registry / fractascan / 0.1.18

fractascan@0.1.18

Fracta — auditor de segurança + LGPD multi-agente e determinístico para SaaS (DAST + SAST, relatório A–F). CLI: fracta scan.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsTelemetryUrlStrings

Manifest

WildcardDependency

scanned 9 file(s), 677 KB of source, external domains: api.anthropic.com, app.seu-dominio.com, cve.mitre.org, cwe.mitre.org, datatracker.ietf.org, developer.mozilla.org, docs.anthropic.com, docs.expo.dev, docs.nestjs.com, docs.stripe.com, evil.com, fracta.pro, github.com, json.schemastore.org, owasp.org, platform.claude.com, semgrep.dev, staging.meuapp.com.br, supabase.com, www.gov.br, www.prisma.io, zap-api.tech

Source & flagged code

6 flagged

dist/index.jsView file

Lines 173-213javascript

173 }

174 }

175 async testRateLimit(scope, findings) {

176 const authEndpoint = scope.target.auth?.endpoint;

177 if (!authEndpoint) {

178 findings.push({

179 id: stableFindingId({ saas: scope.target.name, camada: this.category, rule: "rate-limit-not-tested" }),

180 runId: scope.runId,

181 agent: this.name,

182 category: this.category,

183 camada: this.category,

184 severity: "info",

185 title: "Rate limit n\xE3o testado \u2014 auth.endpoint n\xE3o configurado",

186 description: "Configure auth.endpoint no targets.yaml para testar prote\xE7\xE3o contra brute force.",

187 recommendation: "Adicione auth.endpoint no targets.yaml:\n```yaml\nauth:\n endpoint: /api/auth/login\n```",

188 createdAt: /* @__PURE__ */ new Date()

189 });

190 return;

191 }

192 const client = new FractaHttpClient(scope.target.url);

193 const body = { email: "brute@fracta.test", password: "wrong-password-fracta-12345" };

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index.jsView on unpkg · L193

194 const requests = Array.from(

195 { length: 10 },

196 () => client.request(authEndpoint, { method: "POST", body, timeoutMs: 5e3 }).catch(() => null)

197 );

198 const results = await Promise.all(requests);

199 const rateLimited = results.filter((r) => r?.status === 429).length;

200 if (rateLimited < 2) {

201 findings.push({

202 id: stableFindingId({ saas: scope.target.name, camada: this.category, rule: `brute-force:${authEndpoint}`, location: authEndpoint }),

203 runId: scope.runId,

204 agent: this.name,

205 category: this.category,

206 camada: this.category,

207 severity: "high",

208 title: "Rate limiting ausente no endpoint de login",

209 description: `10 requisi\xE7\xF5es simult\xE2neas de login inv\xE1lido retornaram apenas ${rateLimited} respostas 429. Prote\xE7\xE3o contra brute force insuficiente.`,

210 endpoint: authEndpoint,

211 evidence: `10 POST ${authEndpoint} com credenciais erradas \u2192 ${rateLimited}/10 retornaram 429`,

212 recommendation: "Implemente rate limiting no endpoint de login:\n```typescript\nimport { ThrottlerGuard } from '@nestjs/throttler';\n\n@UseGuards(ThrottlerGuard)\n@Post('login')\nasync login(@Body() dto: LoginDto) { ... }\n```",

213 references: ["https://owasp.org/www-community/attacks/Brute_force_attack"],

Lines 230-270javascript

230}

231function analyzeCsp(policy) {

232 const d = parse(policy);

233 const issues = [];

234 const scriptSrc = d.get("script-src") ?? d.get("default-src"

Lines 1619-1659javascript

1619 endpoint: path,

1620 evidence: `Avg v\xE1lido: ${avgValid.toFixed(0)}ms / Avg inexistente: ${avgFake.toFixed(0)}ms / \u0394=${delta.toFixed(0)}ms`,

1621 recommendation: "Sempre execute a verifica\xE7\xE3o de senha (bcrypt.compare) mesmo se o usu\xE1

Lines 3784-3824javascript

3784 category: this.category,

3785 camada: this.category,

3786 severity: "critical",

3787 title: `Prisma Studio exposto: ${path}`,

3788 description: `${path} parece servir o Prisma Studio publicamente. Studio d\xE1 acesso CRUD irrestrito ao banco \u2014 qualquer pessoa pode ler/editar/deletar dados.`,

dist/init-EUSLT3FC.jsView file

Lines 4-52javascript

4var TARGETS_TEMPLATE = `# Fracta \u2014 targets.yaml

5# Declare aqui os sistemas que VOC\xCA controla e autoriza a testar.

6# \xC9 este arquivo que libera os testes intrusivos (auth, IDOR): eles s\xF3 rodam

7# contra o que estiver declarado abaixo.

9# \u26A0\uFE0F NUNCA aponte para produ\xE7\xE3o com dados reais. Use staging.

