forked from SocketDev/socket-python-cli
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathissues.py
More file actions
2101 lines (1727 loc) · 66.5 KB
/
issues.py
File metadata and controls
2101 lines (1727 loc) · 66.5 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
import json
__all__ = [
"AllIssues",
"badEncoding",
"badSemver",
"badSemverDependency",
"bidi",
"binScriptConfusion",
"chronoAnomaly",
"criticalCVE",
"cve",
"debugAccess",
"deprecated",
"deprecatedException",
"explicitlyUnlicensedItem",
"unidentifiedLicense",
"noLicenseFound",
"copyleftLicense",
"nonpermissiveLicense",
"miscLicenseIssues",
"deprecatedLicense",
"didYouMean",
"dynamicRequire",
"emptyPackage",
"envVars",
"extraneousDependency",
"fileDependency",
"filesystemAccess",
"gitDependency",
"gitHubDependency",
"hasNativeCode",
"highEntropyStrings",
"homoglyphs",
"httpDependency",
"installScripts",
"gptSecurity",
"gptAnomaly",
"gptMalware",
"potentialVulnerability",
"invalidPackageJSON",
"invisibleChars",
"licenseChange",
"licenseException",
"longStrings",
"missingTarball",
"majorRefactor",
"malware",
"manifestConfusion",
"mediumCVE",
"mildCVE",
"minifiedFile",
"missingAuthor",
"missingDependency",
"missingLicense",
"mixedLicense",
"ambiguousClassifier",
"modifiedException",
"modifiedLicense",
"networkAccess",
"newAuthor",
"noAuthorData",
"noBugTracker",
"noREADME",
"noRepository",
"noTests",
"noV1",
"noWebsite",
"nonFSFLicense",
"nonOSILicense",
"nonSPDXLicense",
"notice",
"obfuscatedFile",
"obfuscatedRequire",
"peerDependency",
"semverAnomaly",
"shellAccess",
"shellScriptOverride",
"suspiciousString",
"telemetry",
"trivialPackage",
"troll",
"typeModuleCompatibility",
"uncaughtOptionalDependency",
"unclearLicense",
"shrinkwrap",
"unmaintained",
"unpublished",
"unresolvedRequire",
"unsafeCopyright",
"unstableOwnership",
"unusedDependency",
"urlStrings",
"usesEval",
"zeroWidth",
"floatingDependency",
"unpopularPackage",
]
class badEncoding:
description: str
props: dict
suggestion: str
title: str
emoji: str
nextStepTitle: str
def __init__(self):
self.description = "Source files are encoded using a non-standard text encoding."
self.props = {"encoding": "Encoding"}
self.suggestion = "Ensure all published files are encoded using a standard encoding such as UTF8, UTF16, UTF32, SHIFT-JIS, etc."
self.title = "Bad text encoding"
self.emoji = "\u26a0\ufe0f"
self.nextStepTitle = "What is bad text encoding?"
def __str__(self):
return json.dumps(self.__dict__)
class badSemver:
description: str
suggestion: str
title: str
emoji: str
nextStepTitle: str
def __init__(self):
self.description = "Package version is not a valid semantic version (semver)."
self.suggestion = "All versions of all packages on npm should use use a valid semantic version. Publish a new version of the package with a valid semantic version. Semantic version ranges do not work with invalid semantic versions."
self.title = "Bad semver"
self.emoji = "\u26a0\ufe0f"
self.nextStepTitle = "What is bad semver?"
def __str__(self):
return json.dumps(self.__dict__)
class badSemverDependency:
description: str
props: dict
suggestion: str
title: str
emoji: str
nextStepTitle: str
def __init__(self):
self.description = "Package has dependencies with an invalid semantic version. This could be a sign of beta, low quality, or unmaintained dependencies."
self.props = {"packageName": "Package name", "packageVersion": "Package version"}
self.suggestion = "Switch to a version of the dependency with valid semver or override the dependency version if it is determined to be problematic."
self.title = "Bad dependency semver"
self.emoji = "\u26a0\ufe0f"
self.nextStepTitle = "What is bad dependency semver?"
def __str__(self):
return json.dumps(self.__dict__)
class bidi:
description: str
suggestion: str
title: str
emoji: str
nextStepTitle: str
def __init__(self):
self.description = "Source files contain bidirectional unicode control characters. This could indicate a Trojan source supply chain attack. See: trojansource.codes for more information."
