@node9/proxy 2.27.1 → 2.28.1

package/dist/index.mjs

@@ -364,9 +364,9 @@ function matchesPattern(text, patterns) {
   const withoutDotSlash = text.replace(/^\.\//, "");
   return isMatch(withoutDotSlash) || isMatch(`./${withoutDotSlash}`);
 }
-function getNestedValue(obj, path17) {
+function getNestedValue(obj, path19) {
   if (!obj || typeof obj !== "object") return null;
-  const segments2 = path17.split(".");
+  const segments2 = path19.split(".");
   for (const seg of segments2) {
     if (FORBIDDEN_PATH_SEGMENTS.has(seg)) return null;
   }
@@ -2176,14 +2176,54 @@ function pipInstall(words, from, manager, out) {
   if (v >= 0 && lower(words[v]) === "install")
     pushPy(out, manager, operands(words, v + 1, PIP_VALUE_FLAGS));
 }
+function localContexts(file) {
+  const contexts = /* @__PURE__ */ new Map();
+  const sample = parseShared("cd . && true");
+  if (typeof sample === "symbol") return contexts;
+  const andOp = sample.Stmts[0].Cmd.Op;
+  function visit(stmt, steps, depth = 0) {
+    if (depth > 64) return null;
+    if (!stmt || stmt.Background || stmt.Negated || stmt.Redirs?.length) return null;
+    const cmd = stmt.Cmd;
+    const kind = syntax2.NodeType(cmd);
+    if (kind === "BinaryCmd" && cmd.Op === andOp) {
+      const next = visit(cmd.X, steps, depth + 1);
+      return next === null ? null : visit(cmd.Y, next, depth + 1);
+    }
+    if (kind !== "CallExpr" || cmd.Assigns?.length) return null;
+    const words = (cmd.Args ?? []).map((w) => resolveWordLiteral(w));
+    if (words[0] === "cd" && words.length === 2 && typeof words[1] === "string" && words[1] && !/^[-~]/.test(words[1]))
+      return [...steps, words[1]];
+    if (!["npx", "npm", "bunx", "bun"].includes(words[0])) return null;
+    if (words.some(
+      (w) => w === null || /^(?:--(?:prefix|cwd|directory|workspace|workspaces|global|ignore-existing)(?:=|$)|-[Cwg])/.test(
+        w
+      )
+    ))
+      return null;
+    contexts.set(cmd.Pos().Offset(), steps);
+    return null;
+  }
+  if (file.Stmts?.length === 1) visit(file.Stmts[0], []);
+  return contexts;
+}
 function collect(command, out, depth) {
   if (!command || command.length > 5e4) return;
   const f = parseShared(command);
   if (typeof f === "symbol") return;
+  const contexts = depth === 0 ? localContexts(f) : /* @__PURE__ */ new Map();
   syntax2.Walk(f, (node) => {
     if (node && syntax2.NodeType(node) === "CallExpr") {
       const words = (node.Args || []).map((a) => resolveWordLiteral(a));
+      const start = out.length;
       if (words.length > 0) fromCall(words, out, depth);
+      const steps = contexts.get(node.Pos().Offset());
+      for (let i = start; i < out.length; i++) {
+        if (["npx", "bunx", "npm exec"].includes(out[i].manager)) {
+          if (!steps) out[i].localCwd = null;
+          else if (steps.length) out[i].localCwd = steps;
+        }
+      }
     }
     return true;
   });
@@ -2193,7 +2233,7 @@ function extractPackageInstalls(command) {
   collect(command, out, 0);
   const seen = /* @__PURE__ */ new Set();
   return out.filter((r) => {
-    const k = `${r.ecosystem}\0${r.name}\0${r.version ?? ""}`;
+    const k = JSON.stringify([r.ecosystem, r.manager, r.name, r.raw, r.localCwd]);
     if (seen.has(k)) return false;
     seen.add(k);
     return true;
@@ -2626,7 +2666,15 @@ function tuningToLegacyPolicy(policy, tuning) {
   const unknown = [];
   for (const [id, fields] of Object.entries(tuning)) {
     if (!fields || typeof fields !== "object") continue;
-    for (const [name, value] of Object.entries(fields)) {
+    const normalized = { ...fields };
+    if (id === "loading.malicious-package") {
+      if (normalized.registrySignals === false) {
+        normalized.newPackage ??= "off";
+        normalized.installScript ??= "off";
+      }
+      delete normalized.registrySignals;
+    }
+    for (const [name, value] of Object.entries(normalized)) {
