aegis-scan 0.2.0

Supply chain security CLI for npm — detect malicious packages before installing
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101

use colored::Colorize;

use crate::types::{AnalysisReport, Finding, RiskLabel, Severity};

/// Print a human-readable, tree-style security report to the terminal.
pub fn print_report(report: &AnalysisReport) {
    println!();
    println!(
        "  \u{1f4e6} {}@{}",
        report.package_name.bold(),
        report.version
    );
    println!();

    if report.findings.is_empty() {
        println!("  \u{2705} {}", "Clean — no issues found".green());
        println!();
        print_risk_line(report.risk_score, &report.risk_label);
        println!();
        return;
    }

    for finding in &report.findings {
        print_finding(finding);
    }

    print_risk_line(report.risk_score, &report.risk_label);
    println!();
}

fn print_finding(f: &Finding) {
    let (icon, styled_header) = match f.severity {
        Severity::Critical => (
            "\u{26d4}",
            format!("CRITICAL — {}", f.category)
                .red()
                .bold()
                .to_string(),
        ),
        Severity::High => (
            "\u{26a0}\u{fe0f} ",
            format!("HIGH — {}", f.category).red().to_string(),
        ),
        Severity::Medium => (
            "\u{26a0}\u{fe0f} ",
            format!("MEDIUM — {}", f.category).yellow().to_string(),
        ),
        Severity::Low => (
            "\u{2139}\u{fe0f} ",
            format!("LOW — {}", f.category).blue().to_string(),
        ),
        Severity::Info => (
            "\u{2139}\u{fe0f} ",
            format!("INFO — {}", f.category).green().to_string(),
        ),
    };

    println!("  {} {}", icon, styled_header);
    println!("  {}  {}", "\u{2502}".dimmed(), f.description);

    if let Some(ref file) = f.file {
        let location = match f.line {
            Some(line) => format!("{}:{}", file, line),
            None => file.clone(),
        };
        println!("  {}  \u{1f4c4} {}", "\u{2502}".dimmed(), location.dimmed());
    }

    if let Some(ref snippet) = f.snippet {
        println!(
            "  {}  {} {}",
            "\u{2502}".dimmed(),
            "\u{2514}\u{2500}".dimmed(),
            snippet.dimmed()
        );
    }

    println!();
}

fn print_risk_line(score: f64, label: &RiskLabel) {
    let score_str = format!("{:.1}/10", score);
    let colored_score = if score < 3.0 {
        score_str.green()
    } else if score <= 7.0 {
        score_str.yellow()
    } else {
        score_str.red()
    };

    let label_str = format!("{}", label);
    let colored_label = match label {
        RiskLabel::Clean => label_str.green().bold(),
        RiskLabel::Low => label_str.green().bold(),
        RiskLabel::Medium => label_str.yellow().bold(),
        RiskLabel::High => label_str.red().bold(),
        RiskLabel::Critical => label_str.red().bold(),
    };

    println!("  Risk: {} — {}", colored_score, colored_label);
}