@4da/mcp-server 6.2.3 → 6.2.5

package/dist/live/lockfile-parsers-rbphp.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Ruby (Gemfile.lock -> RubyGems) and PHP (composer.lock -> Packagist).
+ *
+ * Until 6.2.5 neither was read: a Rails or Symfony project came back "No
+ * manifest files found... run from your project root", which reads as the
+ * user's mistake rather than an ecosystem this server did not cover (audit
+ * A2, 2026-10-12). Both readers mirror the desktop app's
+ * (src-tauri/src/ace/lockfile/ruby.rs; ProjectScanner::parse_composer_lock),
+ * and the conformance corpus scores them against the same truth
+ * (rb-js-rails-6.0, php-js-symfony-demo).
+ */
+import { InstanceSet, type VersionSource } from "./lockfile-types.js";
+/**
+ * Gemfile.lock: the `specs:` of each `GEM` section (registry gems). GIT and
+ * PATH sections are local or git sources, not RubyGems releases, and are
+ * skipped. A platform suffix (`nokogiri (1.10.4-x86_64-linux)`) is not part
+ * of the version: RubyGems prereleases use `.pre`, never `-`.
+ */
+export declare function readGemfileLock(content: string): {
+    instances: InstanceSet;
+    versions: Map<string, string>;
+    direct: string[];
+};
+/**
+ * composer.lock: `packages` (runtime) and `packages-dev` (dev). A leading `v`
+ * is dropped (`v5.4.0` is release 5.4.0 on Packagist and in OSV). A branch
+ * checkout (`dev-main`) names no version and is skipped; a numbered branch
+ * alias (`3.0.x-dev`) is kept, as osv-scanner and the desktop app keep it.
+ */
+export declare function readComposerLock(lock: {
+    packages?: unknown;
+    "packages-dev"?: unknown;
+}): {
+    instances: InstanceSet;
+    versions: Map<string, string>;
+};
+export declare function resolveRuby(cwd: string): VersionSource;
+export declare function resolvePhp(cwd: string): VersionSource;