       const field = TUNING_FIELDS.find((f) => f.checkId === id && f.name === name);
       if (!field) {
         unknown.push(`${id}.${name}`);
@@ -2985,9 +3033,9 @@ function bareToolName(toolName) {
   const parts = toolName.split("__");
   return (parts.length >= 3 ? parts.slice(2).join("__") : toolName).toLowerCase();
 }
-function valuesAt(args, path17) {
+function valuesAt(args, path19) {
   let cursors = [args];
-  for (const rawSegment of path17.split(".")) {
+  for (const rawSegment of path19.split(".")) {
     const isArray = rawSegment.endsWith("[]");
     const key = isArray ? rawSegment.slice(0, -2) : rawSegment;
     const next = [];
@@ -3019,8 +3067,8 @@ function extractToolDestinations(toolName, args) {
     const paths = DESTINATION_ARGS.get(bareToolName(toolName));
     if (!paths) return [];
     const out = [];
-    for (const path17 of paths) {
-      for (const value of valuesAt(args, path17)) {
+    for (const path19 of paths) {
+      for (const value of valuesAt(args, path19)) {
         const host = hostOf(value);
         if (host) out.push({ host, binary: toolName, raw: value });
       }
@@ -3034,15 +3082,15 @@ function ssrfDestinationFloor(toolName, args, opts = {}) {
   try {
     const paths = DESTINATION_ARGS.get(bareToolName(toolName));
     if (!paths) return null;
-    for (const path17 of paths) {
-      for (const value of valuesAt(args, path17)) {
+    for (const path19 of paths) {
+      for (const value of valuesAt(args, path19)) {
         const host = hostOf(value);
         if (!host) continue;
         const m = classifySsrf(host);
         if (!m) continue;
         if (isStrictGatedTier(m.tier) && !opts.ssrfStrict) continue;
         if (m.overridable && ssrfExemptMatches(opts.ssrfAllow, m.normalized)) continue;
-        return { ...m, argPath: path17, host, reason: ssrfReason(m, host) };
+        return { ...m, argPath: path19, host, reason: ssrfReason(m, host) };
       }
     }
     return null;
@@ -6940,14 +6988,19 @@ var init_dist = __esm({
       { checkId: "loading.skill-tamper", name: "roots", legacy: ["skillPinning", "roots"] },
       {
         checkId: "loading.malicious-package",
-        name: "registrySignals",
-        legacy: ["packageCheck", "registrySignals"]
+        name: "newPackage",
+        legacy: ["packageCheck", "newPackage"]
       },
       {
         checkId: "loading.malicious-package",
         name: "maxAgeHours",
         legacy: ["packageCheck", "maxAgeHours"]
       },
+      {
+        checkId: "loading.malicious-package",
+        name: "installScript",
+        legacy: ["packageCheck", "installScript"]
+      },
       {
         checkId: "loading.malicious-package",
         name: "onlineFallback",
@@ -7230,7 +7283,8 @@ __export(audit_exports, {
   buildArgsPreview: () => buildArgsPreview,
   filePathFromArgs: () => filePathFromArgs,
   generateEventId: () => generateEventId,
-  redactSecrets: () => redactSecrets
+  redactSecrets: () => redactSecrets,
+  truncateAuditPreview: () => truncateAuditPreview
 });
 import fs from "fs";
 import path from "path";
@@ -7263,11 +7317,14 @@ function buildArgsPreview(args) {
     const primary = o && (o.command ?? o.file_path ?? o.path ?? o.url ?? o.query);
     const text = typeof primary === "string" ? primary : args ? JSON.stringify(args) : "";
     if (!text) return void 0;
-    return redactSecrets(text).slice(0, 120);
+    return truncateAuditPreview(redactSecrets(text));
   } catch {
     return void 0;
   }
 }
+function truncateAuditPreview(text) {
+  return text.slice(0, 120).replace(/[\uD800-\uDBFF]$/, "");
+}
 function appendToLog(logPath, entry) {
   try {
     const dir = path.dirname(logPath);
@@ -7550,7 +7607,10 @@ var ConfigFileSchema = z.object({
     packageCheck: z.object({
       enabled: z.boolean().optional(),
       onMalicious: z.enum(["block", "review"]).optional(),
+      // 2.27.0 shape, still accepted: false = newPackage and installScript off.
