The security lens (modscan-audit) is Python-only. The TS/JS front-end already exists (modscan/languages/typescript.py, tree-sitter), so extending the lens to JS/TS is the real "add a language" step — sinks are largely universal.
Sinks to catalogue (JS/TS)
- code exec:
eval(...), new Function(...)
- process:
child_process.exec / execSync / spawn
- dynamic load: dynamic
require(...) / import(...) with a non-literal arg
- deserialization:
vm.runInThisContext, unsafe JSON-adjacent/node-serialize if in scope
Design note
modscan/security/detect.py currently walks Python ast. TS detection needs a tree-sitter walk (as typescript.py already does). Keep the MS-SEC-* catalog + severity×confidence shape; add a language-dispatched detector. One catalog namespace, per-language matchers.
Scope guard
Enumeration only (no taint). Reuse the planted-sink + benign-decoy test pattern. Separation rule holds: security package imports only the public parser API.
The security lens (
modscan-audit) is Python-only. The TS/JS front-end already exists (modscan/languages/typescript.py, tree-sitter), so extending the lens to JS/TS is the real "add a language" step — sinks are largely universal.Sinks to catalogue (JS/TS)
eval(...),new Function(...)child_process.exec/execSync/spawnrequire(...)/import(...)with a non-literal argvm.runInThisContext, unsafeJSON-adjacent/node-serializeif in scopeDesign note
modscan/security/detect.pycurrently walks Pythonast. TS detection needs a tree-sitter walk (astypescript.pyalready does). Keep theMS-SEC-*catalog + severity×confidence shape; add a language-dispatched detector. One catalog namespace, per-language matchers.Scope guard
Enumeration only (no taint). Reuse the planted-sink + benign-decoy test pattern. Separation rule holds: security package imports only the public parser API.