.config.suspiciousBehavior !== false)
+            results.push(this.detectSuspicious(ip, path, method));
+        if (this.config.payloadAnomaly !== false)
+            results.push((0, index_js_1.detectPayloadAnomaly)(combinedPayload));
+        let totalScore = results
+            .filter((r) => r.triggered)
+            .reduce((sum, r) => sum + r.score, 0);
+        const sensitivity = this.getRouteSensitivity(path);
+        totalScore = Math.round(totalScore * SENSITIVITY_MULTIPLIER[sensitivity]);
+        if (this.scorer) {
+            this.scorer.addScore(ip, totalScore > 0 ? totalScore : -0.5);
+            const ipScore = this.scorer.getScore(ip);
+            if (ipScore > 20 && totalScore > 0)
+                totalScore += 5;
+        }
+        return {
+            action: this.decide(totalScore),
+            totalScore,
+            ip, path, method,
+            results: results.filter((r) => r.triggered),
+            timestamp: new Date(),
+        };
+    }
+    recordResponse(ip, path, statusCode) {
+        if (this.config.bruteForce === false)
+            return;
+        this.detectBruteForce(ip, path, statusCode);
+    }
+    decide(score) {
+        if (score >= this.thresholds.block)
+            return "block";
+        if (score >= this.thresholds.throttle)
+            return "throttle";
+        if (score >= this.thresholds.warn)
+            return "warn";
+        return "allow";
+    }
+    getRouteSensitivity(path) {
+        const map = this.config.routeSensitivity ?? {};
+        for (const [route, sensitivity] of Object.entries(map)) {
+            if (path.startsWith(route))
+                return sensitivity;
+        }
+        return "medium";
+    }
+    isWhitelisted(ip) {
+        return this.config.whitelist?.includes(ip) ?? false;
+    }
+    destroy() {
+        this.scorer?.destroy();
+    }
+}
+exports.DetectionEngine = DetectionEngine;

package/dist/core/rules/brute-force.d.ts

@@ -0,0 +1,2 @@
+import type { DetectionResult, BruteForceConfig, Store } from "../../types.js";
+export declare function createBruteForceDetector(store: Store, config?: Partial<BruteForceConfig>): (ip: string, path: string, statusCode?: number) => DetectionResult;

package/dist/core/rules/brute-force.js

@@ -0,0 +1,75 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createBruteForceDetector = createBruteForceDetector;
+const DEFAULTS = {
+    maxAttempts: 5,
+    windowMs: 5 * 60 * 1000,
+    blockDurationMs: 15 * 60 * 1000,
+    authRoutes: ["/login", "/signin", "/auth", "/api/auth", "/api/login"],
+};
+function createBruteForceDetector(store, config) {
+    const opts = { ...DEFAULTS, ...config };
+    return function detectBruteForce(ip, path, statusCode) {
+        const isAuthRoute = opts.authRoutes.some((route) => path.toLowerCase().startsWith(route));
+        if (!isAuthRoute) {
+            return { triggered: false, score: 0, rule: "brute-force", reason: "" };
+        }
+        const blockKey = `bf:block:${ip}`;
+        const attemptKey = `bf:attempts:${ip}`;
+        if (store.get(blockKey)) {
+            return {
+                triggered: true,
+                score: 10,
+                rule: "brute-force",
+                reason: "IP is temporarily blocked due to repeated failed login attempts",
+            };
+        }
+        // Clear counter on successful auth
+        if (statusCode !== undefined && statusCode >= 200 && statusCode < 300) {
+            store.delete(attemptKey);
+            return { triggered: false, score: 0, rule: "brute-force", reason: "" };
+        }
+        if (statusCode !== undefined && statusCode >= 400 && statusCode < 500) {
+            const attempts = store.increment(attemptKey, opts.windowMs);
+            if (attempts >= opts.maxAttempts * 4) {
+                store.set(blockKey, true, 24 * 60 * 60 * 1000);
+                return {
+                    triggered: true,
+                    score: 10,
+                    rule: "brute-force",
+                    reason: `${attempts} failed login attempts — blocked for 24 hours`,
+                };
+            }
+            if (attempts >= opts.maxAttempts * 2) {
+                store.set(blockKey, true, opts.blockDurationMs);
+                return {
+                    triggered: true,
+                    score: 8,
+                    rule: "brute-force",
+                    reason: `${attempts} failed login attempts — temporarily blocked`,
+                };
+            }
+            if (attempts >= opts.maxAttempts) {
+                return {
+                    triggered: true,
+                    score: 7,
+                    rule: "brute-force",
+                    reason: `${attempts} failed login attempts in ${opts.windowMs / 60000} minutes`,
+                };
+            }
+        }
+        // Pre-request: check existing attempt count
+        if (statusCode === undefined) {
+            const currentAttempts = store.get(attemptKey) ?? 0;
+            if (currentAttempts >= opts.maxAttempts) {
+                return {
+                    triggered: true,
+                    score: 5,
+                    rule: "brute-force",
+                    reason: `${currentAttempts} prior failed login attempts from this IP`,
+                };
+            }
+        }
+        return { triggered: false, score: 0, rule: "brute-force", reason: "" };
+    };
+}