       registrySignals: z.boolean().optional(),
+      newPackage: z.enum(["review", "off"]).optional(),
+      installScript: z.enum(["review", "off"]).optional(),
       maxAgeHours: z.number().min(0).optional(),
       onlineFallback: z.boolean().optional(),
       allow: z.array(z.string()).optional()
@@ -7565,8 +7625,8 @@ var ConfigFileSchema = z.object({
 }).strict();
 function formatIssues(issues) {
   const lines = issues.map((issue) => {
-    const path17 = issue.path.length > 0 ? issue.path.map(String).join(".") : "root";
-    return `  \u2022 ${path17}: ${issue.message}`;
+    const path19 = issue.path.length > 0 ? issue.path.map(String).join(".") : "root";
+    return `  \u2022 ${path19}: ${issue.message}`;
   });
   return `Invalid config:
 ${lines.join("\n")}`;
@@ -7579,9 +7639,9 @@ function prunePaths(root, paths) {
     const yi = y[y.length - 1];
     return typeof xi === "number" && typeof yi === "number" ? yi - xi : 0;
   });
-  for (const path17 of ordered) {
+  for (const path19 of ordered) {
     let cur = root;
-    for (const key of path17.slice(0, -1)) {
+    for (const key of path19.slice(0, -1)) {
       if (cur === null || typeof cur !== "object") {
         cur = void 0;
         break;
@@ -7589,7 +7649,7 @@ function prunePaths(root, paths) {
       cur = cur[key];
     }
     if (cur === null || typeof cur !== "object") continue;
-    const last = path17[path17.length - 1];
+    const last = path19[path19.length - 1];
     if (Array.isArray(cur)) {
       const i = Number(last);
       if (Number.isInteger(i) && i >= 0 && i < cur.length) {
@@ -7625,7 +7685,7 @@ function sanitizeConfig(raw) {
           return issue.keys.map((k) => [...at, k]);
         }
         return [at.slice(0, -level || void 0)];
-      }).filter((path17) => path17.length > 0);
+      }).filter((path19) => path19.length > 0);
       if (paths.length === 0 || !prunePaths(working, paths)) break;
     }
     if (ConfigFileSchema.safeParse(working).success) break;
@@ -8361,8 +8421,9 @@ var DEFAULT_CONFIG = {
     packageCheck: {
       enabled: true,
       onMalicious: "block",
-      registrySignals: true,
+      newPackage: "review",
       maxAgeHours: 48,
+      installScript: "review",
       onlineFallback: true,
       allow: []
     },
@@ -8724,7 +8785,13 @@ function getConfig(cwd) {
       if (typeof pc.enabled === "boolean") cur.enabled = pc.enabled;
       if (pc.onMalicious === "block" || pc.onMalicious === "review")
         cur.onMalicious = pc.onMalicious;
-      if (typeof pc.registrySignals === "boolean") cur.registrySignals = pc.registrySignals;
+      if (pc.registrySignals === false) {
+        cur.newPackage = "off";
+        cur.installScript = "off";
+      }
+      if (pc.newPackage === "review" || pc.newPackage === "off") cur.newPackage = pc.newPackage;
+      if (pc.installScript === "review" || pc.installScript === "off")
+        cur.installScript = pc.installScript;
       if (typeof pc.maxAgeHours === "number" && pc.maxAgeHours >= 0)
         cur.maxAgeHours = pc.maxAgeHours;
       if (typeof pc.onlineFallback === "boolean") cur.onlineFallback = pc.onlineFallback;
@@ -8934,7 +9001,10 @@ function getConfig(cwd) {
           mergedPolicy.packageCheck = {
