sc-lang-typescript

SC: TypeScript/JavaScript Security Deep Scan

Purpose

Detects TypeScript/JavaScript-specific security anti-patterns and language-idiomatic attack vectors across both browser and Node.js environments. This skill covers frontend frameworks (React, Next.js, Angular, Vue), backend frameworks (Express, Fastify, Koa, Nest), ORMs (Prisma, Drizzle, TypeORM, Sequelize), and the broader npm ecosystem.

Activation

Activates when TypeScript or JavaScript is detected in the project. Detection signals include:

• Files with .ts, .tsx, .js, .jsx, .mjs, .cjs extensions
• package.json, tsconfig.json, deno.json, or bun.lockb presence
• Node.js runtime markers (process.env, require(), import)

Checklist Reference

References references/typescript-security-checklist.md.

TypeScript/JavaScript-Specific Vulnerability Patterns

---

1. Prototype Pollution

Description: Attackers inject properties into Object.prototype via __proto__, constructor.prototype, or recursive merge functions, poisoning every object in the runtime.

Dangerous Functions / Patterns:

• obj[key] = value where key is user-controlled
• Recursive deepMerge, _.merge, _.defaultsDeep with untrusted input
• JSON.parse() of untrusted input followed by object spread or merge
• Direct access to __proto__ or constructor.prototype

Safe Alternative:

• Use Object.create(null) for lookup maps
• Validate keys against a denylist: __proto__, constructor, prototype
• Use Map instead of plain objects for user-keyed data
• Freeze prototypes with Object.freeze(Object.prototype) in sensitive contexts

Vulnerable Code:

function deepMerge(target: any, source: any) {
  for (const key in source) {
    if (typeof source[key] === 'object') {
      target[key] = deepMerge(target[key] || {}, source[key]);
    } else {
      target[key] = source[key]; // __proto__.isAdmin = true
    }
  }
  return target;
}
deepMerge({}, JSON.parse(userInput));