package/dist/live/lockfile-parsers-rbphp.js

@@ -0,0 +1,123 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Ruby (Gemfile.lock -> RubyGems) and PHP (composer.lock -> Packagist).
+ *
+ * Until 6.2.5 neither was read: a Rails or Symfony project came back "No
+ * manifest files found... run from your project root", which reads as the
+ * user's mistake rather than an ecosystem this server did not cover (audit
+ * A2, 2026-10-12). Both readers mirror the desktop app's
+ * (src-tauri/src/ace/lockfile/ruby.rs; ProjectScanner::parse_composer_lock),
+ * and the conformance corpus scores them against the same truth
+ * (rb-js-rails-6.0, php-js-symfony-demo).
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { emptySource, found, InstanceSet } from "./lockfile-types.js";
+/** Lines longer than this are not lockfile syntax; skipping them keeps every pattern below linear. */
+const MAX_LINE = 4096;
+/**
+ * Gemfile.lock: the `specs:` of each `GEM` section (registry gems). GIT and
+ * PATH sections are local or git sources, not RubyGems releases, and are
+ * skipped. A platform suffix (`nokogiri (1.10.4-x86_64-linux)`) is not part
+ * of the version: RubyGems prereleases use `.pre`, never `-`.
+ */
+export function readGemfileLock(content) {
+    const instances = new InstanceSet();
+    const versions = new Map();
+    const direct = [];
+    let section = "";
+    let inSpecs = false;
+    for (const raw of content.split(/\r?\n/)) {
+        if (raw.length > MAX_LINE || raw.trim() === "")
+            continue;
+        if (!raw.startsWith(" ")) {
+            section = raw.trimEnd();
+            inSpecs = false;
+            continue;
+        }
+        const indent = raw.length - raw.trimStart().length;
+        const line = raw.trim();
+        if (section === "DEPENDENCIES" && indent === 2) {
+            const name = /^([^\s!(]+)/.exec(line)?.[1];
+            if (name)
+                direct.push(name);
+            continue;
+        }
+        if (line === "specs:" && indent === 2) {
+            inSpecs = true;
+            continue;
+        }
+        if (indent === 2) {
+            inSpecs = false;
+            continue;
+        }
+        if (!inSpecs || indent !== 4 || section !== "GEM")
+            continue;
+        const open = line.indexOf(" (");
+        if (open <= 0 || !line.endsWith(")"))
+            continue;
+        const name = line.slice(0, open);
+        const version = line.slice(open + 2, -1).split("-")[0].trim();
+        if (!name || name.includes(" ") || !version)
+            continue;
+        instances.add(name, version);
+        if (!versions.has(name))
+            versions.set(name, version);
+    }
+    return { instances, versions, direct };
+}
+/**
+ * composer.lock: `packages` (runtime) and `packages-dev` (dev). A leading `v`
+ * is dropped (`v5.4.0` is release 5.4.0 on Packagist and in OSV). A branch
+ * checkout (`dev-main`) names no version and is skipped; a numbered branch
+ * alias (`3.0.x-dev`) is kept, as osv-scanner and the desktop app keep it.
+ */
+export function readComposerLock(lock) {
+    const instances = new InstanceSet();
+    const versions = new Map();
+    for (const [key, dev] of [["packages", false], ["packages-dev", true]]) {
+        const list = lock[key];
+        if (!Array.isArray(list))
+            continue;
+        for (const entry of list) {
+            if (typeof entry?.name !== "string" || typeof entry.version !== "string")
+                continue;
+            const version = entry.version.replace(/^v(?=\d)/, "");
+            if (!entry.name || !/^\d/.test(version))
+                continue;
+            instances.add(entry.name, version, dev);
+            if (!versions.has(entry.name))
+                versions.set(entry.name, version);
+        }
+    }
+    return { instances, versions };
+}
+export function resolveRuby(cwd) {
+    const lockPath = path.join(cwd, "Gemfile.lock");
+    if (!fs.existsSync(lockPath))
+        return emptySource();
+    const read = readGemfileLock(fs.readFileSync(lockPath, "utf-8"));
+    if (read.instances.size === 0)
+        return emptySource();
+    return found(read.versions, read.instances, lockPath, "lockfile", { direct: { deps: read.direct, devDeps: [] } });
+}
+export function resolvePhp(cwd) {
+    const lockPath = path.join(cwd, "composer.lock");
+    if (!fs.existsSync(lockPath))
+        return emptySource();
+    const read = readComposerLock(JSON.parse(fs.readFileSync(lockPath, "utf-8")));
+    if (read.instances.size === 0)
+        return emptySource();
+    return found(read.versions, read.instances, lockPath, "lockfile", { direct: composerDirect(cwd) });
+}
+/** composer.json `require` / `require-dev` package names (platform requirements such as `php` and `ext-*` left out). */
+function composerDirect(cwd) {
+    try {
+        const manifest = JSON.parse(fs.readFileSync(path.join(cwd, "composer.json"), "utf-8"));
+        const names = (field) => Object.keys(manifest[field] ?? {}).filter((n) => n.includes("/"));
+        return { deps: names("require"), devDeps: names("require-dev") };
+    }
+    catch {
+        return { deps: [], devDeps: [] };
+    }
+}

package/dist/live/lockfile-parsers.d.ts

@@ -32,6 +32,12 @@ export type { PackageInstance, VersionSource } from "./lockfile-types.js";
 export declare function lockfileCandidates(cwd: string, ecosystem: OsvEcosystem): string[];
 /** The manifest the resolver falls back to for this ecosystem, or null when it has none. */
 export declare function manifestCandidate(cwd: string, ecosystem: OsvEcosystem): string | null;
+/**
+ * The versions one directory pins for one ecosystem, plus every lockfile that
+ * is present but could not be read (`problems`). A damaged or conflicted
+ * lockfile used to fall through silently to the next candidate or to "no
+ * lockfile" (audit B-9): now the answer names the file and the error.
+ */
 export declare function resolveVersionSource(cwd: string, ecosystem: OsvEcosystem): VersionSource;
 /** The package name a package-lock `packages` key installs: the segment after its LAST `node_modules/`. */
 export declare function packageNameFromNodeModulesPath(lockPath: string): string;

