Cong Yu
Victoria Lu
Xiaomeng Wang

To read from a github repository: npm run start [owner] [repo]

args:

owner: owner of the repository repo: repository name

e.g.: npm run start wsghlby vulnerability-test will get to the root of remote repository of this project. !! Recursive reading from directories are not supported yet.

This module scans the git log of the given repository, and compare between two consecutive commits to see if sensitive information has been committed.

Example output:

Git Exposure Scan:
Detected sensitive information in git commits [commit A] and [commit B]:
RSA private key: -----BEGIN RSA PRIVATE KEY----- appearances: 1

• To debug:

Go to git-exposure.ts and trigger the call with a hard coded repo path, then run npm run scan-git to run this script independently.

This module scans the dependent npm packages, and find potentially malicious code. Currently, we only focus on data exchange, powerful function and encoded string.

Example output:

Malicious Code Scan:
- Found data exchange & powerful function & encoded string in [file path]:
[source code]

You need to manually remove the scan-dependency directory after scanning.

Since it is hard to find a real malicious npm package, we provide the testing result of several examples in test-examples-result.md

This module scans all dependent npm packages and check if there is possible phishing package exist.

Example output:

Phishing package detection:
- The dependent package "jquey" looks similar to the popular package "jquery" with 0.833 similarity. It's possibly a phishing package.