registry / fractascan / 0.1.17

fractascan@0.1.17

Fracta — auditor de segurança + LGPD multi-agente e determinístico para SaaS (DAST + SAST, relatório A–F). CLI: fracta scan.

AI Security Review

scanned 5h ago · by lpm-firewall-ai

No confirmed malicious attack surface. The package is a security-auditing CLI that makes user-invoked network probes against configured targets and may run local scanner binaries against a configured repo.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs fracta CLI commands such as scan, docs, verify, verify-csp, or init

Impact

Can generate active test traffic and local reports; no unconsented install-time or import-time behavior identified.

Mechanism

User-invoked SaaS security scanner with DAST/SAST/reporting

Rationale

The suspicious primitives are package-aligned for a documented security scanner and are activated by explicit CLI use, with no lifecycle hooks or hidden exfiltration path found. Bundled Anthropic SDK/tooling and scanner subprocess use are opt-in or scan-path capabilities, not evidence of malware in this package.

Evidence

package.jsonREADME.mddist/index.jsdist/chunk-U24RMSTQ.jsdist/node-QWZVVGUH.jsconfigs/targets.yamlfracta-reportsfracta-state.db

Network endpoints2

fracta.proapi.anthropic.com

Decision evidence

public snapshot

AI called this Clean at 88.0% confidence as Benign with medium false-positive risk.

Evidence for block

dist/index.js CLI performs active DAST requests against configured target URLs, including auth, IDOR, CORS, race, Stripe tests.
dist/chunk-U24RMSTQ.js runCommand can invoke npm audit, gitleaks, semgrep on user-configured repoPath during scan.
dist/index.js --llm opt-in uses ANTHROPIC_API_KEY and Anthropic client to enrich reports.

Evidence against

package.json has no preinstall/install/postinstall lifecycle scripts.
dist/index.js main only runs on CLI/bin invocation; no import-time scan or install-time mutation found.
Network requests are target-configured audit traffic or documented Anthropic API use when --llm is explicitly enabled.
Report/state writes are local user-selected paths: output directory, state DB, and init targets.yaml.
Secret scanning code sanitizes gitleaks output and does not include leaked secret values in findings.
No credential harvesting/exfiltration, persistence, destructive behavior, or AI-agent control-surface writes found.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsTelemetryUrlStrings

Manifest

WildcardDependency

scanned 9 file(s), 674 KB of source, external domains: api.anthropic.com, app.seu-dominio.com, cve.mitre.org, cwe.mitre.org, datatracker.ietf.org, developer.mozilla.org, docs.anthropic.com, docs.expo.dev, docs.nestjs.com, docs.stripe.com, evil.com, fracta.pro, github.com, json.schemastore.org, owasp.org, platform.claude.com, semgrep.dev, staging.meuapp.com.br, supabase.com, www.gov.br, www.prisma.io, zap-api.tech

Source & flagged code

7 flagged

dist/index.jsView file

Lines 173-213javascript

173 }

174 }

175 async testRateLimit(scope, findings) {

176 const authEndpoint = scope.target.auth?.endpoint;

177 if (!authEndpoint) {

178 findings.push({

179 id: stableFindingId({ saas: scope.target.name, camada: this.category, rule: "rate-limit-not-tested" }),

180 runId: scope.runId,

181 agent: this.name,

182 category: this.category,

183 camada: this.category,

184 severity: "info",

185 title: "Rate limit n\xE3o testado \u2014 auth.endpoint n\xE3o configurado",

186 description: "Configure auth.endpoint no targets.yaml para testar prote\xE7\xE3o contra brute force.",

187 recommendation: "Adicione auth.endpoint no targets.yaml:\n```yaml\nauth:\n endpoint: /api/auth/login\n```",

188 createdAt: /* @__PURE__ */ new Date()

189 });

190 return;

191 }

192 const client = new FractaHttpClient(scope.target.url);

193 const body = { email: "brute@fracta.test", password: "wrong-password-fracta-12345" };

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index.jsView on unpkg · L193

194 const requests = Array.from(

195 { length: 10 },

196 () => client.request(authEndpoint, { method: "POST", body, timeoutMs: 5e3 }).catch(() => null)

197 );

198 const results = await Promise.all(requests);

199 const rateLimited = results.filter((r) => r?.status === 429).length;

