guarddog
guarddog copied to clipboard
Add diff scanning option
This PR adds a --diff option to the scan subcommand:
$ guarddog pypi scan requests --diff 2.32.2
$ guarddog npm scan /tmp/axios_1.8.4 --diff /tmp/axios_1.8.3.tar.gz
This will perform source code analysis only on the code changes that exist between the two selected package versions. Clearly, these results are only meaningful when different versions of the same package are compared.
Example:
$ guarddog pypi scan llm-code-lens --version 0.5.3
Found 3 potentially malicious indicators in llm-code-lens
clipboard-access: found 3 source code matches
* This package accesses the clipboard, which can indicate it's trying to steal sensitive data or overwrite cryptocurrency addresses at llm_code_lens/cli.py/llm_code_lens/cli.py:465
pyperclip.copy(full_message)
* This package accesses the clipboard, which can indicate it's trying to steal sensitive data or overwrite cryptocurrency addresses at llm_code_lens/cli.py/llm_code_lens/cli.py:477
pyperclip.copy(full_message)
* This package accesses the clipboard, which can indicate it's trying to steal sensitive data or overwrite cryptocurrency addresses at llm_code_lens/cli.py/llm_code_lens/cli.py:489
pyperclip.copy(full_message)
$ guarddog pypi scan llm-code-lens --version 0.5.2
Found 3 potentially malicious indicators in llm-code-lens
clipboard-access: found 3 source code matches
* This package accesses the clipboard, which can indicate it's trying to steal sensitive data or overwrite cryptocurrency addresses at llm_code_lens/cli.py/llm_code_lens/cli.py:465
pyperclip.copy(full_message)
* This package accesses the clipboard, which can indicate it's trying to steal sensitive data or overwrite cryptocurrency addresses at llm_code_lens/cli.py/llm_code_lens/cli.py:477
pyperclip.copy(full_message)
* This package accesses the clipboard, which can indicate it's trying to steal sensitive data or overwrite cryptocurrency addresses at llm_code_lens/cli.py/llm_code_lens/cli.py:489
pyperclip.copy(full_message)
$ guarddog pypi scan llm-code-lens --version 0.5.3 --diff 0.5.2
Found 0 potentially malicious indicators scanning llm-code-lens
Diff scanning is available for the PyPI, npm and Go ecosystems. There are no plans to try to extend it to GitHub Actions.
The PR also adds and updates tests to accommodate the new feature and updates all dependencies to their latest compatible versions.