registry / fractascan / 0.1.2

fractascan@0.1.2

Fracta — auditor de segurança + LGPD multi-agente e determinístico para SaaS (DAST + SAST, relatório A–F). CLI: fracta scan.

Static Scan Results

scanned 5d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsTelemetryUrlStrings

Manifest

WildcardDependency

scanned 7 file(s), 636 KB of source, external domains: api.anthropic.com, app.seu-dominio.com, cve.mitre.org, cwe.mitre.org, datatracker.ietf.org, docs.anthropic.com, docs.expo.dev, docs.nestjs.com, docs.stripe.com, evil.com, fracta.pro, github.com, meuapp.com.br, owasp.org, platform.claude.com, supabase.com, www.gov.br, www.prisma.io

Source & flagged code

5 flagged

dist/index.jsView file

Lines 130-170javascript

130 }

131 }

132 async testRateLimit(scope, findings) {

133 const authEndpoint = scope.target.auth?.endpoint;

134 if (!authEndpoint) {

135 findings.push({

136 id: stableFindingId({ saas: scope.target.name, camada: this.category, rule: "rate-limit-not-tested" }),

137 runId: scope.runId,

138 agent: this.name,

139 category: this.category,

140 camada: this.category,

141 severity: "info",

142 title: "Rate limit n\xE3o testado \u2014 auth.endpoint n\xE3o configurado",

143 description: "Configure auth.endpoint no targets.yaml para testar prote\xE7\xE3o contra brute force.",

144 recommendation: "Adicione auth.endpoint no targets.yaml:\n```yaml\nauth:\n endpoint: /api/auth/login\n```",

145 createdAt: /* @__PURE__ */ new Date()

146 });

147 return;

148 }

149 const client = new FractaHttpClient(scope.target.url);

150 const body = { email: "brute@fracta.test", password: "wrong-password-fracta-12345" };

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index.jsView on unpkg · L150

151 const requests = Array.from(

152 { length: 10 },

153 () => client.request(authEndpoint, { method: "POST", body, timeoutMs: 5e3 }).catch(() => null)

154 );

155 const results = await Promise.all(requests);

156 const rateLimited = results.filter((r) => r?.status === 429).length;

157 if (rateLimited < 2) {

158 findings.push({

159 id: stableFindingId({ saas: scope.target.name, camada: this.category, rule: `brute-force:${authEndpoint}`, location: authEndpoint }),

160 runId: scope.runId,

161 agent: this.name,

162 category: this.category,

163 camada: this.category,

164 severity: "high",

165 title: "Rate limiting ausente no endpoint de login",

166 description: `10 requisi\xE7\xF5es simult\xE2neas de login inv\xE1lido retornaram apenas ${rateLimited} respostas 429. Prote\xE7\xE3o contra brute force insuficiente.`,

167 endpoint: authEndpoint,

168 evidence: `10 POST ${authEndpoint} com credenciais erradas \u2192 ${rateLimited}/10 retornaram 429`,

169 recommendation: "Implemente rate limiting no endpoint de login:\n```typescript\nimport { ThrottlerGuard } from '@nestjs/throttler';\n\n@UseGuards(ThrottlerGuard)\n@Post('login')\nasync login(@Body() dto: LoginDto) { ... }\n```",

170 references: ["https://owasp.org/www-community/attacks/Brute_force_attack"],

Lines 187-227javascript

187}

188function analyzeCsp(policy) {

189 const d = parse(policy);

190 const issues = [];

191 const scriptSrc = d.get("script-src") ?? d.get("default-src"

Lines 1420-1460javascript

1420 endpoint: path,

1421 evidence: `Avg v\xE1lido: ${avgValid.toFixed(0)}ms / Avg inexistente: ${avgFake.toFixed(0)}ms / \u0394=${delta.toFixed(0)}ms`,

1422 recommendation: "Sempre execute a verifica\xE7\xE3o de senha (bcrypt.compare) mesmo se o usu\xE1

Lines 3378-3418javascript

3378 category: this.category,

3379 camada: this.category,

3380 severity: "critical",

3381 title: `Prisma Studio exposto: ${path}`,

3382 description: `${path} parece servir o Prisma Studio publicamente. Studio d\xE1 acesso CRUD irrestrito ao banco \u2014 qualquer pessoa pode ler/editar/deletar dados.`,

dist/chunk-U24RMSTQ.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = fractascan@0.1.0 matchedIdentity = npm:ZnJhY3Rhc2Nhbg:0.1.0 similarity = 0.800 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunk-U24RMSTQ.jsView on unpkg

Source & flagged code

5 flagged · loading source

dist/index.jsView file

150patternName = generic_password severity = medium line = 150 matchedText = const bo..." };