package/dist/core/rules/index.d.ts

@@ -0,0 +1,6 @@
+export { detectSQLInjection } from "./sql-injection.js";
+export { detectXSS } from "./xss.js";
+export { createBruteForceDetector } from "./brute-force.js";
+export { createRateLimiter } from "./rate-limit.js";
+export { createSuspiciousBehaviorDetector } from "./suspicious-behavior.js";
+export { detectPayloadAnomaly } from "./payload-anomaly.js";

package/dist/core/rules/index.js

@@ -0,0 +1,15 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectPayloadAnomaly = exports.createSuspiciousBehaviorDetector = exports.createRateLimiter = exports.createBruteForceDetector = exports.detectXSS = exports.detectSQLInjection = void 0;
+var sql_injection_js_1 = require("./sql-injection.js");
+Object.defineProperty(exports, "detectSQLInjection", { enumerable: true, get: function () { return sql_injection_js_1.detectSQLInjection; } });
+var xss_js_1 = require("./xss.js");
+Object.defineProperty(exports, "detectXSS", { enumerable: true, get: function () { return xss_js_1.detectXSS; } });
+var brute_force_js_1 = require("./brute-force.js");
+Object.defineProperty(exports, "createBruteForceDetector", { enumerable: true, get: function () { return brute_force_js_1.createBruteForceDetector; } });
+var rate_limit_js_1 = require("./rate-limit.js");
+Object.defineProperty(exports, "createRateLimiter", { enumerable: true, get: function () { return rate_limit_js_1.createRateLimiter; } });
+var suspicious_behavior_js_1 = require("./suspicious-behavior.js");
+Object.defineProperty(exports, "createSuspiciousBehaviorDetector", { enumerable: true, get: function () { return suspicious_behavior_js_1.createSuspiciousBehaviorDetector; } });
+var payload_anomaly_js_1 = require("./payload-anomaly.js");
+Object.defineProperty(exports, "detectPayloadAnomaly", { enumerable: true, get: function () { return payload_anomaly_js_1.detectPayloadAnomaly; } });

package/dist/core/rules/payload-anomaly.d.ts

@@ -0,0 +1,2 @@
+import type { DetectionResult } from "../../types.js";
+export declare function detectPayloadAnomaly(input: string): DetectionResult;

package/dist/core/rules/payload-anomaly.js

@@ -0,0 +1,55 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectPayloadAnomaly = detectPayloadAnomaly;
+const MAX_PAYLOAD_LENGTH = 10_000;
+const SPECIAL_CHAR_THRESHOLD = 0.3;
+const MAX_NESTING_DEPTH = 50;
+function specialCharRatio(input) {
+    if (input.length === 0)
+        return 0;
+    const specialChars = input.replace(/[a-zA-Z0-9\s.,;:!?@#$%&*()\-_=+\[\]{}'"\/\\]/g, "");
+    return specialChars.length / input.length;
+}
+function calculateNestingDepth(input) {
+    let maxDepth = 0;
+    let currentDepth = 0;
+    for (const char of input) {
+        if (char === "{" || char === "[") {
+            currentDepth++;
+            if (currentDepth > maxDepth)
+                maxDepth = currentDepth;
+        }
+        else if (char === "}" || char === "]") {
+            currentDepth = Math.max(0, currentDepth - 1);
+        }
+    }
+    return maxDepth;
+}
+function detectPayloadAnomaly(input) {
+    let score = 0;
+    const matched = [];
+    if (input.length > MAX_PAYLOAD_LENGTH) {
+        score += 3;
+        matched.push(`oversized payload (${input.length} chars)`);
+    }
+    const ratio = specialCharRatio(input);
+    if (ratio > SPECIAL_CHAR_THRESHOLD) {
+        score += 4;
+        matched.push(`high special-char density (${(ratio * 100).toFixed(0)}%)`);
+    }
+    if (input.includes("\0") || input.includes("%00")) {
+        score += 5;
+        matched.push("null byte injection");
+    }
+    const depth = calculateNestingDepth(input);
+    if (depth > MAX_NESTING_DEPTH) {
+        score += 3;
+        matched.push(`deeply nested structure (depth ${depth})`);
+    }
+    return {
+        triggered: score > 0,
+        score,
+        rule: "payload-anomaly",
+        reason: matched.length ? `Payload anomaly: ${matched.join(", ")}` : "",
+    };
+}

