toolip 1.0.6 → 2.0.0

package/dist/src/analyzers/ast/ast-security-analyzer.d.ts

@@ -0,0 +1,6 @@
+import type { Analyzer, AnalyzerContext, AnalyzerResult } from '../../contracts/analyzer.js';
+export declare class AstSecurityAnalyzer implements Analyzer {
+    readonly id = "typescript-ast-security";
+    readonly version = "1.0.0";
+    analyze(context: AnalyzerContext): Promise<AnalyzerResult>;
+}

package/dist/src/analyzers/ast/ast-security-analyzer.js

@@ -0,0 +1,64 @@
+import { readFile } from 'node:fs/promises';
+import { createScannerContext } from '../../core/scanner-context.js';
+import { analyzeAstSource } from './source-analysis.js';
+const supportedExtensions = new Set([
+    'js',
+    'jsx',
+    'ts',
+    'tsx',
+    'mjs',
+    'cjs'
+]);
+function shouldAnalyze(relativePath, extension) {
+    if (!supportedExtensions.has(extension))
+        return false;
+    if (relativePath.endsWith('.d.ts'))
+        return false;
+    if (relativePath.endsWith('.map'))
+        return false;
+    if (relativePath.startsWith('dist/'))
+        return false;
+    return true;
+}
+export class AstSecurityAnalyzer {
+    id = 'typescript-ast-security';
+    version = '1.0.0';
+    async analyze(context) {
+        const startedAt = performance.now();
+        const scannerContext = await createScannerContext(context.root);
+        const findings = [];
+        const warnings = [];
+        let filesAnalyzed = 0;
+        for (const file of scannerContext.files) {
+            if (!shouldAnalyze(file.relativePath, file.extension)) {
+                continue;
+            }
+            if (context.signal?.aborted) {
+                throw new Error('AST security analysis was cancelled.');
+            }
+            try {
+                const content = await readFile(file.absolutePath, 'utf8');
+                findings.push(...analyzeAstSource(file.relativePath, content));
+                filesAnalyzed += 1;
+            }
+            catch (error) {
+                const message = error instanceof Error
+                    ? error.message
+                    : String(error);
+                warnings.push(`${file.relativePath}: ${message}`);
+            }
+        }
+        return {
+            analyzer: this.id,
+            durationMs: Math.round(performance.now() - startedAt),
+            findings,
+            warnings: warnings.length > 0 ? warnings : undefined,
+            metadata: {
+                filesAnalyzed,
+                findings: findings.length,
+                parser: 'typescript-compiler-api'
+            }
+        };
+    }
+}
+//# sourceMappingURL=ast-security-analyzer.js.map

package/dist/src/analyzers/ast/ast-security-analyzer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ast-security-analyzer.js","sourceRoot":"","sources":["../../../../src/analyzers/ast/ast-security-analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAM5C,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAExD,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,IAAI;IACJ,KAAK;IACL,IAAI;IACJ,KAAK;IACL,KAAK;IACL,KAAK;CACN,CAAC,CAAC;AAEH,SAAS,aAAa,CACpB,YAAoB,EACpB,SAAiB;IAEjB,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IACtD,IAAI,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IACjD,IAAI,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IAChD,IAAI,YAAY,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IACnD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,OAAO,mBAAmB;IACrB,EAAE,GAAG,yBAAyB,CAAC;IAC/B,OAAO,GAAG,OAAO,CAAC;IAE3B,KAAK,CAAC,OAAO,CACX,OAAwB;QAExB,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QACpC,MAAM,cAAc,GAAG,MAAM,oBAAoB,CAC/C,OAAO,CAAC,IAAI,CACb,CAAC;QACF,MAAM,QAAQ,GAAG,EAAE,CAAC;QACpB,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,IAAI,aAAa,GAAG,CAAC,CAAC;QAEtB,KAAK,MAAM,IAAI,IAAI,cAAc,CAAC,KAAK,EAAE,CAAC;YACxC,IACE,CAAC,aAAa,CACZ,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,SAAS,CACf,EACD,CAAC;gBACD,SAAS;YACX,CAAC;YAED,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;gBAC5B,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;YAC1D,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAC5B,IAAI,CAAC,YAAY,EACjB,MAAM,CACP,CAAC;gBAEF,QAAQ,CAAC,IAAI,CACX,GAAG,gBAAgB,CACjB,IAAI,CAAC,YAAY,EACjB,OAAO,CACR,CACF,CAAC;gBAEF,aAAa,IAAI,CAAC,CAAC;YACrB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,OAAO,GACX,KAAK,YAAY,KAAK;oBACpB,CAAC,CAAC,KAAK,CAAC,OAAO;oBACf,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAEpB,QAAQ,CAAC,IAAI,CACX,GAAG,IAAI,CAAC,YAAY,KAAK,OAAO,EAAE,CACnC,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,EAAE;YACjB,UAAU,EAAE,IAAI,CAAC,KAAK,CACpB,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,CAC9B;YACD,QAAQ;YACR,QAAQ,EACN,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;YAC5C,QAAQ,EAAE;gBACR,aAAa;gBACb,QAAQ,EAAE,QAAQ,CAAC,MAAM;gBACzB,MAAM,EAAE,yBAAyB;aAClC;SACF,CAAC;IACJ,CAAC;CACF"}

package/dist/src/analyzers/ast/rules.d.ts

@@ -0,0 +1,48 @@
+import type { FindingConfidence, FindingSeverity } from '../../contracts/finding.js';
+export type AstSecurityRule = {
+    id: string;
+    title: string;
+    category: 'dangerous-code';
+    severity: FindingSeverity;
+    confidence: FindingConfidence;
+    message: string;
+    remediation: string;
+};
+export declare const astSecurityRules: {
+    eval: {
+        id: string;
+        title: string;
+        category: "dangerous-code";
+        severity: "high";
+        confidence: "high";
+        message: string;
+        remediation: string;
+    };
+    functionConstructor: {
+        id: string;
+        title: string;
+        category: "dangerous-code";
+        severity: "high";
+        confidence: "high";
+        message: string;
+        remediation: string;
+    };
+    childProcessExec: {
+        id: string;
+        title: string;
+        category: "dangerous-code";
+        severity: "high";
+        confidence: "high";
+        message: string;
+        remediation: string;
+    };
+    childProcessExecSync: {
+        id: string;
+        title: string;
+        category: "dangerous-code";
+        severity: "high";
+        confidence: "high";
+        message: string;
+        remediation: string;
+    };
+};

