tangkal 1.1.0

package/dist/src/analyzers/static-analysis.js

@@ -0,0 +1,246 @@
+import { parse } from '@babel/parser';
+import _traverse from '@babel/traverse';
+import { isObfuscated, hasLongLines } from '../utils/entropy.js';
+// @ts-ignore
+const traverse = _traverse.default || _traverse;
+import fs from 'fs';
+import readline from 'readline';
+export async function analyzeStream(filePath) {
+    const findings = [];
+    const fileStream = fs.createReadStream(filePath, { encoding: 'utf-8' });
+    const rl = readline.createInterface({
+        input: fileStream,
+        crlfDelay: Infinity
+    });
+    let lineIndex = 0;
+    let sampleContent = '';
+    const SAMPLE_SIZE = 5000;
+    for await (const line of rl) {
+        lineIndex++;
+        if (line.length > 1000) {
+            findings.push({
+                type: 'Heuristic',
+                name: 'Massive Line Length',
+                file: filePath,
+                line: lineIndex,
+                severity: 'high',
+                content: `Line length: ${line.length} chars`,
+                description: 'Extremely long line detected (Streaming Scan).'
+            });
+            rl.close();
+            break;
+        }
+        if (sampleContent.length < SAMPLE_SIZE) {
+            sampleContent += line + '\n';
+        }
+    }
+    if (sampleContent.length > 0 && isObfuscated(sampleContent)) {
+        findings.push({
+            type: 'Heuristic',
+            name: 'High Entropy',
+            file: filePath,
+            line: 0,
+            severity: 'medium',
+            content: 'File content appears random/encrypted',
+            description: 'Shannon entropy is abnormally high (Sampled).'
+        });
+    }
+    return findings;
+}
+export function analyzeContent(content, file) {
+    const findings = [];
+    const lines = content.split('\n');
+    const isJson = file.endsWith('.json');
+    if (isJson)
+        return [];
+    if (content.length > 1024 * 1024) {
+        const longLine = hasLongLines(content);
+        if (longLine) {
+            findings.push({
+                type: 'Heuristic',
+                name: 'Massive Line Length',
+                file,
+                line: longLine.lineIndex,
+                severity: 'high',
+                content: `Line length: ${longLine.length} chars`,
+                description: 'Extremely long line detected (File too large for AST).'
+            });
+        }
+        return findings;
+    }
+    // AST Analysis
+    try {
+        const ast = parse(content, {
+            sourceType: 'unambiguous',
+            plugins: ['typescript', 'jsx']
+        });
+        traverse(ast, {
+            CallExpression(path) {
+                const callee = path.node.callee;
+                const line = path.node.loc?.start.line || 0;
+                const rawLine = lines[line - 1];
+                const codeSnippet = rawLine ? rawLine.trim() : 'N/A';
+                // eval()
+                if (callee.type === 'Identifier' && callee.name === 'eval') {
+                    findings.push({
+                        type: 'AST',
+                        name: 'Dynamic Execution',
+                        file,
+                        line,
+                        severity: 'high',
+                        content: codeSnippet,
+                        description: 'Use of eval() detected. Vulnerable to code injection.'
+                    });
+                }
+                // child_process, fs, net, etc.
+                if (callee.type === 'MemberExpression') {
+                    const obj = callee.object;
+                    const prop = callee.property;
+                    if (obj.type === 'Identifier' && prop.type === 'Identifier') {
+                        if (obj.name === 'child_process') {
+                            findings.push({
+                                type: 'AST',
+                                name: 'Shell Execution',
+                                file,
+                                line,
+                                severity: 'medium',
+                                content: codeSnippet,
+                                description: `Executes system commands: ${obj.name}.${prop.name}(...)`
+                            });
+                        }
+                        if (obj.name === 'fs' || obj.name === 'fs/promises') {
+                            findings.push({
+                                type: 'AST',
+                                name: 'File System Access',
+                                file,
+                                line,
+                                severity: 'medium',
+                                content: codeSnippet,
+                                description: `Accesses file system: ${obj.name}.${prop.name}(...)`
+                            });
+                        }
+                        if (['net', 'http', 'https', 'dgram', 'tls'].includes(obj.name)) {
+                            findings.push({
+                                type: 'AST',
+                                name: 'Network Access',
+                                file,
+                                line,
+                                severity: 'medium',
+                                content: codeSnippet,
+                                description: `Establishes network connection: ${obj.name}.${prop.name}(...)`
+                            });
+                        }
+                        // Buffer.from(..., 'base64')
+                        if (obj.name === 'Buffer' && prop.name === 'from') {
+                            const args = path.node.arguments;
+                            if (args.length > 1 && args[1].type === 'StringLiteral' && args[1].value === 'base64') {
+                                findings.push({
+                                    type: 'AST',
+                                    name: 'Base64 Decoding',
+                                    file,
+                                    line,
+                                    severity: 'medium',
+                                    content: codeSnippet,
+                                    description: 'Decodes Base64 content. Often used to hide payloads.'
+                                });
+                            }
+                        }
+                    }
+                }
+            },
+            MemberExpression(path) {
+                // process.env
+                const line = path.node.loc?.start.line || 0;
+                const rawLine = lines[line - 1];
+                const codeSnippet = rawLine ? rawLine.trim() : 'N/A';
+                if (path.node.object.type === 'Identifier' && path.node.object.name === 'process' &&
+                    path.node.property.type === 'Identifier' && path.node.property.name === 'env') {
+                    findings.push({
+                        type: 'AST',
+                        name: 'Environment Access',
+                        file,
+                        line,
+                        severity: 'low',
+                        content: codeSnippet,
+                        description: 'Accesses environment variables (process.env).'
+                    });
+                }
+            },
+            StringLiteral(path) {
+                const val = path.node.value;
+                const line = path.node.loc?.start.line || 0;
+                const rawLine = lines[line - 1];
+                const codeSnippet = rawLine ? rawLine.trim() : val;
+                if (/\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b/.test(val)) {
+                    if (val !== '127.0.0.1' && val !== '0.0.0.0') {
+                        findings.push({
+                            type: 'AST',
+                            name: 'Suspicious IP',
+                            file,
+                            line,
+                            severity: 'medium',
+                            content: codeSnippet,
+                            description: `Contains hardcoded IP address: ${val}`
+                        });
+                    }
+                }
+                if (val.startsWith('http://') || (val.startsWith('https://') && !val.includes('npmjs') && !val.includes('github'))) {
+                    findings.push({
+                        type: 'AST',
+                        name: 'Suspicious URL',
+                        file,
+                        line,
+                        severity: 'medium',
+                        content: codeSnippet,
+                        description: `Contains hardcoded URL: ${val}`
+                    });
+                }
+            },
+            NewExpression(path) {
+                const callee = path.node.callee;
+                const line = path.node.loc?.start.line || 0;
+                const rawLine = lines[line - 1];
+                const codeSnippet = rawLine ? rawLine.trim() : 'new Function(...)';
+                if (callee.type === 'Identifier' && callee.name === 'Function') {
+                    findings.push({
+                        type: 'AST',
+                        name: 'Dynamic Execution',
+                        file,
+                        line,
+                        severity: 'high',
+                        content: codeSnippet,
+                        description: 'Creates function from string (new Function). Vulnerable to injection.'
+                    });
+                }
+            }
+        });
+    }
+    catch (e) { }
+    // 2. Heuristics (Long Lines)
+    const longLine = hasLongLines(content);
+    if (longLine) {
+        findings.push({
+            type: 'Heuristic',
+            name: 'Massive Line Length',
+            file,
+            line: longLine.lineIndex,
+            severity: 'high',
+            content: `Line length: ${longLine.length} chars`,
+            description: 'Extremely long line detected. Often indicates minified malware or packed code.'
+        });
+    }
+    // 3. Entropy Check (Obfuscation)
+    if (!file.endsWith('.json') && isObfuscated(content)) {
+        findings.push({
+            type: 'Heuristic',
+            name: 'High Entropy',
+            file,
+            line: 0,
+            severity: 'medium',
+            content: 'File content appears random/encrypted',
+            description: 'Shannon entropy is abnormally high.'
+        });
+    }
+    return findings;
+}
+//# sourceMappingURL=static-analysis.js.map