package/dist/core/rules/rate-limit.d.ts

@@ -0,0 +1,2 @@
+import type { DetectionResult, RateLimitConfig, Store } from "../../types.js";
+export declare function createRateLimiter(store: Store, config?: Partial<RateLimitConfig>): (ip: string, path: string) => DetectionResult;

package/dist/core/rules/rate-limit.js

@@ -0,0 +1,48 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createRateLimiter = createRateLimiter;
+const DEFAULTS = {
+    windowMs: 60 * 1000,
+    maxRequests: 100,
+    routes: {},
+};
+function normalizePath(path) {
+    return path
+        .split("?")[0]
+        .replace(/\/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/gi, "/:id")
+        .replace(/\/\d+/g, "/:n");
+}
+function createRateLimiter(store, config) {
+    const opts = { ...DEFAULTS, ...config };
+    return function detectRateLimit(ip, path) {
+        const normalized = normalizePath(path);
+        let maxRequests = opts.maxRequests;
+        for (const [route, limit] of Object.entries(opts.routes ?? {})) {
+            if (normalized.startsWith(route)) {
+                maxRequests = limit;
+                break;
+            }
+        }
+        const key = `rl:${ip}:${normalized}`;
+        const globalKey = `rl:global:${ip}`;
+        const routeCount = store.increment(key, opts.windowMs);
+        const globalCount = store.increment(globalKey, opts.windowMs);
+        if (globalCount > opts.maxRequests * 3) {
+            return {
+                triggered: true,
+                score: 6,
+                rule: "rate-limit",
+                reason: `Traffic spike: ${globalCount} requests in ${opts.windowMs / 1000}s (${opts.maxRequests * 3} threshold)`,
+            };
+        }
+        if (routeCount > maxRequests) {
+            return {
+                triggered: true,
+                score: 4,
+                rule: "rate-limit",
+                reason: `Rate limit exceeded: ${routeCount}/${maxRequests} on ${normalized}`,
+            };
+        }
+        return { triggered: false, score: 0, rule: "rate-limit", reason: "" };
+    };
+}

package/dist/core/rules/sql-injection.d.ts

@@ -0,0 +1,2 @@
+import type { DetectionResult } from "../../types.js";
+export declare function detectSQLInjection(input: string): DetectionResult;

package/dist/core/rules/sql-injection.js

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectSQLInjection = detectSQLInjection;
+const MAX_INPUT_LENGTH = 20_000;
+const TAUTOLOGY = /('|")\s{0,5}OR\s{1,5}(1\s*=\s*1|\w{1,20}\s*=\s*\w{1,20})/i;
+const UNION_SELECT = /UNION\s{1,10}(ALL\s{1,10})?SELECT\b/i;
+const STACKED_QUERY = /;\s{0,5}(DROP|DELETE|INSERT|UPDATE|ALTER|CREATE|TRUNCATE|EXEC)\b/i;
+const COMMENT_WITH_SQL = /(--|\/\*).{0,200}?(SELECT|DROP|INSERT|DELETE|UPDATE|UNION)\b/i;
+const ENCODED_INJECTION = /(CHAR|CHR|0x)\s{0,3}\(/i;
+const TIME_BASED = /(SLEEP|BENCHMARK|WAITFOR\s{1,5}DELAY|PG_SLEEP)\s{0,3}\(/i;
+const NOSQL_OPERATOR = /\$\s{0,3}(gt|gte|lt|lte|ne|in|nin|regex|where|exists|or|and)\b/i;
+const COMMAND_EXECUTION = /\b(xp_cmdshell|cmd\.exe|EXEC(UTE)?)\b/i;
+const SCHEMA_MANIPULATION = /\b(DROP\s{1,5}(TABLE|DATABASE|INDEX|VIEW)|ALTER\s{1,5}TABLE|GRANT\s{1,5}ALL|FLUSH\s{1,5}PRIVILEGES)\b/i;
+const MASS_EXPORT = /\b(INTO\s{1,5}(OUT|DUMP)FILE|mysqldump|pg_dump)\b/i;
+const rules = [
+    { pattern: TAUTOLOGY, score: 5, label: "tautology attack" },
+    { pattern: UNION_SELECT, score: 5, label: "UNION SELECT" },
+    { pattern: STACKED_QUERY, score: 6, label: "stacked query" },
+    { pattern: COMMENT_WITH_SQL, score: 4, label: "comment bypass with SQL keyword" },
+    { pattern: ENCODED_INJECTION, score: 4, label: "encoded injection" },
+    { pattern: TIME_BASED, score: 5, label: "time-based blind injection" },
+    { pattern: NOSQL_OPERATOR, score: 4, label: "NoSQL operator injection" },
+    { pattern: COMMAND_EXECUTION, score: 6, label: "OS command execution via SQL" },
+    { pattern: SCHEMA_MANIPULATION, score: 6, label: "schema manipulation" },
+    { pattern: MASS_EXPORT, score: 5, label: "mass data export" },
+];
+function detectSQLInjection(input) {
+    const safe = input.length > MAX_INPUT_LENGTH ? input.slice(0, MAX_INPUT_LENGTH) : input;
+    let score = 0;
+    const matched = [];
+    for (const rule of rules) {
+        if (rule.pattern.test(safe)) {
+            score += rule.score;
+            matched.push(rule.label);
+        }
+    }
+    return {
+        triggered: score > 0,
+        score,
+        rule: "sql-injection",
+        reason: matched.length ? `SQL injection: ${matched.join(", ")}` : "",
+    };
+}

