@cdxgen/cdxgen 13.5.0 → 13.6.0

package/README.md

@@ -216,7 +216,7 @@ Common asset names:
 #### Linux
 
 ```bash
-VERSION="v13.5.0"
+VERSION="v13.6.0"
 ASSET="cdx-audit-linux-amd64"
 BASE_URL="https://github.com/cdxgen/cdxgen/releases/download/${VERSION}"
 
@@ -230,7 +230,7 @@ chmod +x "${ASSET}"
 #### macOS
 
 ```bash
-VERSION="v13.5.0"
+VERSION="v13.6.0"
 ASSET="cdx-audit-darwin-arm64"
 BASE_URL="https://github.com/cdxgen/cdxgen/releases/download/${VERSION}"
 
@@ -244,7 +244,7 @@ chmod +x "${ASSET}"
 #### Windows (PowerShell)
 
 ```powershell
-$Version = "v13.5.0"
+$Version = "v13.6.0"
 $Asset = "cdx-audit-windows-amd64.exe"
 $BaseUrl = "https://github.com/cdxgen/cdxgen/releases/download/$Version"
 
@@ -269,7 +269,7 @@ steps:
     env:
       GH_TOKEN: ${{ github.token }}
     run: |
-      gh release download v13.5.0 \
+      gh release download v13.6.0 \
         --repo cdxgen/cdxgen \
         --pattern 'cdx-audit-linux-amd64' \
         --pattern 'cdx-audit-linux-amd64.sha256'
@@ -296,7 +296,7 @@ winget install cdxgen
 
 You can also use the cdxgen container image with node, deno, or bun runtime versions.
 
-The default version uses Node.js 24
+The default version uses Node.js 26
 
 ```bash
 docker run --rm -e CDXGEN_DEBUG_MODE=debug -v /tmp:/tmp -v $(pwd):/app:rw -t ghcr.io/cdxgen/cdxgen:master -r /app -o /app/bom.json
@@ -337,7 +337,7 @@ npm install -g @cdxgen/cdxgen --ignore-scripts --min-release-age=2
 **pnpm**:
 
 ```shell
-pnpm add -g @cdxgen/cdxgen --omit=optional --ignore-scripts --minimum-release-age=2880
+pnpm add -g @cdxgen/cdxgen --ignore-scripts --config.minimum-release-age=2880
 ```
 
 **bun**:

package/bin/cdxgen.js

@@ -490,6 +490,10 @@ const args = _yargs
     description: "Path for the usages slices file created by atom.",
     hidden: true,
   })
+  .option("callsites-slices-file", {
+    description: "Path for the callsites slices file created by atom.",
+    hidden: true,
+  })
   .option("data-flow-slices-file", {
     description: "Path for the data-flow slices file created by atom.",
     hidden: true,

package/bin/evinse.js

@@ -269,6 +269,9 @@ const args = yargs(hideBin(process.argv))
     description: "Use an existing usages slices file.",
     default: "usages.slices.json",
   })
+  .option("callsites-slices-file", {
+    description: "Use an existing callsites slices file (JS/TS).",
+  })
   .option("scalasem-command", {
     description:
       "Use a specific scalasem script for Scala evidence analysis. Defaults to SCALASEM_CMD.",

package/bin/validate.js

@@ -19,6 +19,7 @@ import process from "node:process";
 import yargs from "yargs";
 import { hideBin } from "yargs/helpers";
 
+import { installConsoleShim, restoreConsole } from "../lib/core/ui.js";
 import {
   dirNameStr,
   retrieveCdxgenVersion,
@@ -144,6 +145,11 @@ const args = _yargs
   .help()
   .wrap(Math.min(120, yargs().terminalWidth())).argv;
 
+// stdout carries the report and nothing else; messages from the validators
+// go to the diagnostic stream so `-r json` and `-r sarif` stay parseable.
+installConsoleShim();
+process.once("exit", restoreConsole);
+
 /**
  * Loads the BOM. When signatures are verified, the text must also pass
  * parseStrictJson(), and `strictError` explains why it did not.

