@cdxgen/cdxgen 0.0.1 → 13.0.0

package/data/rules/asar-archives.yaml

@@ -0,0 +1,150 @@
+# Electron ASAR archive security rules
+# Category: asar-archive
+# Evaluates packaged Electron application archives for dynamic execution,
+# capability overlap, integrity mismatches, and embedded install-time scripts.
+
+- id: ASAR-001
+  name: "Archived JavaScript with eval or dynamic loading"
+  description: "ASAR-packaged JavaScript using eval, Function, or dynamic import/require deserves review for arbitrary code execution and remote payload loading risk."
+  severity: high
+  category: asar-archive
+  dry-run-support: full
+  condition: |
+    components[
+      $prop($, 'cdx:file:kind') = 'asar-entry'
+      and (
+        $propBool($, 'cdx:asar:js:hasEval') = true
+        or $propBool($, 'cdx:asar:js:capability:dynamicImport') = true
+        or $listContains($propList($, 'cdx:asar:js:executionIndicators'), 'eval')
+        or $listContains($propList($, 'cdx:asar:js:executionIndicators'), 'function-constructor')
+      )
+    ]
+  location: |
+    {
+      "bomRef": $. "bom-ref",
+      "srcFile": $prop($, 'internal:SrcFile'),
+      "archivePath": $prop($, 'cdx:asar:path')
+    }
+  message: "Archived JavaScript '{{ name }}' uses eval-like or dynamic loading behavior inside an ASAR package"
+  mitigation: "Review the packaged source for eval, Function, dynamic import, or runtime module resolution. Prefer static imports and signed update channels."
+  evidence: |
+    {
+      "archivePath": $prop($, 'cdx:asar:path'),
+      "executionIndicators": $prop($, 'cdx:asar:js:executionIndicators'),
+      "dynamicImport": $prop($, 'cdx:asar:js:capability:dynamicImport'),
+      "hasEval": $prop($, 'cdx:asar:js:hasEval')
+    }
+
+- id: ASAR-002
+  name: "Archived JavaScript with network plus file or hardware access"
+  description: "Packaged JavaScript that combines outbound network capability with filesystem or hardware access can materially increase exfiltration or device-control risk."
+  severity: high
+  category: asar-archive
+  dry-run-support: full
+  condition: |
+    components[
+      $prop($, 'cdx:file:kind') = 'asar-entry'
+      and $propBool($, 'cdx:asar:js:capability:network') = true
+      and (
+        $propBool($, 'cdx:asar:js:capability:fileAccess') = true
+        or $propBool($, 'cdx:asar:js:capability:hardware') = true
+        or $propBool($, 'cdx:asar:js:hasDynamicFetch') = true
+      )
+    ]
+  location: |
+    {
+      "bomRef": $. "bom-ref",
+      "srcFile": $prop($, 'internal:SrcFile'),
+      "archivePath": $prop($, 'cdx:asar:path')
+    }
+  message: "Archived JavaScript '{{ name }}' combines network behavior with sensitive local access capabilities"
+  mitigation: "Review outbound endpoints, local file access, and hardware APIs. Limit packaged code to explicit allowlisted operations and sign release artifacts."
+  evidence: |
+    {
+      "archivePath": $prop($, 'cdx:asar:path'),
+      "capabilities": $prop($, 'cdx:asar:js:capabilities'),
+      "networkIndicators": $prop($, 'cdx:asar:js:networkIndicators'),
+      "hardwareIndicators": $prop($, 'cdx:asar:js:hardwareIndicators'),
+      "fileAccessIndicators": $prop($, 'cdx:asar:js:fileAccessIndicators')
+    }
+
+- id: ASAR-003
+  name: "Declared ASAR integrity mismatch"
+  description: "An ASAR entry whose declared integrity hash does not match the computed file hash may indicate tampering or packaging defects."
