@lateos/npm-scan 0.16.0 → 0.16.5

package/backend/detectors/tier1-infostealer.js

@@ -0,0 +1,280 @@
+import { KNOWN_REPUTABLE_PACKAGES } from '../policy.js';
+import * as acorn from 'acorn';
+
+const FS_READ_RE = /fs\.(?:readFile|readFileSync|readdir|readdirSync)\s*\(/g;
+const HTTP_FETCH_RE = /\b(?:fetch|axios|got|superagent|request)\s*\(/g;
+const CURL_WGET_RE = /\b(?:curl|wget|powershell)\s+/gi;
+const CHILD_PROC_RE = /\b(?:exec|execSync|execFile|execFileSync|spawn|spawnSync|fork)\s*\(/g;
+const DOMAIN_EXTRACT_RE = /https?:\/\/([^'"\s)\];,\n\r]+)/gi;
+const GITHUB_DOMAIN_RE = /github\.com/i;
+const NPMJS_DOMAIN_RE = /npmjs\.(?:com|org)/i;
+
+const AWS_KEY_RE = /AKIA[0-9A-Z]{16}/g;
+const NPM_TOKEN_RE = /npm_[a-zA-Z0-9]{36}/g;
+const GH_TOKEN_RE = /ghp_[a-zA-Z0-9]{30,40}/g;
+const GH_OLD_TOKEN_RE = /gho_[a-zA-Z0-9]{36}/g;
+const GITLAB_TOKEN_RE = /glpat-[a-zA-Z0-9_-]{20,}/g;
+
+const ENV_DUMP_RE = /process\.env\.(?:AWS_[A-Z_]+|NPM_TOKEN|NPM_AUTH_TOKEN|GIT_TOKEN|SSH_KEY)/g;
+
+const EVAL_RE = /\beval\s*\(/g;
+const FUNCTION_CTOR_RE = /\bFunction\s*\(/g;
+const B64_STRING_RE = /['"`]([A-Za-z0-9+/]{40,}={0,2})['"`]/g;
+
+function shannonEntropy(s) {
+  const len = s.length;
+  if (len === 0) return 0;
+  const freq = {};
+  for (const ch of s) freq[ch] = (freq[ch] || 0) + 1;
+  let entropy = 0;
+  for (const count of Object.values(freq)) {
+    const p = count / len;
+    entropy -= p * Math.log2(p);
+  }
+  return entropy;
+}
+
+function isMinified(content) {
+  const identifiers = content.match(/\b[a-zA-Z_$][\w$]*\b/g);
+  if (identifiers && identifiers.length > 0) {
+    const avgLen = identifiers.reduce((s, id) => s + id.length, 0) / identifiers.length;
+    if (avgLen < 3) return true;
+  }
+  return shannonEntropy(content) > 5.5;
+}
+
+function extractDomains(content) {
+  const domains = [];
+  let match;
+  DOMAIN_EXTRACT_RE.lastIndex = 0;
+  while ((match = DOMAIN_EXTRACT_RE.exec(content)) !== null) {
+    domains.push(match[1]);
+  }
+  return domains;
+}
+
+function extractCredentials(content) {
+  const creds = [];
+  let match;
+  AWS_KEY_RE.lastIndex = 0;
+  while ((match = AWS_KEY_RE.exec(content)) !== null) {
+    creds.push({ type: 'cred_regex_aws', value: match[0], index: match.index });
+  }
+  NPM_TOKEN_RE.lastIndex = 0;
+  while ((match = NPM_TOKEN_RE.exec(content)) !== null) {
+    creds.push({ type: 'cred_regex_npm_token', value: match[0], index: match.index });
+  }
+  GH_TOKEN_RE.lastIndex = 0;
+  while ((match = GH_TOKEN_RE.exec(content)) !== null) {
+    creds.push({ type: 'cred_regex_gh_token', value: match[0], index: match.index });
+  }
+  return creds;
+}
+
+function getLineColumn(content, index) {
+  const lines = content.slice(0, index).split('\n');
+  return { line: lines.length, column: lines[lines.length - 1].length + 1 };
+}
+
+function patternMatcher(f, content) {
+  const file = f.path || f.name || 'unknown';
+  const result = {
+    file,
+    hasPattern: false,
+    patterns: [],
+    locations: [],
+    evidence: [],
+    domainsFound: [],
+    credsFound: [],
+    isObfuscated: false,
+  };
+