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index.jsView on unpkg · L150

1440patternName = generic_password severity = medium line = 1440 matchedText = body: { ..." },

Medium

Secret Pattern

Hardcoded password in dist/index.js

dist/index.jsView on unpkg · L1440

3398patternName = generic_password severity = medium line = 3398 matchedText = password...99",

Medium

Secret Pattern

Hardcoded password in dist/index.js

dist/index.jsView on unpkg · L3398

207title: "CSP com 'unsafe-eval' em script-src", L208: detail: "'unsafe-eval' reabre eval()/new Function()/setTimeout(string) \u2014 amplia a superf\xEDcie de XSS.", L209: recommendation: "Remova 'unsafe-eval' e refatore o c\xF3digo que depende de eval/Function din\xE2micos."

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.jsView on unpkg · L207

dist/chunk-U24RMSTQ.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunk-U24RMSTQ.jsView on unpkg

Findings

1 High6 Medium6 Low

HighPrevious Version Dangerous Deltadist/chunk-U24RMSTQ.js

MediumSecret Patterndist/index.js

MediumNetwork

MediumEnvironment Vars

MediumWildcard Dependency

MediumSecret Patterndist/index.js

LowScripts Present

LowEvaldist/index.js

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

5 flagged

dist/index.jsView file

Lines 130-170javascript

130 }

131 }

132 async testRateLimit(scope, findings) {

133 const authEndpoint = scope.target.auth?.endpoint;

134 if (!authEndpoint) {

135 findings.push({

136 id: stableFindingId({ saas: scope.target.name, camada: this.category, rule: "rate-limit-not-tested" }),

137 runId: scope.runId,

138 agent: this.name,

139 category: this.category,

140 camada: this.category,

141 severity: "info",

142 title: "Rate limit n\xE3o testado \u2014 auth.endpoint n\xE3o configurado",

143 description: "Configure auth.endpoint no targets.yaml para testar prote\xE7\xE3o contra brute force.",

144 recommendation: "Adicione auth.endpoint no targets.yaml:\n```yaml\nauth:\n endpoint: /api/auth/login\n```",

145 createdAt: /* @__PURE__ */ new Date()

146 });

147 return;

148 }

149 const client = new FractaHttpClient(scope.target.url);

150 const body = { email: "brute@fracta.test", password: "wrong-password-fracta-12345" };

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index.jsView on unpkg · L150

151 const requests = Array.from(

152 { length: 10 },

153 () => client.request(authEndpoint, { method: "POST", body, timeoutMs: 5e3 }).catch(() => null)

154 );

155 const results = await Promise.all(requests);

156 const rateLimited = results.filter((r) => r?.status === 429).length;

157 if (rateLimited < 2) {

158 findings.push({

159 id: stableFindingId({ saas: scope.target.name, camada: this.category, rule: `brute-force:${authEndpoint}`, location: authEndpoint }),

160 runId: scope.runId,

161 agent: this.name,

162 category: this.category,

163 camada: this.category,

164 severity: "high",

165 title: "Rate limiting ausente no endpoint de login",

166 description: `10 requisi\xE7\xF5es simult\xE2neas de login inv\xE1lido retornaram apenas ${rateLimited} respostas 429. Prote\xE7\xE3o contra brute force insuficiente.`,

167 endpoint: authEndpoint,

168 evidence: `10 POST ${authEndpoint} com credenciais erradas \u2192 ${rateLimited}/10 retornaram 429`,

170 references: ["https://owasp.org/www-community/attacks/Brute_force_attack"],

Lines 187-227javascript

187}

188function analyzeCsp(policy) {

189 const d = parse(policy);

190 const issues = [];

191 const scriptSrc = d.get("script-src") ?? d.get("default-src"

Lines 1420-1460javascript

1420 endpoint: path,

1421 evidence: `Avg v\xE1lido: ${avgValid.toFixed(0)}ms / Avg inexistente: ${avgFake.toFixed(0)}ms / \u0394=${delta.toFixed(0)}ms`,

1422 recommendation: "Sempre execute a verifica\xE7\xE3o de senha (bcrypt.compare) mesmo se o usu\xE1

Lines 3378-3418javascript

3378 category: this.category,

3379 camada: this.category,

3380 severity: "critical",

3381 title: `Prisma Studio exposto: ${path}`,

3382 description: `${path} parece servir o Prisma Studio publicamente. Studio d\xE1 acesso CRUD irrestrito ao banco \u2014 qualquer pessoa pode ler/editar/deletar dados.`,

dist/chunk-U24RMSTQ.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunk-U24RMSTQ.jsView on unpkg