+  severity: high
+  category: asar-archive
+  dry-run-support: full
+  condition: |
+    components[
+      $prop($, 'cdx:file:kind') = 'asar-entry'
+      and $prop($, 'cdx:asar:integrityVerified') = 'false'
+    ]
+  location: |
+    {
+      "bomRef": $. "bom-ref",
+      "srcFile": $prop($, 'internal:SrcFile'),
+      "archivePath": $prop($, 'cdx:asar:path')
+    }
+  message: "Archived entry '{{ name }}' has a declared integrity hash mismatch inside an ASAR package"
+  mitigation: "Rebuild the archive from trusted sources, verify signing provenance, and compare the packaged file to the expected release artifact."
+  evidence: |
+    {
+      "archivePath": $prop($, 'cdx:asar:path'),
+      "declaredHash": $prop($, 'cdx:asar:declaredIntegrityHash'),
+      "verified": $prop($, 'cdx:asar:integrityVerified')
+    }
+
+- id: ASAR-004
+  name: "Embedded npm package with install-time scripts inside ASAR"
+  description: "Node packages shipped inside ASAR archives that declare install/preinstall hooks are still useful compromise indicators during artifact review."
+  severity: high
+  category: asar-archive
+  dry-run-support: partial
+  condition: |
+    components[
+      $propBool($, 'cdx:npm:hasInstallScript') = true
+      and $contains($prop($, 'internal:SrcFile'), '.asar#/')
+    ]
+  location: |
+    {
+      "bomRef": $. "bom-ref",
+      "purl": purl,
+      "srcFile": $prop($, 'internal:SrcFile')
+    }
+  message: "Embedded npm package '{{ name }}@{{ version }}' inside ASAR declares install-time lifecycle scripts"
+  mitigation: "Review the embedded package source and build provenance. Remove unnecessary lifecycle hooks or vendor only prebuilt trusted artifacts."
+  evidence: |
+    {
+      "srcFile": $prop($, 'internal:SrcFile'),
+      "lifecycleScripts": $prop($, 'cdx:npm:risky_scripts'),
+      "executionIndicators": $prop($, 'cdx:npm:lifecycleExecutionIndicators'),
+      "obfuscationIndicators": $prop($, 'cdx:npm:lifecycleObfuscationIndicators')
+    }
+
+- id: ASAR-005
+  name: "Electron ASAR signing metadata failed verification"
+  description: "Electron Info.plist signing metadata that fails verification is a high-signal indicator of packaging defects or release-artifact tampering."
+  severity: high
+  category: asar-archive
+  dry-run-support: full
+  condition: |
+    components[
+      $prop($, 'cdx:file:kind') = 'asar-archive'
+      and $propBool($, 'cdx:asar:hasSigningMetadata') = true
+      and $prop($, 'cdx:asar:signingVerified') = 'false'
+    ]
+  location: |
+    {
+      "bomRef": $. "bom-ref",
+      "srcFile": $prop($, 'internal:SrcFile')
+    }
+  message: "ASAR archive '{{ name }}' has Electron signing metadata that failed verification"
+  mitigation: "Rebuild the Electron package from trusted sources, verify the Info.plist ElectronAsarIntegrity data, and confirm the shipped ASAR matches the expected signed release artifact."
+  evidence: |
+    {
+      "signingDeclaredHash": $prop($, 'cdx:asar:signingDeclaredHash'),
+      "signingAlgorithm": $prop($, 'cdx:asar:signingAlgorithm'),
+      "signingSource": $prop($, 'cdx:asar:signingSource'),
+      "signingScope": $prop($, 'cdx:asar:signingScope'),
+      "signingVerified": $prop($, 'cdx:asar:signingVerified')
+    }

package/data/rules/cbom-security.yaml

@@ -0,0 +1,165 @@
+# CBOM Security and Compliance Rules
+# Category: cbom-security, cbom-compliance
+# Evaluates cryptographic assets (algorithms, protocols, certificates, related-crypto-material) for weaknesses.
+
+- id: CBS-001
+  name: "Weak/Deprecated Cryptographic Algorithm"
+  description: "Usage of weak or deprecated cryptographic algorithms such as MD5, SHA-1, RC4, DES, 3DES, or Blowfish exposes data to decryption or collision attacks."