package/dist/core/rules/suspicious-behavior.d.ts

@@ -0,0 +1,2 @@
+import type { DetectionResult, Store } from "../../types.js";
+export declare function createSuspiciousBehaviorDetector(store: Store): (ip: string, path: string, method: string) => DetectionResult;

package/dist/core/rules/suspicious-behavior.js

@@ -0,0 +1,58 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createSuspiciousBehaviorDetector = createSuspiciousBehaviorDetector;
+const SENSITIVE_PATHS = [
+    "/admin", "/.env", "/config", "/wp-admin", "/wp-login",
+    "/phpmyadmin", "/.git", "/.htaccess", "/server-status",
+    "/debug", "/actuator", "/graphql", "/api/v1/admin",
+];
+const SUSPICIOUS_EXTENSIONS = /\.(sql|bak|backup|old|orig|conf|log|ini|env)$/i;
+const MAX_TRACKED_ROUTES = 100;
+const ENDPOINT_SCAN_THRESHOLD = 20;
+function createSuspiciousBehaviorDetector(store) {
+    return function detectSuspiciousBehavior(ip, path, method) {
+        let score = 0;
+        const matched = [];
+        const normalizedPath = path.toLowerCase();
+        for (const sensitive of SENSITIVE_PATHS) {
+            if (normalizedPath.startsWith(sensitive)) {
+                score += 5;
+                matched.push(`probing ${sensitive}`);
+                break;
+            }
+        }
+        if (SUSPICIOUS_EXTENSIONS.test(path)) {
+            score += 4;
+            matched.push("suspicious file extension");
+        }
+        if (path.includes("..") || path.includes("%2e%2e") ||
+            path.includes("%2e.") || path.includes(".%2e") ||
+            path.includes("%252e%252e") || path.includes("..%5c") ||
+            path.includes("..%c0%af") || path.includes("..;/")) {
+            score += 6;
+            matched.push("directory traversal attempt");
+        }
+        const routeSetKey = `sb:routes:${ip}`;
+        const routes = store.get(routeSetKey) ?? [];
+        if (!routes.includes(path) && routes.length < MAX_TRACKED_ROUTES) {
+            routes.push(path);
+            store.set(routeSetKey, routes, 60_000);
+        }
+        if (routes.length > ENDPOINT_SCAN_THRESHOLD) {
+            score += 5;
+            matched.push(`endpoint scanning (${routes.length} unique routes in 1 min)`);
+        }
+        const unusualMethod = (method === "DELETE" || method === "PUT" || method === "PATCH") &&
+            (normalizedPath === "/" || normalizedPath.startsWith("/login") || normalizedPath.startsWith("/signup"));
+        if (unusualMethod) {
+            score += 3;
+            matched.push(`unusual ${method} on ${path}`);
+        }
+        return {
+            triggered: score > 0,
+            score,
+            rule: "suspicious-behavior",
+            reason: matched.length ? `Suspicious: ${matched.join(", ")}` : "",
+        };
+    };
+}

package/dist/core/rules/xss.d.ts

@@ -0,0 +1,2 @@
+import type { DetectionResult } from "../../types.js";
+export declare function detectXSS(input: string): DetectionResult;