self.suggestion = "Remove bidirectional unicode control characters, or clearly document what they are used for."
self.title = "Bidirectional unicode control characters"
self.emoji = "\u26a0\ufe0f"
self.nextStepTitle = "What are bidirectional unicode control characters?"
def __str__(self):
return json.dumps(self.__dict__)
class binScriptConfusion:
description: str
props: dict
suggestion: str
title: str
emoji: str
nextStepTitle: str
def __init__(self):
self.description = "This package has multiple bin scripts with the same name. This can cause non-deterministic behavior when installing or could be a sign of a supply chain attack"
self.props = {"binScript": "Bin script"}
self.suggestion = "Consider removing one of the conflicting packages. Packages should only export bin scripts with their name"
self.title = "Bin script confusion"
self.emoji = "\ud83d\ude35\u200d\ud83d\udcab"
self.nextStepTitle = "What is bin script confusion?"
def __str__(self):
return json.dumps(self.__dict__)
class chronoAnomaly:
description: str
props: dict
suggestion: str
title: str
emoji: str
nextStepTitle: str
def __init__(self):
self.description = "Semantic versions published out of chronological order."
self.props = {"prevChronoDate": "Previous chronological date", "prevChronoVersion": "Previous chronological version", "prevSemverDate": "Previous semver date", "prevSemverVersion": "Previous semver version"}
self.suggestion = "This could either indicate dependency confusion or a patched vulnerability."
self.title = "Chronological version anomaly"
self.emoji = "\u26a0\ufe0f"
self.nextStepTitle = "What is a chronological version anomaly?"
def __str__(self):
return json.dumps(self.__dict__)
class criticalCVE:
description: str
props: dict
suggestion: str
title: str
emoji: str
nextStepTitle: str
def __init__(self):
self.description = "Contains a Critical Common Vulnerability and Exposure (CVE)."
self.props = {"cveId": "CVE ID", "cwes": "CWEs", "cvss": "CVSS", "description": "Description", "firstPatchedVersionIdentifier": "Patched version", "ghsaId": "GHSA ID", "id": "Id", "severity": "Severity", "title": "Title", "url": "URL", "vulnerableVersionRange": "Vulnerable versions"}
self.suggestion = "Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies."
self.title = "Critical CVE"
self.emoji = "\u26a0\ufe0f"
self.nextStepTitle = "What is a critical CVE?"
def __str__(self):
return json.dumps(self.__dict__)
class cve:
description: str
props: dict
suggestion: str
title: str
emoji: str
nextStepTitle: str
def __init__(self):
self.description = "Contains a high severity Common Vulnerability and Exposure (CVE)."
self.props = {"cveId": "CVE ID", "cwes": "CWEs", "cvss": "CVSS", "description": "Description", "firstPatchedVersionIdentifier": "Patched version", "ghsaId": "GHSA ID", "id": "Id", "severity": "Severity", "title": "Title", "url": "URL", "vulnerableVersionRange": "Vulnerable versions"}
self.suggestion = "Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies."
self.title = "High CVE"
self.emoji = "\u26a0\ufe0f"
self.nextStepTitle = "What is a CVE?"
def __str__(self):
return json.dumps(self.__dict__)
class debugAccess:
description: str
props: dict
suggestion: str
title: str
emoji: str
nextStepTitle: str
def __init__(self):
self.description = "Uses debug, reflection and dynamic code execution features."
self.props = {"module": "Module"}
self.suggestion = "Removing the use of debug will reduce the risk of any reflection and dynamic code execution."
self.title = "Debug access"
self.emoji = "\u26a0\ufe0f"
self.nextStepTitle = "What is debug access?"
def __str__(self):
return json.dumps(self.__dict__)
class deprecated:
description: str
props: dict
suggestion: str
title: str
emoji: str
nextStepTitle: str
def __init__(self):
self.description = "The maintainer of the package marked it as deprecated. This could indicate that a single version should not be used, or that the package is no longer maintained and any new vulnerabilities will not be fixed."
self.props = {"reason": "Reason"}
self.suggestion = "Research the state of the package and determine if there are non-deprecated versions that can be used, or if it should be replaced with a new, supported solution."
self.title = "Deprecated"
self.emoji = "\u26a0\ufe0f"
self.nextStepTitle = "What is a deprecated package?"