package/dist/src/analyzers/static-analysis.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"static-analysis.js","sourceRoot":"","sources":["../../../src/analyzers/static-analysis.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AACtC,OAAO,SAAS,MAAM,iBAAiB,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEjE,aAAa;AACb,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,IAAI,SAAS,CAAC;AAChD,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,QAAQ,MAAM,UAAU,CAAC;AAkBhC,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,QAAgB;IAChD,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,UAAU,GAAG,EAAE,CAAC,gBAAgB,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;IACxE,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC;QAChC,KAAK,EAAE,UAAU;QACjB,SAAS,EAAE,QAAQ;KACtB,CAAC,CAAC;IAEH,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,aAAa,GAAG,EAAE,CAAC;IACvB,MAAM,WAAW,GAAG,IAAI,CAAC;IAEzB,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,EAAE,EAAE,CAAC;QAC1B,SAAS,EAAE,CAAC;QACZ,IAAI,IAAI,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;YACrB,QAAQ,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,WAAW;gBACjB,IAAI,EAAE,qBAAqB;gBAC3B,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,SAAS;gBACf,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,gBAAgB,IAAI,CAAC,MAAM,QAAQ;gBAC5C,WAAW,EAAE,gDAAgD;aAChE,CAAC,CAAC;YACH,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,MAAM;QACV,CAAC;QACD,IAAI,aAAa,CAAC,MAAM,GAAG,WAAW,EAAE,CAAC;YACrC,aAAa,IAAI,IAAI,GAAG,IAAI,CAAC;QACjC,CAAC;IACL,CAAC;IAED,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,IAAI,YAAY,CAAC,aAAa,CAAC,EAAE,CAAC;QACzD,QAAQ,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,WAAW;YACjB,IAAI,EAAE,cAAc;YACpB,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC;YACP,QAAQ,EAAE,QAAQ;YAClB,OAAO,EAAE,uCAAuC;YAChD,WAAW,EAAE,+CAA+C;SAC/D,CAAC,CAAC;IACP,CAAC;IACD,OAAO,QAAQ,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,OAAe,EAAE,IAAY;IAC1D,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAEtC,IAAI,MAAM;QAAE,OAAO,EAAE,CAAC;IAEtB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,WAAW;gBACjB,IAAI,EAAE,qBAAqB;gBAC3B,IAAI;gBACJ,IAAI,EAAE,QAAQ,CAAC,SAAS;gBACxB,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,gBAAgB,QAAQ,CAAC,MAAM,QAAQ;gBAChD,WAAW,EAAE,wDAAwD;aACxE,CAAC,CAAC;QACL,CAAC;QACD,OAAO,QAAQ,CAAC;IACpB,CAAC;IAED,eAAe;IACf,IAAI,CAAC;QACD,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,EAAE;YACvB,UAAU,EAAE,aAAa;YACzB,OAAO,EAAE,CAAC,YAAY,EAAE,KAAK,CAAC;SACjC,CAAC,CAAC;QAEH,QAAQ,CAAC,GAAG,EAAE;YACV,cAAc,CAAC,IAAS;gBACpB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;gBAChC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC;gBAC5C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;gBAChC,MAAM,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;gBAErD,SAAS;gBACT,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;oBACzD,QAAQ,CAAC,IAAI,CAAC;wBACV,IAAI,EAAE,KAAK;wBACX,IAAI,EAAE,mBAAmB;wBACzB,IAAI;wBACJ,IAAI;wBACJ,QAAQ,EAAE,MAAM;wBAChB,OAAO,EAAE,WAAW;wBACpB,WAAW,EAAE,uDAAuD;qBACvE,CAAC,CAAC;gBACP,CAAC;gBAEA,+BAA+B;gBAChC,IAAI,MAAM,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;oBACrC,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC;oBAC1B,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC;oBAE7B,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;wBAC1D,IAAI,GAAG,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;4BAC9B,QAAQ,CAAC,IAAI,CAAC;gCACX,IAAI,EAAE,KAAK;gCACX,IAAI,EAAE,iBAAiB;gCACvB,IAAI;gCACJ,IAAI;gCACJ,QAAQ,EAAE,QAAQ;gCAClB,OAAO,EAAE,WAAW;gCACpB,WAAW,EAAE,6BAA6B,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,OAAO;6BACzE,CAAC,CAAC;wBACP,CAAC;wBACD,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,IAAI,GAAG,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;4BACjD,QAAQ,CAAC,IAAI,CAAC;gCACX,IAAI,EAAE,KAAK;gCACX,IAAI,EAAE,oBAAoB;gCAC1B,IAAI;gCACJ,IAAI;gCACJ,QAAQ,EAAE,QAAQ;gCAClB,OAAO,EAAE,WAAW;gCACpB,WAAW,EAAE,yBAAyB,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,OAAO;6BACrE,CAAC,CAAC;wBACP,CAAC;wBACA,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;4BAC9D,QAAQ,CAAC,IAAI,CAAC;gCACX,IAAI,EAAE,KAAK;gCACX,IAAI,EAAE,gBAAgB;gCACtB,IAAI;gCACJ,IAAI;gCACJ,QAAQ,EAAE,QAAQ;gCAClB,OAAO,EAAE,WAAW;gCACpB,WAAW,EAAE,mCAAmC,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,OAAO;6BAC/E,CAAC,CAAC;wBACP,CAAC;wBAED,6BAA6B;wBAC7B,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;4BAChD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;4BACjC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,eAAe,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gCACnF,QAAQ,CAAC,IAAI,CAAC;oCACX,IAAI,EAAE,KAAK;oCACX,IAAI,EAAE,iBAAiB;oCACvB,IAAI;oCACJ,IAAI;oCACJ,QAAQ,EAAE,QAAQ;oCAClB,OAAO,EAAE,WAAW;oCACpB,WAAW,EAAE,sDAAsD;iCACtE,CAAC,CAAC;4BACP,CAAC;wBACL,CAAC;oBACL,CAAC;gBACL,CAAC;YACL,CAAC;YACD,gBAAgB,CAAC,IAAS;gBACrB,cAAc;gBACd,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC;gBAC5C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;gBAChC,MAAM,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;gBAEtD,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS;oBAC7E,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,YAAY,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;oBAChF,QAAQ,CAAC,IAAI,CAAC;wBACV,IAAI,EAAE,KAAK;wBACX,IAAI,EAAE,oBAAoB;wBAC1B,IAAI;wBACJ,IAAI;wBACJ,QAAQ,EAAE,KAAK;wBACf,OAAO,EAAE,WAAW;wBACpB,WAAW,EAAE,+CAA+C;qBAC/D,CAAC,CAAC;gBACP,CAAC;YACL,CAAC;YACD,aAAa,CAAC,IAAS;gBACnB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;gBAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC;gBAC5C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;gBAChC,MAAM,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;gBAEnD,IAAI,wCAAwC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;oBACpD,IAAI,GAAG,KAAK,WAAW,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;wBAC1C,QAAQ,CAAC,IAAI,CAAC;4BACZ,IAAI,EAAE,KAAK;4BACX,IAAI,EAAE,eAAe;4BACrB,IAAI;4BACJ,IAAI;4BACJ,QAAQ,EAAE,QAAQ;4BAClB,OAAO,EAAE,WAAW;4BACpB,WAAW,EAAE,kCAAkC,GAAG,EAAE;yBACvD,CAAC,CAAC;oBACN,CAAC;gBACN,CAAC;gBACD,IAAI,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;oBAChH,QAAQ,CAAC,IAAI,CAAC;wBACP,IAAI,EAAE,KAAK;wBACX,IAAI,EAAE,gBAAgB;wBACtB,IAAI;wBACJ,IAAI;wBACJ,QAAQ,EAAE,QAAQ;wBAClB,OAAO,EAAE,WAAW;wBACpB,WAAW,EAAE,2BAA2B,GAAG,EAAE;qBACpD,CAAC,CAAC;gBACP,CAAC;YACL,CAAC;YACD,aAAa,CAAC,IAAS;gBACnB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;gBAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC;gBAC5C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;gBAChC,MAAM,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,mBAAmB,CAAC;gBAEpE,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;oBAC5D,QAAQ,CAAC,IAAI,CAAC;wBACX,IAAI,EAAE,KAAK;wBACX,IAAI,EAAE,mBAAmB;wBACzB,IAAI;wBACJ,IAAI;wBACJ,QAAQ,EAAE,MAAM;wBAChB,OAAO,EAAE,WAAW;wBACpB,WAAW,EAAE,uEAAuE;qBACvF,CAAC,CAAC;gBACP,CAAC;YACL,CAAC;SACJ,CAAC,CAAC;IACP,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC,CAAA,CAAC;IAEd,6BAA6B;IAC7B,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACvC,IAAI,QAAQ,EAAE,CAAC;QACb,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,WAAW;YACjB,IAAI,EAAE,qBAAqB;YAC3B,IAAI;YACJ,IAAI,EAAE,QAAQ,CAAC,SAAS;YACxB,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,gBAAgB,QAAQ,CAAC,MAAM,QAAQ;YAChD,WAAW,EAAE,gFAAgF;SAC9F,CAAC,CAAC;IACL,CAAC;IAED,iCAAiC;IACjC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;QACrD,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,WAAW;YACjB,IAAI,EAAE,cAAc;YACpB,IAAI;YACJ,IAAI,EAAE,CAAC;YACP,QAAQ,EAAE,QAAQ;YAClB,OAAO,EAAE,uCAAuC;YAChD,WAAW,EAAE,qCAAqC;SACnD,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/src/cli.d.ts