package/dist/live/lockfile-parsers.js

@@ -26,14 +26,17 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { readBunLock } from "./bun-lockfile.js";
-import { readPnpmLock, readYarnLock } from "./js-lockfile-readers.js";
+import { MAX_LOCKFILE_LINE, readPnpmLock, readYarnLock } from "./js-lockfile-readers.js";
 import { requirementFiles, resolveGo, resolvePython } from "./lockfile-parsers-pygo.js";
 import { emptySource, found, InstanceSet } from "./lockfile-types.js";
+import { resolvePhp, resolveRuby } from "./lockfile-parsers-rbphp.js";
 const LOCKFILES = {
     npm: ["package-lock.json", "npm-shrinkwrap.json", "pnpm-lock.yaml", "yarn.lock", "bun.lock"],
     "crates.io": ["Cargo.lock"],
     PyPI: ["poetry.lock", "uv.lock", "pdm.lock", "Pipfile.lock"],
     Go: ["go.mod", "go.sum"],
+    RubyGems: ["Gemfile.lock"],
+    Packagist: ["composer.lock"],
 };
 const MANIFESTS = {
     npm: "package.json",
@@ -52,7 +55,29 @@ export function manifestCandidate(cwd, ecosystem) {
     const name = MANIFESTS[ecosystem];
     return name ? path.join(cwd, name) : null;
 }
+/**
+ * The versions one directory pins for one ecosystem, plus every lockfile that
+ * is present but could not be read (`problems`). A damaged or conflicted
+ * lockfile used to fall through silently to the next candidate or to "no
+ * lockfile" (audit B-9): now the answer names the file and the error.
+ */
 export function resolveVersionSource(cwd, ecosystem) {
+    let read;
+    let thrown = null;
+    try {
+        read = readVersionSource(cwd, ecosystem);
+    }
+    catch (error) {
+        read = emptySource();
+        const file = (LOCKFILES[ecosystem] ?? []).map((n) => path.join(cwd, n)).find((f) => fs.existsSync(f));
+        if (file)
+            thrown = { file, error: describeParseError(file, error) ?? "could not be parsed" };
+    }
+    // The reader's own problems (a refused requirements include, M4) and the lockfiles it could not read.
+    const problems = [...(read.problems ?? []), ...(thrown ? [thrown] : unreadLockfiles(cwd, ecosystem, read))];
+    return problems.length > 0 ? { ...read, problems: problems.map((p) => ({ ...p, ecosystem })) } : read;
+}
+function readVersionSource(cwd, ecosystem) {
     switch (ecosystem) {
         case "npm":
             return resolveNpm(cwd);
@@ -62,10 +87,95 @@ export function resolveVersionSource(cwd, ecosystem) {
             return resolvePython(cwd);
         case "Go":
             return resolveGo(cwd);
+        case "RubyGems":
+            return resolveRuby(cwd);
+        case "Packagist":
+            return resolvePhp(cwd);
         default:
             return emptySource();
     }
 }
+/**
+ * yarn.lock entries skipped because a line of theirs is past the reader's
+ * length cap (B-10 keeps the patterns linear). Said, so the read is never
+ * taken for complete (audit L5).
+ */
+function yarnSkippedProblem(file, skipped) {
+    const entries = skipped === 1 ? "1 entry" : `${skipped} entries`;
+    return {
+        file,
+        skipped,
+        error: `${entries} on a line longer than ${MAX_LOCKFILE_LINE} characters (not lockfile syntax) ${skipped === 1 ? "was" : "were"} skipped, so ${skipped === 1 ? "its version was" : "their versions were"} not checked`,
+    };
+}
+function yarnSkips(file) {
+    try {
+        return readYarnLock(fs.readFileSync(file, "utf-8"), new Map());
+    }
+    catch {
+        return 0;
+    }
+}
+/** Lines git writes into a file it could not merge. */
+const CONFLICT_MARKER = /^(?:<{7}|>{7})(?: |$)|^={7}$/m;
+/**
+ * Lockfiles that exist here, rank above the file the versions came from (or
+ * there is none), and were not read: each with the reason, re-derived from