+  if (!content) return result;
+
+  result.isObfuscated = isMinified(content) || EVAL_RE.test(content) || FUNCTION_CTOR_RE.test(content);
+
+  FS_READ_RE.lastIndex = 0;
+  HTTP_FETCH_RE.lastIndex = 0;
+  CHILD_PROC_RE.lastIndex = 0;
+  CURL_WGET_RE.lastIndex = 0;
+
+  const hasFsRead = FS_READ_RE.test(content);
+  const hasHttpFetch = HTTP_FETCH_RE.test(content);
+  const hasChildProc = CHILD_PROC_RE.test(content);
+  const hasCurlWget = CURL_WGET_RE.test(content);
+
+  const domains = extractDomains(content);
+  const externalDomains = domains.filter(d => !NPMJS_DOMAIN_RE.test(d));
+  const gitHubDomains = domains.filter(d => GITHUB_DOMAIN_RE.test(d) && !NPMJS_DOMAIN_RE.test(d));
+
+  if (hasFsRead && hasHttpFetch) {
+    const isGithubOnly = gitHubDomains.length > 0 && externalDomains.length === gitHubDomains.length;
+    result.hasPattern = true;
+    result.patterns.push({ subtype: isGithubOnly ? 'nw_exfil_to_github' : 'fs_exfil', baseScore: 80 });
+    result.domainsFound.push(...domains);
+    FS_READ_RE.lastIndex = 0;
+    const fsMatch = FS_READ_RE.exec(content);
+    if (fsMatch) {
+      const lc = getLineColumn(content, fsMatch.index);
+      result.locations.push({ file, line: lc.line, column: lc.column });
+    }
+    result.evidence.push(isGithubOnly
+      ? 'pattern: fs.readFile + network to GitHub'
+      : 'pattern: fs.readFile + external fetch');
+  }
+
+  if (hasFsRead && (hasChildProc || hasCurlWget)) {
+    const isGithubOnly = gitHubDomains.length > 0 && externalDomains.length === gitHubDomains.length;
+    result.hasPattern = true;
+    result.patterns.push({ subtype: isGithubOnly ? 'nw_exfil_to_github' : 'fs_exfil', baseScore: 80 });
+    result.domainsFound.push(...domains);
+    FS_READ_RE.lastIndex = 0;
+    const fsMatch = FS_READ_RE.exec(content);
+    if (fsMatch) {
+      const lc = getLineColumn(content, fsMatch.index);
+      result.locations.push({ file, line: lc.line, column: lc.column });
+    }
+    result.evidence.push(isGithubOnly
+      ? 'pattern: fs.readFile + child_process to GitHub'
+      : 'pattern: fs.readFile + child_process network');
+  }
+
+  const creds = extractCredentials(content);
+  if (creds.length > 0) {
+    result.hasPattern = true;
+    result.credsFound.push(...creds);
+    const primaryType = creds[0].type;
+    result.patterns.push({ subtype: primaryType, baseScore: 85 });
+    const lc = getLineColumn(content, creds[0].index);
+    result.locations.push({ file, line: lc.line, column: lc.column });
+    const typeNames = [...new Set(creds.map(c => c.type))];
+    result.evidence.push(`hardcoded_credentials: ${creds.length} (${typeNames.join(', ')})`);
+  }
+
+  ENV_DUMP_RE.lastIndex = 0;
+  const envMatch = ENV_DUMP_RE.exec(content);
+  if (envMatch) {
+    result.hasPattern = true;
+    result.patterns.push({ subtype: 'env_dump', baseScore: 80 });
+    const lc = getLineColumn(content, envMatch.index);
+    result.locations.push({ file, line: lc.line, column: lc.column });
+    result.evidence.push('pattern: process.env.AWS_* dump');
+  }
+
+  return result;
+}
+