@@ -0,0 +1,2 @@
+export declare function run(): Promise<void>;
+//# sourceMappingURL=cli.d.ts.map

package/dist/src/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../../src/cli.ts"],"names":[],"mappings":"AA4HA,wBAAsB,GAAG,kBAExB"}

package/dist/src/cli.js

@@ -0,0 +1,112 @@
+import { Command } from 'commander';
+import chalk from 'chalk';
+import fs from 'fs/promises';
+import path from 'path';
+import inquirer from 'inquirer';
+import { scanDirectory } from './scanner.js';
+const program = new Command();
+program
+    .name('tangkal')
+    .description('Preventive security scanner for cloned repositories')
+    .version('1.1.0')
+    .argument('[directory]', 'directory to scan', '.')
+    .option('--json', 'output results as JSON')
+    .option('--no-audit', 'skip npm audit check')
+    .option('--nuke', 'interactive mode to delete suspicious files')
+    .action(async (directory, options) => {
+    try {
+        const results = await scanDirectory(directory, options);
+        if (options.json) {
+            console.log(JSON.stringify(results, null, 2));
+            return;
+        }
+        if (results.length === 0) {
+            console.log(chalk.green.bold('\nOK: No suspicious patterns found.'));
+            return;
+        }
+        // Separate vulnerabilities from other results for special formatting
+        const vulnerabilities = results.filter(f => f.type === 'Vulnerability');
+        const otherResults = results.filter(f => f.type !== 'Vulnerability');
+        if (otherResults.length > 0) {
+            console.log(chalk.red.bold('\n===================================='));
+            console.log(chalk.red.bold('ALERT: Malicious Code Detected'));
+            console.log(chalk.red.bold('===================================='));
+            otherResults.forEach(f => {
+                console.log(chalk.red('--------------------------------------------------'));
+                console.log(`${chalk.red.bold('TYPE:')} ${chalk.white.bold(f.name || f.type)}  ${chalk.gray(`(Severity: ${f.severity.toUpperCase()})`)}`);
+                console.log(`${chalk.cyan('FILE:')} ${chalk.white(f.file)}:${chalk.yellow(f.line || 0)}`);
+                console.log(`${chalk.cyan('DESC:')} ${chalk.yellow(f.description)}`);
+                if (f.content) {
+                    console.log(chalk.cyan('CODE:'));
+                    console.log(chalk.bgBlack.white(`  ${f.content.trim()}  `));
+                }
+                console.log('');
+            });
+        }
+        if (vulnerabilities.length > 0) {
+            console.log(chalk.red.bold('\n===================================='));
+            console.log(chalk.red.bold('ALERT: Vulnerable Package'));
+            console.log(chalk.red.bold('===================================='));
+            // Sort by severity (Critical first)
+            const severityOrder = { 'critical': 0, 'high': 1, 'moderate': 2, 'medium': 2, 'low': 3 };
+            vulnerabilities.sort((a, b) => (severityOrder[a.severity] ?? 99) - (severityOrder[b.severity] ?? 99));
+            vulnerabilities.forEach(v => {
+                const fixedIn = v.fixedIn || 'latest';
+                const severityColor = (v.severity === 'critical' || v.severity === 'high') ? chalk.red.bold : chalk.yellow;
+                const pkgLabel = chalk.magenta(`${v.name}@${v.version}`);
+                console.log(chalk.green(`[SOLUTION]: Upgrade ${v.name}@${v.version} to ${v.name}@${fixedIn} to fix.`));
+                let links = `[${v.url}]`;
+                if (v.references && v.references.length) {
+                    const snyk = v.references.find(r => r.includes('snyk.io'));
+                    if (snyk)
+                        links += ` [${snyk}]`;
+                }
+                console.log(`${chalk.white('[')}${severityColor(v.severity.toUpperCase())}${chalk.white(' Severity]')} ${chalk.blue(links)}`);
+                console.log(`${pkgLabel} ${chalk.white(v.summary)}`);
+                console.log(chalk.dim(`introduced by ${v.name}@${v.version}`));
+                console.log('');
+            });
+        }
+        // Nuke Mode
+        if (options.nuke) {
+            const filesToDelete = [...new Set(results.map(r => r.file))];
+            const { selected } = await inquirer.prompt([
+                {
+                    type: 'checkbox',
+                    name: 'selected',
+                    message: 'Select files to DELETE (Space to select, Enter to confirm):',
+                    choices: filesToDelete
+                }
+            ]);
+            if (selected.length > 0) {
+                const { confirm } = await inquirer.prompt([{
+                        type: 'confirm',
+                        name: 'confirm',
+                        message: `Are you sure you want to PERMANENTLY delete ${selected.length} files?`,
+                        default: false
+                    }]);
+                if (confirm) {
+                    for (const file of selected) {
+                        await fs.unlink(path.resolve(directory, file));
+                        console.log(chalk.red(`Deleted: ${file}`));
+                    }
+                    console.log(chalk.green('Cleanup complete.'));
+                }
+            }
+        }
+        else {
+            console.log(chalk.red.bold('FAIL: Potential threats found.'));
+            console.log(chalk.yellow('Review manually or run with --nuke to delete files interactively.'));
+        }
+    }
+    catch (error) {
+        console.error(chalk.red.bold('\nFATAL ERROR:'), error.message || error);
+        if (error.stack)
+            console.error(chalk.gray(error.stack));
+        process.exit(1);
+    }
+});
+export async function run() {
+    await program.parseAsync();
+}
+//# sourceMappingURL=cli.js.map