+  severity: high
+  category: cbom-security
+  dry-run-support: full
+  standards:
+    nist-800-53:
+      - "SC-13 Cryptographic Protection"
+    iso-27001:
+      - "A.8.24 Use of cryptography"
+  condition: |
+    components[
+      cryptoProperties.assetType = 'algorithm'
+      and (
+        $contains($lowercase($safeStr(cryptoProperties.algorithmProperties.algorithmFamily)), 'md5')
+        or $contains($lowercase($safeStr(cryptoProperties.algorithmProperties.algorithmFamily)), 'sha-1')
+        or $contains($lowercase($safeStr(cryptoProperties.algorithmProperties.algorithmFamily)), 'sha1')
+        or $contains($lowercase($safeStr(cryptoProperties.algorithmProperties.algorithmFamily)), 'rc4')
+        or $contains($lowercase($safeStr(cryptoProperties.algorithmProperties.algorithmFamily)), 'des')
+        or $contains($lowercase($safeStr(cryptoProperties.algorithmProperties.algorithmFamily)), 'blowfish')
+        or $contains($lowercase($safeStr(cryptoProperties.algorithmProperties.algorithmFamily)), 'md4')
+        or $contains($lowercase($safeStr(cryptoProperties.algorithmProperties.algorithmFamily)), 'rc2')
+      )
+    ]
+  location: |
+    {
+      "bomRef": $firstNonEmpty($."bom-ref", bom.serialNumber)
+    }
+  message: "Weak/Deprecated cryptographic algorithm family '{{ cryptoProperties.algorithmProperties.algorithmFamily }}' detected in component '{{ name }}'"
+  mitigation: "Migrate to secure alternatives like SHA-256, SHA-3, or AES-GCM."
+  evidence: |
+    {
+      "algorithmFamily": cryptoProperties.algorithmProperties.algorithmFamily,
+      "primitive": cryptoProperties.algorithmProperties.primitive
+    }
+
+- id: CBS-002
+  name: "Insecure Cipher Mode of Operation"
+  description: "Electronic Codebook (ECB) mode lacks cryptographic diffusion and exposes patterns in ciphertext, while Cipher Block Chaining (CBC) without authenticated encryption (AEAD) is vulnerable to padding oracle attacks."
+  severity: high
+  category: cbom-security
+  dry-run-support: full
+  standards:
+    nist-800-53:
+      - "SC-13 Cryptographic Protection"
+  condition: |
+    components[
+      cryptoProperties.assetType = 'algorithm'
+      and (
+        cryptoProperties.algorithmProperties.mode = 'ecb'
+        or (cryptoProperties.algorithmProperties.mode = 'cbc' and cryptoProperties.algorithmProperties.primitive != 'ae')
+      )
+    ]
+  location: |
+    {
+      "bomRef": $firstNonEmpty($."bom-ref", bom.serialNumber)
+    }
+  message: "Insecure cipher mode '{{ cryptoProperties.algorithmProperties.mode }}' detected for component '{{ name }}'"
+  mitigation: "Use authenticated encryption modes such as GCM or CCM."
+  evidence: |
+    {
+      "algorithmFamily": cryptoProperties.algorithmProperties.algorithmFamily,
+      "mode": cryptoProperties.algorithmProperties.mode,
+      "primitive": cryptoProperties.algorithmProperties.primitive
+    }
+
+- id: CBS-003
+  name: "Insufficient Classical Security Level or Key Size"
+  description: "Symmetric algorithms with security levels under 128 bits, or asymmetric algorithms (like RSA) with keys under 2048 bits, are vulnerable to brute-force attacks."