package/dist/core/rules/xss.js

@@ -0,0 +1,37 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectXSS = detectXSS;
+const MAX_INPUT_LENGTH = 20_000;
+const SCRIPT_TAG = /<script[\s>]/i;
+const EVENT_HANDLER = /\bon(error|load|click|mouseover|mouseenter|focus|focusin|blur|submit|change|input|keydown|keyup|pointerover|animationend|transitionend|beforeunload)\s{0,3}=/i;
+const JS_PROTOCOL = /javascript\s{0,3}:/i;
+const DANGEROUS_TAGS = /<(iframe|object|embed|form|base|meta|link|svg|math)[\s>]/i;
+const DATA_URI = /data\s{0,3}:\s{0,3}(text\/html|application\/xhtml)/i;
+const EVAL_PATTERN = /\b(eval|Function|setTimeout|setInterval)\s{0,3}\(/i;
+const TEMPLATE_INJECTION = /\$\{.{0,100}?\}/;
+const rules = [
+    { pattern: SCRIPT_TAG, score: 6, label: "script tag" },
+    { pattern: EVENT_HANDLER, score: 4, label: "event handler injection" },
+    { pattern: JS_PROTOCOL, score: 5, label: "javascript: protocol" },
+    { pattern: DANGEROUS_TAGS, score: 4, label: "dangerous HTML tag" },
+    { pattern: DATA_URI, score: 4, label: "data URI with HTML" },
+    { pattern: EVAL_PATTERN, score: 3, label: "eval/Function pattern" },
+    { pattern: TEMPLATE_INJECTION, score: 3, label: "template literal injection" },
+];
+function detectXSS(input) {
+    const safe = input.length > MAX_INPUT_LENGTH ? input.slice(0, MAX_INPUT_LENGTH) : input;
+    let score = 0;
+    const matched = [];
+    for (const rule of rules) {
+        if (rule.pattern.test(safe)) {
+            score += rule.score;
+            matched.push(rule.label);
+        }
+    }
+    return {
+        triggered: score > 0,
+        score,
+        rule: "xss",
+        reason: matched.length ? `XSS: ${matched.join(", ")}` : "",
+    };
+}

package/dist/core/scorer.d.ts

@@ -0,0 +1,11 @@
+import type { Store } from "../types.js";
+export declare class IPScorer {
+    private store;
+    private trackedIPs;
+    private decayTimer;
+    constructor(store: Store);
+    addScore(ip: string, points: number): number;
+    getScore(ip: string): number;
+    private decayAll;
+    destroy(): void;
+}

package/dist/core/scorer.js

@@ -0,0 +1,50 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IPScorer = void 0;
+const DECAY_INTERVAL_MS = 60_000;
+const SCORE_TTL_MS = 24 * 60 * 60 * 1000;
+const MAX_TRACKED_IPS = 10_000;
+class IPScorer {
+    store;
+    trackedIPs = new Set();
+    decayTimer;
+    constructor(store) {
+        this.store = store;
+        this.decayTimer = setInterval(() => this.decayAll(), DECAY_INTERVAL_MS);
+        if (this.decayTimer.unref)
+            this.decayTimer.unref();
+    }
+    addScore(ip, points) {
+        const key = `ip:score:${ip}`;
+        const current = this.store.get(key) ?? 0;
+        const newScore = Math.max(0, current + points);
+        this.store.set(key, newScore, SCORE_TTL_MS);
+        if (newScore > 0 && this.trackedIPs.size < MAX_TRACKED_IPS) {
+            this.trackedIPs.add(ip);
+        }
+        else if (newScore === 0) {
+            this.trackedIPs.delete(ip);
+        }
+        return newScore;
+    }
+    getScore(ip) {
+        return this.store.get(`ip:score:${ip}`) ?? 0;
+    }
+    decayAll() {
+        for (const ip of this.trackedIPs) {
+            const key = `ip:score:${ip}`;
+            const score = this.store.get(key) ?? 0;
+            if (score > 0) {
+                this.store.set(key, score - 1, SCORE_TTL_MS);
+            }
+            else {
+                this.trackedIPs.delete(ip);
+            }
+        }
+    }
+    destroy() {
+        clearInterval(this.decayTimer);
+        this.trackedIPs.clear();
+    }
+}
+exports.IPScorer = IPScorer;

package/dist/index.d.ts

@@ -0,0 +1,11 @@
+export { securityWatch } from "./middleware/express.js";
+export type { SecurityConfig, ThreatInfo, DetectionResult, SecurityAction, Sensitivity, Thresholds, RateLimitConfig, BruteForceConfig, AlertConfig, Store, SecurityWatchMiddleware, } from "./types.js";
+export { DetectionEngine } from "./core/engine.js";
+export { IPScorer } from "./core/scorer.js";
+export { MemoryStore } from "./store/memory.js";
+export { detectSQLInjection } from "./core/rules/sql-injection.js";
+export { detectXSS } from "./core/rules/xss.js";
+export { detectPayloadAnomaly } from "./core/rules/payload-anomaly.js";
+export { createBruteForceDetector } from "./core/rules/brute-force.js";
+export { createRateLimiter } from "./core/rules/rate-limit.js";
+export { createSuspiciousBehaviorDetector } from "./core/rules/suspicious-behavior.js";

