@node9/proxy 2.52.0 → 2.54.0

package/dist/scan-ink.mjs

@@ -211,6 +211,8 @@ var ConfigFileSchema = z.object({
       registrySignals: z.boolean().optional(),
       newPackage: z.enum(["review", "off"]).optional(),
       installScript: z.enum(["review", "off"]).optional(),
+      lookalike: z.enum(["review", "off"]).optional(),
+      establishedAge: z.enum(["review", "off"]).optional(),
       maxAgeHours: z.number().min(0).optional(),
       onlineFallback: z.boolean().optional(),
       allow: z.array(z.string()).optional()
@@ -2335,7 +2337,7 @@ var CHECK_TEXT = {
     advice: "Fixed at Block. A person accepts the change on the machine (node9 mcp pin update)."
   },
   "loading.malicious-package": {
-    plain: "The agent installs a package that the public malicious-package database (OSV) lists, or one published minutes ago. Covers npm, PyPI, RubyGems, crates.io, Go, NuGet, Maven, Packagist and VS Code extensions; the publish-age and install-script signals are npm and PyPI only. A new release built from the same repository as the one before it (registry provenance) and an install script the package has always run do not stop; a release that lost the provenance its previous release had does.",
+    plain: "The agent installs a package that the public malicious-package database (OSV) lists, or one published minutes ago. Covers npm, PyPI, RubyGems, crates.io, Go, NuGet, Maven, Packagist and VS Code extensions; the publish-age and install-script signals are npm and PyPI only. A new release built from the same repository as the one before it (registry provenance) and an install script the package has always run do not stop; a release that lost the provenance its previous release had does. A name that looks like a popular package and has no standing of its own, a name no package on npm or PyPI has, or a package npm removed as malicious also stops for review (the lookalike tuning). A fresh release of a package over a year old that released within the last six months is its normal cadence: Standard lets it through, Strict asks (the establishedAge tuning).",
     example: "npm install of a package flagged as malware",
     advice: "Keep Block for known-malicious packages; brand-new packages already stop for Review."
   },
@@ -3432,6 +3434,46 @@ var PHP = [
   ],
   ["permissions", /\b(?:chmod|chown|chgrp|lchown|lchgrp)\s*\(/]
 ];
+var READ_CALL = {
+  python: String.raw`(?:\b(?:io|codecs)\.)?\bopen|\b(?:dotenv_values|load_dotenv|get_key|read_file|loadtxt|read_csv)`,
+  node: String.raw`\b(?:readFileSync|readFile|createReadStream|readTextFile(?:Sync)?|readFileStr|openSync|file)`,
+  perl: String.raw`\b(?:open|sysopen|read_file|slurp)`,
+  ruby: String.raw`\b(?:File|IO)\.(?:read|binread|readlines|foreach|open)|\bDotenv\.(?:load|parse|overload)`,
+  php: String.raw`\b(?:file_get_contents|fopen|file|readfile|parse_ini_file|highlight_file|show_source)`
+};
+var ARG = String.raw`(?:(?:(?:my|our|local)\s+)?[\w.$]+(?:\s*\(\s*\))?|'[^'\n]{0,8}'|"[^"\n]{0,8}")\s*,\s*`;
+var WRAP = String.raw`(?:(?:new\s+)?[\w.$]+\s*\(\s*(?:${ARG}){0,3}){0,3}`;
+var STR_PREFIX = String.raw`[rRbBuUfF]{0,2}`;
+var WRITE_MODE_LITERAL = String.raw`['"](?=[rbtU+]*w|(?![^'"]*\+)[rbtU]*[ax])[rwaxbtU+]{1,4}['"]`;
+var WRITE_MODE = String.raw`\s*,\s*(?:mode\s*=\s*)?${WRITE_MODE_LITERAL}`;
+var WRITE_MODE_AFTER = new RegExp(`^(?:\\s*\\)){0,3}${WRITE_MODE}`);
+var readCallBefore = (language) => new RegExp(
+  String.raw`(?:${READ_CALL[language]})(?![\w$])\s*\(?\s*(?:${ARG}){0,3}${WRAP}${STR_PREFIX}$`
+);
+var READ_BEFORE = {
+  python: readCallBefore("python"),
+  node: readCallBefore("node"),
+  perl: readCallBefore("perl"),
+  ruby: readCallBefore("ruby"),
+  php: readCallBefore("php")
+};
+var READ_AFTER = {
+  python: new RegExp(
+    String.raw`^\s*\)\s*\.\s*(?:read_text|read_bytes|open)\s*\((?!\s*(?:mode\s*=\s*)?${WRITE_MODE_LITERAL})`
+  )
+};
+var ASSIGNED = new RegExp(String.raw`([$\w]+)\s*=\s*${WRAP}${STR_PREFIX}$`);
+var openedName = (language) => new RegExp(
+  String.raw`(?:${READ_CALL[language]})(?![\w$])\s*\(?\s*(?:${ARG}){0,3}${WRAP}([$\w]+)(?!${WRITE_MODE})\s*[),]` + (language === "python" ? String.raw`|\bPath\s*\(\s*([$\w]+)\s*\)\s*\.\s*(?:read_text|read_bytes|open)\s*\(` : ""),
+  "g"
+);
+var OPENED_NAME = {
+  python: openedName("python"),
+  node: openedName("node"),
+  perl: openedName("perl"),
+  ruby: openedName("ruby"),
+  php: openedName("php")
+};
 var sharedParser = lazy(() => getSyntax().NewParser());
 var SHELL_INTERPRETERS = /* @__PURE__ */ new Set([
   "bash",
@@ -7380,6 +7422,16 @@ var TUNING_FIELDS = [
     name: "installScript",
     legacy: ["packageCheck", "installScript"]
   },
+  {
+    checkId: "loading.malicious-package",
+    name: "lookalike",
+    legacy: ["packageCheck", "lookalike"]
+  },
+  {
+    checkId: "loading.malicious-package",
+    name: "establishedAge",
+    legacy: ["packageCheck", "establishedAge"]
+  },
   {
     checkId: "loading.malicious-package",
     name: "onlineFallback",
@@ -7827,6 +7879,8 @@ var DEFAULT_CONFIG = {
       newPackage: "review",
       maxAgeHours: 48,
       installScript: "review",
+      lookalike: "review",
+      establishedAge: "off",
       onlineFallback: true,
       allow: []
     },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/proxy",
-  "version": "2.52.0",
+  "version": "2.54.0",
   "description": "Access control for AI agents. Set what Claude Code, Codex, Gemini, Cursor and any MCP server are allowed to do, review risky actions before they run, and keep every action on the record.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",