package/dist/src/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../../src/cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,MAAM,aAAa,CAAC;AAC7B,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,QAAQ,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,SAAS,CAAC;KACf,WAAW,CAAC,qDAAqD,CAAC;KAClE,OAAO,CAAC,OAAO,CAAC;KAChB,QAAQ,CAAC,aAAa,EAAE,mBAAmB,EAAE,GAAG,CAAC;KACjD,MAAM,CAAC,QAAQ,EAAE,wBAAwB,CAAC;KAC1C,MAAM,CAAC,YAAY,EAAE,sBAAsB,CAAC;KAC5C,MAAM,CAAC,QAAQ,EAAE,6CAA6C,CAAC;KAC/D,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE;IACnC,IAAI,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAExD,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAC9C,OAAO;QACT,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC,CAAC;YACrE,OAAO;QACT,CAAC;QAED,qEAAqE;QACrE,MAAM,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC;QACxE,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC;QAErE,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC,CAAC;YACtE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC,CAAC;YAC9D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC,CAAC;YAEpE,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;gBACrB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC,CAAC;gBAC7E,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC1I,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;gBAC1F,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;gBAErE,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;oBACX,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;oBACjC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;gBACjE,CAAC;gBACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACpB,CAAC,CAAC,CAAC;QACP,CAAC;QAED,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC,CAAC;YACtE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC,CAAC;YACzD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC,CAAC;YAEpE,oCAAoC;YACpC,MAAM,aAAa,GAA2B,EAAE,UAAU,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;YACjH,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YAEtG,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;gBACxB,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,IAAI,QAAQ,CAAC;gBACtC,MAAM,aAAa,GAAG,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,IAAI,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC;gBAC3G,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;gBAEzD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,IAAI,IAAI,OAAO,UAAU,CAAC,CAAC,CAAC;gBAEvG,IAAI,KAAK,GAAG,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC;gBACzB,IAAI,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;oBACtC,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;oBAC3D,IAAI,IAAI;wBAAE,KAAK,IAAI,KAAK,IAAI,GAAG,CAAC;gBACpC,CAAC;gBAED,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBAC9H,OAAO,CAAC,GAAG,CAAC,GAAG,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;gBACrD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;gBAC/D,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACpB,CAAC,CAAC,CAAC;QACP,CAAC;QAED,YAAY;QACZ,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,MAAM,aAAa,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAE7D,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC;gBACzC;oBACE,IAAI,EAAE,UAAU;oBAChB,IAAI,EAAE,UAAU;oBAChB,OAAO,EAAE,6DAA6D;oBACtE,OAAO,EAAE,aAAa;iBACvB;aACF,CAAC,CAAC;YAEH,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC;wBACvC,IAAI,EAAE,SAAS;wBACf,IAAI,EAAE,SAAS;wBACf,OAAO,EAAE,+CAA+C,QAAQ,CAAC,MAAM,SAAS;wBAChF,OAAO,EAAE,KAAK;qBACjB,CAAC,CAAC,CAAC;gBAEJ,IAAI,OAAO,EAAE,CAAC;oBACV,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;wBAC1B,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;wBAC/C,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC;oBAC/C,CAAC;oBACD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC;gBAClD,CAAC;YACH,CAAC;QACH,CAAC;aAAM,CAAC;YACJ,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC,CAAC;YAC9D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,mEAAmE,CAAC,CAAC,CAAC;QACnG,CAAC;IACL,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,CAAC;QACxE,IAAI,KAAK,CAAC,KAAK;YAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QACxD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,KAAK,UAAU,GAAG;IACvB,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC;AAC7B,CAAC"}