package/dist/src/analyzers/ast/rules.js

@@ -0,0 +1,39 @@
+export const astSecurityRules = {
+    eval: {
+        id: 'TLP-AST-001',
+        title: 'Dynamic eval execution',
+        category: 'dangerous-code',
+        severity: 'high',
+        confidence: 'high',
+        message: 'eval() executes code from a string and can introduce code-injection vulnerabilities.',
+        remediation: 'Replace eval() with explicit parsing, validated dispatch, or a purpose-built interpreter.'
+    },
+    functionConstructor: {
+        id: 'TLP-AST-002',
+        title: 'Dynamic Function constructor',
+        category: 'dangerous-code',
+        severity: 'high',
+        confidence: 'high',
+        message: 'The Function constructor creates executable code from strings.',
+        remediation: 'Use explicit functions and validated control flow instead of runtime code generation.'
+    },
+    childProcessExec: {
+        id: 'TLP-AST-003',
+        title: 'Shell execution with child_process.exec',
+        category: 'dangerous-code',
+        severity: 'high',
+        confidence: 'high',
+        message: 'child_process.exec() invokes a shell and can become vulnerable when command input is not strictly controlled.',
+        remediation: 'Prefer execFile() or spawn() with argument arrays and validate every untrusted value.'
+    },
+    childProcessExecSync: {
+        id: 'TLP-AST-004',
+        title: 'Synchronous shell execution with child_process.execSync',
+        category: 'dangerous-code',
+        severity: 'high',
+        confidence: 'high',
+        message: 'child_process.execSync() invokes a shell synchronously and can introduce injection and availability risks.',
+        remediation: 'Avoid shell interpolation. Prefer execFileSync() or spawnSync() with validated argument arrays.'
+    }
+};
+//# sourceMappingURL=rules.js.map

package/dist/src/analyzers/ast/rules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rules.js","sourceRoot":"","sources":["../../../../src/analyzers/ast/rules.ts"],"names":[],"mappings":"AAeA,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,IAAI,EAAE;QACJ,EAAE,EAAE,aAAa;QACjB,KAAK,EAAE,wBAAwB;QAC/B,QAAQ,EAAE,gBAAgB;QAC1B,QAAQ,EAAE,MAAM;QAChB,UAAU,EAAE,MAAM;QAClB,OAAO,EACL,sFAAsF;QACxF,WAAW,EACT,2FAA2F;KAC9F;IACD,mBAAmB,EAAE;QACnB,EAAE,EAAE,aAAa;QACjB,KAAK,EAAE,8BAA8B;QACrC,QAAQ,EAAE,gBAAgB;QAC1B,QAAQ,EAAE,MAAM;QAChB,UAAU,EAAE,MAAM;QAClB,OAAO,EACL,gEAAgE;QAClE,WAAW,EACT,uFAAuF;KAC1F;IACD,gBAAgB,EAAE;QAChB,EAAE,EAAE,aAAa;QACjB,KAAK,EAAE,yCAAyC;QAChD,QAAQ,EAAE,gBAAgB;QAC1B,QAAQ,EAAE,MAAM;QAChB,UAAU,EAAE,MAAM;QAClB,OAAO,EACL,+GAA+G;QACjH,WAAW,EACT,uFAAuF;KAC1F;IACD,oBAAoB,EAAE;QACpB,EAAE,EAAE,aAAa;QACjB,KAAK,EAAE,yDAAyD;QAChE,QAAQ,EAAE,gBAAgB;QAC1B,QAAQ,EAAE,MAAM;QAChB,UAAU,EAAE,MAAM;QAClB,OAAO,EACL,4GAA4G;QAC9G,WAAW,EACT,iGAAiG;KACpG;CACwC,CAAC"}

package/dist/src/analyzers/ast/source-analysis.d.ts

@@ -0,0 +1,2 @@
+import type { Finding } from '../../contracts/finding.js';
+export declare function analyzeAstSource(filePath: string, content: string): Finding[];