+export const name = 'tier1-infostealer';
+
+export async function scan(pkgJson, jsFiles, registryMeta, allFiles) {
+  const pkgName = pkgJson?.name;
+  if (pkgName && KNOWN_REPUTABLE_PACKAGES.has(pkgName)) return [];
+
+  const files = jsFiles || [];
+  if (files.length === 0) return [];
+
+  let parseFailCount = 0;
+
+  for (const f of files) {
+    const content = f.content || '';
+    if (!content) continue;
+    try {
+      acorn.parse(content, { ecmaVersion: 'latest' });
+    } catch {
+      parseFailCount++;
+    }
+  }
+
+  if (files.length >= 20 && parseFailCount / files.length >= 0.1) return [];
+
+  const perFile = files.map(f => patternMatcher(f, f.content || ''));
+  const filesWithPatterns = perFile.filter(p => p.hasPattern);
+
+  if (filesWithPatterns.length === 0) return [];
+
+  let highestBase = 0;
+  let mainSubtype = '';
+  let isObfuscated = false;
+  const allEvidence = [];
+  const allLocations = [];
+  const involvedFiles = [];
+  const hasCreds = false;
+
+  for (const f of filesWithPatterns) {
+    if (!involvedFiles.includes(f.file)) involvedFiles.push(f.file);
+    allLocations.push(...f.locations);
+    allEvidence.push(...f.evidence);
+    if (f.isObfuscated) isObfuscated = true;
+    for (const p of f.patterns) {
+      if (p.baseScore > highestBase) {
+        highestBase = p.baseScore;
+        mainSubtype = p.subtype;
+      }
+    }
+  }
+
+  let baseScore = highestBase;
+
+  const anyCredPattern = filesWithPatterns.some(f => f.patterns.some(p => p.subtype.startsWith('cred_')));
+  if (anyCredPattern) {
+    baseScore = Math.min(100, Math.round(baseScore * 2.5));
+  }
+
+  if (isObfuscated) baseScore += 15;
+
+  if (involvedFiles.length > 1) {
+    baseScore = Math.min(100, Math.round(baseScore * 1.3));
+  }
+
+  const confidenceScore = Math.max(50, Math.min(100, baseScore));
+
+  function confidenceLabel(score) {
+    if (score >= 95) return 'CRITICAL';
+    if (score >= 80) return 'HIGH';
+    return 'MEDIUM';
+  }
+
+  const evidenceSet = new Set(allEvidence);
+  const evidence = [...evidenceSet].slice(0, 10);
+
+  const locationMap = new Map();
+  for (const loc of allLocations) {
+    const key = `${loc.file}:${loc.line}:${loc.column}`;
+    if (!locationMap.has(key)) locationMap.set(key, loc);
+  }
+
+  const isCritical = anyCredPattern;
+  const severity = isCritical ? 'critical' : confidenceScore >= 80 ? 'high' : 'medium';
+
+  const domainSummary = filesWithPatterns
+    .flatMap(f => f.domainsFound)
+    .filter(Boolean)
+    .slice(0, 3);
+
+  const credCount = filesWithPatterns.reduce((s, f) => s + f.credsFound.length, 0);
+
+  let message;
+  if (anyCredPattern) {
+    message = `Hardcoded credentials detected (${credCount} found)`;
+  } else if (involvedFiles.length > 1) {
+    message = `Cross-file exfiltration detected across ${involvedFiles.length} files`;
+  } else if (mainSubtype === 'env_dump') {
+    message = 'Environment variable harvesting detected';
+  } else {
+    message = 'Filesystem exfiltration to external domain detected';
+  }
+
+  return [{
+    detector: 'tier1-infostealer',