200 if (rateLimited < 2) {

201 findings.push({

202 id: stableFindingId({ saas: scope.target.name, camada: this.category, rule: `brute-force:${authEndpoint}`, location: authEndpoint }),

203 runId: scope.runId,

204 agent: this.name,

205 category: this.category,

206 camada: this.category,

207 severity: "high",

208 title: "Rate limiting ausente no endpoint de login",

209 description: `10 requisi\xE7\xF5es simult\xE2neas de login inv\xE1lido retornaram apenas ${rateLimited} respostas 429. Prote\xE7\xE3o contra brute force insuficiente.`,

210 endpoint: authEndpoint,

211 evidence: `10 POST ${authEndpoint} com credenciais erradas \u2192 ${rateLimited}/10 retornaram 429`,

212 recommendation: "Implemente rate limiting no endpoint de login:\n```typescript\nimport { ThrottlerGuard } from '@nestjs/throttler';\n\n@UseGuards(ThrottlerGuard)\n@Post('login')\nasync login(@Body() dto: LoginDto) { ... }\n```",

213 references: ["https://owasp.org/www-community/attacks/Brute_force_attack"],

Lines 230-270javascript

230}

231function analyzeCsp(policy) {

232 const d = parse(policy);

233 const issues = [];

234 const scriptSrc = d.get("script-src") ?? d.get("default-src"

Lines 1619-1659javascript

1619 endpoint: path,

1620 evidence: `Avg v\xE1lido: ${avgValid.toFixed(0)}ms / Avg inexistente: ${avgFake.toFixed(0)}ms / \u0394=${delta.toFixed(0)}ms`,

1621 recommendation: "Sempre execute a verifica\xE7\xE3o de senha (bcrypt.compare) mesmo se o usu\xE1

Lines 3748-3788javascript

3748 category: this.category,

3749 camada: this.category,

3750 severity: "critical",

3751 title: `Prisma Studio exposto: ${path}`,

3752 description: `${path} parece servir o Prisma Studio publicamente. Studio d\xE1 acesso CRUD irrestrito ao banco \u2014 qualquer pessoa pode ler/editar/deletar dados.`,

•matchType = previous_version_dangerous_delta matchedPackage = fractascan@0.1.2 matchedIdentity = npm:ZnJhY3Rhc2Nhbg:0.1.2 similarity = 0.714 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

dist/init-EUSLT3FC.jsView file

Lines 4-52javascript

4var TARGETS_TEMPLATE = `# Fracta \u2014 targets.yaml

5# Declare aqui os sistemas que VOC\xCA controla e autoriza a testar.

6# \xC9 este arquivo que libera os testes intrusivos (auth, IDOR): eles s\xF3 rodam

7# contra o que estiver declarado abaixo.

9# \u26A0\uFE0F NUNCA aponte para produ\xE7\xE3o com dados reais. Use staging.

10# Vari

Source & flagged code

7 flagged · loading source

dist/index.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

193patternName = generic_password severity = medium line = 193 matchedText = const bo..." };

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index.jsView on unpkg · L193

1639patternName = generic_password severity = medium line = 1639 matchedText = body: { ..." },

Medium

Secret Pattern

Hardcoded password in dist/index.js

dist/index.jsView on unpkg · L1639

3768patternName = generic_password severity = medium line = 3768 matchedText = password...99",

Medium

Secret Pattern

Hardcoded password in dist/index.js

dist/index.jsView on unpkg · L3768

250title: "CSP com 'unsafe-eval' em script-src", L251: detail: "'unsafe-eval' reabre eval()/new Function()/setTimeout(string) \u2014 amplia a superf\xEDcie de XSS.", L252: recommendation: "Remova 'unsafe-eval' e refatore o c\xF3digo que depende de eval/Function din\xE2micos."