package/data/license-aliases.json

@@ -18,8 +18,6 @@
   "httpsopensourceorglicenseapache20": "Apache-2.0",
   "httpwwwapacheorglicenseslicense20html": "Apache-2.0",
   "zeroclausebsd": "0BSD",
-  "newbsdlicense": "BSD-3-Clause",
-  "newbsd": "BSD-3-Clause",
   "bsd2clause": "BSD-2-Clause",
   "bsd2clauselicense": "BSD-2-Clause",
   "thebsd2clauselicense": "BSD-2-Clause",
@@ -30,11 +28,13 @@
   "thebsd3clauselicense": "BSD-3-Clause",
   "bsd3clauseneworrevisedlicensebsd3clause": "BSD-3-Clause",
   "eclipsedistributionlicensenewbsdlicense": "BSD-3-Clause",
+  "newbsdlicense": "BSD-3-Clause",
   "modifiedbsdlicense": "BSD-3-Clause",
   "revisedbsd": "BSD-3-Clause",
   "revisedbsdlicense": "BSD-3-Clause",
   "thenewbsdlicense": "BSD-3-Clause",
   "3clausebsdlicense": "BSD-3-Clause",
+  "newbsd": "BSD-3-Clause",
   "bsd4clause": "BSD-4-Clause",
   "bsd4clauselicense": "BSD-4-Clause",
   "thebsd4clauselicense": "BSD-4-Clause",
@@ -258,6 +258,8 @@
   "aswfdigitalassetslicenseversion10": "ASWF-Digital-Assets-1.0",
   "aswfdigitalassets11": "ASWF-Digital-Assets-1.1",
   "aswfdigitalassetslicense11": "ASWF-Digital-Assets-1.1",
+  "atcgame": "atc-game",
+  "atcgamelicense": "atc-game",
   "baekmuk": "Baekmuk",
   "baekmuklicense": "Baekmuk",
   "bahyph": "Bahyph",
@@ -309,6 +311,8 @@
   "bsd2clausepluspatentlicense": "BSD-2-Clause-Patent",
   "bsd2clausepkgconfdisclaimer": "BSD-2-Clause-pkgconf-disclaimer",
   "bsd2clausepkgconfdisclaimervariant": "BSD-2-Clause-pkgconf-disclaimer",
+  "bsd2clauseposunchanged": "BSD-2-Clause-pos-unchanged",
+  "bsd2clausepositionunchangedvariant": "BSD-2-Clause-pos-unchanged",
   "bsd2clauseviews": "BSD-2-Clause-Views",
   "bsd2clausewithviewssentence": "BSD-2-Clause-Views",
   "bsd3clauseneworrevisedlicense": "BSD-3-Clause",
@@ -331,6 +335,8 @@
   "bsd3clausenonuclearwarranty": "BSD-3-Clause-No-Nuclear-Warranty",
   "bsd3clauseopenmpi": "BSD-3-Clause-Open-MPI",
   "bsd3clauseopenmpivariant": "BSD-3-Clause-Open-MPI",
+  "bsd3clauseopenwebui": "BSD-3-Clause-OpenWebUI",
+  "bsd3clauseopenwebuivariant": "BSD-3-Clause-OpenWebUI",
   "bsd3clausesun": "BSD-3-Clause-Sun",
   "bsd3clausesunmicrosystems": "BSD-3-Clause-Sun",
   "bsd3clausetso": "BSD-3-Clause-Tso",
@@ -345,6 +351,7 @@
   "bsd43tahoelicense": "BSD-4.3TAHOE",
   "bsdadvertisingacknowledgement": "BSD-Advertising-Acknowledgement",
   "bsdadvertisingacknowledgementlicense": "BSD-Advertising-Acknowledgement",
+  "bsdasktoendorse": "BSD-ask-to-endorse",
   "bsdattributionhpnddisclaimer": "BSD-Attribution-HPND-disclaimer",
   "bsdwithattributionandhpnddisclaimer": "BSD-Attribution-HPND-disclaimer",
   "bsdinfernonettverk": "BSD-Inferno-Nettverk",
@@ -352,10 +359,14 @@
   "bsdmarkmodificationslicense": "BSD-Mark-Modifications",