             enabled: typeof pc.enabled === "boolean" ? pc.enabled : cur.enabled,
             onMalicious: pc.onMalicious === "block" || pc.onMalicious === "review" ? pc.onMalicious : cur.onMalicious,
-            registrySignals: typeof pc.registrySignals === "boolean" ? pc.registrySignals : cur.registrySignals,
+            // The 2.27.0 boolean still arrives from older dashboard columns:
+            // false turns both signals off unless the new keys say otherwise.
+            newPackage: pc.newPackage === "review" || pc.newPackage === "off" ? pc.newPackage : pc.registrySignals === false ? "off" : cur.newPackage,
+            installScript: pc.installScript === "review" || pc.installScript === "off" ? pc.installScript : pc.registrySignals === false ? "off" : cur.installScript,
             maxAgeHours: typeof pc.maxAgeHours === "number" && Number.isFinite(pc.maxAgeHours) && pc.maxAgeHours >= 0 ? pc.maxAgeHours : cur.maxAgeHours,
             onlineFallback: typeof pc.onlineFallback === "boolean" ? pc.onlineFallback : cur.onlineFallback,
             allow: Array.isArray(pc.allow) ? pc.allow.filter((a) => typeof a === "string" && a.length > 0) : cur.allow
@@ -8960,13 +9030,13 @@ function getConfig(cwd) {
         }
         if (Array.isArray(mc.jailPaths)) {
           for (const jp of mc.jailPaths) {
-            const path17 = typeof jp?.path === "string" ? jp.path.trim() : "";
-            if (!path17) continue;
+            const path19 = typeof jp?.path === "string" ? jp.path.trim() : "";
+            if (!path19) continue;
             const verdict = jp?.verdict === "review" ? "review" : "block";
-            for (const r of pathRules(path17, verdict, "org-managed jail")) {
+            for (const r of pathRules(path19, verdict, "org-managed jail")) {
               mergedPolicy.smartRules.push({ ...r, name: `org:${r.name}` });
             }
-            mergedPolicy.managedJailPaths.push({ path: path17, verdict });
+            mergedPolicy.managedJailPaths.push({ path: path19, verdict });
           }
         }
         if (Array.isArray(mc.trustedHosts)) {
@@ -10363,6 +10433,7 @@ function recordAndCheck(tool, args, threshold = 3, windowMs = 12e4) {
 // src/supply-chain/check.ts
 init_dist();
 import picomatch from "picomatch";
+import path18 from "path";
 
 // src/supply-chain/osv-index.ts
 init_dist();
@@ -10523,30 +10594,58 @@ async function queryOsvMalicious(queries) {
 }
 
 // src/supply-chain/registry.ts
+import { maxSatisfying, satisfies, validRange } from "semver";
 var TIMEOUT_MS2 = 1500;
 var MAX_BYTES = 2 * 1024 * 1024;
-async function npmInfo(name, version) {
+async function npmInfo(name, version, freshWindowMs, raw) {
   const base = endpoints().npmRegistry;
   if (!base) return null;
-  const doc = await fetchJson(`${base}/${name.replaceAll("/", "%2F")}`, {
+  const url = `${base}/${name.replaceAll("/", "%2F")}`;
+  const doc = await fetchJson(url, {
     timeoutMs: TIMEOUT_MS2,
     maxBytes: MAX_BYTES,
     headers: { Accept: "application/vnd.npm.install-v1+json" }
   });
   if (!doc) return null;
   const latest = doc["dist-tags"]?.latest;
-  const resolved = version ?? latest;
+  const aliasStart = raw?.indexOf("@npm:") ?? -1;
+  const target = aliasStart > 0 ? raw.slice(aliasStart + 5) : raw?.replace(/^npm:/, "");
