{"_id":"@aegis-security/aegis","name":"@aegis-security/aegis","dist-tags":{"latest":"0.1.0"},"versions":{"0.1.0":{"name":"@aegis-security/aegis","version":"0.1.0","description":"A static analysis tool for Solidity smart contracts focused on security, correctness, and productivity","bin":{"aegis":"src/cli/index.js"},"scripts":{"test":"jest","test:watch":"jest --watch","test:coverage":"jest --coverage","start":"node src/cli/index.js"},"keywords":["solidity","security","static-analysis","smart-contracts","audit","vulnerability-detection"],"license":"MIT","repository":{"type":"git","url":"git+https://github.com/SharfShiplo/aegis.git"},"bugs":{"url":"https://github.com/SharfShiplo/aegis/issues"},"homepage":"https://github.com/SharfShiplo/aegis#readme","dependencies":{"commander":"^11.1.0","chalk":"^4.1.2","@solidity-parser/parser":"^0.20.0","glob":"^10.3.10"},"devDependencies":{"jest":"^29.7.0","@types/node":"^20.10.0"},"engines":{"node":">=14.0.0"},"_id":"@aegis-security/aegis@0.1.0","gitHead":"01499db29017262bef52189c4f93544772ad67dc","_nodeVersion":"24.11.0","_npmVersion":"10.8.2","dist":{"integrity":"sha512-6y8S2DiKlK0nvT/8ux2wKp09JhYcLr9v08AXTR4wpo47ElNf7dE5WVxVBY3WPC9YU+S3qmkhopvQI8TU+gSBJA==","shasum":"9a0fc0e558074a2e818da2a39e3ef2f38d716670","tarball":"https://registry.npmjs.org/@aegis-security/aegis/-/aegis-0.1.0.tgz","fileCount":35,"unpackedSize":85093,"signatures":[{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEYCIQD8jNX7NJLS28IRyyxRBiN9eCgr1jyVpb049J/Ti6MPDgIhAJwPB7Ea8e/gJhApDUtUd4gmDZtBAGr2bOxdUdA7tntr"}]},"_npmUser":{"name":"sharfuddin","email":"sharf.ahammed@gmail.com"},"directories":{},"maintainers":[{"name":"sharfuddin","email":"sharf.ahammed@gmail.com"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/aegis_0.1.0_1768975533426_0.4210346943288361"},"_hasShrinkwrap":false}},"time":{"created":"2026-01-21T06:05:33.309Z","0.1.0":"2026-01-21T06:05:33.568Z","modified":"2026-01-21T06:05:34.074Z"},"maintainers":[{"name":"sharfuddin","email":"sharf.ahammed@gmail.com"}],"description":"A static analysis tool for Solidity smart contracts focused on security, correctness, and productivity","homepage":"https://github.com/SharfShiplo/aegis#readme","keywords":["solidity","security","static-analysis","smart-contracts","audit","vulnerability-detection"],"repository":{"type":"git","url":"git+https://github.com/SharfShiplo/aegis.git"},"bugs":{"url":"https://github.com/SharfShiplo/aegis/issues"},"license":"MIT","readme":"# Aegis\r\n\r\nA static analysis tool for Solidity smart contracts focused on security, correctness, and productivity. Aegis helps developers, auditors, and researchers identify common vulnerabilities and code smells in Solidity code.\r\n\r\n## Features\r\n\r\n- 🔍 **Static Analysis**: Analyzes Solidity source code without execution\r\n- 🚨 **Vulnerability Detection**: Identifies common security issues and code smells\r\n- 🎯 **Actionable Suggestions**: Provides remediation guidance for each finding\r\n- 📊 **Multiple Output Formats**: Supports JSON and human-readable text output\r\n- ⚡ **Fast & Reliable**: Built for speed and CI/CD integration\r\n- 🔧 **Extensible**: Modular rule system for easy customization\r\n\r\n## Installation\r\n\r\nThe npm package is published under the scoped name `@aegis-security/aegis`. Although the package is published under a scoped name, the CLI command is simply `aegis`.