def __str__(self):
return json.dumps(self.__dict__)
class deprecatedException:
description: str
props: dict
suggestion: str
title: str
emoji: str
nextStepTitle: str
def __init__(self):
self.description = "(Experimental) Contains a known deprecated SPDX license exception."
self.props = {"comments": "Comments", "exceptionId": "Exception id"}
self.suggestion = "Fix the license so that it no longer contains deprecated SPDX license exceptions."
self.title = "Deprecated SPDX exception"
self.emoji = "\u26a0\ufe0f"
self.nextStepTitle = "What is a deprecated SPDX exception?"
def __str__(self):
return json.dumps(self.__dict__)
class explicitlyUnlicensedItem:
description: str
props: dict
suggestion: str
title: str
emoji: str
nextStepTitle: str
def __init__(self):
self.description = "(Experimental) Something was found which is explicitly marked as unlicensed"
self.props = {"location": "Location"}
self.suggestion = "Manually review your policy on such materials"
self.title = "Explicitly Unlicensed Item"
self.emoji = "\u26a0\ufe0f"
self.nextStepTitle = "What do I need to know about license files?"
def __str__(self):
return json.dumps(self.__dict__)
class unidentifiedLicense:
description: str
props: dict
suggestion: str
title: str
emoji: str
nextStepTitle: str
def __init__(self):
self.description = "(Experimental) Something that seems like a license was found, but its contents could not be matched with a known license"
self.props = {"comments": "Comments", "exceptionId": "Exception id", "location": "Location"}
self.suggestion = "Manually review the license contents."
self.title = "Unidentified License"
self.emoji = "\u26a0\ufe0f"
self.nextStepTitle = "What do I need to know about license files?"
def __str__(self):
return json.dumps(self.__dict__)
class noLicenseFound:
description: str
props: dict
suggestion: str
title: str
emoji: str
nextStepTitle: str
def __init__(self):
self.description = "(Experimental) License information could not be found"
self.props = {"comments": "Comments", "exceptionId": "Exception id"}
self.suggestion = "Manually review the licensing"
self.title = "No License Found"
self.emoji = "\u26a0\ufe0f"
self.nextStepTitle = "What do I need to know about license files?"
def __str__(self):
return json.dumps(self.__dict__)
class copyleftLicense:
description: str
props: dict
suggestion: str
title: str
emoji: str
nextStepTitle: str
def __init__(self):
self.description = "(Experimental) Copyleft license information was found"
self.props = {"comments": "Comments", "licenseId": "License Identifiers"}
self.suggestion = "Determine whether use of copyleft material works for you"
self.title = "Copyleft License"
self.emoji = "\u26a0\ufe0f"
self.nextStepTitle = "What do I need to know about license files?"
def __str__(self):
return json.dumps(self.__dict__)
class nonpermissiveLicense:
description: str
props: dict
suggestion: str
title: str
emoji: str
nextStepTitle: str
def __init__(self):
self.description = "(Experimental) A license not known to be considered permissive was found"
self.props = {"comments": "Comments", "licenseId": "License Identifier"}
self.suggestion = "Determine whether use of material not offered under a known permissive license works for you"
self.title = "Non-permissive License"
self.emoji = "\u26a0\ufe0f"
self.nextStepTitle = "What do I need to know about license files?"
def __str__(self):
return json.dumps(self.__dict__)
class miscLicenseIssues:
description: str
props: dict
suggestion: str
title: str
emoji: str
nextStepTitle: str
def __init__(self):
self.description = "(Experimental) A package's licensing information has fine-grained problems"
self.props = {"description": "Description", "location": "The location where the issue originates from"}
self.suggestion = "Determine whether use of material not offered under a known permissive license works for you"
self.title = "Nonpermissive License"
self.emoji = "\u26a0\ufe0f"
self.nextStepTitle = "What do I need to know about license files?"
def __str__(self):
return json.dumps(self.__dict__)
class deprecatedLicense:
description: str
props: dict
suggestion: str
title: str
emoji: str
nextStepTitle: str
def __init__(self):
self.description = "(Experimental) License is deprecated which may have legal implications regarding the package's use."
self.props = {"licenseId": "License id"}
self.suggestion = "Update or change the license to a well-known or updated license."