   "bsdprotection": "BSD-Protection",
   "bsdprotectionlicense": "BSD-Protection",
+  "bsdsourcealtgpl": "BSD-Source-alt-GPL",
+  "bsdsourcecodeattributiongplalternative": "BSD-Source-alt-GPL",
   "bsdsourcebeginningfile": "BSD-Source-beginning-file",
   "bsdsourcecodeattributionbeginningoffilevariant": "BSD-Source-beginning-file",
   "bsdsourcecode": "BSD-Source-Code",
   "bsdsourcecodeattribution": "BSD-Source-Code",
+  "bsdsourcecodenodisclaimer": "BSD-Source-Code-no-disclaimer",
+  "bsdsourcecodeattributionnodisclaimer": "BSD-Source-Code-no-disclaimer",
   "bsdsystemics": "BSD-Systemics",
   "systemicsbsdvariantlicense": "BSD-Systemics",
   "bsdsystemicsw3works": "BSD-Systemics-W3Works",
@@ -364,6 +375,8 @@
   "boostsoftwarelicense10": "BSL-1.0",
   "buddy": "Buddy",
   "buddylicense": "Buddy",
+  "bugroff": "Bugroff",
+  "bugrofflicense": "Bugroff",
   "busl11": "BUSL-1.1",
   "businesssourcelicense11": "BUSL-1.1",
   "bzip2105": "bzip2-1.0.6",
@@ -420,6 +433,8 @@
   "creativecommonsattributionnoncommercial30unported": "CC-BY-NC-3.0",
   "ccbync30de": "CC-BY-NC-3.0-DE",
   "creativecommonsattributionnoncommercial30germany": "CC-BY-NC-3.0-DE",
+  "ccbync30igo": "CC-BY-NC-3.0-IGO",
+  "creativecommonsattributionnoncommercial30igo": "CC-BY-NC-3.0-IGO",
   "ccbync40": "CC-BY-NC-4.0",
   "creativecommonsattributionnoncommercial40international": "CC-BY-NC-4.0",
   "ccbyncnd10": "CC-BY-NC-ND-1.0",
@@ -657,6 +672,8 @@
   "fuzzybitmaplicense": "FBM",
   "fdkaac": "FDK-AAC",
   "fraunhoferfdkaaccodeclibrary": "FDK-AAC",
+  "fdkmpegh": "FDK-MPEG-H",
+  "fraunhoferfdkmpeghsoftware": "FDK-MPEG-H",
   "fergusontwofish": "Ferguson-Twofish",
   "fergusontwofishlicense": "Ferguson-Twofish",
   "frameworx10": "Frameworx-1.0",
@@ -795,6 +812,8 @@
   "hidapilicense": "HIDAPI",
   "hippocratic21": "Hippocratic-2.1",
   "hippocraticlicense21": "Hippocratic-2.1",
+  "hippocratic30core": "Hippocratic-3.0-core",
+  "hippocraticlicense30": "Hippocratic-3.0-core",
   "hp1986": "HP-1986",
   "hewlettpackard1986license": "HP-1986",
   "hp1989": "HP-1989",
@@ -873,6 +892,8 @@
   "imlib2license": "Imlib2",
   "infozip": "Info-ZIP",
   "infoziplicense": "Info-ZIP",
+  "informatica": "Informatica",
+  "informaticalicense": "Informatica",
   "innernet20": "Inner-Net-2.0",
   "innernetlicensev20": "Inner-Net-2.0",
   "innosetup": "InnoSetup",
@@ -1660,6 +1681,7 @@
   "shl21": "SHL-2.1",
   "solderpadhardwarelicensev21": "SHL-2.1",
   "simplelibraryusageexception": "Simple-Library-Usage-exception",
+  "spellingproviderlgplexception": "Spelling-Provider-LGPL-exception",
   "sqlitestudioopensslexception": "sqlitestudio-OpenSSL-exception",
   "stunnelexception": "stunnel-exception",
   "swiexception": "SWI-exception",