+  const specStart = target?.indexOf("@", 1) ?? -1;
+  const spec = specStart > 0 ? target.slice(specStart + 1) : "";
+  let resolved = version;
+  if (!resolved) {
+    if (!spec) resolved = latest;
+    else if (doc["dist-tags"]?.[spec]) resolved = doc["dist-tags"][spec];
+    else if (validRange(spec)) {
+      resolved = latest && satisfies(latest, spec) ? latest : maxSatisfying(Object.keys(doc.versions ?? {}), spec) ?? void 0;
+    }
+  }
   if (!resolved) return null;
   const v = doc.versions?.[resolved];
   const modifiedMs = doc.modified ? Date.parse(doc.modified) : NaN;
-  return {
+  const info = {
     version: resolved,
-    // `modified` bounds the publish time of EVERY version from above, but it
-    // only approximates the age of the newest one: an older pinned version
-    // gets no age (it is at least as old as `latest`, so never "new").
-    publishedAtMs: Number.isFinite(modifiedMs) && resolved === latest ? modifiedMs : void 0,
     hasInstallScript: v?.hasInstallScript === true
   };
+  if (!Number.isFinite(modifiedMs)) return info;
+  if (Date.now() - modifiedMs >= freshWindowMs) {
+    info.publishedAtMs = resolved === latest ? modifiedMs : void 0;
+    return info;
+  }
+  try {
+    const full = await fetchJson(url, { timeoutMs: TIMEOUT_MS2, maxBytes: MAX_BYTES });
+    const t = full?.time?.[resolved];
+    const tMs = t ? Date.parse(t) : NaN;
+    if (Number.isFinite(tMs)) {
+      info.publishedAtMs = tMs;
+      return info;
+    }
+    info.ageFallback = `no publish time for ${resolved} in the full document`;
+  } catch (err) {
+    info.ageFallback = `full document ${err.message}`;
+  }
+  info.publishedAtMs = modifiedMs;
+  return info;
 }
 async function pypiInfo(name, version) {
   const base = endpoints().pypi;
@@ -10561,8 +10660,36 @@ async function pypiInfo(name, version) {
     publishedAtMs: times.length > 0 ? Math.min(...times) : void 0
   };
 }
-async function registryInfo(eco, name, version) {
-  return eco === "npm" ? npmInfo(name, version) : pypiInfo(name, version);
+async function registryInfo(eco, name, version, freshWindowMs, raw) {
+  return eco === "npm" ? npmInfo(name, version, freshWindowMs, raw) : pypiInfo(name, version);
+}
+
+// src/supply-chain/local-resolve.ts
+import fs16 from "fs";
+import path17 from "path";
+var MAX_LEVELS = 32;
+var LOCAL_FIRST_MANAGERS = /* @__PURE__ */ new Set(["npx", "bunx", "npm exec"]);
+function resolveInstalled(name, cwd) {
+  if (!cwd || !path17.isAbsolute(cwd)) return null;
+  if (!/^(?:@[^/\\]+\/)?[^/\\]+$/.test(name)) return null;
+  let dir = path17.resolve(cwd);
+  for (let i = 0; i < MAX_LEVELS; i++) {
+    const pkgDir = path17.join(dir, "node_modules", ...name.split("/"));
+    const manifest = path17.join(pkgDir, "package.json");
+    try {
+      const raw = fs16.readFileSync(manifest, "utf8");
+      const parsed = JSON.parse(raw);
+      if (typeof parsed.version === "string" && parsed.version.length > 0) {
+        return { version: parsed.version, dir: pkgDir };
+      }
+      return null;
+    } catch {
+    }
+    const parent = path17.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return null;
 }
 
 // src/supply-chain/check.ts
