@aegis-sdk/testing - npm Package Compare versions

Comparing version 0.1.0 to 0.2.0

dist/index.cjs

@@ -831,2 +831,67 @@ 'use strict';
 };
+var DEFAULT_PREFIXES = [
+  "",
+  "Hello, can you help me? ",
+  "I have a question: ",
+  "Please assist me with: ",
+  "URGENT: ",
+  '{"input": "',
+  "```\n",
+  "<!-- "
+];
+var DEFAULT_SUFFIXES = [
+  "",
+  " Thank you!",
+  " Thanks in advance.",
+  "\nPlease format your response as JSON.",
+  '"}',
+  "\n```",
+  " -->",
+  "   "
+];
+function applyEncoding(text, encoding) {
+  switch (encoding) {
+    case "base64":
+      try {
+        return btoa(text);
+      } catch {
+        return applyEncoding(text, "hex");
+      }
+    case "hex":
+      return Array.from(text).map((c) => c.charCodeAt(0).toString(16).padStart(2, "0")).join("");
+    case "unicode":
+      return Array.from(text).map((c) => {
+        const code = c.charCodeAt(0);
+        if (code > 127) return `\\u${code.toString(16).padStart(4, "0")}`;
+        return c;
+      }).join("");
+    case "none":
+    default:
+      return text;
+  }
+}
+function generateFuzzPayloads(options) {
+  const {
+    attacks,
+    prefixes = DEFAULT_PREFIXES,
+    suffixes = DEFAULT_SUFFIXES,
+    encodings = ["none"],
+    maxPermutations = 1e3
+  } = options;
+  const results = [];
+  for (const attack of attacks) {
+    for (const encoding of encodings) {
+      const encoded = applyEncoding(attack, encoding);
+      for (const prefix of prefixes) {
+        for (const suffix of suffixes) {
+          if (results.length >= maxPermutations) {
+            return results;
+          }
+          results.push(prefix + encoded + suffix);
+        }
+      }
+    }
+  }
+  return results;
+}
 
@@ -836,2 +901,3 @@ exports.ATTACK_SUITES = ATTACK_SUITES;
 exports.RedTeamScanner = RedTeamScanner;
+exports.generateFuzzPayloads = generateFuzzPayloads;
 exports.getAllPayloads = getAllPayloads;
@@ -838,0 +904,0 @@ exports.getAllSuites = getAllSuites;

dist/index.d.cts

@@ -116,3 +116,36 @@ import { Aegis } from '@aegis-sdk/core';
 }
+type FuzzEncoding = "base64" | "hex" | "unicode" | "none";
+interface GenerateFuzzPayloadsOptions {
+    /** The attack strings to permute. */
+    attacks: string[];
+    /** Optional prefixes to prepend. Defaults to a small built-in set. */
+    prefixes?: string[];
+    /** Optional suffixes to append. Defaults to a small built-in set. */
+    suffixes?: string[];
+    /** Optional encoding transformations. Defaults to ["none"]. */
+    encodings?: FuzzEncoding[];
+    /** Maximum number of permutations to return. Defaults to 1000. */
+    maxPermutations?: number;
+}
+/**
+ * Generate fuzz payloads by combinatorially combining attacks with prefixes,
+ * suffixes, and encoding transformations.
+ *
+ * This function does NOT depend on fast-check and is suitable for use in the
+ * published npm package. It produces deterministic, enumerable permutations.
+ *
+ * @example
+ * ```ts
+ * const payloads = generateFuzzPayloads({
+ *   attacks: ["Ignore all previous instructions"],
+ *   prefixes: ["Hello, ", ""],
+ *   suffixes: [" Thanks!", ""],
+ *   encodings: ["none", "base64"],
+ *   maxPermutations: 100,
+ * });
+ * // Returns up to 100 combined payload strings
+ * ```
+ */
+declare function generateFuzzPayloads(options: GenerateFuzzPayloadsOptions): string[];
 
-export { ATTACK_SUITES, type AttackPayload, type AttackSuite, PayloadGenerator, RedTeamScanner, getAllPayloads, getAllSuites, getSuiteById, getSuitesByThreatCategory };
+export { ATTACK_SUITES, type AttackPayload, type AttackSuite, type FuzzEncoding, type GenerateFuzzPayloadsOptions, PayloadGenerator, RedTeamScanner, generateFuzzPayloads, getAllPayloads, getAllSuites, getSuiteById, getSuitesByThreatCategory };