self.title = "Deprecated license"
self.emoji = "\u26a0\ufe0f"
self.nextStepTitle = "What is a deprecated license?"
def __str__(self):
return json.dumps(self.__dict__)
class didYouMean:
description: str
props: dict
suggestion: str
title: str
emoji: str
nextStepTitle: str
def __init__(self):
self.description = "Package name is similar to other popular packages and may not be the package you want."
self.props = {"alternatePackage": "Alternate package", "downloads": "Downloads", "downloadsRatio": "Download ratio", "editDistance": "Edit distance"}
self.suggestion = "Use care when consuming similarly named packages and ensure that you did not intend to consume a different package. Malicious packages often publish using similar names as existing popular packages."
self.title = "Possible typosquat attack"
self.emoji = "\ud83e\uddd0"
self.nextStepTitle = "What is a typosquat?"
def __str__(self):
return json.dumps(self.__dict__)
class dynamicRequire:
description: str
suggestion: str
title: str
emoji: str
nextStepTitle: str
def __init__(self):
self.description = "Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution."
self.suggestion = "Packages should avoid dynamic imports when possible. Audit the use of dynamic require to ensure it is not executing malicious or vulnerable code."
self.title = "Dynamic require"
self.emoji = "\u26a0\ufe0f"
self.nextStepTitle = "What is dynamic require?"
def __str__(self):
return json.dumps(self.__dict__)
class emptyPackage:
description: str
props: dict
suggestion: str
title: str
emoji: str
nextStepTitle: str
def __init__(self):
self.description = "Package does not contain any code. It may be removed, is name squatting, or the result of a faulty package publish."
self.props = {"linesOfCode": "Lines of code"}
self.suggestion = "Remove dependencies that do not export any code or functionality and ensure the package version includes all of the files it is supposed to."
self.title = "Empty package"
self.emoji = "\u26a0\ufe0f"
self.nextStepTitle = "What is an empty package?"
def __str__(self):
return json.dumps(self.__dict__)
class envVars:
description: str
props: dict
suggestion: str
title: str
emoji: str
capabilityName: str
nextStepTitle: str
def __init__(self):
self.description = "Package accesses environment variables, which may be a sign of credential stuffing or data theft."
self.props = {"envVars": "Environment variables"}
self.suggestion = "Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to."
self.title = "Environment variable access"
self.emoji = "\u26a0\ufe0f"
self.capabilityName = "environment"
self.nextStepTitle = "What is environment variable access?"
def __str__(self):
return json.dumps(self.__dict__)
class extraneousDependency:
description: str
props: dict
suggestion: str
title: str
emoji: str
nextStepTitle: str
def __init__(self):
self.description = "Package optionally loads a dependency which is not specified within any of the package.json dependency fields. It may inadvertently be importing dependencies specified by other packages."
self.props = {"name": "Name"}
self.suggestion = "Specify all optionally loaded dependencies in optionalDependencies within package.json."
self.title = "Extraneous dependency"
self.emoji = "\u26a0\ufe0f"
self.nextStepTitle = "What are extraneous dependencies?"
def __str__(self):
return json.dumps(self.__dict__)
class fileDependency:
description: str
props: dict
suggestion: str
title: str
emoji: str
nextStepTitle: str
def __init__(self):
self.description = "Contains a dependency which resolves to a file. This can obfuscate analysis and serves no useful purpose."
self.props = {"filePath": "File path", "packageName": "Package name"}
self.suggestion = "Remove the dependency specified by a file resolution string from package.json and update any bare name imports that referenced it before to use relative path strings."
self.title = "File dependency"
self.emoji = "\u26a0\ufe0f"
self.nextStepTitle = "What are file dependencies?"
def __str__(self):
return json.dumps(self.__dict__)
class filesystemAccess:
description: str
props: dict
suggestion: str
title: str
emoji: str
capabilityName: str
nextStepTitle: str
def __init__(self):
self.description = "Accesses the file system, and could potentially read sensitive data."
self.props = {"module": "Module"}
self.suggestion = "If a package must read the file system, clarify what it will read and ensure it reads only what it claims to. If appropriate, packages can leave file system access to consumers and operate on data passed to it instead."
self.title = "Filesystem access"
self.emoji = "\u26a0\ufe0f"
self.capabilityName = "filesystem"
self.nextStepTitle = "What is filesystem access?"