package/data/remediations.json

@@ -431,6 +431,34 @@
     },
     "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES"
   },
+  "js.lockfile-unsafe-path": {
+    "ecosystem": "npm",
+    "kind": "evidence.degraded",
+    "impact": "transitive-deps",
+    "title": "Secure mode omitted package-lock.json entries whose paths point outside the project",
+    "targetTier": "lockfile",
+    "actions": [
+      {
+        "kind": "config",
+        "command": "Review the file: and link entries the warning names; remove any you did not add, and regenerate the lockfile with npm install --package-lock-only"
+      },
+      {
+        "kind": "config",
+        "command": "For trusted sibling file: or npm link dependencies, rerun outside secure mode on a trusted checkout to keep them"
+      },
+      {
+        "kind": "rerun"
+      }
+    ],
+    "verify": {
+      "rules": [],
+      "expectTier": "lockfile",
+      "eventsCleared": [
+        "js.lockfile-unsafe-path"
+      ]
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES"
+  },
   "js.pnpm-lock-unparseable": {
     "ecosystem": "npm",
     "kind": "evidence.degraded",
@@ -935,6 +963,30 @@
     },
     "docs": "https://cyclonedx.github.io/cdxgen/#/EVINSE"
   },
+  "dosai.method-calls-capped": {
+    "ecosystem": "csharp",
+    "kind": "evidence.degraded",
+    "impact": "components",
+    "title": "The dosai report holds more distinct method calls than cdxgen keeps, so some occurrence evidence was dropped",
+    "targetTier": "resolved",
+    "actions": [
+      {
+        "kind": "config",
+        "detail": "Raise the cap with CDXGEN_DOSAI_MAX_METHOD_CALLS, or write the report with dosai's --sections so it holds less."
+      },
+      {
+        "kind": "rerun"
+      }
+    ],
+    "verify": {
+      "rules": [],
+      "expectTier": "resolved",
+      "eventsCleared": [
+        "dosai.method-calls-capped"
+      ]
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/EVINSE"
+  },
   "cocoa.pods.missing": {
     "ecosystem": "cocoa",
     "kind": "fallback.engaged",
@@ -1282,6 +1334,54 @@
     },
     "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES?id=php"
   },
+  "ruby.host-probe.package-db-unreadable": {
+    "ecosystem": "ruby",
+    "kind": "evidence.degraded",
+    "impact": "components",
+    "title": "A package database could not be read in full, so the Ruby no package owns on this host was not identified",
+    "targetTier": null,
+    "actions": [
+      {
+        "kind": "config",
+        "command": "Run cdxgen as a user that can read the package databases (for example with sudo), so Ruby files can be matched to the packages that own them"
+      },
+      {
+        "kind": "rerun"
+      }
+    ],
+    "verify": {
+      "rules": [],
+      "expectTier": null,
+      "eventsCleared": [
+        "ruby.host-probe.package-db-unreadable"
+      ]
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES?id=ruby"
+  },
+  "npm.host-probe.package-db-unreadable": {
+    "ecosystem": "npm",
+    "kind": "evidence.degraded",
+    "impact": "components",
+    "title": "A package database could not be read in full, so the Node.js no package owns on this host was not identified",
+    "targetTier": null,
+    "actions": [
+      {
+        "kind": "config",
+        "command": "Run cdxgen as a user that can read the package databases (for example with sudo), so node binaries can be matched to the packages that own them"
+      },
+      {
+        "kind": "rerun"
+      }
+    ],
+    "verify": {
+      "rules": [],
+      "expectTier": null,
+      "eventsCleared": [
+        "npm.host-probe.package-db-unreadable"
+      ]
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/OBOM_LESSONS"
+  },
   "php.composer.platform-unattributed": {
     "ecosystem": "php",
     "kind": "evidence.degraded",
@@ -1401,6 +1501,30 @@
     },
     "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES"
   },
+  "binary.brotli-probe.capped": {
+    "ecosystem": "generic",
+    "kind": "evidence.degraded",
+    "impact": "components",
+    "title": "The Brotli decoder probe reached its file or byte cap, so some native files were not read for an embedded decoder",
+    "targetTier": null,
+    "actions": [
+      {
+        "kind": "config",
+        "command": "Scan the image or root filesystem in smaller parts (for example one application directory at a time with -t rootfs), so every native file is read for an embedded Brotli decoder"
+      },
+      {
+        "kind": "rerun"
+      }
+    ],
+    "verify": {
+      "rules": [],
+      "expectTier": null,
+      "eventsCleared": [
+        "binary.brotli-probe.capped"
+      ]
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/BOM_AUDIT?id=brotli-security"
+  },
   "os.apk-installed-db.unreadable": {
     "ecosystem": "generic",
     "kind": "evidence.degraded",