10# Vari

Source & flagged code

6 flagged · loading source

dist/index.jsView file

193patternName = generic_password severity = medium line = 193 matchedText = const bo..." };

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index.jsView on unpkg · L193

1639patternName = generic_password severity = medium line = 1639 matchedText = body: { ..." },

Medium

Secret Pattern

Hardcoded password in dist/index.js

dist/index.jsView on unpkg · L1639

3804patternName = generic_password severity = medium line = 3804 matchedText = password...99",

Medium

Secret Pattern

Hardcoded password in dist/index.js

dist/index.jsView on unpkg · L3804

250title: "CSP com 'unsafe-eval' em script-src", L251: detail: "'unsafe-eval' reabre eval()/new Function()/setTimeout(string) \u2014 amplia a superf\xEDcie de XSS.", L252: recommendation: "Remova 'unsafe-eval' e refatore o c\xF3digo que depende de eval/Function din\xE2micos."

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.jsView on unpkg · L250

dist/init-EUSLT3FC.jsView file

24patternName = generic_password severity = medium line = 24 matchedText = password...aqui

Medium

Secret Pattern

Hardcoded password in dist/init-EUSLT3FC.js

dist/init-EUSLT3FC.jsView on unpkg · L24

32patternName = generic_password severity = medium line = 32 matchedText = # pa...SS}"

Medium

Secret Pattern

Hardcoded password in dist/init-EUSLT3FC.js

dist/init-EUSLT3FC.jsView on unpkg · L32

Findings

8 Medium6 Low

MediumSecret Patterndist/index.js

MediumNetwork

MediumEnvironment Vars

MediumWildcard Dependency

MediumSecret Patterndist/index.js

MediumSecret Patterndist/init-EUSLT3FC.js

LowScripts Present

LowEvaldist/index.js

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

6 flagged

dist/index.jsView file

Lines 173-213javascript

173 }

174 }

175 async testRateLimit(scope, findings) {

176 const authEndpoint = scope.target.auth?.endpoint;

177 if (!authEndpoint) {

178 findings.push({

179 id: stableFindingId({ saas: scope.target.name, camada: this.category, rule: "rate-limit-not-tested" }),

180 runId: scope.runId,

181 agent: this.name,

182 category: this.category,

183 camada: this.category,

184 severity: "info",

185 title: "Rate limit n\xE3o testado \u2014 auth.endpoint n\xE3o configurado",

186 description: "Configure auth.endpoint no targets.yaml para testar prote\xE7\xE3o contra brute force.",

187 recommendation: "Adicione auth.endpoint no targets.yaml:\n```yaml\nauth:\n endpoint: /api/auth/login\n```",

188 createdAt: /* @__PURE__ */ new Date()

189 });

190 return;

191 }

192 const client = new FractaHttpClient(scope.target.url);

193 const body = { email: "brute@fracta.test", password: "wrong-password-fracta-12345" };

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index.jsView on unpkg · L193

194 const requests = Array.from(

195 { length: 10 },

196 () => client.request(authEndpoint, { method: "POST", body, timeoutMs: 5e3 }).catch(() => null)

197 );

198 const results = await Promise.all(requests);

199 const rateLimited = results.filter((r) => r?.status === 429).length;

200 if (rateLimited < 2) {

201 findings.push({

202 id: stableFindingId({ saas: scope.target.name, camada: this.category, rule: `brute-force:${authEndpoint}`, location: authEndpoint }),

203 runId: scope.runId,

204 agent: this.name,

205 category: this.category,

206 camada: this.category,

207 severity: "high",

208 title: "Rate limiting ausente no endpoint de login",

209 description: `10 requisi\xE7\xF5es simult\xE2neas de login inv\xE1lido retornaram apenas ${rateLimited} respostas 429. Prote\xE7\xE3o contra brute force insuficiente.`,

210 endpoint: authEndpoint,

211 evidence: `10 POST ${authEndpoint} com credenciais erradas \u2192 ${rateLimited}/10 retornaram 429`,

213 references: ["https://owasp.org/www-community/attacks/Brute_force_attack"],

Lines 230-270javascript

230}

231function analyzeCsp(policy) {

232 const d = parse(policy);

233 const issues = [];

234 const scriptSrc = d.get("script-src") ?? d.get("default-src"

Lines 1619-1659javascript

1619 endpoint: path,

1620 evidence: `Avg v\xE1lido: ${avgValid.toFixed(0)}ms / Avg inexistente: ${avgFake.toFixed(0)}ms / \u0394=${delta.toFixed(0)}ms`,

1621 recommendation: "Sempre execute a verifica\xE7\xE3o de senha (bcrypt.compare) mesmo se o usu\xE1

Lines 3784-3824javascript

3784 category: this.category,

3785 camada: this.category,

3786 severity: "critical",

3787 title: `Prisma Studio exposto: ${path}`,

3788 description: `${path} parece servir o Prisma Studio publicamente. Studio d\xE1 acesso CRUD irrestrito ao banco \u2014 qualquer pessoa pode ler/editar/deletar dados.`,

dist/init-EUSLT3FC.jsView file

Lines 4-52javascript

4var TARGETS_TEMPLATE = `# Fracta \u2014 targets.yaml

5# Declare aqui os sistemas que VOC\xCA controla e autoriza a testar.

6# \xC9 este arquivo que libera os testes intrusivos (auth, IDOR): eles s\xF3 rodam

7# contra o que estiver declarado abaixo.

9# \u26A0\uFE0F NUNCA aponte para produ\xE7\xE3o com dados reais. Use staging.

10# Vari