+    id: 'TIER1-INFOSTEALER',
+    severity,
+    confidence: confidenceLabel(confidenceScore),
+    confidenceScore,
+    subtype: mainSubtype || 'fs_exfil',
+    message,
+    evidence,
+    locations: [...locationMap.values()],
+    crossFiles: [...new Set(involvedFiles)],
+    reference: 'Campaign 2 & 3',
+  }];
+}

package/backend/detectors/tier1-lifecycle-hook.js

@@ -0,0 +1,176 @@
+import { KNOWN_REPUTABLE_PACKAGES } from '../policy.js';
+
+const HOOK_NAMES = ['postinstall', 'preinstall', 'install', 'prepare', 'preuninstall', 'postuninstall'];
+
+const CURL_WGET_RE = /\b(?:curl|wget|powershell|bash|sh)\b/i;
+const CHILD_PROC_RE = /\b(?:exec|execSync|spawn|spawnSync|fork)\s*\(/g;
+const EVAL_RE = /\beval\s*\(/g;
+const FUNCTION_CTOR_RE = /\bFunction\s*\(/g;
+const ZERO_EVAL_RE = /\(0,\s*eval\)\s*\(/g;
+const URL_RE = /https?:\/\/([^'"\s)\]]+)/gi;
+const IP_RE = /\b(?:\d{1,3}\.){3}\d{1,3}\b/g;
+const INTERNAL_DOMAIN_RE = /(?:github-ent|jira\.internal|docs\.internal)/i;
+const ENV_EXFIL_RE = /process\.env\.(?:AWS_[A-Z_]+|NPM_TOKEN|NPM_AUTH_TOKEN|GIT_TOKEN|SSH_KEY)/g;
+const HEX_STRING_RE = /(?:0x[0-9a-fA-F]{2,}|\\x[0-9a-fA-F]{2})/g;
+const B64_RE = /['"`]([A-Za-z0-9+/]{20,}={0,2})['"`]/g;
+const REQUIRE_RE = /\brequire\s*\(/g;
+
+function shannonEntropy(s) {
+  const len = s.length;
+  if (len === 0) return 0;
+  const freq = {};
+  for (const ch of s) freq[ch] = (freq[ch] || 0) + 1;
+  let entropy = 0;
+  for (const count of Object.values(freq)) {
+    const p = count / len;
+    entropy -= p * Math.log2(p);
+  }
+  return entropy;
+}
+
+function isObfuscated(content) {
+  if (!content) return false;
+  const noWhitespace = !/\s/.test(content.trim());
+  const identifiers = content.match(/\b[a-zA-Z_$][\w$]*\b/g);
+  let avgIdLen = 0;
+  if (identifiers && identifiers.length > 0) {
+    avgIdLen = identifiers.reduce((s, id) => s + id.length, 0) / identifiers.length;
+  }
+  if (noWhitespace && identifiers && identifiers.length > 0 && avgIdLen < 3) return true;
+  if (noWhitespace && /^[a-zA-Z_$][\w$]*\([^)]*\)$/.test(content.trim())) return true;
+  HEX_STRING_RE.lastIndex = 0;
+  if (HEX_STRING_RE.test(content)) return true;
+  B64_RE.lastIndex = 0;
+  if (B64_RE.test(content)) return true;
+  if (shannonEntropy(content) > 5.5) return true;
+  return false;
+}
+
+function extractUrls(content) {
+  const urls = [];
+  let match;
+  URL_RE.lastIndex = 0;
+  while ((match = URL_RE.exec(content)) !== null) {
+    urls.push(match[1]);
+  }
+  return urls;
+}
+
+export const name = 'tier1-lifecycle-hook';
+
+export async function scan(pkgJson, jsFiles, registryMeta, allFiles) {
+  const pkgName = pkgJson?.name;
+  if (pkgName && KNOWN_REPUTABLE_PACKAGES.has(pkgName)) return [];
+
+  const scripts = pkgJson?.scripts || {};
+  const hooks = {};
+
+  for (const [name, val] of Object.entries(scripts)) {
+    if (HOOK_NAMES.includes(name) || /^(pre|post)/.test(name)) {
+      hooks[name] = val;
+    }
+  }
+
+  if (Object.keys(hooks).length === 0) return [];
+
+  const findings = [];
+
+  for (const [hookName, scriptContent] of Object.entries(hooks)) {