+ * the file so the note can say what is wrong with it.
+ */
+function unreadLockfiles(cwd, ecosystem, read) {
+    const readFiles = new Set([read.source, ...(read.extraSources ?? [])].filter((f) => Boolean(f)).map((f) => path.resolve(f)));
+    const problems = [];
+    for (const name of LOCKFILES[ecosystem] ?? []) {
+        if (name === "go.sum")
+            continue; // read with go.mod, never on its own
+        const file = path.join(cwd, name);
+        if (readFiles.has(path.resolve(file)))
+            break; // everything after it ranks lower
+        if (!fs.existsSync(file))
+            continue;
+        // A yarn.lock whose entries were all skipped for length: named with the count, even when the file is short (L5).
+        const skipped = name === "yarn.lock" ? yarnSkips(file) : 0;
+        if (skipped > 0) {
+            problems.push(yarnSkippedProblem(file, skipped));
+            continue;
+        }
+        const error = describeParseError(file, null);
+        if (error)
+            problems.push({ file, error });
+    }
+    return problems;
+}
+/**
+ * Why a present lockfile yielded nothing, or null when nothing is wrong with
+ * it (a valid lockfile of a project with no dependencies).
+ */
+function describeParseError(file, error) {
+    let content;
+    try {
+        content = fs.readFileSync(file, "utf-8");
+    }
+    catch (readError) {
+        return `could not be read (${readError instanceof Error ? readError.message : String(readError)})`;
+    }
+    if (CONFLICT_MARKER.test(content))
+        return "it contains git merge-conflict markers (<<<<<<< / >>>>>>>): resolve the conflict and reinstall to regenerate it";
+    if (/\.json$/i.test(file)) {
+        try {
+            JSON.parse(content);
+        }
+        catch (parseError) {
+            return `invalid JSON (${parseError instanceof Error ? parseError.message.slice(0, 120) : String(parseError)})`;
+        }
+    }
+    if (error)
+        return `could not be parsed (${error instanceof Error ? error.message.slice(0, 120) : String(error)})`;
+    if (/\.json$/i.test(file))
+        return null;
+    // A text lockfile of some size that gave no package at all is damaged or in a format this reader does not know.
+    const lines = content.split(/\r?\n/).filter((l) => l.trim() !== "").length;
+    return lines > 20 ? "no package versions could be read from it (unsupported format or damaged)" : null;
+}
 /** Instances for a manifest-only read: one per name, scope unknown. */
 function manifestInstances(versions) {
     return [...versions].map(([name, version]) => ({ name, version }));
@@ -128,15 +238,17 @@ function resolveNpm(cwd) {
             const versions = new Map();
             const instances = new InstanceSet();
             const specs = new Map();
-            readYarnLock(fs.readFileSync(yarnLockPath, "utf-8"), versions, instances, specs);
+            const skipped = readYarnLock(fs.readFileSync(yarnLockPath, "utf-8"), versions, instances, specs);
             // The copy a direct dependency resolves to is the one its package.json range names.
             for (const [name, range] of manifestRanges(cwd)) {
                 const version = specs.get(`${name}@${range}`);
                 if (version)
                     versions.set(name, version);
             }
-            if (versions.size > 0)
-                return found(versions, instances, yarnLockPath, "lockfile");
+            if (versions.size > 0) {
+                const read = found(versions, instances, yarnLockPath, "lockfile");
+                return skipped > 0 ? { ...read, problems: [yarnSkippedProblem(yarnLockPath, skipped)] } : read;
+            }
         }
         catch { /* fall through */ }
     }