@@ -10633,13 +10760,45 @@ async function maliciousFor(p, version, cfg, misses, networkCapped) {
   }
   return null;
 }
-async function checkOne(p, cfg, misses, networkCapped) {
+function checkInstalled(p, version, misses) {
+  const local = lookupIndex(p.ecosystem, p.name);
+  if (local.status === "unavailable") {
+    misses.push(`${label(p, version)}: installed copy, local index unavailable`);
+    return [];
+  }
+  if (local.status !== "hit") return [];
+  const covering = local.entries.filter((e) => entryCovers(e, version) === true).map((e) => e.id);
+  if (covering.length === 0) return [];
+  return [
+    {
+      pkg: p,
+      version,
+      installed: true,
+      kind: "malicious",
+      advisories: covering,
+      detail: `installed ${label(p, version)} (${covering.join(", ")})`
+    }
+  ];
+}
+async function checkOne(p, cfg, misses, networkCapped, cwd) {
+  if (p.ecosystem === "npm" && LOCAL_FIRST_MANAGERS.has(p.manager) && p.localCwd !== null && (p.raw === p.name || p.version)) {
+    const localCwd = cwd && path18.isAbsolute(cwd) ? (p.localCwd ?? []).reduce((dir, step) => path18.resolve(dir, step), cwd) : void 0;
+    const installed = resolveInstalled(p.name, localCwd);
+    if (installed && (!p.version || p.version === installed.version))
+      return checkInstalled(p, installed.version, misses);
+  }
   const findings = [];
   let info = null;
-  if (cfg.registrySignals && !networkCapped) {
+  const wantsRegistry = cfg.newPackage !== "off" || cfg.installScript !== "off";
+  if (wantsRegistry && !networkCapped) {
     try {
-      info = await registryInfo(p.ecosystem, p.name, p.version);
+      const windowMs = cfg.newPackage === "off" ? 0 : cfg.maxAgeHours * 36e5;
+      info = await registryInfo(p.ecosystem, p.name, p.version, windowMs, p.raw);
       if (!info) misses.push(`${label(p, p.version)}: registry metadata unavailable`);
+      else if (info.ageFallback)
+        misses.push(
+          `${label(p, info.version)}: age from the package modified time (${info.ageFallback})`
+        );
     } catch (err) {
       misses.push(`${label(p, p.version)}: registry ${err.message}`);
     }
@@ -10647,18 +10806,18 @@ async function checkOne(p, cfg, misses, networkCapped) {
   const version = p.version ?? info?.version;
   const mal = await maliciousFor(p, version, cfg, misses, networkCapped);
   if (mal) findings.push(mal);
-  if (info?.publishedAtMs !== void 0) {
+  if (cfg.newPackage !== "off" && info?.publishedAtMs !== void 0) {
     const ageH = (Date.now() - info.publishedAtMs) / 36e5;
     if (ageH >= 0 && ageH < cfg.maxAgeHours) {
       findings.push({
         pkg: p,
         version,
         kind: "new",
-        detail: `${label(p, version)} was published ${Math.max(1, Math.round(ageH))}h ago (under ${cfg.maxAgeHours}h)`
+        detail: info.ageFallback ? `${label(p, version)} has package metadata updated ${Math.max(1, Math.round(ageH))}h ago (under ${cfg.maxAgeHours}h); version publish time unavailable` : `${label(p, version)} was published ${Math.max(1, Math.round(ageH))}h ago (under ${cfg.maxAgeHours}h)`
       });
     }
   }
-  if (info?.hasInstallScript) {
+  if (cfg.installScript !== "off" && info?.hasInstallScript) {
     findings.push({
       pkg: p,
       version,