+  severity: high
+  category: cbom-security
+  dry-run-support: full
+  standards:
+    nist-800-53:
+      - "SC-13 Cryptographic Protection"
+  condition: |
+    components[
+      (
+        cryptoProperties.assetType = 'algorithm'
+        and $number(cryptoProperties.algorithmProperties.classicalSecurityLevel) > 0
+        and $number(cryptoProperties.algorithmProperties.classicalSecurityLevel) < 128
+      )
+      or (
+        cryptoProperties.assetType = 'related-crypto-material'
+        and cryptoProperties.relatedCryptoMaterialProperties.type = 'private-key'
+        and $number(cryptoProperties.relatedCryptoMaterialProperties.size) > 0
+        and $number(cryptoProperties.relatedCryptoMaterialProperties.size) < 2048
+      )
+    ]
+  location: |
+    {
+      "bomRef": $firstNonEmpty($."bom-ref", bom.serialNumber)
+    }
+  message: "Cryptographic strength is insufficient: {{ $firstNonEmpty(cryptoProperties.algorithmProperties.classicalSecurityLevel, cryptoProperties.relatedCryptoMaterialProperties.size) }} bits"
+  mitigation: "Upgrade key lengths to at least 128 bits for symmetric keys and 2048 bits (preferably 3072 or 4096 bits) for asymmetric/RSA keys."
+  evidence: |
+    {
+      "assetType": cryptoProperties.assetType,
+      "classicalSecurityLevel": cryptoProperties.algorithmProperties.classicalSecurityLevel,
+      "keySize": cryptoProperties.relatedCryptoMaterialProperties.size
+    }
+
+- id: CBS-004
+  name: "Outdated/Insecure Protocol Version"
+  description: "Outdated protocols such as SSL v2, SSL v3, TLS 1.0, or TLS 1.1 contain severe vulnerabilities and should be disabled in favor of TLS 1.2 or TLS 1.3."
+  severity: critical
+  category: cbom-security
+  dry-run-support: full
+  standards:
+    nist-800-53:
+      - "SC-8 Transmission Confidentiality and Integrity"
+  condition: |
+    components[
+      cryptoProperties.assetType = 'protocol'
+      and (
+        cryptoProperties.protocolProperties.type = 'tls' or cryptoProperties.protocolProperties.type = 'dtls'
+      )
+      and (
+        $contains($lowercase($safeStr(cryptoProperties.protocolProperties.version)), '1.0')
+        or $contains($lowercase($safeStr(cryptoProperties.protocolProperties.version)), '1.1')
+        or $contains($lowercase($safeStr(cryptoProperties.protocolProperties.version)), 'ssl')
+        or $contains($lowercase($safeStr(cryptoProperties.protocolProperties.version)), '2.0')
+        or $contains($lowercase($safeStr(cryptoProperties.protocolProperties.version)), '3.0')
+      )
+    ]
+  location: |
+    {
+      "bomRef": $firstNonEmpty($."bom-ref", bom.serialNumber)
+    }
+  message: "Insecure protocol version '{{ cryptoProperties.protocolProperties.version }}' detected for component '{{ name }}'"
+  mitigation: "Require TLS 1.2 or TLS 1.3 as the minimum protocol version."
+  evidence: |
+    {
+      "protocol": cryptoProperties.protocolProperties.type,
+      "version": cryptoProperties.protocolProperties.version
+    }
+
+- id: CBC-001
+  name: "Expired or Expiring Certificate"
+  description: "Certificates that have expired or are close to their expiration date will cause service disruptions or trust validation failures."
+  severity: high
+  category: cbom-compliance
+  dry-run-support: full
+  condition: |
+    components[
+      cryptoProperties.assetType = 'certificate'
+      and $hasProp($, 'cdx:cert:isExpired', 'true')
+    ]
+  location: |
+    {
+      "bomRef": $firstNonEmpty($."bom-ref", bom.serialNumber)
+    }
+  message: "Certificate for Subject '{{ cryptoProperties.certificateProperties.subjectName }}' has expired or is invalid"
+  mitigation: "Renew the certificate and update the deployment trust stores."