package/dist/src/config.d.ts

@@ -0,0 +1,9 @@
+export interface Pattern {
+    name: string;
+    regex: RegExp;
+    severity: 'critical' | 'high' | 'medium' | 'low';
+    description: string;
+}
+export declare const PATTERNS: Pattern[];
+export declare const POPULAR_PACKAGES: string[];
+//# sourceMappingURL=config.d.ts.map

package/dist/src/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/config.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;IACjD,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,eAAO,MAAM,QAAQ,EAAE,OAAO,EA+B7B,CAAC;AAGF,eAAO,MAAM,gBAAgB,EAAE,MAAM,EAKpC,CAAC"}

package/dist/src/config.js

@@ -0,0 +1,40 @@
+export const PATTERNS = [
+    {
+        name: 'Dynamic Execution',
+        regex: /\b(eval|new\s+Function)\b/g,
+        severity: 'high',
+        description: 'Executes arbitrary code strings.'
+    },
+    {
+        name: 'Base64 Decoding',
+        regex: /\b(atob|Buffer\.from\(.*['"]base64['"]\))/g,
+        severity: 'medium',
+        description: 'Often used to hide payloads.'
+    },
+    {
+        name: 'Suspicious Network',
+        regex: /\b(axios|fetch|https?:\.get)\s*\(.*(atob|Buffer|token|api|model)\b/gi,
+        severity: 'high',
+        description: 'Network call with decoded/suspicious params.'
+    },
+    {
+        name: 'Hex Obfuscation',
+        regex: /\\x[0-9a-fA-F]{2}/g,
+        severity: 'medium',
+        description: 'Hex-encoded strings used for obfuscation.'
+    },
+    {
+        name: 'Shell Execution',
+        regex: /\b(child_process|exec|spawn|fork)\b/g,
+        severity: 'medium',
+        description: 'Executes system commands.'
+    }
+];
+// A small list of very popular packages to check against for typosquatting
+export const POPULAR_PACKAGES = [
+    'react', 'react-dom', 'next', 'vue', 'express', 'lodash', 'commander',
+    'chalk', 'axios', 'tslib', 'typescript', 'eslint', 'jest', 'moment',
+    'date-fns', 'uuid', 'classnames', 'prop-types', 'webpack', 'babel-core',
+    'body-parser', 'cookie-parser', 'dotenv', 'mongoose', 'nodemon'
+];
+//# sourceMappingURL=config.js.map

package/dist/src/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/config.ts"],"names":[],"mappings":"AAOA,MAAM,CAAC,MAAM,QAAQ,GAAc;IACjC;QACE,IAAI,EAAE,mBAAmB;QACzB,KAAK,EAAE,4BAA4B;QACnC,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,kCAAkC;KAChD;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,KAAK,EAAE,4CAA4C;QACnD,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,8BAA8B;KAC5C;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,KAAK,EAAE,uEAAuE;QAC9E,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,8CAA8C;KAC5D;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,KAAK,EAAE,oBAAoB;QAC3B,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,2CAA2C;KACzD;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,KAAK,EAAE,sCAAsC;QAC7C,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,2BAA2B;KACzC;CACF,CAAC;AAEF,2EAA2E;AAC3E,MAAM,CAAC,MAAM,gBAAgB,GAAa;IACxC,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW;IACrE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ;IACnE,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY;IACvE,aAAa,EAAE,eAAe,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS;CAChE,CAAC"}

package/dist/src/scanner.d.ts

@@ -0,0 +1,8 @@
+import { type Finding } from './analyzers/static-analysis.js';
+interface ScanOptions {
+    json?: boolean;
+    skipAudit?: boolean;
+}
+export declare function scanDirectory(directory: string, options?: ScanOptions): Promise<Finding[]>;
+export {};
+//# sourceMappingURL=scanner.d.ts.map

package/dist/src/scanner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanner.d.ts","sourceRoot":"","sources":["../../src/scanner.ts"],"names":[],"mappings":"AAMA,OAAO,EAAiC,KAAK,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAK7F,UAAU,WAAW;IACnB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,wBAAsB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAmHpG"}