+    const content = typeof scriptContent === 'string' ? scriptContent : '';
+    if (!content) continue;
+
+    const truncated = content.length > 10240 ? content.slice(0, 10240) : content;
+
+    const obfuscated = isObfuscated(truncated);
+    const hasEval = EVAL_RE.test(truncated) || FUNCTION_CTOR_RE.test(truncated) || ZERO_EVAL_RE.test(truncated);
+    const hasNetwork = CURL_WGET_RE.test(truncated) || CHILD_PROC_RE.test(truncated);
+    const hasUrls = URL_RE.test(truncated) || IP_RE.test(truncated);
+    const urls = extractUrls(truncated);
+    const hasInternal = INTERNAL_DOMAIN_RE.test(truncated);
+    const envExfil = ENV_EXFIL_RE.test(truncated);
+    const silent = !REQUIRE_RE.test(truncated);
+
+    let baseScore = 0;
+    let subtype = '';
+    let severity = 'medium';
+    const evidence = [`hook: ${hookName}`];
+
+    if (hasEval || (obfuscated && hasNetwork)) {
+      baseScore = 90;
+      subtype = 'obfuscated_install';
+      severity = 'critical';
+      evidence.push('patterns: eval, obfuscated code');
+    }
+
+    if (hasUrls) {
+      const urlBase = hasInternal ? 90 : 70;
+      if (urlBase > baseScore) {
+        baseScore = urlBase;
+        subtype = hasInternal ? 'obfuscated_install' : 'encoded_payload_postinstall';
+        severity = hasInternal ? 'critical' : 'high';
+      }
+      const domainInfo = hasInternal ? 'internal domain' : 'external URL';
+      evidence.push(`patterns: hardcoded ${domainInfo} in hook`);
+      if (urls.length > 0) evidence.push(`target: ${urls[0]}`);
+    }
+
+    if (envExfil) {
+      const envScore = 90;
+      if (envScore > baseScore) {
+        baseScore = envScore;
+        subtype = hasUrls ? 'hidden_preinstall' : 'encoded_payload_postinstall';
+        severity = 'critical';
+      }
+      evidence.push('pattern: process.env exfiltration');
+    }
+
+    if (obfuscated && hasEval && hasNetwork && !hasUrls && !envExfil) {
+      if (baseScore < 90) {
+        baseScore = 90;
+        subtype = 'obfuscated_install';
+        severity = 'critical';
+      }
+    }
+
+    if (obfuscated) {
+      const entropy = shannonEntropy(truncated);
+      evidence.push(`entropy: ${entropy.toFixed(2)} (suspicious)`);
+    }
+
+    if (silent && baseScore >= 70) {
+      subtype = 'silent_eval_in_hook';
+      evidence.push('silent: no explicit require()');
+      baseScore = Math.min(100, Math.round(baseScore * 2.5));
+    }
+
+    if (baseScore === 0) continue;
+
+    const confidenceScore = Math.max(50, Math.min(100, baseScore));
+
+    function confidenceLabel(score) {
+      if (score >= 95) return 'CRITICAL';
+      if (score >= 80) return 'HIGH';
+      return 'MEDIUM';
+    }
+
+    findings.push({
+      detector: 'tier1-lifecycle-hook',
+      id: 'TIER1-LIFECYCLE-HOOK',
+      severity,
+      confidence: confidenceLabel(confidenceScore),
+      confidenceScore,
+      subtype,
+      message: `Suspicious lifecycle hook "${hookName}"`,
+      evidence,
+      locations: [{
+        file: 'package.json',
+        field: `scripts.${hookName}`,