\r\n\r\nFor local development:\r\n```bash\r\nnpm install\r\n```\r\n\r\nFor global installation:\r\n```bash\r\nnpm install -g @aegis-security/aegis\r\n```\r\n\r\nOr use via npx:\r\n```bash\r\nnpx @aegis-security/aegis scan .\r\n```\r\n\r\n## Quick Start\r\n\r\n### Scan a single file\r\n\r\n```bash\r\naegis scan contracts/Token.sol\r\n```\r\n\r\n### Scan a directory\r\n\r\n```bash\r\naegis scan contracts/\r\n```\r\n\r\n### Get JSON output\r\n\r\n```bash\r\naegis scan . --format json\r\n```\r\n\r\n### Filter by severity\r\n\r\n```bash\r\naegis scan . --severity HIGH\r\n```\r\n\r\n### Ignore specific rules\r\n\r\n```bash\r\naegis scan . --ignore-rules UNBOUNDED_LOOP,DEPRECATED\r\n```\r\n\r\n### Quiet mode\r\n\r\n```bash\r\naegis scan . --quiet\r\n```\r\n\r\n## Command Line Options\r\n\r\n```\r\nUsage: aegis scan <target> [options]\r\n\r\nArguments:\r\n  target                  File or directory to scan\r\n\r\nOptions:\r\n  -f, --format <format>   Output format (json|text) (default: \"text\")\r\n  -s, --severity <level>  Minimum severity level (CRITICAL|HIGH|MEDIUM|LOW)\r\n  -i, --ignore-rules      Comma-separated list of rule IDs to ignore\r\n  --quiet                 Suppress summary output\r\n  -h, --help              Display help for command\r\n  -V, --version           Display version\r\n```\r\n\r\n## Detected Issues\r\n\r\nAegis currently detects the following issues:\r\n\r\n### CRITICAL\r\n\r\n- **REENTRANCY**: Potential reentrancy vulnerabilities in external calls\r\n\r\n### HIGH\r\n\r\n- **TX_ORIGIN**: Use of `tx.origin` for authorization\r\n- **UNCHECKED_CALL**: Unchecked low-level calls (`call()`, `delegatecall()`, etc.)\r\n- **INTEGER_OVERFLOW**: Integer overflow/underflow (Solidity < 0.8)\r\n\r\n### MEDIUM\r\n\r\n- **UNBOUNDED_LOOP**: Potentially unbounded loops\r\n- **DEPRECATED**: Usage of deprecated functions/opcodes\r\n\r\n## Output Formats\r\n\r\n### Text Output (Default)\r\n\r\n```\r\nAegis Scan Results\r\n==================================================\r\n\r\ncontracts/VulnerableContract.sol (Solidity ^0.7.0)\r\n  [HIGH] Use of tx.origin for authorization - prefer msg.sender\r\n    Rule: TX_ORIGIN | Line: 10:15\r\n    Suggestion: Use msg.sender instead of tx.origin. tx.origin can be manipulated by intermediate contracts in a call chain.\r\n\r\n==================================================\r\nSummary:\r\n  Files scanned: 1\r\n  Files with issues: 1\r\n  Total findings: 1\r\n\r\nFindings by severity:\r\n  HIGH: 1\r\n```\r\n\r\n### JSON Output\r\n\r\n```json\r\n{\r\n  \"summary\": {\r\n    \"files\": 1,\r\n    \"totalFindings\": 1,\r\n    \"bySeverity\": {\r\n      \"CRITICAL\": 0,\r\n      \"HIGH\": 1,\r\n      \"MEDIUM\": 0,\r\n      \"LOW\": 0\r\n    },\r\n    \"filesWithIssues\": 1\r\n  },\r\n  \"results\": [\r\n    {\r\n      \"file\": \"/path/to/contracts/VulnerableContract.sol\",\r\n      \"version\": \"^0.7.0\",\r\n      \"findings\": [\r\n        {\r\n          \"ruleId\": \"TX_ORIGIN\",\r\n          \"severity\": \"HIGH\",\r\n          \"message\": \"Use of tx.origin for authorization - prefer msg.sender\",\r\n          \"file\": \"/path/to/contracts/VulnerableContract.sol\",\r\n          \"line\": 10,\r\n          \"column\": 15,\r\n          \"suggestion\": \"Use msg.sender instead of tx.origin...