package/dist/live/lockfile-types.d.ts

@@ -26,6 +26,33 @@ export interface VersionSource {
     extraSources?: string[];
     /** declared_ranges: the declared requirement per name ("^1.2.0"), for names whose version is only a floor. */
     ranges?: Map<string, string>;
+    /**
+     * The direct dependencies the lockfile itself names (Gemfile.lock
+     * DEPENDENCIES, composer.json require / require-dev), for ecosystems whose
+     * manifest the project scanner does not read.
+     */
+    direct?: {
+        deps: string[];
+        devDeps: string[];
+    };
+    /** Lockfiles present here that could not be read, and why: never a silent "no lockfile". */
+    problems?: LockfileProblem[];
+}
+/** A lockfile that exists but could not be read. */
+export interface LockfileProblem {
+    /** Absolute path. */
+    file: string;
+    /** Why, in words ("merge-conflict markers", "invalid JSON: ..."). */
+    error: string;
+    /**
+     * Set when the file WAS read except for this many entries (a yarn.lock line
+     * past the length cap): a partial read, not an unreadable file.
+     */
+    skipped?: number;
+    /** Set for a requirements include refused because it points outside the project (B-11): a policy, not damage. */
+    refused?: true;
+    /** The ecosystem whose resolution reported it (stamped by resolveVersionSource), for ecosystem_filter. */
+    ecosystem?: string;
 }
 export type SourceKind = "lockfile" | "manifest" | "declared_ranges";
 export declare function emptySource(): VersionSource;
@@ -40,4 +67,4 @@ export declare class InstanceSet {
     get size(): number;
     toArray(): PackageInstance[];
 }
-export declare function found(versions: Map<string, string>, instances: InstanceSet | PackageInstance[], source: string, kind: SourceKind, extra?: Pick<VersionSource, "extraSources" | "ranges">): VersionSource;
+export declare function found(versions: Map<string, string>, instances: InstanceSet | PackageInstance[], source: string, kind: SourceKind, extra?: Pick<VersionSource, "extraSources" | "ranges" | "direct">): VersionSource;

package/dist/live/maintenance.d.ts

@@ -3,7 +3,7 @@
  * scan (vulnerability_scan, get_actionable_signals, what_should_i_know,
  * dependency_health) so they all draw the same line.
  */
-import type { VulnerabilityEntry } from "./types.js";
+import type { OsvVulnerability, VulnerabilityEntry } from "./types.js";
 /**
  * Is this advisory a maintenance notice rather than a vulnerability?
  *
@@ -20,9 +20,23 @@ import type { VulnerabilityEntry } from "./types.js";
  *
  * Matched on the advisory's own wording, which RustSec keeps consistent, and
  * deliberately NOT on "deprecated" — that word appears in plenty of real
- * vulnerability summaries.
+ * vulnerability summaries. An entry the scan marked from the record's
+ * `informational` field (`maintenance`, isMaintenanceRecord) is one whatever
+ * its wording.
  */
-export declare function isMaintenanceNotice(v: Pick<VulnerabilityEntry, "summary">): boolean;
+export declare function isMaintenanceNotice(v: Pick<VulnerabilityEntry, "summary"> & {
+    maintenance?: boolean;
+}): boolean;
+/**
+ * The same predicate over an OSV record, for one package (the rule both engines
+ * share, vectors ft-074 / sv-024): the summary wording, OR `informational` of
+ * `unmaintained` / `notice` on the record, OR on an `affected[]` entry for this
+ * package. RustSec writes it per affected entry, never on the record:
+ * RUSTSEC-2018-0017 (`tempdir` crate has been deprecated; use `tempfile`)
+ * carries it only there, and was graded a vulnerability while only the record
+ * level was read.
+ */
+export declare function isMaintenanceRecord(vuln: Pick<OsvVulnerability, "summary" | "database_specific" | "affected">, packageName: string, ecosystem: string): boolean;
 /**
  * The advisories a scan can actually ask the user to act on today: built on
  * this host AND exploitable (not a maintenance notice). This is the set
@@ -30,4 +44,6 @@ export declare function isMaintenanceNotice(v: Pick<VulnerabilityEntry, "summary
  * every other tool that counts "vulnerable" must count the same set or the
  * numbers disagree across tools over one scan.
  */
-export declare function isActionableVulnerability(v: Pick<VulnerabilityEntry, "summary" | "platformActive">): boolean;
+export declare function isActionableVulnerability(v: Pick<VulnerabilityEntry, "summary" | "platformActive"> & {
+    maintenance?: boolean;
+}): boolean;