+  evidence: |
+    {
+      "subject": cryptoProperties.certificateProperties.subjectName,
+      "issuer": cryptoProperties.certificateProperties.issuerName,
+      "notValidAfter": cryptoProperties.certificateProperties.notValidAfter
+    }

package/data/rules/chrome-extensions.yaml

@@ -0,0 +1,248 @@
+# Chrome Extension Security Rules
+# Category: chrome-extension
+# Evaluates Chromium browser extensions for risky permissions and execution posture
+
+- id: CHE-001
+  name: "Extension with broad host access"
+  description: "Browser extensions with <all_urls> or wildcard host permissions can access and manipulate content on most websites"
+  severity: high
+  category: chrome-extension
+  dry-run-support: full
+  condition: |
+    components[
+      $startsWith(purl, 'pkg:chrome-extension/')
+      and (
+        $listContains($propList($, 'cdx:chrome-extension:permissions'), '<all_urls>')
+        or $listContains($propList($, 'cdx:chrome-extension:hostPermissions'), '<all_urls>')
+        or $listContains($propList($, 'cdx:chrome-extension:hostPermissions'), '*://*/*')
+      )
+    ]
+  location: |
+    {
+      "bomRef": $. "bom-ref",
+      "purl": purl,
+      "srcFile": $prop($, 'internal:SrcFile')
+    }
+  message: "Chrome extension '{{ name }}@{{ version }}' has broad host access permissions"
+  mitigation: "Limit host permissions to required domains; avoid <all_urls> and broad wildcard host patterns"
+  evidence: |
+    {
+      "permissions": $prop($, 'cdx:chrome-extension:permissions'),
+      "hostPermissions": $prop($, 'cdx:chrome-extension:hostPermissions')
+    }
+
+- id: CHE-002
+  name: "Extension with network interception capabilities"
+  description: "Extensions that combine webRequest and webRequestBlocking can intercept and modify browser network traffic"
+  severity: critical
+  category: chrome-extension
+  dry-run-support: full
+  condition: |
+    components[
+      $startsWith(purl, 'pkg:chrome-extension/')
+      and $listContains($propList($, 'cdx:chrome-extension:permissions'), 'webRequest')
+      and $listContains($propList($, 'cdx:chrome-extension:permissions'), 'webRequestBlocking')
+    ]
+  location: |
+    {
+      "bomRef": $. "bom-ref",
+      "purl": purl,
+      "srcFile": $prop($, 'internal:SrcFile')
+    }
+  message: "Chrome extension '{{ name }}@{{ version }}' can intercept and block web requests"
+  mitigation: "Review extension code for request filtering/modification logic; restrict deployment to trusted publishers"
+  evidence: |
+    {
+      "permissions": $prop($, 'cdx:chrome-extension:permissions'),
+      "contentScriptsRunAt": $prop($, 'cdx:chrome-extension:contentScriptsRunAt')
+    }
+
+- id: CHE-003
+  name: "Always-early content scripts with broad access"
+  description: "Extensions injecting content scripts at document_start together with broad host permissions increase pre-DOM execution risk"
+  severity: high
+  category: chrome-extension
+  dry-run-support: full
+  condition: |
+    components[
+      $startsWith(purl, 'pkg:chrome-extension/')
+      and $listContains($propList($, 'cdx:chrome-extension:contentScriptsRunAt'), 'document_start')
+      and (
+        $listContains($propList($, 'cdx:chrome-extension:permissions'), '<all_urls>')
+        or $listContains($propList($, 'cdx:chrome-extension:hostPermissions'), '<all_urls>')
+        or $listContains($propList($, 'cdx:chrome-extension:hostPermissions'), '*://*/*')
+      )
+    ]
+  location: |
+    {
+      "bomRef": $. "bom-ref",
+      "purl": purl
+    }
