fe0193956d
Pre-installation verification of VS Code extensions via URL — fetch a remote VSIX, extract it in a hardened sandbox, and run the existing IDE scanner pipeline against it. No npm dependencies. Sources: - VS Code Marketplace (publisher.gallery.vsassets.io direct download) - OpenVSX (open-vsx.org official API) - Direct .vsix HTTPS URLs Defenses: - HTTPS-only, TLS verified, manual redirect with per-source host whitelist - 30s total timeout via AbortController - 50MB compressed cap, 500MB uncompressed, 100x expansion ratio - Zero-dep ZIP extractor: zip-slip, absolute paths, drive letters, NUL bytes, symlinks (Unix mode 0xA000), depth limits, ZIP64 rejected, encrypted rejected - SHA-256 streamed during fetch, surfaced in meta.source - Temp dir cleanup in all paths (try/finally) Files: - scanners/lib/vsix-fetch.mjs (HTTPS fetcher, host whitelist, streaming SHA-256) - scanners/lib/zip-extract.mjs (zero-dep parser with hardening caps) - knowledge/marketplace-api-notes.md (endpoint reference) - 3 test files (48 tests added: vsix-fetch, zip-extract, ide-extension-url) Tests: 1296 → 1344 (all green). Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
36 lines
810 B
JSON
36 lines
810 B
JSON
{
|
|
"name": "llm-security",
|
|
"version": "6.4.0",
|
|
"description": "Security scanning, auditing, and threat modeling for Claude Code projects",
|
|
"type": "module",
|
|
"bin": {
|
|
"llm-security": "./bin/llm-security.mjs"
|
|
},
|
|
"files": [
|
|
"bin/",
|
|
"scanners/",
|
|
"LICENSE",
|
|
"README.md"
|
|
],
|
|
"homepage": "https://git.fromaitochitta.com/open/claude-code-llm-security",
|
|
"engines": {
|
|
"node": ">=18"
|
|
},
|
|
"scripts": {
|
|
"test": "node --test 'tests/**/*.test.mjs'",
|
|
"bump": "node scripts/bump-version.mjs"
|
|
},
|
|
"keywords": [
|
|
"claude-code",
|
|
"security",
|
|
"owasp",
|
|
"llm",
|
|
"plugin"
|
|
],
|
|
"author": "Kjell Tore Guttormsen",
|
|
"license": "MIT",
|
|
"repository": {
|
|
"type": "git",
|
|
"url": "https://git.fromaitochitta.com/fromaitochitta/claude-code-llm-security"
|
|
}
|
|
}
|