\"\r\n        }\r\n      ]\r\n    }\r\n  ]\r\n}\r\n```\r\n\r\n## Exit Codes\r\n\r\n- `0`: Scan completed successfully, no CRITICAL issues found\r\n- `1`: Scan completed but CRITICAL issues were detected, or an error occurred\r\n\r\nThis makes Aegis suitable for CI/CD pipelines where non-zero exit codes can trigger build failures.\r\n\r\n## CI/CD Integration\r\n\r\n### GitHub Actions Example\r\n\r\n```yaml\r\nname: Security Scan\r\n\r\non: [push, pull_request]\r\n\r\njobs:\r\n  scan:\r\n    runs-on: ubuntu-latest\r\n    steps:\r\n      - uses: actions/checkout@v3\r\n      - uses: actions/setup-node@v3\r\n        with:\r\n          node-version: '18'\r\n      - run: npm install\r\n      - run: npm install -g .\r\n      - run: aegis scan contracts/ --format json > scan-results.json\r\n      - uses: actions/upload-artifact@v3\r\n        with:\r\n          name: scan-results\r\n          path: scan-results.json\r\n```\r\n\r\n## Examples\r\nSome examples intentionally trigger MEDIUM findings to demonstrate how Aegis reports non-critical issues.\r\n\r\nSee the `examples/` directory for sample Solidity contracts:\r\n\r\n- `vulnerable-contract.sol`: Contains various vulnerabilities for testing\r\n- `safe-contract.sol`: Demonstrates mostly safe patterns but may still trigger non-critical findings (e.g. gas-related warnings)\r\n- `clean-example.sol`: Demonstrates a contract with zero findings\r\n\r\nRun Aegis on these examples:\r\n\r\n```bash\r\naegis scan examples/vulnerable-contract.sol\r\n```\r\n\r\n## Development\r\n\r\n### Running Tests\r\n\r\n```bash\r\nnpm test\r\n```\r\n\r\n### Running Tests with Coverage\r\n\r\n```bash\r\nnpm run test:coverage\r\n```\r\n\r\n### Project Structure\r\n\r\n```\r\naegis/\r\n├── src/\r\n│   ├── cli/           # CLI interface\r\n│   ├── core/          # Core types (Finding, Rule)\r\n│   ├── scanner/       # Scanner implementation\r\n│   ├── ast/           # AST parsing utilities\r\n│   ├── rules/         # Vulnerability detection rules\r\n│   ├── reporters/     # Output formatters (JSON, Text)\r\n│   └── utils/         # Utility functions\r\n├── examples/          # Example Solidity contracts\r\n├── src/__tests__/     # Test files\r\n└── README.md\r\n```\r\n\r\n## Contributing\r\n\r\nSee [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines on contributing to Aegis.\r\n\r\n## License\r\n\r\nMIT\r\n\r\n## Disclaimer\r\n\r\nAegis is an automated static analysis tool and does not guarantee the detection of all security vulnerabilities. It should not be considered a substitute for a comprehensive security audit or professional review. Always perform thorough testing and independent audits before deploying smart contracts to mainnet. This software is provided “as is” without warranties of any kind.\r\n\r\n","readmeFilename":"README.md","_rev":"1-d66ff1a7808e49e19a97b75047f08ea0"}