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.jsView on unpkg · L250

dist/init-EUSLT3FC.jsView file

24patternName = generic_password severity = medium line = 24 matchedText = password...aqui

Medium

Secret Pattern

Hardcoded password in dist/init-EUSLT3FC.js

dist/init-EUSLT3FC.jsView on unpkg · L24

32patternName = generic_password severity = medium line = 32 matchedText = # pa...SS}"

Medium

Secret Pattern

Hardcoded password in dist/init-EUSLT3FC.js

dist/init-EUSLT3FC.jsView on unpkg · L32

Findings

1 High8 Medium6 Low

HighPrevious Version Dangerous Deltadist/index.js

MediumSecret Patterndist/index.js

MediumNetwork

MediumEnvironment Vars

MediumWildcard Dependency

MediumSecret Patterndist/index.js

MediumSecret Patterndist/init-EUSLT3FC.js

LowScripts Present

LowEvaldist/index.js

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

7 flagged

dist/index.jsView file

Lines 173-213javascript

173 }

174 }

175 async testRateLimit(scope, findings) {

176 const authEndpoint = scope.target.auth?.endpoint;

177 if (!authEndpoint) {

178 findings.push({

179 id: stableFindingId({ saas: scope.target.name, camada: this.category, rule: "rate-limit-not-tested" }),

180 runId: scope.runId,

181 agent: this.name,

182 category: this.category,

183 camada: this.category,

184 severity: "info",

185 title: "Rate limit n\xE3o testado \u2014 auth.endpoint n\xE3o configurado",

186 description: "Configure auth.endpoint no targets.yaml para testar prote\xE7\xE3o contra brute force.",

187 recommendation: "Adicione auth.endpoint no targets.yaml:\n```yaml\nauth:\n endpoint: /api/auth/login\n```",

188 createdAt: /* @__PURE__ */ new Date()

189 });

190 return;

191 }

192 const client = new FractaHttpClient(scope.target.url);

193 const body = { email: "brute@fracta.test", password: "wrong-password-fracta-12345" };

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index.jsView on unpkg · L193

194 const requests = Array.from(

195 { length: 10 },

196 () => client.request(authEndpoint, { method: "POST", body, timeoutMs: 5e3 }).catch(() => null)

197 );

198 const results = await Promise.all(requests);

199 const rateLimited = results.filter((r) => r?.status === 429).length;

200 if (rateLimited < 2) {

201 findings.push({

202 id: stableFindingId({ saas: scope.target.name, camada: this.category, rule: `brute-force:${authEndpoint}`, location: authEndpoint }),

203 runId: scope.runId,

204 agent: this.name,

205 category: this.category,

206 camada: this.category,

207 severity: "high",

208 title: "Rate limiting ausente no endpoint de login",

209 description: `10 requisi\xE7\xF5es simult\xE2neas de login inv\xE1lido retornaram apenas ${rateLimited} respostas 429. Prote\xE7\xE3o contra brute force insuficiente.`,

210 endpoint: authEndpoint,

211 evidence: `10 POST ${authEndpoint} com credenciais erradas \u2192 ${rateLimited}/10 retornaram 429`,

213 references: ["https://owasp.org/www-community/attacks/Brute_force_attack"],

Lines 230-270javascript

230}

231function analyzeCsp(policy) {

232 const d = parse(policy);

233 const issues = [];

234 const scriptSrc = d.get("script-src") ?? d.get("default-src"

Lines 1619-1659javascript

1619 endpoint: path,

1620 evidence: `Avg v\xE1lido: ${avgValid.toFixed(0)}ms / Avg inexistente: ${avgFake.toFixed(0)}ms / \u0394=${delta.toFixed(0)}ms`,

1621 recommendation: "Sempre execute a verifica\xE7\xE3o de senha (bcrypt.compare) mesmo se o usu\xE1

Lines 3748-3788javascript

3748 category: this.category,

3749 camada: this.category,

3750 severity: "critical",

3751 title: `Prisma Studio exposto: ${path}`,

3752 description: `${path} parece servir o Prisma Studio publicamente. Studio d\xE1 acesso CRUD irrestrito ao banco \u2014 qualquer pessoa pode ler/editar/deletar dados.`,

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

dist/init-EUSLT3FC.jsView file

Lines 4-52javascript

4var TARGETS_TEMPLATE = `# Fracta \u2014 targets.yaml

5# Declare aqui os sistemas que VOC\xCA controla e autoriza a testar.

6# \xC9 este arquivo que libera os testes intrusivos (auth, IDOR): eles s\xF3 rodam

7# contra o que estiver declarado abaixo.

9# \u26A0\uFE0F NUNCA aponte para produ\xE7\xE3o com dados reais. Use staging.

10# Vari