package/dist/src/analyzers/ast/source-analysis.js

@@ -0,0 +1,225 @@
+import ts from 'typescript';
+import { astSecurityRules } from './rules.js';
+function scriptKind(filePath) {
+    if (filePath.endsWith('.tsx'))
+        return ts.ScriptKind.TSX;
+    if (filePath.endsWith('.jsx'))
+        return ts.ScriptKind.JSX;
+    if (filePath.endsWith('.js'))
+        return ts.ScriptKind.JS;
+    if (filePath.endsWith('.mjs'))
+        return ts.ScriptKind.JS;
+    if (filePath.endsWith('.cjs'))
+        return ts.ScriptKind.JS;
+    return ts.ScriptKind.TS;
+}
+function isChildProcessModule(value) {
+    return value === 'child_process' || value === 'node:child_process';
+}
+function moduleNameFromImport(declaration) {
+    return ts.isStringLiteral(declaration.moduleSpecifier)
+        ? declaration.moduleSpecifier.text
+        : undefined;
+}
+function requireModuleName(expression) {
+    if (!expression ||
+        !ts.isCallExpression(expression) ||
+        !ts.isIdentifier(expression.expression) ||
+        expression.expression.text !== 'require' ||
+        expression.arguments.length !== 1) {
+        return undefined;
+    }
+    const [argument] = expression.arguments;
+    return argument && ts.isStringLiteral(argument)
+        ? argument.text
+        : undefined;
+}
+function collectBindings(sourceFile) {
+    const bindings = {
+        namespaceImports: new Set(),
+        execImports: new Set(),
+        execSyncImports: new Set()
+    };
+    for (const statement of sourceFile.statements) {
+        if (ts.isImportDeclaration(statement)) {
+            const moduleName = moduleNameFromImport(statement);
+            if (!moduleName || !isChildProcessModule(moduleName)) {
+                continue;
+            }
+            const importClause = statement.importClause;
+            if (!importClause) {
+                continue;
+            }
+            const bindingsClause = importClause.namedBindings;
+            if (bindingsClause && ts.isNamespaceImport(bindingsClause)) {
+                bindings.namespaceImports.add(bindingsClause.name.text);
+            }
+            if (bindingsClause && ts.isNamedImports(bindingsClause)) {
+                for (const element of bindingsClause.elements) {
+                    const importedName = element.propertyName?.text ?? element.name.text;
+                    const localName = element.name.text;
+                    if (importedName === 'exec') {
+                        bindings.execImports.add(localName);
+                    }
+                    if (importedName === 'execSync') {
+                        bindings.execSyncImports.add(localName);
+                    }
+                }
+            }
+        }
+        if (!ts.isVariableStatement(statement)) {
+            continue;
+        }
+        for (const declaration of statement.declarationList.declarations) {
+            const initializer = declaration.initializer;
+            const moduleName = requireModuleName(initializer);
+            if (moduleName &&
+                isChildProcessModule(moduleName) &&
+                ts.isIdentifier(declaration.name)) {
+                bindings.namespaceImports.add(declaration.name.text);
+            }
+            if (moduleName &&
+                isChildProcessModule(moduleName) &&
+                ts.isObjectBindingPattern(declaration.name)) {
+                for (const element of declaration.name.elements) {
+                    if (!ts.isIdentifier(element.name)) {
+                        continue;
+                    }
+                    const importedName = element.propertyName &&
+                        ts.isIdentifier(element.propertyName)
+                        ? element.propertyName.text
+                        : element.name.text;
+                    if (importedName === 'exec') {
+                        bindings.execImports.add(element.name.text);
+                    }
+                    if (importedName === 'execSync') {
+                        bindings.execSyncImports.add(element.name.text);
+                    }
+                }
+            }
+            if (initializer &&
+                ts.isPropertyAccessExpression(initializer) &&
+                ts.isCallExpression(initializer.expression) &&
+                ts.isIdentifier(initializer.expression.expression) &&
+                initializer.expression.expression.text === 'require' &&
+                initializer.expression.arguments.length === 1) {
+                const [argument] = initializer.expression.arguments;
+                const requiredModule = argument && ts.isStringLiteral(argument)
+                    ? argument.text
+                    : undefined;
+                if (requiredModule &&
+                    isChildProcessModule(requiredModule) &&
+                    ts.isIdentifier(declaration.name)) {
+                    if (initializer.name.text === 'exec') {
+                        bindings.execImports.add(declaration.name.text);
+                    }
+                    if (initializer.name.text === 'execSync') {
+                        bindings.execSyncImports.add(declaration.name.text);
+                    }
+                }
+            }
+        }
+    }
+    return bindings;
+}
+function findingLocation(sourceFile, node) {
+    const start = sourceFile.getLineAndCharacterOfPosition(node.getStart(sourceFile));
+    const end = sourceFile.getLineAndCharacterOfPosition(node.getEnd());
+    return {
+        file: sourceFile.fileName,
+        line: start.line + 1,
+        column: start.character + 1,
+        endLine: end.line + 1,
+        endColumn: end.character + 1
+    };
+}
+function evidenceExcerpt(sourceFile, node) {
+    const text = node
+        .getText(sourceFile)
+        .replaceAll(/\s+/g, ' ')
+        .trim();
+    return text.length <= 180
+        ? text
+        : `${text.slice(0, 177)}...`;
+}
+function createFinding(sourceFile, node, rule) {
+    const location = findingLocation(sourceFile, node);
+    const fingerprint = `${rule.id}:${sourceFile.fileName}:` +
+        `${location?.line ?? 0}:${location?.column ?? 0}`;
+    return {
+        id: fingerprint,
+        ruleId: rule.id,
+        title: rule.title,
+        category: rule.category,
+        severity: rule.severity,
+        confidence: rule.confidence,
+        message: rule.message,
+        source: 'typescript-ast',
+        location,
+        evidence: [
+            {
+                summary: evidenceExcerpt(sourceFile, node),
+                fingerprint
+            }
+        ],
+        remediation: {
+            summary: rule.remediation
+        },
+        metadata: {
+            nodeKind: ts.SyntaxKind[node.kind]
+        }
+    };
+}
+function childProcessRuleForCall(call, bindings) {
+    const target = call.expression;
+    if (ts.isIdentifier(target)) {
+        if (bindings.execImports.has(target.text)) {
+            return astSecurityRules.childProcessExec;
+        }
+        if (bindings.execSyncImports.has(target.text)) {
+            return astSecurityRules.childProcessExecSync;
+        }
+        return undefined;
+    }
+    if (!ts.isPropertyAccessExpression(target)) {
+        return undefined;
+    }
+    if (!ts.isIdentifier(target.expression) ||
+        !bindings.namespaceImports.has(target.expression.text)) {
+        return undefined;
+    }
+    if (target.name.text === 'exec') {
+        return astSecurityRules.childProcessExec;
+    }
+    if (target.name.text === 'execSync') {
+        return astSecurityRules.childProcessExecSync;
+    }
+    return undefined;
+}
+export function analyzeAstSource(filePath, content) {
+    const sourceFile = ts.createSourceFile(filePath, content, ts.ScriptTarget.Latest, true, scriptKind(filePath));
+    const bindings = collectBindings(sourceFile);
+    const findings = [];
+    const visit = (node) => {
+        if (ts.isCallExpression(node) &&
+            ts.isIdentifier(node.expression) &&
+            node.expression.text === 'eval') {
+            findings.push(createFinding(sourceFile, node, astSecurityRules.eval));
+        }
+        if (ts.isNewExpression(node) &&
+            ts.isIdentifier(node.expression) &&
+            node.expression.text === 'Function') {
+            findings.push(createFinding(sourceFile, node, astSecurityRules.functionConstructor));
+        }
+        if (ts.isCallExpression(node)) {
+            const childProcessRule = childProcessRuleForCall(node, bindings);
+            if (childProcessRule) {
+                findings.push(createFinding(sourceFile, node, childProcessRule));
+            }
+        }
+        ts.forEachChild(node, visit);
+    };
+    visit(sourceFile);
+    return findings;
+}
+//# sourceMappingURL=source-analysis.js.map

