Electronegativity is a tool to identify misconfigurations and security anti-patterns in Electron-based applications.
It leverages AST and DOM parsing to look for security-relevant configurations, as described in the "Electron Security Checklist - A Guide for Developers and Auditors" whitepaper.
Software developers and security auditors can use this tool to detect and mitigate potential weaknesses and implementation bugs when developing applications using Electron. A good understanding of Electron (in)security is still required when using Electronegativity, as some of the potential issues detected by the tool require manual investigation.
Major releases are pushed to NPM and can be simply installed using:
$ npm install @doyensec/electronegativity -g
$ electronegativity -h
|-V||output the version number|
|-i, --input||input (directory, .js, .html, .asar)|
|-l, --checks||only run the specified checks, passed in csv format|
|-s, --severity||only return findings with the specified level of severity or above|
|-c, --confidence||only return findings with the specified level of confidence or above|
|-o, --output <filename[.csv or .sarif]>||save the results to a file in csv or sarif format|
|-r, --relative||show relative path for files|
|-v, --verbose||show the description for the findings|
|-u, --upgrade||run Electron upgrade checks, eg -u 7..8 to check upgrade from Electron 7 to 8|
|-h, --help||output usage information|
Using electronegativity to look for issues in a directory containing an Electron app:
$ electronegativity -i /path/to/electron/app
Using electronegativity to look for issues in an
asar archive and saving the results in a csv file:
$ electronegativity -i /path/to/asar/archive -o result.csv
Using electronegativity when upgrading from one version of Electron to another to find breaking changes:
$ electronegativity -i /path/to/electron/app -v -u 7..8
node --max-old-space-size=4096 electronegativity -i /path/to/asar/archive -o result.csv
You can also use electronegativity programmatically, using similar options as for the CLI:
const run =// or: import run from '@doyensec/electronegativity';
The result contains the number of global and atomic checks, any errors encountered while parsing and an array of the issues found, like this:
If you're thinking about contributing to this project, please take a look at our CONTRIBUTING.md.
Electronegativity was made possible thanks to the work of many contributors.
This project has been sponsored by Doyensec LLC.
Engage us to break your Electron.js application!