package/dist/index.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createSuspiciousBehaviorDetector = exports.createRateLimiter = exports.createBruteForceDetector = exports.detectPayloadAnomaly = exports.detectXSS = exports.detectSQLInjection = exports.MemoryStore = exports.IPScorer = exports.DetectionEngine = exports.securityWatch = void 0;
+var express_js_1 = require("./middleware/express.js");
+Object.defineProperty(exports, "securityWatch", { enumerable: true, get: function () { return express_js_1.securityWatch; } });
+// Core (for advanced usage)
+var engine_js_1 = require("./core/engine.js");
+Object.defineProperty(exports, "DetectionEngine", { enumerable: true, get: function () { return engine_js_1.DetectionEngine; } });
+var scorer_js_1 = require("./core/scorer.js");
+Object.defineProperty(exports, "IPScorer", { enumerable: true, get: function () { return scorer_js_1.IPScorer; } });
+var memory_js_1 = require("./store/memory.js");
+Object.defineProperty(exports, "MemoryStore", { enumerable: true, get: function () { return memory_js_1.MemoryStore; } });
+// Individual rules (for custom pipelines)
+var sql_injection_js_1 = require("./core/rules/sql-injection.js");
+Object.defineProperty(exports, "detectSQLInjection", { enumerable: true, get: function () { return sql_injection_js_1.detectSQLInjection; } });
+var xss_js_1 = require("./core/rules/xss.js");
+Object.defineProperty(exports, "detectXSS", { enumerable: true, get: function () { return xss_js_1.detectXSS; } });
+var payload_anomaly_js_1 = require("./core/rules/payload-anomaly.js");
+Object.defineProperty(exports, "detectPayloadAnomaly", { enumerable: true, get: function () { return payload_anomaly_js_1.detectPayloadAnomaly; } });
+var brute_force_js_1 = require("./core/rules/brute-force.js");
+Object.defineProperty(exports, "createBruteForceDetector", { enumerable: true, get: function () { return brute_force_js_1.createBruteForceDetector; } });
+var rate_limit_js_1 = require("./core/rules/rate-limit.js");
+Object.defineProperty(exports, "createRateLimiter", { enumerable: true, get: function () { return rate_limit_js_1.createRateLimiter; } });
+var suspicious_behavior_js_1 = require("./core/rules/suspicious-behavior.js");
+Object.defineProperty(exports, "createSuspiciousBehaviorDetector", { enumerable: true, get: function () { return suspicious_behavior_js_1.createSuspiciousBehaviorDetector; } });

package/dist/middleware/express.d.ts

@@ -0,0 +1,2 @@
+import type { SecurityConfig, SecurityWatchMiddleware } from "../types.js";
+export declare function securityWatch(config?: SecurityConfig): SecurityWatchMiddleware;

package/dist/middleware/express.js

@@ -0,0 +1,126 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.securityWatch = securityWatch;
+const engine_js_1 = require("../core/engine.js");
+const memory_js_1 = require("../store/memory.js");
+const alert_js_1 = require("../services/alert.js");
+const logger_js_1 = require("../services/logger.js");
+function getClientIP(req, trustProxy) {
+    if (trustProxy) {
+        const forwarded = req.headers["x-forwarded-for"];
+        if (typeof forwarded === "string")
+            return forwarded.split(",")[0].trim();
+    }
+    return req.socket.remoteAddress || "unknown";
+}
+function extractInput(req) {
+    const parts = [];
+    if (req.query) {
+        for (const value of Object.values(req.query)) {
+            if (typeof value === "string")
+                parts.push(value);
+        }
+    }
+    if (req.body) {
+        if (typeof req.body === "string") {
+            parts.push(req.body);
+        }
+        else if (typeof req.body === "object") {
+            try {
+                parts.push(JSON.stringify(req.body));
+            }
+            catch {
+                for (const val of Object.values(req.body)) {
+                    if (typeof val === "string")
+                        parts.push(val);
+                }
+            }
+        }
+    }
+    if (req.params) {
+        for (const value of Object.values(req.params)) {
+            if (typeof value === "string")
+                parts.push(value);
+        }
+    }
+    return parts.join(" ");
+}
+function extractHeaders(req) {
+    const scannable = ["referer", "user-agent", "cookie", "origin"];
+    const parts = [];
+    for (const header of scannable) {
+        const val = req.headers[header];
+        if (typeof val === "string")
+            parts.push(val);
+    }
+    return parts.join(" ");
+}
+function securityWatch(config = {}) {
+    const store = new memory_js_1.MemoryStore();
+    const engine = new engine_js_1.DetectionEngine(config, store);
+    const alertConfig = config.alerts ?? { console: true };
+    const alerts = new alert_js_1.AlertService(alertConfig);
+    const logEnabled = alertConfig.console !== false;
+    const trustProxy = config.trustProxy ?? false;
+    const middleware = (req, res, next) => {
+        try {
+            const ip = getClientIP(req, trustProxy);
+            if (engine.isWhitelisted(ip)) {
+                next();
+                return;
+            }
+            const input = extractInput(req);
+            const headerInput = extractHeaders(req);
+            const threat = engine.analyze({
+                ip,
+                path: req.path,
+                method: req.method,
+                body: input,
+                query: req.url.includes("?") ? req.url.split("?")[1] : undefined,
+                headers: headerInput,
+            });
+            res.on("finish", () => {
+                try {
+                    engine.recordResponse(ip, req.path, res.statusCode);
+                }
+                catch { }
+            });
+            if (threat.action !== "allow") {
+                if (logEnabled)
+                    (0, logger_js_1.logThreat)(threat);
+                alerts.send(threat);
+            }
+            switch (threat.action) {
+                case "block":
+                    if (config.onBlock)
+                        config.onBlock(req, threat);
+                    res.status(403).json({ error: "Forbidden", message: "Request blocked by SecurityWatch" });
+                    return;
+                case "throttle":
+                    if (config.onWarn)
+                        config.onWarn(req, threat);
+                    res.setHeader("Retry-After", "60");
+                    res.status(429).json({ error: "Too Many Requests", message: "You are being rate limited" });
+                    return;
+                case "warn":
+                    if (config.onWarn)
+                        config.onWarn(req, threat);
+                    req.securityWatch = threat;
+                    next();
+                    return;
+                default:
+                    next();
+            }
+        }
+        catch (err) {
+            if (logEnabled)
+                console.error("[SecurityWatch] Internal error:", err);
+            next();
+        }
+    };
+    middleware.destroy = () => {
+        engine.destroy();
+        store.destroy();
+    };
+    return middleware;
+}