package/data/rules/ai-bom.yaml

@@ -330,7 +330,7 @@
     components[
       type = 'machine-learning-model'
       and $prop($, 'cdx:ai:artifactFormat') = 'onnx'
-      and not $hasProp($, 'cdx:onnx:producer')
+      and $not($hasProp($, 'cdx:onnx:producer'))
     ]
   location: |
     {

package/data/rules/brotli-decoder.yaml

@@ -0,0 +1,107 @@
+# Embedded Brotli decoder rules
+# Category: brotli-security
+# Evaluates the cdx:brotli:* properties recorded for native files (container,
+# rootfs and OS scans) and vendored source trees (C/C++ source scans).
+# CVE-2026-111497 is an out-of-bounds write in Google's Brotli decoder
+# (CWE-252, CWE-787) reachable from any Brotli stream an attacker controls:
+# an HTTP response a client decodes, a request body a server inflates, a
+# compressed file. Fixed in google/brotli 1.0.10, 1.1.1 and 1.2.1 (commit
+# 0ed4268). The Go port, andybalholm/brotli, had the same logic error but
+# only crashes; it is fixed in v1.2.7.
+# https://github.com/google/brotli/commit/0ed4268a4401abcb4472096340477cf4af7d1a2b
+#
+# The fix is read from the decoder itself (its BLOCK_SWITCH error name), not
+# from a version number, so a distro backport that keeps the old version is
+# recognised as fixed and a Node.js that still reports brotli 1.2.0 after the
+# fix is not flagged.
+
+- id: BROTLI-RCE-001
+  name: "Native file embeds a Brotli decoder affected by CVE-2026-111497"
+  description: "A binary, shared library or extension module carries its own copy of Google's C Brotli decoder without the fix for CVE-2026-111497. Updating the system libbrotli does not fix a private copy: the file itself has to be replaced by a release built from a fixed decoder."
+  severity: high
+  category: brotli-security
+  dry-run-support: full
+  condition: |
+    components[
+      $hasProp($, 'cdx:brotli:c:blockSwitchFix', 'false')
+      and $not($hasProp($, 'cdx:vendored', 'true'))
+    ]
+  location: |
+    {
+      "bomRef": $firstNonEmpty($."bom-ref", bom.serialNumber)
+    }
+  message: "'{{ name }}' embeds a Brotli decoder without the CVE-2026-111497 fix; a crafted Brotli stream can write past a decoder buffer (possible code execution). {{ $hasProp($, 'cdx:node:buildVersion') ? 'Upgrade Node.js ' & $prop($, 'cdx:node:buildVersion') & ' to 22.23.4, 24.22.1, 26.12.1 or later.' : 'Replace it with a build that bundles brotli 1.0.10, 1.1.1 or 1.2.1 (or google/brotli commit 0ed4268).' }}"
+  mitigation: "Node.js: 22.23.4, 24.22.1, 26.12.1. Python: Brotli 1.2.1, brotlicffi 1.2.1.0. Ruby: brotli gem 0.9.2. Java: Brotli4j 1.24.0. Other software: a release that bundles brotli 1.0.10, 1.1.1 or 1.2.1, or a rebuild with google/brotli commit 0ed4268. Until then, reject Content-Encoding: br request bodies at the proxy and keep untrusted Brotli data away from the affected process."
+  evidence: |
+    {
+      "srcFile": $prop($, 'internal:SrcFile'),
+      "evidence": $prop($, 'cdx:brotli:c:evidence'),
+      "nodeVersion": $prop($, 'cdx:node:buildVersion')
+    }
+
+- id: BROTLI-RCE-002
+  name: "Vendored Brotli source affected by CVE-2026-111497"
+  description: "The project carries a copy of Google's Brotli sources whose decoder lacks the fix for CVE-2026-111497. Everything built from this tree inherits the bug, and no package manager or distro update will reach it."