@@ -10668,7 +10827,7 @@ async function checkOne(p, cfg, misses, networkCapped) {
   }
   return findings;
 }
-async function runPackageCheck(toolName, args, cfg) {
+async function runPackageCheck(toolName, args, cfg, cwd) {
   if (!cfg.enabled) return ALLOW;
   try {
     const command = commandOf(toolName, args);
@@ -10679,7 +10838,7 @@ async function runPackageCheck(toolName, args, cfg) {
     const misses = [];
     const checked = requests;
     const settled = await Promise.allSettled(
-      checked.map((p, i) => checkOne(p, cfg, misses, i >= MAX_NETWORK_PACKAGES))
+      checked.map((p, i) => checkOne(p, cfg, misses, i >= MAX_NETWORK_PACKAGES, cwd))
     );
     const findings = [];
     settled.forEach((s, i) => {
@@ -11087,7 +11246,7 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
   }
   const packageCheck = config.policy.packageCheck;
   if (packageCheck?.enabled && !isManual) {
-    const pkg = await runPackageCheck(toolName, args, packageCheck);
+    const pkg = await runPackageCheck(toolName, args, packageCheck, options?.cwd);
     if (pkg.misses.length > 0) {
       appendToLog(HOOK_DEBUG_LOG, {
         ts: (/* @__PURE__ */ new Date()).toISOString(),

package/dist/scan-ink.mjs

@@ -196,7 +196,10 @@ var ConfigFileSchema = z.object({
     packageCheck: z.object({
       enabled: z.boolean().optional(),
       onMalicious: z.enum(["block", "review"]).optional(),
+      // 2.27.0 shape, still accepted: false = newPackage and installScript off.
       registrySignals: z.boolean().optional(),
+      newPackage: z.enum(["review", "off"]).optional(),
+      installScript: z.enum(["review", "off"]).optional(),
       maxAgeHours: z.number().min(0).optional(),
       onlineFallback: z.boolean().optional(),
       allow: z.array(z.string()).optional()
@@ -2800,14 +2803,19 @@ var TUNING_FIELDS = [
   { checkId: "loading.skill-tamper", name: "roots", legacy: ["skillPinning", "roots"] },
   {
     checkId: "loading.malicious-package",
-    name: "registrySignals",
-    legacy: ["packageCheck", "registrySignals"]
+    name: "newPackage",
+    legacy: ["packageCheck", "newPackage"]
   },
   {
     checkId: "loading.malicious-package",
     name: "maxAgeHours",
     legacy: ["packageCheck", "maxAgeHours"]
   },
+  {
+    checkId: "loading.malicious-package",
+    name: "installScript",
+    legacy: ["packageCheck", "installScript"]
+  },
   {
     checkId: "loading.malicious-package",
     name: "onlineFallback",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/proxy",
-  "version": "2.27.1",
+  "version": "2.28.1",
   "description": "Access control for AI agents. Set what Claude Code, Codex, Gemini, Cursor and any MCP server are allowed to do, review risky actions before they run, and keep every action on the record.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",
@@ -99,6 +99,7 @@
     "picomatch": "^4.0.3",
     "react": "^19.2.6",
     "safe-regex2": "^5.1.0",
+    "semver": "^7.8.5",
     "smol-toml": "^1.6.1",
     "string-width": "^8.3.0",
     "yaml": "^2.9.0",
@@ -118,6 +119,7 @@
     "@types/node": "^26.4.1",
     "@types/picomatch": "^4.0.2",
     "@types/react": "^19.2.14",
+    "@types/semver": "^7.8.0",
     "@vitest/coverage-v8": "^5.0.0",
     "cross-env": "^10.1.0",
     "ink-testing-library": "^4.0.0",