feat(detectors): add VisibleNpmRegistryAuthData detector

[deerajcm]

Description:

Summary

• Adds a detector for visible npm registry auth data in .npmrc files
• Detects both _authToken (npm tokens) and _auth (base64 credentials)
• Verifier calls GET /-/whoami endpoint to validate npm tokens; treats 200 as verified, 401/403 as determinately invalid
• Adds VisibleNpmRegistryAuthData = 1054 to proto/detector_type.proto, regenerated pb.go, and registers the scanner in pkg/engine/defaults/defaults.go
• Populates SecretParts with auth_kind and key, includes a rotation_guide in ExtraData, and implements CustomFalsePositiveChecker

Test plan

• go test ./pkg/detectors/visiblenpmregistryauthdata -tags=detectors -v — all pattern + verify cases pass
• go build ./... succeeds
• go vet ./... clean on touched packages

Notes

NPM registry auth data in .npmrc files can expose publish/install privileges to private or public registries. Leaked credentials grant full access to package publishing and consumption.

Detection

• Keyword pre-filter: _authToken, _auth, registry.npmjs.org, npmrc
• Patterns:
  • _authToken line: matches npm tokens and UUIDs
  • _auth line: matches base64-encoded credentials (16+ chars)

Verification

• GET https://registry.npmjs.org/-/whoami with Authorization: Bearer <token>
• 200 → verified
• 401/403 → determinately unverified (no error)
• Other status → indeterminate (verification error surfaced)
• Note: _auth values (base64) are not verifiable without assuming decode structure

---

Note

Medium Risk
Adds outbound verification calls to the npm registry when scanning with verify enabled; detection logic is isolated but overlaps conceptually with existing npm token detectors.

Overview
Adds a VisibleNpmRegistryAuthData scanner for credentials embedded in .npmrc-style config (not bare npm_ tokens alone). It matches _authToken and _auth assignment lines, deduplicates hits, tags results with auth_kind / rotation metadata, and plugs into default detectors via proto enum 1054.

When verification is on, token-shaped values (npm_* or UUID) are checked with GET …/-/whoami and Authorization: Bearer; 200 marks verified, 401/403 unverified, other statuses surface a verification error. _auth base64 blobs are reported but not verified.

Unit tests cover regex/keyword matching and mocked whoami behavior.

^{Reviewed by Cursor Bugbot for commit 7576597. Bugbot is set up for automated code reviews on this repo. Configure here.}

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.

---

Deeraj CM seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{Reviewed by Cursor Bugbot for commit 7576597. Configure here.}

[cursor]

Skipped proto enum value 1053

Medium Severity

VisibleNpmRegistryAuthData is assigned proto enum value 1054, but the previous entry AWSAppSync is 1052, skipping value 1053. Every other value in the enum from 0 through 1052 is sequential with no gaps. This looks like an accidental off-by-one and could cause confusion or conflicts if another detector is later assigned 1053.

Additional Locations (1)

• pkg/pb/detector_typepb/detector_type.pb.go#L1108-L1109

 

^{Reviewed by Cursor Bugbot for commit 7576597. Configure here.}

[cursor]

UUID regex inconsistently allows uppercase hex digits

Low Severity

verifyableTokenPat allows uppercase hex [0-9A-Fa-f] in the first 8-char UUID group but only lowercase [0-9a-f] in the remaining four groups. A valid UUID-style npm token with uppercase hex characters after the first segment (e.g. 1234abcd-ABCD-...) won't match, causing the detector to skip verification for an otherwise verifiable token.

 

^{Reviewed by Cursor Bugbot for commit 7576597. Configure here.}