+  severity: high
+  category: brotli-security
+  dry-run-support: full
+  condition: |
+    components[
+      $hasProp($, 'cdx:vendored', 'true')
+      and $hasProp($, 'cdx:brotli:c:blockSwitchFix', 'false')
+    ]
+  location: |
+    {
+      "bomRef": $firstNonEmpty($."bom-ref", bom.serialNumber)
+    }
+  message: "Vendored Brotli {{ version }} at '{{ $prop($, 'cdx:vendored:path') }}' lacks the CVE-2026-111497 fix; update it to 1.0.10, 1.1.1 or 1.2.1, or cherry-pick google/brotli commit 0ed4268."
+  mitigation: "Update the vendored copy to brotli 1.0.10, 1.1.1 or 1.2.1, or cherry-pick google/brotli commit 0ed4268 (with 50a9b70, b418fa8 and da98063), then rebuild everything that links it."
+  evidence: |
+    {
+      "path": $prop($, 'cdx:vendored:path'),
+      "version": version,
+      "versionSource": $prop($, 'cdx:vendored:versionSource')
+    }
+
+- id: BROTLI-DOS-001
+  name: "Go binary embeds a Brotli port affected by the CVE-2026-111497 logic error"
+  description: "The Go port of the Brotli decoder (github.com/andybalholm/brotli) before v1.2.7 has the same unchecked block-switch error as the C decoder. Go's bounds checks turn it into a panic rather than a memory write, so a crafted stream crashes the process."
+  severity: medium
+  category: brotli-security
+  dry-run-support: full
+  condition: |
+    components[
+      $hasProp($, 'cdx:brotli:go:blockSwitchFix', 'false')
+    ]
+  location: |
+    {
+      "bomRef": $firstNonEmpty($."bom-ref", bom.serialNumber)
+    }
+  message: "'{{ name }}' embeds github.com/andybalholm/brotli older than v1.2.7; a crafted Brotli stream makes it panic. Rebuild with v1.2.7 or later."
+  mitigation: "Update github.com/andybalholm/brotli to v1.2.7 or later and rebuild the binary."
+  evidence: |
+    {
+      "srcFile": $prop($, 'internal:SrcFile')
+    }
+
+- id: BROTLI-RCE-003
+  name: "Native file embeds a Brotli decoder whose CVE-2026-111497 fix state cannot be read"
+  description: "A binary, shared library or extension module carries Google's C Brotli decoder, recognised by its decoding tables, but the linker dropped the error-name table that shows whether the fix is in (--gc-sections, LTO and -dead_strip do this when nothing calls BrotliDecoderErrorString). Whether the copy is vulnerable has to be settled from the release that built the file."
+  severity: low
+  category: brotli-security
+  dry-run-support: full
+  condition: |
+    components[
+      $hasProp($, 'cdx:brotli:c:blockSwitchFix', 'unknown')
+    ]
+  location: |
+    {
+      "bomRef": $firstNonEmpty($."bom-ref", bom.serialNumber)
+    }
+  message: "'{{ name }}' embeds a Brotli decoder whose CVE-2026-111497 fix state cannot be read from the file; check that it was built from brotli 1.0.10, 1.1.1, 1.2.1 or later, or with google/brotli commit 0ed4268."
+  mitigation: "Find the release the file belongs to and confirm it bundles a fixed decoder (brotli 1.0.10, 1.1.1, 1.2.1, or commit 0ed4268); replace it otherwise."
+  evidence: |
+    {
+      "srcFile": $prop($, 'internal:SrcFile'),
+      "evidence": $prop($, 'cdx:brotli:c:evidence')
+    }