+  message: "Chrome extension '{{ name }}@{{ version }}' injects scripts at document_start with broad site access"
+  mitigation: "Prefer run_at=document_idle where possible and scope host permissions to explicit trusted origins"
+  evidence: |
+    {
+      "contentScriptsRunAt": $prop($, 'cdx:chrome-extension:contentScriptsRunAt'),
+      "permissions": $prop($, 'cdx:chrome-extension:permissions'),
+      "hostPermissions": $prop($, 'cdx:chrome-extension:hostPermissions')
+    }
+
+- id: CHE-004
+  name: "Autofill-capable extension with broad host permissions"
+  description: "Autofill features handling credential or PII flows should be reviewed when broad host permissions are granted"
+  severity: medium
+  category: chrome-extension
+  dry-run-support: full
+  condition: |
+    components[
+      $startsWith(purl, 'pkg:chrome-extension/')
+      and $propBool($, 'cdx:chrome-extension:hasAutofill') = true
+      and (
+        $listContains($propList($, 'cdx:chrome-extension:permissions'), '<all_urls>')
+        or $listContains($propList($, 'cdx:chrome-extension:hostPermissions'), '<all_urls>')
+        or $listContains($propList($, 'cdx:chrome-extension:hostPermissions'), '*://*/*')
+      )
+    ]
+  location: |
+    {
+      "bomRef": $. "bom-ref",
+      "purl": purl
+    }
+  message: "Autofill-capable extension '{{ name }}@{{ version }}' has broad host access"
+  mitigation: "Review autofill data handling and origin checks; enforce least-privilege host permissions"
+  evidence: |
+    {
+      "hasAutofill": $prop($, 'cdx:chrome-extension:hasAutofill'),
+      "permissions": $prop($, 'cdx:chrome-extension:permissions'),
+      "hostPermissions": $prop($, 'cdx:chrome-extension:hostPermissions'),
+      "storageManagedSchema": $prop($, 'cdx:chrome-extension:storageManagedSchema')
+    }
+
+- id: CHE-005
+  name: "Extension with file/device capability and broad host scope"
+  description: "Extensions requesting file or device-adjacent capabilities alongside broad host scope can increase data collection and exfiltration risk."
+  severity: high
+  category: chrome-extension
+  dry-run-support: full
+  condition: |
+    components[
+      $startsWith(purl, 'pkg:chrome-extension/')
+      and (
+        $propBool($, 'cdx:chrome-extension:capability:fileAccess') = true
+        or $propBool($, 'cdx:chrome-extension:capability:deviceAccess') = true
+        or $propBool($, 'cdx:chrome-extension:capability:bluetooth') = true
+      )
+      and (
+        $listContains($propList($, 'cdx:chrome-extension:permissions'), '<all_urls>')
+        or $listContains($propList($, 'cdx:chrome-extension:hostPermissions'), '<all_urls>')
+        or $listContains($propList($, 'cdx:chrome-extension:hostPermissions'), '*://*/*')
+      )
+    ]
+  location: |
+    {
+      "bomRef": $. "bom-ref",
+      "purl": purl,
+      "srcFile": $prop($, 'internal:SrcFile')
+    }
+  message: "Chrome extension '{{ name }}@{{ version }}' combines broad host scope with file/device capabilities"
+  mitigation: "Review whether file/device permissions are required and narrow host permissions to explicit trusted origins."
+  evidence: |
+    {
+      "capabilities": $prop($, 'cdx:chrome-extension:capabilities'),
+      "permissions": $prop($, 'cdx:chrome-extension:permissions'),
+      "hostPermissions": $prop($, 'cdx:chrome-extension:hostPermissions')
+    }
+
+- id: CHE-006
+  name: "Code-injecting extension with broad host scope"
+  description: "Extensions with explicit code-injection capability and broad host scope may execute arbitrary script logic across many origins."