+        value: content.length > 200 ? `${content.slice(0, 200)}...` : content,
+      }],
+      crossFiles: [],
+      reference: 'Campaign 1',
+    });
+  }
+
+  return findings;
+}

package/backend/detectors/tier1-metadata-spoof.js

@@ -0,0 +1,180 @@
+import { KNOWN_REPUTABLE_PACKAGES } from '../policy.js';
+
+const INTERNAL_SUFFIX_RE = /\.(?:internal|local|corp|intra|priv|lan)(?:[.:/]|$)/i;
+const CORPORATE_RE = /(?:github-ent|jira-ent|github\.enterprise|internal-gitlab|gitlab\.internal|jenkins\.internal|confluence\.internal)/i;
+const PRIVATE_IP_RE = /^(?:10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(?:1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3})/;
+
+function extractDomain(url) {
+  try {
+    const u = new URL(url);
+    return u.hostname;
+  } catch {
+    const m = url.match(/^(?:https?:\/\/)?([^\/\s:]+)/);
+    return m ? m[1] : null;
+  }
+}
+
+function isInternalUrl(url) {
+  if (!url) return false;
+  const domain = extractDomain(url);
+  if (!domain) return false;
+  if (INTERNAL_SUFFIX_RE.test(domain)) return true;
+  if (CORPORATE_RE.test(domain)) return true;
+  if (PRIVATE_IP_RE.test(domain)) return true;
+  return false;
+}
+
+function parseSemver(version) {
+  if (!version) return null;
+  const parts = version.replace(/^[~^]/, '').split('.');
+  const m = parseInt(parts[0], 10);
+  const n = parseInt(parts[1], 10);
+  const p = parseInt(parts[2], 10);
+  if (isNaN(m) || isNaN(n) || isNaN(p)) return null;
+  return { major: m, minor: n, patch: p };
+}
+
+function detectSemverInflation(currentVer, registryMeta) {
+  if (!currentVer || !registryMeta) return null;
+
+  const age = registryMeta.age;
+  if (age !== undefined && age < 7) return null;
+
+  const previousVer = registryMeta.previousVersion || null;
+  if (!previousVer) return null;
+
+  const cur = parseSemver(currentVer);
+  const prev = parseSemver(previousVer);
+  if (!cur || !prev) return null;
+
+  const majorJump = cur.major - prev.major;
+  const minorJump = cur.minor - prev.minor;
+  const patchJump = cur.patch - prev.patch;
+
+  if (majorJump > 10) return { type: 'major', from: previousVer, to: currentVer, jump: majorJump };
+  if (minorJump > 20) return { type: 'minor', from: previousVer, to: currentVer, jump: minorJump };
+  if (patchJump > 50) return { type: 'patch', from: previousVer, to: currentVer, jump: patchJump };
+
+  return null;
+}
+
+export const name = 'tier1-metadata-spoof';
+
+export async function scan(pkgJson, jsFiles, registryMeta, allFiles) {
+  const pkgName = pkgJson?.name;
+  if (pkgName && KNOWN_REPUTABLE_PACKAGES.has(pkgName)) return [];
+
+  const fieldUrls = [];
+
+  function addField(field, value) {
+    if (value && typeof value === 'string') {
+      fieldUrls.push({ field, value });
+    }
+  }
+
+  if (pkgJson.repository) {
+    const v = typeof pkgJson.repository === 'string' ? pkgJson.repository : pkgJson.repository.url;
+    addField('repository.url', v);
+  }
+
+  addField('homepage', pkgJson.homepage);
+
+  if (pkgJson.bugs) {
+    const v = typeof pkgJson.bugs === 'string' ? pkgJson.bugs : pkgJson.bugs.url;