package/dist/services/alert.d.ts

@@ -0,0 +1,7 @@
+import type { ThreatInfo, AlertConfig } from "../types.js";
+export declare class AlertService {
+    private webhookUrl;
+    constructor(config?: AlertConfig);
+    send(info: ThreatInfo): void;
+    private sendSlack;
+}

package/dist/services/alert.js

@@ -0,0 +1,71 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AlertService = void 0;
+const https_1 = __importDefault(require("https"));
+const ALLOWED_SLACK_HOSTS = ["hooks.slack.com", "hooks.slack-gov.com"];
+function isAllowedWebhookUrl(urlString) {
+    try {
+        const url = new URL(urlString);
+        if (url.protocol !== "https:")
+            return false;
+        return ALLOWED_SLACK_HOSTS.some((host) => url.hostname === host || url.hostname.endsWith(`.${host}`));
+    }
+    catch {
+        return false;
+    }
+}
+class AlertService {
+    webhookUrl;
+    constructor(config = { console: true }) {
+        if (config.slackWebhookUrl) {
+            if (isAllowedWebhookUrl(config.slackWebhookUrl)) {
+                this.webhookUrl = config.slackWebhookUrl;
+            }
+            else {
+                console.warn("[SecurityWatch] Invalid Slack webhook URL — must be HTTPS on hooks.slack.com. Slack alerts disabled.");
+            }
+        }
+    }
+    send(info) {
+        if (this.webhookUrl && (info.action === "block" || info.action === "throttle")) {
+            this.sendSlack(info);
+        }
+    }
+    sendSlack(info) {
+        const reasons = info.results.map((r) => `• ${r.reason}`).join("\n");
+        const emoji = info.action === "block" ? ":rotating_light:" : ":warning:";
+        const payload = JSON.stringify({
+            text: `${emoji} *SecurityWatch ${info.action.toUpperCase()}*\n` +
+                `*IP:* ${info.ip}\n` +
+                `*Request:* ${info.method} ${info.path}\n` +
+                `*Score:* ${info.totalScore}\n` +
+                `*Reasons:*\n${reasons}\n` +
+                `*Time:* ${info.timestamp.toISOString()}`,
+        });
+        const url = new URL(this.webhookUrl);
+        const req = https_1.default.request({
+            hostname: url.hostname,
+            path: url.pathname,
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+                "Content-Length": Buffer.byteLength(payload),
+            },
+        }, (res) => {
+            if (res.statusCode && res.statusCode >= 400) {
+                console.warn(`[SecurityWatch] Slack alert failed with status ${res.statusCode}`);
+            }
+            // Drain the response
+            res.resume();
+        });
+        req.on("error", (err) => {
+            console.warn(`[SecurityWatch] Slack alert failed: ${err.message}`);
+        });
+        req.write(payload);
+        req.end();
+    }
+}
+exports.AlertService = AlertService;

package/dist/services/logger.d.ts

@@ -0,0 +1,2 @@
+import type { ThreatInfo } from "../types.js";
+export declare function logThreat(info: ThreatInfo): void;

package/dist/services/logger.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.logThreat = logThreat;
+const COLORS = {
+    reset: "\x1b[0m",
+    red: "\x1b[31m",
+    yellow: "\x1b[33m",
+    cyan: "\x1b[36m",
+};
+const ACTION_STYLES = {
+    block: { color: COLORS.red, label: "BLOCK" },
+    throttle: { color: COLORS.yellow, label: "THROTTLE" },
+    warn: { color: COLORS.cyan, label: "WARN" },
+};
+function logThreat(info) {
+    const style = ACTION_STYLES[info.action];
+    if (!style)
+        return;
+    const reasons = info.results.map((r) => r.reason).join(" | ");
+    console.log(`${style.color}[SecurityWatch ${style.label}]${COLORS.reset} ${info.timestamp.toISOString()} ${info.method} ${info.path} from ${info.ip} (score: ${info.totalScore}) — ${reasons}`);
+}