def __str__(self):
return json.dumps(self.__dict__)
class gitDependency:
description: str
props: dict
suggestion: str
title: str
emoji: str
nextStepTitle: str
def __init__(self):
self.description = "Contains a dependency which resolves to a remote git URL. Dependencies fetched from git URLs are not immutable can be used to inject untrusted code or reduce the likelihood of a reproducible install."
self.props = {"packageName": "Package name", "url": "URL"}
self.suggestion = "Publish the git dependency to npm or a private package repository and consume it from there."
self.title = "Git dependency"
self.emoji = "\ud83c\udf63"
self.nextStepTitle = "What are git dependencies?"
def __str__(self):
return json.dumps(self.__dict__)
class gitHubDependency:
description: str
props: dict
suggestion: str
title: str
emoji: str
nextStepTitle: str
def __init__(self):
self.description = "Contains a dependency which resolves to a GitHub URL. Dependencies fetched from GitHub specifiers are not immutable can be used to inject untrusted code or reduce the likelihood of a reproducible install."
self.props = {"commitsh": "Commit-ish (commit, branch, tag or version)", "githubRepo": "GitHub repo", "githubUser": "GitHub user", "packageName": "Package name"}
self.suggestion = "Publish the GitHub dependency to npm or a private package repository and consume it from there."
self.title = "GitHub dependency"
self.emoji = "\u26a0\ufe0f"
self.nextStepTitle = "What are GitHub dependencies?"
def __str__(self):
return json.dumps(self.__dict__)
class hasNativeCode:
description: str
suggestion: str
title: str
emoji: str
nextStepTitle: str
def __init__(self):
self.description = "Contains native code which could be a vector to obscure malicious code, and generally decrease the likelihood of reproducible or reliable installs."
self.suggestion = "Ensure that native code bindings are expected. Consumers may consider pure JS and functionally similar alternatives to avoid the challenges and risks associated with native code bindings."
self.title = "Native code"
self.emoji = "\ud83e\udee3"
self.nextStepTitle = "What's wrong with native code?"
def __str__(self):
return json.dumps(self.__dict__)
class highEntropyStrings:
description: str
suggestion: str
title: str
emoji: str
nextStepTitle: str
def __init__(self):
self.description = "Contains high entropy strings. This could be a sign of encrypted data, leaked secrets or obfuscated code."
self.suggestion = "Please inspect these strings to check if these strings are benign. Maintainers should clarify the purpose and existence of high entropy strings if there is a legitimate purpose."
self.title = "High entropy strings"
self.emoji = "\u26a0\ufe0f"
self.nextStepTitle = "What are high entropy strings?"
def __str__(self):
return json.dumps(self.__dict__)
class homoglyphs:
description: str
suggestion: str
title: str
emoji: str
nextStepTitle: str
def __init__(self):
self.description = "Contains unicode homoglyphs which can be used in supply chain confusion attacks."
self.suggestion = "Remove unicode homoglyphs if they are unnecessary, and audit their presence to confirm legitimate use."
self.title = "Unicode homoglyphs"
self.emoji = "\u26a0\ufe0f"
self.nextStepTitle = "What are unicode homoglyphs?"
def __str__(self):
return json.dumps(self.__dict__)
class httpDependency:
description: str
props: dict
suggestion: str
title: str
emoji: str
nextStepTitle: str
def __init__(self):
self.description = "Contains a dependency which resolves to a remote HTTP URL which could be used to inject untrusted code and reduce overall package reliability."
self.props = {"packageName": "Package name", "url": "URL"}
self.suggestion = "Publish the HTTP URL dependency to npm or a private package repository and consume it from there."
self.title = "HTTP dependency"
self.emoji = "\ud83e\udd69"
self.nextStepTitle = "What are http dependencies?"
def __str__(self):
return json.dumps(self.__dict__)
class installScripts:
description: str
props: dict
suggestion: str
title: str
emoji: str
nextStepTitle: str
def __init__(self):
self.description = "Install scripts are run when the package is installed. The majority of malware in npm is hidden in install scripts."
self.props = {"script": "Script", "source": "Source"}
self.suggestion = "Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead."
self.title = "Install scripts"
self.emoji = "\ud83d\udcdc"
self.nextStepTitle = "What is an install script?"