package/dist/live/maintenance.js

@@ -4,6 +4,10 @@
  * scan (vulnerability_scan, get_actionable_signals, what_should_i_know,
  * dependency_health) so they all draw the same line.
  */
+import { samePackageName } from "./version-compare.js";
+/** The `informational` kinds that make a notice. `unsound` is a vulnerability: it has real fixes. */
+const NOTICE_KINDS = new Set(["unmaintained", "notice"]);
+const NOTICE_WORDING = /\b(unmaintained|no longer maintained)\b/i;
 /**
  * Is this advisory a maintenance notice rather than a vulnerability?
  *
@@ -20,10 +24,35 @@
  *
  * Matched on the advisory's own wording, which RustSec keeps consistent, and
  * deliberately NOT on "deprecated" — that word appears in plenty of real
- * vulnerability summaries.
+ * vulnerability summaries. An entry the scan marked from the record's
+ * `informational` field (`maintenance`, isMaintenanceRecord) is one whatever
+ * its wording.
  */
 export function isMaintenanceNotice(v) {
-    return /\b(unmaintained|no longer maintained)\b/i.test(v.summary || "");
+    // The scan decided from the record (isMaintenanceRecord); only an entry without that answer
+    // falls back to the wording.
+    return typeof v.maintenance === "boolean" ? v.maintenance : NOTICE_WORDING.test(v.summary || "");
+}
+/**
+ * The same predicate over an OSV record, for one package (the rule both engines
+ * share, vectors ft-074 / sv-024): the summary wording, OR `informational` of
+ * `unmaintained` / `notice` on the record, OR on an `affected[]` entry for this
+ * package. RustSec writes it per affected entry, never on the record:
+ * RUSTSEC-2018-0017 (`tempdir` crate has been deprecated; use `tempfile`)
+ * carries it only there, and was graded a vulnerability while only the record
+ * level was read.
+ */
+export function isMaintenanceRecord(vuln, packageName, ecosystem) {
+    // Structured data beats wording (the rule as amended 2026-10-26, 4DA fix/notice-class-beats-wording):
+    // a class the record states for this package decides alone, the affected[] entry's first, else
+    // the record's. `unsound` is never a notice, whatever its summary says: serde_yml's
+    // unsound advisory reads "unmaintained" and was hidden as a notice that never blocks
+    // (audit 6.2.5 F-7). The wording counts only when no class is stated.
+    const own = (vuln.affected ?? []).find((a) => a.package?.ecosystem === ecosystem && samePackageName(a.package.name, packageName, ecosystem) && a.database_specific?.informational)?.database_specific?.informational;
+    const stated = own ?? vuln.database_specific?.informational;
+    if (stated)
+        return NOTICE_KINDS.has(stated);
+    return NOTICE_WORDING.test(vuln.summary ?? "");
 }
 /**
  * The advisories a scan can actually ask the user to act on today: built on

package/dist/live/malware.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Whether an advisory is a malicious-package record: THE predicate, decided by the 4DA lead for
+ * both engines (2026-10-18). A MAL- id (OpenSSF's malicious-packages feed), a MAL- alias, or
+ * CWE-506 ("Embedded Malicious Code") in the record's `database_specific.cwe_ids`. GitHub's
+ * records of npm's removed malware carry no MAL- id: GHSA-c2m4-w5hm-vqjw ("crossenv is malware")
+ * has aliases [CVE-2017-16074] and cwe_ids ["CWE-506"]. GitHub's older malware records carry
+ * neither: GHSA-28f8-hqmc-7ph8 "Malicious Package in ember-power-timepicker" (reviewed CRITICAL)
+ * has aliases [] and cwe_ids [], one of 49 such npm records, so GitHub's fixed advisory title
+ * template counts too: a summary that STARTS "Malicious Package in " or "Malicious code in "
+ * (any case). Free prose that merely mentions "malicious" or "malware" does not.
+ *
+ * Every malware decision goes through it: the offered-release check, the clean-release predicate
+ * (a release it affects is never clean, never a target, never "newest"), parent standing, the
+ * security-holding note and the severity rank (an installed malicious copy ranks critical).
+ */
+export declare function isMalware(id: string, aliases?: readonly string[], cweIds?: readonly unknown[], summary?: string): boolean;
+/** The CWE ids an OSV record names (`database_specific.cwe_ids`), as strings. */
+export declare function cweIdsOf(record: {
+    database_specific?: unknown;
+}): string[];

