@cyclonedx/cdxgen 12.2.0 → 12.3.0

package/data/rules/package-integrity.yaml

@@ -133,3 +133,52 @@
       "unshadedNamespaces": $prop($, 'cdx:maven:unshadedNamespaces'),
       "scope": $prop($, 'cdx:maven:component_scope')
     }
+
+- id: INT-008
+  name: "README file contains hidden Unicode characters"
+  description: "Hidden Unicode in README files can conceal malicious or misleading content in code review, especially inside comments"
+  severity: medium
+  category: package-integrity
+  condition: |
+    formulation.components[
+      $prop($, 'cdx:file:kind') = 'readme'
+      and $prop($, 'cdx:file:hasHiddenUnicode') = 'true'
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "file": $prop($, 'SrcFile')
+    }
+  message: "README file '{{ name }}' contains hidden Unicode characters"
+  mitigation: "Review the file with hidden-character rendering enabled, remove suspicious bidirectional or zero-width characters, and verify comment blocks carefully before merge"
+  evidence: |
+    {
+      "codePoints": $prop($, 'cdx:file:hiddenUnicodeCodePoints'),
+      "lineNumbers": $prop($, 'cdx:file:hiddenUnicodeLineNumbers'),
+      "inComments": $prop($, 'cdx:file:hiddenUnicodeInComments')
+    }
+
+- id: INT-009
+  name: "npm lifecycle hook contains obfuscated or encoded execution"
+  description: "Lifecycle hooks that decode base64 payloads, hide long encoded blobs, or blend obfuscation with install-time execution are high-confidence supply-chain abuse indicators"
+  severity: critical
+  category: package-integrity
+  attack:
+    tactics: [TA0005]
+    techniques: [T1027]
+  condition: |
+    components[
+      $prop($, 'cdx:npm:hasObfuscatedLifecycleScript') = 'true'
+    ]
+  location: |
+    { "bomRef": $."bom-ref", "purl": purl }
+  message: "npm package '{{ name }}@{{ version }}' contains obfuscated install-time lifecycle scripts '{{ $prop($, 'cdx:npm:obfuscatedLifecycleScripts') }}'"
+  mitigation: "Treat encoded or obfuscated lifecycle hooks as suspicious by default. Review the decoded payload, inspect any referenced script files, and avoid installing until provenance and maintainer intent are verified"
+  evidence: |
+    {
+      "scripts": $prop($, 'cdx:npm:obfuscatedLifecycleScripts'),
+      "obfuscationIndicators": $prop($, 'cdx:npm:lifecycleObfuscationIndicators'),
+      "executionIndicators": $prop($, 'cdx:npm:lifecycleExecutionIndicators'),
+      "indicatorMap": $prop($, 'cdx:npm:lifecycleIndicatorMap')
+    }
+