package/dist/src/analyzers/ast/source-analysis.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-analysis.js","sourceRoot":"","sources":["../../../../src/analyzers/ast/source-analysis.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,YAAY,CAAC;AAE5B,OAAO,EACL,gBAAgB,EAEjB,MAAM,YAAY,CAAC;AAQpB,SAAS,UAAU,CAAC,QAAgB;IAClC,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;IACxD,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;IACxD,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;IACtD,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;IACvD,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;IACvD,OAAO,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;AAC1B,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa;IACzC,OAAO,KAAK,KAAK,eAAe,IAAI,KAAK,KAAK,oBAAoB,CAAC;AACrE,CAAC;AAED,SAAS,oBAAoB,CAC3B,WAAiC;IAEjC,OAAO,EAAE,CAAC,eAAe,CAAC,WAAW,CAAC,eAAe,CAAC;QACpD,CAAC,CAAC,WAAW,CAAC,eAAe,CAAC,IAAI;QAClC,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,iBAAiB,CACxB,UAAqC;IAErC,IACE,CAAC,UAAU;QACX,CAAC,EAAE,CAAC,gBAAgB,CAAC,UAAU,CAAC;QAChC,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC,UAAU,CAAC;QACvC,UAAU,CAAC,UAAU,CAAC,IAAI,KAAK,SAAS;QACxC,UAAU,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EACjC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,CAAC,QAAQ,CAAC,GAAG,UAAU,CAAC,SAAS,CAAC;IAExC,OAAO,QAAQ,IAAI,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC;QAC7C,CAAC,CAAC,QAAQ,CAAC,IAAI;QACf,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,eAAe,CACtB,UAAyB;IAEzB,MAAM,QAAQ,GAAyB;QACrC,gBAAgB,EAAE,IAAI,GAAG,EAAE;QAC3B,WAAW,EAAE,IAAI,GAAG,EAAE;QACtB,eAAe,EAAE,IAAI,GAAG,EAAE;KAC3B,CAAC;IAEF,KAAK,MAAM,SAAS,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;QAC9C,IAAI,EAAE,CAAC,mBAAmB,CAAC,SAAS,CAAC,EAAE,CAAC;YACtC,MAAM,UAAU,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;YAEnD,IAAI,CAAC,UAAU,IAAI,CAAC,oBAAoB,CAAC,UAAU,CAAC,EAAE,CAAC;gBACrD,SAAS;YACX,CAAC;YAED,MAAM,YAAY,GAAG,SAAS,CAAC,YAAY,CAAC;YAE5C,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,SAAS;YACX,CAAC;YAED,MAAM,cAAc,GAAG,YAAY,CAAC,aAAa,CAAC;YAElD,IAAI,cAAc,IAAI,EAAE,CAAC,iBAAiB,CAAC,cAAc,CAAC,EAAE,CAAC;gBAC3D,QAAQ,CAAC,gBAAgB,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1D,CAAC;YAED,IAAI,cAAc,IAAI,EAAE,CAAC,cAAc,CAAC,cAAc,CAAC,EAAE,CAAC;gBACxD,KAAK,MAAM,OAAO,IAAI,cAAc,CAAC,QAAQ,EAAE,CAAC;oBAC9C,MAAM,YAAY,GAChB,OAAO,CAAC,YAAY,EAAE,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;oBAClD,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;oBAEpC,IAAI,YAAY,KAAK,MAAM,EAAE,CAAC;wBAC5B,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;oBACtC,CAAC;oBAED,IAAI,YAAY,KAAK,UAAU,EAAE,CAAC;wBAChC,QAAQ,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;oBAC1C,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC,EAAE,CAAC,mBAAmB,CAAC,SAAS,CAAC,EAAE,CAAC;YACvC,SAAS;QACX,CAAC;QAED,KAAK,MAAM,WAAW,IAAI,SAAS,CAAC,eAAe,CAAC,YAAY,EAAE,CAAC;YACjE,MAAM,WAAW,GAAG,WAAW,CAAC,WAAW,CAAC;YAC5C,MAAM,UAAU,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;YAElD,IACE,UAAU;gBACV,oBAAoB,CAAC,UAAU,CAAC;gBAChC,EAAE,CAAC,YAAY,CAAC,WAAW,CAAC,IAAI,CAAC,EACjC,CAAC;gBACD,QAAQ,CAAC,gBAAgB,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvD,CAAC;YAED,IACE,UAAU;gBACV,oBAAoB,CAAC,UAAU,CAAC;gBAChC,EAAE,CAAC,sBAAsB,CAAC,WAAW,CAAC,IAAI,CAAC,EAC3C,CAAC;gBACD,KAAK,MAAM,OAAO,IAAI,WAAW,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;oBAChD,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;wBACnC,SAAS;oBACX,CAAC;oBAED,MAAM,YAAY,GAChB,OAAO,CAAC,YAAY;wBACpB,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,YAAY,CAAC;wBACnC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI;wBAC3B,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;oBAExB,IAAI,YAAY,KAAK,MAAM,EAAE,CAAC;wBAC5B,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBAC9C,CAAC;oBAED,IAAI,YAAY,KAAK,UAAU,EAAE,CAAC;wBAChC,QAAQ,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBAClD,CAAC;gBACH,CAAC;YACH,CAAC;YAED,IACE,WAAW;gBACX,EAAE,CAAC,0BAA0B,CAAC,WAAW,CAAC;gBAC1C,EAAE,CAAC,gBAAgB,CAAC,WAAW,CAAC,UAAU,CAAC;gBAC3C,EAAE,CAAC,YAAY,CAAC,WAAW,CAAC,UAAU,CAAC,UAAU,CAAC;gBAClD,WAAW,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,KAAK,SAAS;gBACpD,WAAW,CAAC,UAAU,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAC7C,CAAC;gBACD,MAAM,CAAC,QAAQ,CAAC,GAAG,WAAW,CAAC,UAAU,CAAC,SAAS,CAAC;gBACpD,MAAM,cAAc,GAClB,QAAQ,IAAI,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC;oBACtC,CAAC,CAAC,QAAQ,CAAC,IAAI;oBACf,CAAC,CAAC,SAAS,CAAC;gBAEhB,IACE,cAAc;oBACd,oBAAoB,CAAC,cAAc,CAAC;oBACpC,EAAE,CAAC,YAAY,CAAC,WAAW,CAAC,IAAI,CAAC,EACjC,CAAC;oBACD,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;wBACrC,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBAClD,CAAC;oBAED,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;wBACzC,QAAQ,CAAC,eAAe,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACtD,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,eAAe,CACtB,UAAyB,EACzB,IAAa;IAEb,MAAM,KAAK,GAAG,UAAU,CAAC,6BAA6B,CACpD,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAC1B,CAAC;IACF,MAAM,GAAG,GAAG,UAAU,CAAC,6BAA6B,CAClD,IAAI,CAAC,MAAM,EAAE,CACd,CAAC;IAEF,OAAO;QACL,IAAI,EAAE,UAAU,CAAC,QAAQ;QACzB,IAAI,EAAE,KAAK,CAAC,IAAI,GAAG,CAAC;QACpB,MAAM,EAAE,KAAK,CAAC,SAAS,GAAG,CAAC;QAC3B,OAAO,EAAE,GAAG,CAAC,IAAI,GAAG,CAAC;QACrB,SAAS,EAAE,GAAG,CAAC,SAAS,GAAG,CAAC;KAC7B,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CACtB,UAAyB,EACzB,IAAa;IAEb,MAAM,IAAI,GAAG,IAAI;SACd,OAAO,CAAC,UAAU,CAAC;SACnB,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC;SACvB,IAAI,EAAE,CAAC;IAEV,OAAO,IAAI,CAAC,MAAM,IAAI,GAAG;QACvB,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC;AACjC,CAAC;AAED,SAAS,aAAa,CACpB,UAAyB,EACzB,IAAa,EACb,IAAqB;IAErB,MAAM,QAAQ,GAAG,eAAe,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IACnD,MAAM,WAAW,GACf,GAAG,IAAI,CAAC,EAAE,IAAI,UAAU,CAAC,QAAQ,GAAG;QACpC,GAAG,QAAQ,EAAE,IAAI,IAAI,CAAC,IAAI,QAAQ,EAAE,MAAM,IAAI,CAAC,EAAE,CAAC;IAEpD,OAAO;QACL,EAAE,EAAE,WAAW;QACf,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,MAAM,EAAE,gBAAgB;QACxB,QAAQ;QACR,QAAQ,EAAE;YACR;gBACE,OAAO,EAAE,eAAe,CAAC,UAAU,EAAE,IAAI,CAAC;gBAC1C,WAAW;aACZ;SACF;QACD,WAAW,EAAE;YACX,OAAO,EAAE,IAAI,CAAC,WAAW;SAC1B;QACD,QAAQ,EAAE;YACR,QAAQ,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;SACnC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAC9B,IAAuB,EACvB,QAA8B;IAE9B,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC;IAE/B,IAAI,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5B,IAAI,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1C,OAAO,gBAAgB,CAAC,gBAAgB,CAAC;QAC3C,CAAC;QAED,IAAI,QAAQ,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9C,OAAO,gBAAgB,CAAC,oBAAoB,CAAC;QAC/C,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,CAAC,EAAE,CAAC,0BAA0B,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3C,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IACE,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC;QACnC,CAAC,QAAQ,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,EACtD,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAChC,OAAO,gBAAgB,CAAC,gBAAgB,CAAC;IAC3C,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACpC,OAAO,gBAAgB,CAAC,oBAAoB,CAAC;IAC/C,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,QAAgB,EAChB,OAAe;IAEf,MAAM,UAAU,GAAG,EAAE,CAAC,gBAAgB,CACpC,QAAQ,EACR,OAAO,EACP,EAAE,CAAC,YAAY,CAAC,MAAM,EACtB,IAAI,EACJ,UAAU,CAAC,QAAQ,CAAC,CACrB,CAAC;IAEF,MAAM,QAAQ,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,MAAM,KAAK,GAAG,CAAC,IAAa,EAAQ,EAAE;QACpC,IACE,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC;YACzB,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC;YAChC,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,MAAM,EAC/B,CAAC;YACD,QAAQ,CAAC,IAAI,CACX,aAAa,CACX,UAAU,EACV,IAAI,EACJ,gBAAgB,CAAC,IAAI,CACtB,CACF,CAAC;QACJ,CAAC;QAED,IACE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC;YACxB,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC;YAChC,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,UAAU,EACnC,CAAC;YACD,QAAQ,CAAC,IAAI,CACX,aAAa,CACX,UAAU,EACV,IAAI,EACJ,gBAAgB,CAAC,mBAAmB,CACrC,CACF,CAAC;QACJ,CAAC;QAED,IAAI,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,MAAM,gBAAgB,GAAG,uBAAuB,CAC9C,IAAI,EACJ,QAAQ,CACT,CAAC;YAEF,IAAI,gBAAgB,EAAE,CAAC;gBACrB,QAAQ,CAAC,IAAI,CACX,aAAa,CACX,UAAU,EACV,IAAI,EACJ,gBAAgB,CACjB,CACF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC,CAAC;IAEF,KAAK,CAAC,UAAU,CAAC,CAAC;IAElB,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/src/analyzers/dependency-confusion/analyzer.d.ts