+    addField('bugs.url', v);
+  }
+
+  if (pkgJson.funding) {
+    const arr = Array.isArray(pkgJson.funding) ? pkgJson.funding : [pkgJson.funding];
+    for (let i = 0; i < arr.length; i++) {
+      if (arr[i] && arr[i].url) addField(`funding[${i}].url`, arr[i].url);
+    }
+  }
+
+  if (pkgJson.author && typeof pkgJson.author === 'object' && pkgJson.author.url) {
+    addField('author.url', pkgJson.author.url);
+  }
+
+  const internalFields = fieldUrls.filter(f => isInternalUrl(f.value));
+  const hasInternalUrls = internalFields.length > 0;
+
+  const currentVersion = pkgJson?.version;
+  const semverInflation = detectSemverInflation(currentVersion, registryMeta);
+
+  if (!hasInternalUrls && !semverInflation) return [];
+
+  let baseScore = 0;
+  let subtype = '';
+  let primaryMessage = '';
+  const evidence = [];
+  const locations = [];
+
+  if (hasInternalUrls) {
+    baseScore = 65;
+    subtype = 'internal_url_in_repo';
+
+    for (const f of internalFields) {
+      const domain = extractDomain(f.value);
+      evidence.push(`url: ${f.field} = ${f.value}`);
+
+      let pattern = '';
+      if (PRIVATE_IP_RE.test(domain)) pattern = 'private IP';
+      else if (CORPORATE_RE.test(domain)) pattern = 'corporate domain';
+      else pattern = 'internal domain';
+      evidence.push(`pattern: ${domain} (${pattern})`);
+
+      locations.push({ field: f.field, value: f.value });
+    }
+
+    if (internalFields.length > 1) {
+      baseScore += 20;
+      evidence.push('coordinated: multiple internal URLs');
+    }
+
+    primaryMessage = `Package metadata contains spoofed internal URL${internalFields.length > 1 ? 's' : ''}`;
+  }
+
+  if (semverInflation) {
+    const semverMsg = `semver: ${semverInflation.from} \u2192 ${semverInflation.to} (${semverInflation.type} jump of ${semverInflation.jump})`;
+
+    if (hasInternalUrls) {
+      baseScore = Math.round(baseScore * 1.3);
+      evidence.push(semverMsg);
+      evidence.push(`${semverInflation.type} version jump (${semverInflation.jump}) without changelog`);
+      locations.push({ field: 'version', old: semverInflation.from, new: semverInflation.to });
+      primaryMessage += ' + unjustified semver jump';
+    } else {
+      baseScore = 40;
+      subtype = 'semver_inflation';
+      evidence.push(semverMsg);
+      locations.push({ field: 'version', old: semverInflation.from, new: semverInflation.to });
+      primaryMessage = 'Unjustified semver version jump detected';
+    }
+  }
+
+  const confidenceScore = Math.max(50, Math.min(90, baseScore));
+
+  function severityLabel(sc) {
+    if (sc >= 70) return 'high';
+    return 'medium';
+  }
+
+  function confidenceLabel(sc) {
+    if (sc >= 80) return 'HIGH';
+    if (sc >= 60) return 'MEDIUM';
+    return 'LOW';
+  }
+
+  return [{
+    detector: 'tier1-metadata-spoof',
+    id: 'TIER1-METADATA-SPOOF',
+    severity: severityLabel(confidenceScore),
+    confidence: confidenceLabel(confidenceScore),
+    confidenceScore,
+    subtype,
+    message: primaryMessage,
+    evidence,
+    locations,
+    reference: 'Campaign 1',
+  }];
+}