+  severity: critical
+  category: chrome-extension
+  dry-run-support: full
+  condition: |
+    components[
+      $startsWith(purl, 'pkg:chrome-extension/')
+      and $propBool($, 'cdx:chrome-extension:capability:codeInjection') = true
+      and (
+        $listContains($propList($, 'cdx:chrome-extension:permissions'), '<all_urls>')
+        or $listContains($propList($, 'cdx:chrome-extension:hostPermissions'), '<all_urls>')
+        or $listContains($propList($, 'cdx:chrome-extension:hostPermissions'), '*://*/*')
+      )
+    ]
+  location: |
+    {
+      "bomRef": $. "bom-ref",
+      "purl": purl,
+      "srcFile": $prop($, 'internal:SrcFile')
+    }
+  message: "Chrome extension '{{ name }}@{{ version }}' has code-injection capability with broad host coverage"
+  mitigation: "Constrain host permissions and validate code-injection paths (scripting/tabs/debugger/content scripts) against strict allowlists."
+  evidence: |
+    {
+      "capabilities": $prop($, 'cdx:chrome-extension:capabilities'),
+      "permissions": $prop($, 'cdx:chrome-extension:permissions'),
+      "contentScriptsRunAt": $prop($, 'cdx:chrome-extension:contentScriptsRunAt')
+    }
+
+- id: CHE-007
+  name: "Fingerprinting-capable extension with broad host scope"
+  description: "Fingerprinting-related capability indicators combined with broad host access can increase tracking and privacy risk."
+  severity: high
+  category: chrome-extension
+  dry-run-support: full
+  condition: |
+    components[
+      $startsWith(purl, 'pkg:chrome-extension/')
+      and $propBool($, 'cdx:chrome-extension:capability:fingerprinting') = true
+      and (
+        $listContains($propList($, 'cdx:chrome-extension:permissions'), '<all_urls>')
+        or $listContains($propList($, 'cdx:chrome-extension:hostPermissions'), '<all_urls>')
+        or $listContains($propList($, 'cdx:chrome-extension:hostPermissions'), '*://*/*')
+      )
+    ]
+  location: |
+    {
+      "bomRef": $. "bom-ref",
+      "purl": purl,
+      "srcFile": $prop($, 'internal:SrcFile')
+    }
+  message: "Chrome extension '{{ name }}@{{ version }}' has fingerprinting indicators with broad host access"
+  mitigation: "Review extension behavior for passive/active fingerprinting collection and reduce scope to required domains."
+  evidence: |
+    {
+      "capabilities": $prop($, 'cdx:chrome-extension:capabilities'),
+      "permissions": $prop($, 'cdx:chrome-extension:permissions'),
+      "hostPermissions": $prop($, 'cdx:chrome-extension:hostPermissions')
+    }
+
+- id: CHE-008
+  name: "AI-assistant extension with code injection on AI provider domains"
+  description: "Extensions targeting AI assistant domains (OpenAI/ChatGPT/Claude/Copilot) with code-injection capability should be reviewed for prompt/session manipulation risk."
+  severity: high
+  category: chrome-extension
+  dry-run-support: full
+  condition: |
+    components[
+      $startsWith(purl, 'pkg:chrome-extension/')
+      and $propBool($, 'cdx:chrome-extension:capability:codeInjection') = true
+      and (
+        $contains($safeStr($prop($, 'cdx:chrome-extension:hostPermissions')), 'openai.com')
+        or $contains($safeStr($prop($, 'cdx:chrome-extension:hostPermissions')), 'chatgpt.com')
+        or $contains($safeStr($prop($, 'cdx:chrome-extension:hostPermissions')), 'claude.ai')
+        or $contains($safeStr($prop($, 'cdx:chrome-extension:hostPermissions')), 'github.com/copilot')
+      )
+    ]
+  location: |
+    {
+      "bomRef": $. "bom-ref",
+      "purl": purl,
+      "srcFile": $prop($, 'internal:SrcFile')
+    }
+  message: "AI-assistant extension '{{ name }}@{{ version }}' can inject code in assistant workflows"
+  mitigation: "Review prompt/session handling, enforce least-privilege host permissions, and gate deployment to trusted publishers."
+  evidence: |
+    {
+      "capabilities": $prop($, 'cdx:chrome-extension:capabilities'),
+      "permissions": $prop($, 'cdx:chrome-extension:permissions'),
+      "hostPermissions": $prop($, 'cdx:chrome-extension:hostPermissions')
+    }