def __str__(self):
return json.dumps(self.__dict__)
class gptSecurity:
description: str
props: dict
suggestion: str
title: str
emoji: str
nextStepTitle: str
def __init__(self):
self.description = "AI has determined that this package may contain potential security issues or vulnerabilities."
self.props = {"notes": "AI-based analysis of the package's code and behavior", "confidence": "Confidence of this analysis", "severity": "Impact of this threat"}
self.suggestion = "An AI system identified potential security problems in this package. It is advised to review the package thoroughly and assess the potential risks before installation. You may also consider reporting the issue to the package maintainer or seeking alternative solutions with a stronger security posture."
self.title = "AI detected security risk"
self.emoji = "\ud83e\udd16"
self.nextStepTitle = "What are AI detected security risks?"
def __str__(self):
return json.dumps(self.__dict__)
class gptAnomaly:
description: str
props: dict
suggestion: str
title: str
emoji: str
nextStepTitle: str
def __init__(self):
self.description = "AI has identified unusual behaviors that may pose a security risk."
self.props = {"notes": "AI-based analysis of the package's code and behavior", "confidence": "Confidence of this analysis", "severity": "Impact of this threat", "risk": "Risk level"}
self.suggestion = "An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding."
self.title = "AI detected anomaly"
self.emoji = "\ud83e\udd14"
self.nextStepTitle = "What is an AI detected anomaly?"
def __str__(self):
return json.dumps(self.__dict__)
class gptMalware:
description: str
props: dict
suggestion: str
title: str
emoji: str
nextStepTitle: str
def __init__(self):
self.description = "AI has identified this package as malware. This is a strong signal that the package may be malicious."
self.props = {"notes": "AI-based analysis of the package's code and behavior", "confidence": "Confidence of this analysis", "severity": "Impact of this behavior"}
self.suggestion = "Given the AI system's identification of this package as malware, extreme caution is advised. It is recommended to avoid downloading or installing this package until the threat is confirmed or flagged as a false positive."
self.title = "AI detected potential malware"
self.emoji = "\ud83e\udd16"
self.nextStepTitle = "What is AI detected malware?"
def __str__(self):
return json.dumps(self.__dict__)
class potentialVulnerability:
description: str
props: dict
suggestion: str
title: str
emoji: str
nextStepTitle: str
def __init__(self):
self.description = "Initial human review suggests the presence of a vulnerability in this package. It is pending further analysis and confirmation."
self.props = {"note": "AI detection + human review", "risk": "Risk level"}
self.suggestion = "It is advisable to proceed with caution. Engage in a review of the package's security aspects and consider reaching out to the package maintainer for the latest information or patches."
self.title = "Potential vulnerability"
self.emoji = "\ud83d\udea7"
self.nextStepTitle = "Navigating potential vulnerabilities"
def __str__(self):
return json.dumps(self.__dict__)
class invalidPackageJSON:
description: str
suggestion: str
title: str
emoji: str
nextStepTitle: str
def __init__(self):
self.description = "Package has an invalid manifest file and can cause installation problems if you try to use it."
self.suggestion = "Fix syntax errors in the manifest file and publish a new version. Consumers can use npm overrides to force a version that does not have this problem if one exists."
self.title = "Invalid manifest file"
self.emoji = "\ud83e\udd12"
self.nextStepTitle = "What is an invalid manifest file?"
def __str__(self):
return json.dumps(self.__dict__)
class invisibleChars:
description: str
suggestion: str
title: str
emoji: str
nextStepTitle: str
def __init__(self):
self.description = "Source files contain invisible characters. This could indicate source obfuscation or a supply chain attack."
self.suggestion = "Remove invisible characters. If their use is justified, use their visible escaped counterparts."
self.title = "Invisible chars"
self.emoji = "\u26a0\ufe0f"
self.nextStepTitle = "What are invisible characters?"
def __str__(self):
return json.dumps(self.__dict__)
class licenseChange:
description: str
props: dict
suggestion: str
title: str
emoji: str
nextStepTitle: str
def __init__(self):
self.description = "(Experimental) Package license has recently changed."
self.props = {"newLicenseId": "New license id", "prevLicenseId": "Previous license id"}
self.suggestion = "License changes should be reviewed carefully to inform ongoing use. Packages should avoid making major changes to their license type."
self.title = "License change"
self.emoji = "\u26a0\ufe0f"
self.nextStepTitle = "What is a license change?"
