Security Scan

A fast, comprehensive security scanner for JavaScript/TypeScript projects written in Rust. This tool analyzes your codebase for security vulnerabilities, suspicious patterns, risky dependencies, and known CVEs.

Features

• Security Pattern Detection: Identifies risky code patterns including:

  • eval() and dynamic Function constructors
  • Obfuscated code (hex/unicode escape sequences)
  • Base64 encoded payloads and atob() usage
  • Network requests and suspicious API calls

• AST-based Analysis: Uses SWC to parse and analyze JavaScript/TypeScript files for deeper inspection beyond regex patterns

• Dependency Analysis: Scans node_modules for suspicious packages and dependencies

• CVE Vulnerability Detection: Optional integration with OSV.dev to check for known vulnerabilities in your dependencies

• Multiple Output Formats:

  • Colorized console output with severity filtering
  • JSON report for integration with CI/CD pipelines

• Smart Ignore Rules: Respects .security-scan-ignore files to exclude false positives

Installation

cargo build --release

The compiled binary will be available at target/release/security-scan.

Usage

Basic Scan

Scan a JavaScript/TypeScript project:

security-scan /path/to/project

With OSV Vulnerability Checks

Query OSV.dev for known CVEs (requires network access):

security-scan /path/to/project --include-osv

Filter by Severity

Only show findings at or above a certain severity level:

security-scan /path/to/project --min-severity high

Available severity levels: low, medium, high

Export JSON Report

Generate a JSON report for CI/CD integration:

security-scan /path/to/project --output report.json

Output Example

Security Scan Report
Project: /Users/example/my-project
Generated: 2024-10-31T18:26:00Z
Totals: 3 security, 1 dependency, 2 vulnerability

HIGH 2 security, 0 dependency, 1 vulnerability
  [Security] src/utils.js:42:10 - eval call may execute dynamic code
    eval(userInput)
  [Security] src/obfuscated.js:15:3 - Base64 decoding via atob
    const decoded = atob(encodedData)
  express@4.16.0 - CVE-2024-29041 (CVSS:7.5)
    Denial of Service vulnerability
    https://osv.dev/vulnerability/CVE-2024-29041
    fixed in 4.19.2

MEDIUM 1 security, 1 dependency, 1 vulnerability
  [Security] src/suspicious.js:88:5 - Network request detected
    fetch('https://example.com/api')
  [Dependency] node_modules/suspicious-pkg/index.js - Obfuscated code detected (suspicious-pkg)

Use --output <file> to generate a full JSON report.

Configuration

Ignore Files

Create a .security-scan-ignore file in your project root to exclude directories:

# Ignore Next.js build directories
next
.next

# Ignore custom build output
dist
build

Supported File Types

• JavaScript: .js, .mjs, .cjs
• JSX: .jsx
• TypeScript: .ts, .tsx
• JSON: .json (limited scanning)

Architecture

• scanner/security.rs: Regex-based pattern matching for common security issues
• scanner/ast.rs: AST-based analysis using SWC for deeper code inspection
• scanner/node_modules.rs: Dependency and package scanning
• scanner/osv.rs: OSV.dev API integration for CVE lookups
• scanner/ignore.rs: Ignore pattern matching
• report.rs: Output formatting and JSON serialization

Severity Levels

• HIGH: Critical security issues (eval, encoded payloads, known CVEs)
• MEDIUM: Suspicious patterns (obfuscated code, network requests)
• LOW: General concerns (other findings)

Limitations

• Files larger than 512KB are skipped
• Automatically excludes common directories: node_modules, .git, dist, build, coverage, target
• OSV vulnerability checks require network access

Dependencies

Key dependencies:

• walkdir: File system traversal
• swc_ecma_parser: JavaScript/TypeScript AST parsing
• regex: Pattern matching
• serde_json: JSON serialization
• ureq: HTTP client for OSV.dev API
• owo-colors: Terminal colors
• clap: CLI argument parsing

License

See repository license for details.

Contributing

This is a security tool. When contributing:

• Avoid false positives that could cause alert fatigue
• Add tests for new detection patterns
• Update this README with new features
• Consider performance impact on large codebases