package/dist/src/scanner.js

@@ -0,0 +1,115 @@
+import fg from 'fast-glob';
+import fs from 'fs/promises';
+import path from 'path';
+import chalk from 'chalk';
+import ora from 'ora';
+import { loadIgnore } from './utils/ignore.js';
+import { analyzeContent, analyzeStream } from './analyzers/static-analysis.js';
+import { checkTyposquatting } from './analyzers/dependencies.js';
+import { auditDependencies } from './analyzers/network.js';
+import { parsePackageLock } from './utils/lockfile.js';
+export async function scanDirectory(directory, options = {}) {
+    const targetDir = path.resolve(directory);
+    const ig = await loadIgnore(targetDir);
+    const allFindings = [];
+    // 1. Find Files (Streaming)
+    const stream = fg.stream(['**/*.{js,ts,jsx,tsx,json}'], {
+        cwd: targetDir,
+        dot: true,
+        ignore: ['**/node_modules/**', '**/.git/**']
+    });
+    if (!options.json) {
+        console.log(chalk.gray(`Scanning files from ${targetDir} (Streaming)...`));
+    }
+    let packageJsonFound = false;
+    // 2. Scan Content
+    for await (const entry of stream) {
+        const file = entry;
+        if (ig.ignores(file))
+            continue;
+        const filePath = path.join(targetDir, file);
+        try {
+            const stat = await fs.stat(filePath);
+            // Optimize: Stream large files (>1MB)
+            if (stat.size > 1024 * 1024) {
+                const streamFindings = await analyzeStream(filePath);
+                streamFindings.forEach(f => { f.file = file; allFindings.push(f); });
+                continue;
+            }
+            // Standard Read for small files
+            let content = await fs.readFile(filePath, 'utf-8');
+            content = content.replace(/^\uFEFF/, '');
+            // Check package.json specifically
+            if (file === 'package.json') {
+                packageJsonFound = true;
+                try {
+                    const pkg = JSON.parse(content);
+                    // A. Lifecycle Scripts
+                    const scripts = pkg.scripts || {};
+                    const dangerousScripts = ['preinstall', 'postinstall', 'install'];
+                    for (const name of dangerousScripts) {
+                        if (scripts[name]) {
+                            allFindings.push({
+                                type: 'Lifecycle Script',
+                                name: name,
+                                file,
+                                line: 0,
+                                severity: 'critical',
+                                content: scripts[name],
+                                description: 'Dangerous lifecycle script that runs automatically on install.'
+                            });
+                        }
+                    }
+                    // B. Typosquatting (Async & Network-aware)
+                    const typoFindings = await checkTyposquatting(pkg);
+                    typoFindings.forEach(f => {
+                        allFindings.push({ ...f, file });
+                    });
+                }
+                catch (e) {
+                    // Error parsing or checking typosquat
+                }
+            }
+            // Static Code Analysis (AST)
+            const contentFindings = analyzeContent(content, file);
+            allFindings.push(...contentFindings);
+        }
+        catch (e) {
+            // failed to read file
+        }
+    }
+    // 3. Network Audit (Reputation & Vulnerability)
+    if (!options.skipAudit) {
+        const lockDeps = await parsePackageLock(targetDir);
+        if (lockDeps && lockDeps.length > 0) {
+            if (!options.json)
+                console.log(chalk.gray('Running deep dependency audit...'));
+            const spinner = !options.json ? ora(`Auditing ${lockDeps.length} dependencies...`).start() : null;
+            const netFindings = await auditDependencies(lockDeps);
+            allFindings.push(...netFindings);
+            if (spinner)
+                spinner.succeed(`Audit complete: scanned ${lockDeps.length} packages.`);
+        }
+        else if (packageJsonFound) {
+            try {
+                const pkgPath = path.join(targetDir, 'package.json');
+                const pkgContent = await fs.readFile(pkgPath, 'utf-8');
+                const pkg = JSON.parse(pkgContent);
+                const deps = { ...pkg.dependencies, ...pkg.devDependencies };
+                const directDeps = Object.keys(deps).map(k => ({ name: k, version: deps[k].replace(/[\^~]/g, '') }));
+                if (directDeps.length > 0) {
+                    if (!options.json)
+                        console.log(chalk.gray('No lockfile found. Auditing direct dependencies...'));
+                    const spinner = !options.json ? ora(`Auditing ${directDeps.length} direct dependencies...`).start() : null;
+                    const netFindings = await auditDependencies(directDeps);
+                    allFindings.push(...netFindings);
+                    if (spinner)
+                        spinner.succeed(`Audit complete: scanned ${directDeps.length} packages.`);
+                }
+            }
+            catch (e) { }
+        }
+    }
+    return allFindings;
+}
+//# sourceMappingURL=scanner.js.map