@@ -0,0 +1,9 @@
+import type { Analyzer, AnalyzerContext, AnalyzerResult } from '../../contracts/analyzer.js';
+export type RegistryLookup = (packageName: string, signal?: AbortSignal) => Promise<boolean>;
+export declare class DependencyConfusionAnalyzer implements Analyzer {
+    private readonly lookup;
+    readonly id = "dependency-confusion";
+    readonly version = "1.0.0";
+    constructor(lookup?: RegistryLookup);
+    analyze(context: AnalyzerContext): Promise<AnalyzerResult>;
+}

package/dist/src/analyzers/dependency-confusion/analyzer.js

@@ -0,0 +1,98 @@
+import { readFile } from 'node:fs/promises';
+import path from 'node:path';
+function dependencies(manifest) {
+    const sections = [
+        'dependencies',
+        'devDependencies',
+        'optionalDependencies',
+        'peerDependencies'
+    ];
+    const output = [];
+    for (const section of sections) {
+        for (const [name, requirement] of Object.entries(manifest[section] ?? {})) {
+            output.push({
+                name,
+                requirement,
+                section
+            });
+        }
+    }
+    return output;
+}
+function internalSignal(name, requirement) {
+    return (requirement.startsWith('file:') ||
+        requirement.startsWith('workspace:') ||
+        requirement.startsWith('link:') ||
+        requirement.startsWith('git+') ||
+        requirement.startsWith('github:') ||
+        (name.startsWith('@') &&
+            (requirement === '*' ||
+                requirement === 'latest')));
+}
+async function defaultLookup(packageName, signal) {
+    const response = await fetch(`https://registry.npmjs.org/${encodeURIComponent(packageName)}`, {
+        method: 'HEAD',
+        headers: {
+            'user-agent': 'toolip'
+        },
+        signal
+    });
+    if (response.status === 404) {
+        return false;
+    }
+    if (!response.ok) {
+        throw new Error(`npm registry lookup failed with HTTP ${response.status}.`);
+    }
+    return true;
+}
+export class DependencyConfusionAnalyzer {
+    lookup;
+    id = 'dependency-confusion';
+    version = '1.0.0';
+    constructor(lookup = defaultLookup) {
+        this.lookup = lookup;
+    }
+    async analyze(context) {
+        const startedAt = performance.now();
+        const manifest = JSON.parse(await readFile(path.join(context.root, 'package.json'), 'utf8'));
+        const candidates = dependencies(manifest).filter((item) => internalSignal(item.name, item.requirement));
+        const findings = [];
+        for (const candidate of candidates) {
+            const existsPublicly = await this.lookup(candidate.name, context.signal);
+            if (!existsPublicly) {
+                continue;
+            }
+            findings.push({
+                id: `TLP-CONFUSION-001:${candidate.name}`,
+                ruleId: 'TLP-CONFUSION-001',
+                title: `Internal dependency name exists publicly: ${candidate.name}`,
+                category: 'dependency-confusion',
+                severity: 'high',
+                confidence: 'medium',
+                message: `${candidate.name} uses ${candidate.requirement} in ` +
+                    `${candidate.section}, but the same name exists on the public npm registry.`,
+                source: 'npm-registry',
+                evidence: [
+                    {
+                        summary: `${candidate.section}: ${candidate.name} = ${candidate.requirement}`,
+                        fingerprint: `${candidate.name}:${candidate.requirement}`
+                    }
+                ],
+                remediation: {
+                    summary: 'Use an organization-controlled scope, enforce a private registry for the scope, pin registry configuration, and verify package provenance.'
+                },
+                metadata: candidate
+            });
+        }
+        return {
+            analyzer: this.id,
+            durationMs: Math.round(performance.now() - startedAt),
+            findings,
+            metadata: {
+                candidates: candidates.length,
+                publicCollisions: findings.length
+            }
+        };
+    }
+}
+//# sourceMappingURL=analyzer.js.map