package/dist/live/malware.js

@@ -0,0 +1,31 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Whether an advisory is a malicious-package record: THE predicate, decided by the 4DA lead for
+ * both engines (2026-10-18). A MAL- id (OpenSSF's malicious-packages feed), a MAL- alias, or
+ * CWE-506 ("Embedded Malicious Code") in the record's `database_specific.cwe_ids`. GitHub's
+ * records of npm's removed malware carry no MAL- id: GHSA-c2m4-w5hm-vqjw ("crossenv is malware")
+ * has aliases [CVE-2017-16074] and cwe_ids ["CWE-506"]. GitHub's older malware records carry
+ * neither: GHSA-28f8-hqmc-7ph8 "Malicious Package in ember-power-timepicker" (reviewed CRITICAL)
+ * has aliases [] and cwe_ids [], one of 49 such npm records, so GitHub's fixed advisory title
+ * template counts too: a summary that STARTS "Malicious Package in " or "Malicious code in "
+ * (any case). Free prose that merely mentions "malicious" or "malware" does not.
+ *
+ * Every malware decision goes through it: the offered-release check, the clean-release predicate
+ * (a release it affects is never clean, never a target, never "newest"), parent standing, the
+ * security-holding note and the severity rank (an installed malicious copy ranks critical).
+ */
+export function isMalware(id, aliases = [], cweIds = [], summary = "") {
+    // Exactly fourda_depengine::is_malware (4DA #992, b18f364f5): ids and CWEs trimmed and
+    // case-insensitive; the summary trimStart-ed, lowercased, then matched at the start.
+    if ([id, ...aliases].some((x) => typeof x === "string" && x.trim().toUpperCase().startsWith("MAL-")))
+        return true;
+    if (cweIds.some((c) => typeof c === "string" && c.trim().toUpperCase() === "CWE-506"))
+        return true;
+    const title = (summary ?? "").trimStart().toLowerCase();
+    return title.startsWith("malicious package in ") || title.startsWith("malicious code in ");
+}
+/** The CWE ids an OSV record names (`database_specific.cwe_ids`), as strings. */
+export function cweIdsOf(record) {
+    const ids = record.database_specific?.cwe_ids;
+    return Array.isArray(ids) ? ids.filter((x) => typeof x === "string") : [];
+}

package/dist/live/npm-packument.d.ts

@@ -29,11 +29,14 @@ interface NpmVersionDoc {
     hasInstallScript?: boolean;
     dependencies?: Record<string, string>;
     optionalDependencies?: Record<string, string>;
-    deprecated?: string;
+    deprecated?: string | boolean;
 }
 export interface NpmPackument {
     versions?: Record<string, NpmVersionDoc>;
     time?: Record<string, unknown>;
+    "dist-tags"?: {
+        latest?: string;
+    };
 }
 export declare class NpmPackumentReader implements ReleaseMetadataSource {
     private cache;

