id: JS-SEC-020
name: ecb-mode
severity: high
language: javascript
cwe: CWE-327
owasp: "A02:2021"
description: "Detect use of ECB cipher mode in Node.js."
pattern:
  type: regex
  regex:
    - 'createCipheriv\s*\(\s*[\"'']aes-\d+-ecb[\"'']'
    - 'CryptoJS\.mode\.ECB'
    - 'mode\s*:\s*CryptoJS\.mode\.ECB'
message: "ECB cipher mode detected. ECB mode does not hide data patterns and is insecure."
fix_hint: "Use AES-GCM (aes-256-gcm) for authenticated encryption. If using CBC, generate a random IV for each operation."
references:
  - https://cwe.mitre.org/data/definitions/327.html
  - https://owasp.org/Top10/A02_2021-Cryptographic_Failures/