package/dist/src/analyzers/dependency-confusion/analyzer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"analyzer.js","sourceRoot":"","sources":["../../../../src/analyzers/dependency-confusion/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,IAAI,MAAM,WAAW,CAAC;AAoB7B,SAAS,YAAY,CACnB,QAAyB;IAMzB,MAAM,QAAQ,GAAG;QACf,cAAc;QACd,iBAAiB;QACjB,sBAAsB;QACtB,kBAAkB;KACV,CAAC;IAEX,MAAM,MAAM,GAIP,EAAE,CAAC;IAER,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,KAAK,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAC9C,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,CACxB,EAAE,CAAC;YACF,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI;gBACJ,WAAW;gBACX,OAAO;aACR,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,cAAc,CACrB,IAAY,EACZ,WAAmB;IAEnB,OAAO,CACL,WAAW,CAAC,UAAU,CAAC,OAAO,CAAC;QAC/B,WAAW,CAAC,UAAU,CAAC,YAAY,CAAC;QACpC,WAAW,CAAC,UAAU,CAAC,OAAO,CAAC;QAC/B,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC;QAC9B,WAAW,CAAC,UAAU,CAAC,SAAS,CAAC;QACjC,CACE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YACpB,CACE,WAAW,KAAK,GAAG;gBACnB,WAAW,KAAK,QAAQ,CACzB,CACF,CACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,WAAmB,EACnB,MAAoB;IAEpB,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,8BAA8B,kBAAkB,CAC9C,WAAW,CACZ,EAAE,EACH;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,YAAY,EAAE,QAAQ;SACvB;QACD,MAAM;KACP,CACF,CAAC;IAEF,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,wCAAwC,QAAQ,CAAC,MAAM,GAAG,CAC3D,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,OAAO,2BAA2B;IAOnB;IAJV,EAAE,GAAG,sBAAsB,CAAC;IAC5B,OAAO,GAAG,OAAO,CAAC;IAE3B,YACmB,SACf,aAAa;QADE,WAAM,GAAN,MAAM,CACR;IACd,CAAC;IAEJ,KAAK,CAAC,OAAO,CACX,OAAwB;QAExB,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CACzB,MAAM,QAAQ,CACZ,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,cAAc,CAAC,EACvC,MAAM,CACP,CACiB,CAAC;QAErB,MAAM,UAAU,GACd,YAAY,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CACrC,cAAc,CACZ,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,WAAW,CACjB,CACF,CAAC;QAEJ,MAAM,QAAQ,GAAc,EAAE,CAAC;QAE/B,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,MAAM,cAAc,GAClB,MAAM,IAAI,CAAC,MAAM,CACf,SAAS,CAAC,IAAI,EACd,OAAO,CAAC,MAAM,CACf,CAAC;YAEJ,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,SAAS;YACX,CAAC;YAED,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EACA,qBAAqB,SAAS,CAAC,IAAI,EAAE;gBACvC,MAAM,EAAE,mBAAmB;gBAC3B,KAAK,EACH,6CAA6C,SAAS,CAAC,IAAI,EAAE;gBAC/D,QAAQ,EAAE,sBAAsB;gBAChC,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,QAAQ;gBACpB,OAAO,EACL,GAAG,SAAS,CAAC,IAAI,SAAS,SAAS,CAAC,WAAW,MAAM;oBACrD,GAAG,SAAS,CAAC,OAAO,wDAAwD;gBAC9E,MAAM,EAAE,cAAc;gBACtB,QAAQ,EAAE;oBACR;wBACE,OAAO,EACL,GAAG,SAAS,CAAC,OAAO,KAAK,SAAS,CAAC,IAAI,MAAM,SAAS,CAAC,WAAW,EAAE;wBACtE,WAAW,EACT,GAAG,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC,WAAW,EAAE;qBAC/C;iBACF;gBACD,WAAW,EAAE;oBACX,OAAO,EACL,4IAA4I;iBAC/I;gBACD,QAAQ,EAAE,SAAS;aACpB,CAAC,CAAC;QACL,CAAC;QAED,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,EAAE;YACjB,UAAU,EAAE,IAAI,CAAC,KAAK,CACpB,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,CAC9B;YACD,QAAQ;YACR,QAAQ,EAAE;gBACR,UAAU,EAAE,UAAU,CAAC,MAAM;gBAC7B,gBAAgB,EAAE,QAAQ,CAAC,MAAM;aAClC;SACF,CAAC;IACJ,CAAC;CACF"}

package/dist/src/analyzers/docker/analyzer.d.ts

@@ -0,0 +1,6 @@
+import type { Analyzer, AnalyzerContext, AnalyzerResult } from '../../contracts/analyzer.js';
+export declare class DockerfileAnalyzer implements Analyzer {
+    readonly id = "dockerfile-security";
+    readonly version = "1.0.0";
+    analyze(context: AnalyzerContext): Promise<AnalyzerResult>;
+}

package/dist/src/analyzers/docker/analyzer.js

@@ -0,0 +1,103 @@
+import { readFile } from 'node:fs/promises';
+import { createScannerContext } from '../../core/scanner-context.js';
+const rules = [
+    {
+        id: 'TLP-DOCKER-001',
+        title: 'Container may run as root',
+        severity: 'high',
+        test: (_line, lines) => !lines.some((line) => /^USER\s+(?!root\b|0\b)/i.test(line.trim())),
+        message: 'No non-root USER instruction was found.',
+        remediation: 'Create and switch to a dedicated non-root user before the final command.'
+    },
+    {
+        id: 'TLP-DOCKER-002',
+        title: 'Secret-like value in Docker ARG or ENV',
+        severity: 'critical',
+        test: (line) => /^(ARG|ENV)\s+.*(TOKEN|SECRET|PASSWORD|API_KEY|PRIVATE_KEY)/i.test(line.trim()),
+        message: 'A secret-like variable is declared through ARG or ENV.',
+        remediation: 'Use runtime secret injection or BuildKit secret mounts instead of image metadata.'
+    },
+    {
+        id: 'TLP-DOCKER-003',
+        title: 'Unpinned base image tag',
+        severity: 'medium',
+        test: (line) => /^FROM\s+\S+(?::latest)?(?:\s|$)/i.test(line.trim()) && !/@sha256:/i.test(line),
+        message: 'The base image is not pinned by digest.',
+        remediation: 'Pin trusted base images by immutable digest and review updates deliberately.'
+    },
+    {
+        id: 'TLP-DOCKER-004',
+        title: 'Remote ADD instruction',
+        severity: 'high',
+        test: (line) => /^ADD\s+https?:\/\//i.test(line.trim()),
+        message: 'ADD downloads remote content during the image build.',
+        remediation: 'Download explicitly, verify checksums, and use COPY for local content.'
+    },
+    {
+        id: 'TLP-DOCKER-005',
+        title: 'Package installation without cleanup',
+        severity: 'low',
+        test: (line) => /apt-get\s+install/i.test(line) && !/rm\s+-rf\s+\/var\/lib\/apt\/lists/i.test(line),
+        message: 'apt package metadata may remain in the image layer.',
+        remediation: 'Combine installation and cleanup in the same RUN instruction.'
+    }
+];
+export class DockerfileAnalyzer {
+    id = 'dockerfile-security';
+    version = '1.0.0';
+    async analyze(context) {
+        const startedAt = performance.now();
+        const scanner = await createScannerContext(context.root);
+        const findings = [];
+        let dockerfiles = 0;
+        for (const file of scanner.files) {
+            if (!/(^|\/)Dockerfile(?:\.[^/]+)?$/i.test(file.relativePath))
+                continue;
+            dockerfiles += 1;
+            const content = await readFile(file.absolutePath, 'utf8');
+            const lines = content.split(/\r?\n/);
+            for (const rule of rules) {
+                const matches = rule.id === 'TLP-DOCKER-001'
+                    ? [lines[0] ?? '']
+                    : lines.filter((line) => rule.test(line, lines));
+                if (rule.id === 'TLP-DOCKER-001' && !rule.test('', lines))
+                    continue;
+                for (const match of matches) {
+                    const lineNumber = Math.max(1, lines.indexOf(match) + 1);
+                    findings.push({
+                        id: `${rule.id}:${file.relativePath}:${lineNumber}`,
+                        ruleId: rule.id,
+                        title: rule.title,
+                        category: 'container',
+                        severity: rule.severity,
+                        confidence: 'high',
+                        message: rule.message,
+                        source: 'dockerfile',
+                        location: {
+                            file: file.relativePath,
+                            line: lineNumber,
+                            column: 1
+                        },
+                        evidence: [{
+                                summary: match.trim().slice(0, 200) || 'No non-root USER instruction',
+                                fingerprint: `${file.relativePath}:${lineNumber}:${rule.id}`
+                            }],
+                        remediation: {
+                            summary: rule.remediation
+                        }
+                    });
+                }
+            }
+        }
+        return {
+            analyzer: this.id,
+            durationMs: Math.round(performance.now() - startedAt),
+            findings,
+            metadata: {
+                dockerfiles,
+                findings: findings.length
+            }
+        };
+    }
+}
+//# sourceMappingURL=analyzer.js.map