package/dist/live/npm-packument.js

@@ -29,7 +29,8 @@ export class NpmPackumentReader {
         this.rateLimiter = rateLimiter;
     }
     async getReleases(name) {
-        const key = `npm-packument:${name}`;
+        // v2: the projection carries `latest` (FX-H5); a v1 row revalidated by a 304 would lack it.
+        const key = `npm-packument:v2:${name}`;
         const cached = this.cache.getStale(key)?.data ?? null;
         if (cached && Date.now() - cached.fetchedAtMs < FRESH_MS) {
             return { status: "ok", data: cached.index };
@@ -85,7 +86,8 @@ export function projectPackument(name, doc) {
             trust,
             trustEvidence,
             installScripts: installScriptsOf(v),
-            deprecated: typeof v.deprecated === "string" && v.deprecated.length > 0 ? v.deprecated : null,
+            // `deprecated: true` (no message) counts too, as in the 4DA app.
+            deprecated: typeof v.deprecated === "string" && v.deprecated.length > 0 ? v.deprecated : v.deprecated === true ? "deprecated" : null,
             withdrawn: null,
             dependencies: [
                 ...new Set([...Object.keys(v.dependencies ?? {}), ...Object.keys(v.optionalDependencies ?? {})]),
@@ -123,6 +125,7 @@ export function projectPackument(name, doc) {
         name,
         createdAt: typeof time.created === "string" ? time.created : null,
         releases,
+        latest: typeof doc["dist-tags"]?.latest === "string" ? doc["dist-tags"].latest : null,
     };
 }
 function npmTrust(v) {

package/dist/live/offered-release.d.ts

@@ -0,0 +1,53 @@
+/**
+ * A release a tool OFFERS as an upgrade (upgrade_planner's target for a row with no advisory,
+ * dependency_health's latestStableVersion, what_should_i_know's "latest") is checked the way
+ * dependency_check decides `proceed`: against every advisory of the package with the same
+ * predicate (osv-ranges.ts advisoriesAffecting) and against the registry's withdrawals. A
+ * known-affected or withdrawn release is never offered as a safe upgrade, and the answer says why.
+ *
+ * Final release audit of 6.2.5 (2026-10-18): upgrade_planner sent crossenv 0.0.2-security, npm's
+ * placeholder for a removed malware package, to 1.0.1, which GHSA-c2m4-w5hm-vqjw (last_affected
+ * 1.0.1) lists as the malware itself. The same held for cross-env.js, mongose, babelcli, d3.js,
+ * jquery.js, ffmepg, nodesass and nodefabric: rows with no advisory on the installed version took
+ * the registry's latest stable release with no check at all.
+ */
+import type { FixPathSources } from "./fix-paths.js";
+import type { OsvEcosystem } from "./types.js";
+export interface OfferedRelease {
+    /** The release the tool was about to offer. */
+    offered: string;
+    /** False when the package's advisories could not be read: the offer is unchecked, and said to be. */
+    checked: boolean;
+    /** Advisories that affect `offered`. */
+    affectedBy: string[];
+    /** The registry's words when it withdrew `offered` (yanked, or deprecated with a later clean release on its line). */
+    withdrawn: string | null;
+    /** The release to offer instead: the newest release above the installed one that is neither affected nor withdrawn; null when none. */
+    safe: string | null;
+    /**
+     * The installed version is npm's security placeholder (`0.0.x-security`, published after the
+     * malware was taken down) and no release above it is safe: the placeholder is the safe state,
+     * and the step is removing the dependency.
+     */
+    holding: boolean;
+    /** Plain words for an offer that changed or could not be checked; null when `offered` stands as it is. */
+    note: string | null;
+}
+/**
+ * Check one offered release. `installed` is the version the project holds; the replacement is
+ * looked for above it (a stable one unless nothing stable is newer).
+ */
+export declare function vetOfferedRelease(sources: FixPathSources, ecosystem: OsvEcosystem, name: string, installed: string | null, offered: string): Promise<OfferedRelease>;
+/**
+ * vetOfferedRelease over many rows within a time budget; a row not checked in time is absent from
+ * the result, and the caller says so. Keyed by `key`.
+ */
+export declare function vetOfferedReleases(sources: FixPathSources | null, items: Array<{
+    key: string;
+    ecosystem: OsvEcosystem;
+    name: string;
+    installed: string | null;
+    offered: string;
+}>, budgetMs: number, concurrency?: number): Promise<Map<string, OfferedRelease>>;
+/** Said for an offer that could not be checked in time (the budget ran out, or offline). */
+export declare function uncheckedOfferNote(name: string, offered: string): string;