def __str__(self):
return json.dumps(self.__dict__)
class licenseException:
description: str
props: dict
suggestion: str
title: str
emoji: str
nextStepTitle: str
def __init__(self):
self.description = "(Experimental) Contains an SPDX license exception."
self.props = {"comments": "Comments", "exceptionId": "Exception id"}
self.suggestion = "License exceptions should be carefully reviewed."
self.title = "License exception"
self.emoji = "\u26a0\ufe0f"
self.nextStepTitle = "What is a license exception?"
def __str__(self):
return json.dumps(self.__dict__)
class longStrings:
description: str
suggestion: str
title: str
emoji: str
nextStepTitle: str
def __init__(self):
self.description = "Contains long string literals, which may be a sign of obfuscated or packed code."
self.suggestion = "Avoid publishing or consuming obfuscated or bundled code. It makes dependencies difficult to audit and undermines the module resolution system."
self.title = "Long strings"
self.emoji = "\u26a0\ufe0f"
self.nextStepTitle = "What's wrong with long strings?"
def __str__(self):
return json.dumps(self.__dict__)
class missingTarball:
description: str
suggestion: str
title: str
emoji: str
nextStepTitle: str
def __init__(self):
self.description = "This package is missing it's tarball. It could be removed from the npm registry or there may have been an error when publishing."
self.suggestion = "This package cannot be analyzed or installed due to missing data."
self.title = "Missing package tarball"
self.emoji = "\u2754"
self.nextStepTitle = "What is a missing tarball?"
def __str__(self):
return json.dumps(self.__dict__)
class majorRefactor:
description: str
props: dict
suggestion: str
title: str
emoji: str
nextStepTitle: str
def __init__(self):
self.description = "Package has recently undergone a major refactor. It may be unstable or indicate significant internal changes. Use caution when updating to versions that include significant changes."
self.props = {"changedPercent": "Change percentage", "curSize": "Current amount of lines", "linesChanged": "Lines changed", "prevSize": "Previous amount of lines"}
self.suggestion = "Consider waiting before upgrading to see if any issues are discovered, or be prepared to scrutinize any bugs or subtle changes the major refactor may bring. Publishers my consider publishing beta versions of major refactors to limit disruption to parties interested in the new changes."
self.title = "Major refactor"
self.emoji = "\u26a0\ufe0f"
self.nextStepTitle = "What is a major refactor?"
def __str__(self):
return json.dumps(self.__dict__)
class malware:
description: str
props: dict
title: str
suggestion: str
emoji: str
nextStepTitle: str
def __init__(self):
self.description = "This package is malware. We have asked the package registry to remove it."
self.props = {"id": "Id", "note": "Note"}
self.title = "Known malware"
self.suggestion = "It is strongly recommended that malware is removed from your codebase."
self.emoji = "\u2620\ufe0f"
self.nextStepTitle = "What is known malware?"
def __str__(self):
return json.dumps(self.__dict__)
class manifestConfusion:
description: str
props: dict
title: str
suggestion: str
emoji: str
nextStepTitle: str
def __init__(self):
self.description = "This package has inconsistent metadata. This could be malicious or caused by an error when publishing the package."
self.props = {"key": "Key", "description": "Description"}
self.title = "Manifest confusion"
self.suggestion = "Packages with inconsistent metadata may be corrupted or malicious."
self.emoji = "\ud83e\udd78"
self.nextStepTitle = "What is manifest confusion?"
def __str__(self):
return json.dumps(self.__dict__)
class mediumCVE:
description: str
props: dict
suggestion: str
title: str
emoji: str
nextStepTitle: str
def __init__(self):
self.description = "Contains a medium severity Common Vulnerability and Exposure (CVE)."
self.props = {"cveId": "CVE ID", "cwes": "CWEs", "cvss": "CVSS", "description": "Description", "firstPatchedVersionIdentifier": "Patched version", "ghsaId": "GHSA ID", "id": "Id", "severity": "Severity", "title": "Title", "url": "URL", "vulnerableVersionRange": "Vulnerable versions"}
self.suggestion = "Remove or replace dependencies that include known medium severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies."
self.title = "Medium CVE"
self.emoji = "\u26a0\ufe0f"
self.nextStepTitle = "What is a medium CVE?"
def __str__(self):