package/dist/src/analyzers/docker/analyzer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"analyzer.js","sourceRoot":"","sources":["../../../../src/analyzers/docker/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAG5C,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAWrE,MAAM,KAAK,GAAiB;IAC1B;QACE,EAAE,EAAE,gBAAgB;QACpB,KAAK,EAAE,2BAA2B;QAClC,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1F,OAAO,EAAE,yCAAyC;QAClD,WAAW,EAAE,0EAA0E;KACxF;IACD;QACE,EAAE,EAAE,gBAAgB;QACpB,KAAK,EAAE,wCAAwC;QAC/C,QAAQ,EAAE,UAAU;QACpB,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,6DAA6D,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAC/F,OAAO,EAAE,wDAAwD;QACjE,WAAW,EAAE,mFAAmF;KACjG;IACD;QACE,EAAE,EAAE,gBAAgB;QACpB,KAAK,EAAE,yBAAyB;QAChC,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,kCAAkC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;QAC/F,OAAO,EAAE,yCAAyC;QAClD,WAAW,EAAE,8EAA8E;KAC5F;IACD;QACE,EAAE,EAAE,gBAAgB;QACpB,KAAK,EAAE,wBAAwB;QAC/B,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACvD,OAAO,EAAE,sDAAsD;QAC/D,WAAW,EAAE,wEAAwE;KACtF;IACD;QACE,EAAE,EAAE,gBAAgB;QACpB,KAAK,EAAE,sCAAsC;QAC7C,QAAQ,EAAE,KAAK;QACf,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,oCAAoC,CAAC,IAAI,CAAC,IAAI,CAAC;QACnG,OAAO,EAAE,qDAAqD;QAC9D,WAAW,EAAE,+DAA+D;KAC7E;CACF,CAAC;AAEF,MAAM,OAAO,kBAAkB;IACpB,EAAE,GAAG,qBAAqB,CAAC;IAC3B,OAAO,GAAG,OAAO,CAAC;IAE3B,KAAK,CAAC,OAAO,CAAC,OAAwB;QACpC,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACzD,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,IAAI,WAAW,GAAG,CAAC,CAAC;QAEpB,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YACjC,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC;gBAAE,SAAS;YAExE,WAAW,IAAI,CAAC,CAAC;YACjB,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;YAC1D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAErC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,MAAM,OAAO,GAAG,IAAI,CAAC,EAAE,KAAK,gBAAgB;oBAC1C,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;oBAClB,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;gBAEnD,IAAI,IAAI,CAAC,EAAE,KAAK,gBAAgB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC;oBAAE,SAAS;gBAEpE,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;oBAC5B,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;oBACzD,QAAQ,CAAC,IAAI,CAAC;wBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,YAAY,IAAI,UAAU,EAAE;wBACnD,MAAM,EAAE,IAAI,CAAC,EAAE;wBACf,KAAK,EAAE,IAAI,CAAC,KAAK;wBACjB,QAAQ,EAAE,WAAW;wBACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;wBACvB,UAAU,EAAE,MAAM;wBAClB,OAAO,EAAE,IAAI,CAAC,OAAO;wBACrB,MAAM,EAAE,YAAY;wBACpB,QAAQ,EAAE;4BACR,IAAI,EAAE,IAAI,CAAC,YAAY;4BACvB,IAAI,EAAE,UAAU;4BAChB,MAAM,EAAE,CAAC;yBACV;wBACD,QAAQ,EAAE,CAAC;gCACT,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,8BAA8B;gCACrE,WAAW,EAAE,GAAG,IAAI,CAAC,YAAY,IAAI,UAAU,IAAI,IAAI,CAAC,EAAE,EAAE;6BAC7D,CAAC;wBACF,WAAW,EAAE;4BACX,OAAO,EAAE,IAAI,CAAC,WAAW;yBAC1B;qBACF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,EAAE;YACjB,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YACrD,QAAQ;YACR,QAAQ,EAAE;gBACR,WAAW;gBACX,QAAQ,EAAE,QAAQ,CAAC,MAAM;aAC1B;SACF,CAAC;IACJ,CAAC;CACF"}

package/dist/src/analyzers/git-history/analyzer.d.ts

@@ -0,0 +1,8 @@
+import type { Analyzer, AnalyzerContext, AnalyzerResult } from '../../contracts/analyzer.js';
+export declare class GitHistorySecretAnalyzer implements Analyzer {
+    private readonly maxCommits;
+    readonly id = "git-history-secrets";
+    readonly version = "1.0.0";
+    constructor(maxCommits?: number);
+    analyze(context: AnalyzerContext): Promise<AnalyzerResult>;
+}