dist/index.d.ts

@@ -116,3 +116,36 @@ import { Aegis } from '@aegis-sdk/core';
 }
+type FuzzEncoding = "base64" | "hex" | "unicode" | "none";
+interface GenerateFuzzPayloadsOptions {
+    /** The attack strings to permute. */
+    attacks: string[];
+    /** Optional prefixes to prepend. Defaults to a small built-in set. */
+    prefixes?: string[];
+    /** Optional suffixes to append. Defaults to a small built-in set. */
+    suffixes?: string[];
+    /** Optional encoding transformations. Defaults to ["none"]. */
+    encodings?: FuzzEncoding[];
+    /** Maximum number of permutations to return. Defaults to 1000. */
+    maxPermutations?: number;
+}
+/**
+ * Generate fuzz payloads by combinatorially combining attacks with prefixes,
+ * suffixes, and encoding transformations.
+ *
+ * This function does NOT depend on fast-check and is suitable for use in the
+ * published npm package. It produces deterministic, enumerable permutations.
+ *
+ * @example
+ * ```ts
+ * const payloads = generateFuzzPayloads({
+ *   attacks: ["Ignore all previous instructions"],
+ *   prefixes: ["Hello, ", ""],
+ *   suffixes: [" Thanks!", ""],
+ *   encodings: ["none", "base64"],
+ *   maxPermutations: 100,
+ * });
+ * // Returns up to 100 combined payload strings
+ * ```
+ */
+declare function generateFuzzPayloads(options: GenerateFuzzPayloadsOptions): string[];
 
-export { ATTACK_SUITES, type AttackPayload, type AttackSuite, PayloadGenerator, RedTeamScanner, getAllPayloads, getAllSuites, getSuiteById, getSuitesByThreatCategory };
+export { ATTACK_SUITES, type AttackPayload, type AttackSuite, type FuzzEncoding, type GenerateFuzzPayloadsOptions, PayloadGenerator, RedTeamScanner, generateFuzzPayloads, getAllPayloads, getAllSuites, getSuiteById, getSuitesByThreatCategory };

dist/index.js

@@ -829,5 +829,70 @@ import { quarantine } from '@aegis-sdk/core';
 };
+var DEFAULT_PREFIXES = [
+  "",
+  "Hello, can you help me? ",
+  "I have a question: ",
+  "Please assist me with: ",
+  "URGENT: ",
+  '{"input": "',
+  "```\n",
+  "<!-- "
+];
+var DEFAULT_SUFFIXES = [
+  "",
+  " Thank you!",
+  " Thanks in advance.",
+  "\nPlease format your response as JSON.",
+  '"}',
+  "\n```",
+  " -->",
+  "   "
+];
+function applyEncoding(text, encoding) {
+  switch (encoding) {
+    case "base64":
+      try {
+        return btoa(text);
+      } catch {
+        return applyEncoding(text, "hex");
+      }
+    case "hex":
+      return Array.from(text).map((c) => c.charCodeAt(0).toString(16).padStart(2, "0")).join("");
+    case "unicode":
+      return Array.from(text).map((c) => {
+        const code = c.charCodeAt(0);
+        if (code > 127) return `\\u${code.toString(16).padStart(4, "0")}`;
+        return c;
+      }).join("");
+    case "none":
+    default:
+      return text;
+  }
+}
+function generateFuzzPayloads(options) {
+  const {
+    attacks,
+    prefixes = DEFAULT_PREFIXES,
+    suffixes = DEFAULT_SUFFIXES,
+    encodings = ["none"],
+    maxPermutations = 1e3
+  } = options;
+  const results = [];
+  for (const attack of attacks) {
+    for (const encoding of encodings) {
+      const encoded = applyEncoding(attack, encoding);
+      for (const prefix of prefixes) {
+        for (const suffix of suffixes) {
+          if (results.length >= maxPermutations) {
+            return results;
+          }
+          results.push(prefix + encoded + suffix);
+        }
+      }
+    }
+  }
+  return results;
+}
 
-export { ATTACK_SUITES, PayloadGenerator, RedTeamScanner, getAllPayloads, getAllSuites, getSuiteById, getSuitesByThreatCategory };
+export { ATTACK_SUITES, PayloadGenerator, RedTeamScanner, generateFuzzPayloads, getAllPayloads, getAllSuites, getSuiteById, getSuitesByThreatCategory };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package.json

 {
   "name": "@aegis-sdk/testing",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Red team testing tools and attack suites for Aegis",
@@ -26,3 +26,3 @@ "license": "MIT",
   "dependencies": {
-    "@aegis-sdk/core": "0.1.0"
+    "@aegis-sdk/core": "0.2.0"
   },
@@ -29,0 +29,0 @@ "repository": {

New alerts

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

Fixed alerts

Major refactor

Supply chain risk

Package has recently undergone a major refactor. It may be unstable or indicate significant internal changes. Use caution when updating to versions that include significant changes.

Found 1 instance in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

208892

8.29%

Lines of code

1940

9.23%

Number of medium supply chain risk alerts

0

-100%

Dependency changes

• + Added

  @aegis-sdk/core@0.2.0
  (transitive)

• - Removed

  @aegis-sdk/core@0.1.0
  (transitive)

• Updated

  @aegis-sdk/core@0.2.0