package/dist/src/scanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanner.js","sourceRoot":"","sources":["../../src/scanner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,WAAW,CAAC;AAC3B,OAAO,EAAE,MAAM,aAAa,CAAC;AAC7B,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,GAAG,MAAM,KAAK,CAAC;AACtB,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,aAAa,EAAgB,MAAM,gCAAgC,CAAC;AAC7F,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAmB,MAAM,qBAAqB,CAAC;AAOxE,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,SAAiB,EAAE,UAAuB,EAAE;IAC9E,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,EAAE,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,CAAC;IACvC,MAAM,WAAW,GAAc,EAAE,CAAC;IAElC,4BAA4B;IAC5B,MAAM,MAAM,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,2BAA2B,CAAC,EAAE;QACtD,GAAG,EAAE,SAAS;QACd,GAAG,EAAE,IAAI;QACT,MAAM,EAAE,CAAC,oBAAoB,EAAE,YAAY,CAAC;KAC7C,CAAC,CAAC;IAEH,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAClB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,uBAAuB,SAAS,iBAAiB,CAAC,CAAC,CAAC;IAC7E,CAAC;IAED,IAAI,gBAAgB,GAAG,KAAK,CAAC;IAE7B,kBAAkB;IAClB,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,KAAe,CAAC;QAC7B,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,SAAS;QAE/B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC5C,IAAI,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAErC,sCAAsC;YACtC,IAAI,IAAI,CAAC,IAAI,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;gBAC1B,MAAM,cAAc,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;gBACrD,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBACrE,SAAS;YACb,CAAC;YAED,gCAAgC;YAChC,IAAI,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACnD,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;YAEzC,kCAAkC;YAClC,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;gBAC1B,gBAAgB,GAAG,IAAI,CAAC;gBACxB,IAAI,CAAC;oBACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;oBAEhC,uBAAuB;oBACvB,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;oBAClC,MAAM,gBAAgB,GAAG,CAAC,YAAY,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC;oBAClE,KAAK,MAAM,IAAI,IAAI,gBAAgB,EAAE,CAAC;wBAClC,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;4BAChB,WAAW,CAAC,IAAI,CAAC;gCACb,IAAI,EAAE,kBAAkB;gCACxB,IAAI,EAAE,IAAI;gCACV,IAAI;gCACJ,IAAI,EAAE,CAAC;gCACP,QAAQ,EAAE,UAAU;gCACpB,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC;gCACtB,WAAW,EAAE,gEAAgE;6BAChF,CAAC,CAAC;wBACP,CAAC;oBACL,CAAC;oBAED,2CAA2C;oBAC3C,MAAM,YAAY,GAAG,MAAM,kBAAkB,CAAC,GAAG,CAAC,CAAC;oBACnD,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;wBACrB,WAAW,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;oBACrC,CAAC,CAAC,CAAC;gBAEP,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACT,sCAAsC;gBAC1C,CAAC;YACL,CAAC;YAED,6BAA6B;YAC7B,MAAM,eAAe,GAAG,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACtD,WAAW,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,CAAC;QAEzC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACT,sBAAsB;QAC1B,CAAC;IACH,CAAC;IAED,gDAAgD;IAChD,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QACrB,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAEnD,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClC,IAAI,CAAC,OAAO,CAAC,IAAI;gBAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC,CAAC;YAC/E,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,QAAQ,CAAC,MAAM,kBAAkB,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YAElG,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YACtD,WAAW,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,CAAC;YAEjC,IAAI,OAAO;gBAAE,OAAO,CAAC,OAAO,CAAC,2BAA2B,QAAQ,CAAC,MAAM,YAAY,CAAC,CAAC;QACzF,CAAC;aAAM,IAAI,gBAAgB,EAAE,CAAC;YACzB,IAAI,CAAC;gBACF,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;gBACrD,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBACvD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;gBACnC,MAAM,IAAI,GAAG,EAAE,GAAG,GAAG,CAAC,YAAY,EAAE,GAAG,GAAG,CAAC,eAAe,EAAE,CAAC;gBAC7D,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;gBAErG,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACxB,IAAI,CAAC,OAAO,CAAC,IAAI;wBAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC,CAAC;oBACjG,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,UAAU,CAAC,MAAM,yBAAyB,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;oBAE3G,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAC,UAAU,CAAC,CAAC;oBACxD,WAAW,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,CAAC;oBAEjC,IAAI,OAAO;wBAAE,OAAO,CAAC,OAAO,CAAC,2BAA2B,UAAU,CAAC,MAAM,YAAY,CAAC,CAAC;gBAC3F,CAAC;YACJ,CAAC;YAAC,OAAM,CAAC,EAAE,CAAC,CAAA,CAAC;QAClB,CAAC;IACL,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC"}

package/dist/src/utils/entropy.d.ts

@@ -0,0 +1,7 @@
+export declare function calculateEntropy(text: string): number;
+export declare function isObfuscated(text: string, threshold?: number): boolean;
+export declare function hasLongLines(text: string, threshold?: number): {
+    lineIndex: number;
+    length: number;
+} | null;
+//# sourceMappingURL=entropy.d.ts.map

package/dist/src/utils/entropy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entropy.d.ts","sourceRoot":"","sources":["../../../src/utils/entropy.ts"],"names":[],"mappings":"AAKA,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGrD;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,SAAM,GAAG,OAAO,CAInE;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,SAAO,GAAG;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CASzG"}

package/dist/src/utils/entropy.js

@@ -0,0 +1,25 @@
+// @ts-ignore
+import _entropy from 'shannon-entropy';
+// @ts-ignore
+const entropy = _entropy.default || _entropy;
+export function calculateEntropy(text) {
+    if (typeof entropy !== 'function')
+        return 0;
+    return entropy(text);
+}
+export function isObfuscated(text, threshold = 4.5) {
+    // Common english text is around 3.5 - 4.5
+    // Packed/encrypted code often exceeds 5.0
+    return calculateEntropy(text) > threshold;
+}
+export function hasLongLines(text, threshold = 1000) {
+    const lines = text.split('\n');
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        if (line && line.length > threshold) {
+            return { lineIndex: i + 1, length: line.length };
+        }
+    }
+    return null;
+}
+//# sourceMappingURL=entropy.js.map

package/dist/src/utils/entropy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entropy.js","sourceRoot":"","sources":["../../../src/utils/entropy.ts"],"names":[],"mappings":"AAAA,aAAa;AACb,OAAO,QAAQ,MAAM,iBAAiB,CAAC;AACvC,aAAa;AACb,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC;AAE7C,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,IAAI,OAAO,OAAO,KAAK,UAAU;QAAE,OAAO,CAAC,CAAC;IAC5C,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,SAAS,GAAG,GAAG;IACxD,0CAA0C;IAC1C,0CAA0C;IAC1C,OAAO,gBAAgB,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,SAAS,GAAG,IAAI;IACzD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;YACpC,OAAO,EAAE,SAAS,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;QACnD,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/src/utils/ignore.d.ts

@@ -0,0 +1,3 @@
+import type { Ignore } from 'ignore';
+export declare function loadIgnore(dir: string): Promise<Ignore>;
+//# sourceMappingURL=ignore.d.ts.map

package/dist/src/utils/ignore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ignore.d.ts","sourceRoot":"","sources":["../../../src/utils/ignore.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAErC,wBAAsB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAe7D"}