package/dist/store/memory.d.ts

@@ -0,0 +1,12 @@
+import type { Store } from "../types.js";
+export declare class MemoryStore implements Store {
+    private data;
+    private cleanupInterval;
+    constructor(cleanupIntervalMs?: number);
+    get<T = unknown>(key: string): T | undefined;
+    set<T = unknown>(key: string, value: T, ttlMs: number): void;
+    increment(key: string, ttlMs: number): number;
+    delete(key: string): void;
+    private cleanup;
+    destroy(): void;
+}

package/dist/store/memory.js

@@ -0,0 +1,48 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MemoryStore = void 0;
+class MemoryStore {
+    data = new Map();
+    cleanupInterval;
+    constructor(cleanupIntervalMs = 60_000) {
+        this.cleanupInterval = setInterval(() => this.cleanup(), cleanupIntervalMs);
+        if (this.cleanupInterval.unref) {
+            this.cleanupInterval.unref();
+        }
+    }
+    get(key) {
+        const entry = this.data.get(key);
+        if (!entry)
+            return undefined;
+        if (Date.now() > entry.expiresAt) {
+            this.data.delete(key);
+            return undefined;
+        }
+        return entry.value;
+    }
+    set(key, value, ttlMs) {
+        this.data.set(key, { value, expiresAt: Date.now() + ttlMs });
+    }
+    increment(key, ttlMs) {
+        const current = this.get(key) ?? 0;
+        const next = current + 1;
+        this.set(key, next, ttlMs);
+        return next;
+    }
+    delete(key) {
+        this.data.delete(key);
+    }
+    cleanup() {
+        const now = Date.now();
+        for (const [key, entry] of this.data) {
+            if (now > entry.expiresAt) {
+                this.data.delete(key);
+            }
+        }
+    }
+    destroy() {
+        clearInterval(this.cleanupInterval);
+        this.data.clear();
+    }
+}
+exports.MemoryStore = MemoryStore;

package/dist/types.d.ts

@@ -0,0 +1,75 @@
+import type { Request, Response, NextFunction } from "express";
+export interface DetectionResult {
+    triggered: boolean;
+    score: number;
+    rule: string;
+    reason: string;
+}
+export type Sensitivity = "low" | "medium" | "high" | "critical";
+export type SecurityAction = "allow" | "warn" | "throttle" | "block";
+export interface Thresholds {
+    warn: number;
+    throttle: number;
+    block: number;
+}
+export interface RateLimitConfig {
+    windowMs: number;
+    maxRequests: number;
+    routes?: Record<string, number>;
+}
+export interface BruteForceConfig {
+    maxAttempts: number;
+    windowMs: number;
+    blockDurationMs: number;
+    authRoutes?: string[];
+}
+export interface AlertConfig {
+    console?: boolean;
+    slackWebhookUrl?: string;
+}
+export interface SecurityConfig {
+    sqlInjection?: boolean;
+    xss?: boolean;
+    bruteForce?: boolean | BruteForceConfig;
+    rateLimit?: boolean | RateLimitConfig;
+    suspiciousBehavior?: boolean;
+    payloadAnomaly?: boolean;
+    ipReputation?: boolean;
+    alerts?: AlertConfig;
+    routeSensitivity?: Record<string, Sensitivity>;
+    whitelist?: string[];
+    trustProxy?: boolean;
+    thresholds?: Partial<Thresholds>;
+    onBlock?: (req: Request, info: ThreatInfo) => void;
+    onWarn?: (req: Request, info: ThreatInfo) => void;
+}
+export interface ThreatInfo {
+    action: SecurityAction;
+    totalScore: number;
+    ip: string;
+    path: string;
+    method: string;
+    results: DetectionResult[];
+    timestamp: Date;
+}
+export interface StoreEntry<T = unknown> {
+    value: T;
+    expiresAt: number;
+}
+export interface Store {
+    get<T = unknown>(key: string): T | undefined;
+    set<T = unknown>(key: string, value: T, ttlMs: number): void;
+    increment(key: string, ttlMs: number): number;
+    delete(key: string): void;
+}
+export interface SecurityWatchMiddleware {
+    (req: Request, res: Response, next: NextFunction): void;
+    destroy: () => void;
+}
+declare global {
+    namespace Express {
+        interface Request {
+            securityWatch?: ThreatInfo;
+        }
+    }
+}

package/dist/types.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "securitywatch",
-  "version": "1.0.3",
+  "version": "1.0.4",
   "description": "Score-based runtime security middleware for Express. SQL injection, XSS, brute force, rate limiting, IP reputation.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",