package/data/rules/vscode-extensions.yaml

@@ -235,3 +235,78 @@
       "main": $prop($, 'cdx:vscode-extension:main'),
       "contributes": $prop($, 'cdx:vscode-extension:contributes')
     }
+
+- id: VSC-010
+  name: "Extension folder the editor never registered"
+  description: "An extension folder that is on disk but missing from the editor's extensions.json was copied in by hand rather than installed by the editor, so no marketplace or signature check applied to it"
+  severity: high
+  category: vscode-extension
+  dry-run-support: full
+  condition: |
+    components[
+      $startsWith(purl, 'pkg:vscode-extension/')
+      and $prop($, 'cdx:vscode-extension:registered') = 'false'
+    ]
+  location: |
+    {
+      "bomRef": $. "bom-ref",
+      "purl": purl,
+      "srcFile": $prop($, 'internal:SrcFile')
+    }
+  message: "VS Code extension '{{ publisher }}.{{ name }}@{{ version }}' is in the extensions folder of {{ $prop($, 'cdx:vscode-extension:ide') }} but not in its registry"
+  mitigation: "Find out who placed the folder; remove it and reinstall the extension from the marketplace if it is wanted"
+  evidence: |
+    {
+      "ide": $prop($, 'cdx:vscode-extension:ide'),
+      "activationEvents": $prop($, 'cdx:vscode-extension:activationEvents'),
+      "main": $prop($, 'cdx:vscode-extension:main')
+    }
+
+- id: VSC-011
+  name: "Extension installed from a .vsix file"
+  description: "An extension installed from a local .vsix file bypassed the marketplace, so its publisher, signature and version history were not checked at install time"
+  severity: medium
+  category: vscode-extension
+  dry-run-support: full
+  condition: |
+    components[
+      $startsWith(purl, 'pkg:vscode-extension/')
+      and $listContains($propList($, 'cdx:vscode-extension:installSource'), 'vsix')
+    ]
+  location: |
+    {
+      "bomRef": $. "bom-ref",
+      "purl": purl,
+      "srcFile": $prop($, 'internal:SrcFile')
+    }
+  message: "VS Code extension '{{ publisher }}.{{ name }}@{{ version }}' was installed from a .vsix file in {{ $prop($, 'cdx:vscode-extension:ide') }}"
+  mitigation: "Confirm where the .vsix came from and compare the entry-file hash with the marketplace build of the same version"
+  evidence: |
+    {
+      "ide": $prop($, 'cdx:vscode-extension:ide'),
+      "installedAt": $prop($, 'cdx:vscode-extension:installedAt')
+    }
+
+- id: VSC-012
+  name: "Two copies of one extension build run different code"
+  description: "The same publisher, name, version and platform is installed in more than one place, but the entry files differ, so at least one copy was changed after it was installed"
+  severity: high
+  category: vscode-extension
+  dry-run-support: full
+  condition: |
+    components[
+      $startsWith(purl, 'pkg:vscode-extension/')
+      and $prop($, 'cdx:vscode-extension:entryHashMismatch') = 'true'
+    ]
+  location: |
+    {
+      "bomRef": $. "bom-ref",
+      "purl": purl
+    }
+  message: "VS Code extension '{{ publisher }}.{{ name }}@{{ version }}' has different entry-file bytes in {{ $prop($, 'cdx:vscode-extension:ide') }}"
+  mitigation: "Compare each copy's entry-file SHA-256 with the marketplace build of the same version, remove the copy that differs and reinstall it from the marketplace"
+  evidence: |
+    {
+      "ide": $prop($, 'cdx:vscode-extension:ide'),
+      "entryFiles": components.{ "name": name, "sha256": hashes[0].content }
+    }