@vltpkg/query 1.0.0-rc.33 → 1.0.0-rc.34

package/dist/index.js

@@ -124,6 +124,8 @@ const securitySelectors = new Set([
     ':unmaintained',
     ':unpopular',
     ':unstable',
+    ':vuln',
+    ':vulnerable',
 ]);
 const setMethodToJSON = (node) => {
     const { toJSON } = node;
@@ -234,12 +236,7 @@ export class Query {
                     none: securityArchiveEntry.alerts.some(i => i.type === 'noLicenseFound'),
                     exception: securityArchiveEntry.alerts.some(i => i.type === 'licenseException'),
                 },
-                malware: {
-                    low: securityArchiveEntry.alerts.some(i => i.type === 'gptAnomaly'),
-                    medium: securityArchiveEntry.alerts.some(i => i.type === 'gptSecurity'),
-                    high: securityArchiveEntry.alerts.some(i => i.type === 'gptMalware'),
-                    critical: securityArchiveEntry.alerts.some(i => i.type === 'malware'),
-                },
+                malware: securityArchiveEntry.alerts.some(i => i.type === 'malware' || i.type === 'gptMalware'),
                 minified: securityArchiveEntry.alerts.some(i => i.type === 'minifiedFile'),
                 native: securityArchiveEntry.alerts.some(i => i.type === 'hasNativeCode'),
                 network: securityArchiveEntry.alerts.some(i => i.type === 'networkAccess'),
@@ -265,6 +262,13 @@ export class Query {
                 unmaintained: securityArchiveEntry.alerts.some(i => i.type === 'unmaintained'),
                 unpopular: securityArchiveEntry.alerts.some(i => i.type === 'unpopularPackage'),
                 unstable: securityArchiveEntry.alerts.some(i => i.type === 'unstableOwnership'),
+                vuln: {
+                    low: securityArchiveEntry.alerts.some(i => i.type === 'mildCVE' || i.type === 'gptAnomaly'),
+                    medium: securityArchiveEntry.alerts.some(i => i.type === 'potentialVulnerability' ||
+                        i.type === 'gptSecurity'),
+                    high: securityArchiveEntry.alerts.some(i => i.type === 'cve'),
+                    critical: securityArchiveEntry.alerts.some(i => i.type === 'criticalCVE'),
+                },
             };
             setMethodToJSON(node);
         }

package/dist/parser.js

@@ -11,12 +11,13 @@ export const unescapeDots = (query) => query.replaceAll('\\.', '.');
 const pseudoCleanUpNeeded = new Set([
     ':published',
     ':score',
-    ':malware',
     ':severity',
     ':sev',
     ':squat',
     ':semver',
     ':v',
+    ':vuln',
+    ':vulnerable',
     ':path',
 ]);
 const hasParamsToEscape = (node) => pseudoCleanUpNeeded.has(node.value);

package/dist/pseudo/malware.d.ts

@@ -1,22 +1,9 @@
 import type { ParserState } from '../types.ts';
-import type { PostcssNode } from '@vltpkg/dss-parser';
-export type MalwareKinds = '0' | '1' | '2' | '3' | 'critical' | 'high' | 'medium' | 'low' | undefined;
-export type MalwareAlertTypes = 'malware' | 'gptMalware' | 'gptSecurity' | 'gptAnomaly' | undefined;
-export type MalwareComparator = '>' | '<' | '>=' | '<=' | undefined;
-export declare const isMalwareKind: (value?: string) => value is MalwareKinds;
-export declare const asMalwareKind: (value?: string) => MalwareKinds;
-export declare const parseInternals: (nodes: PostcssNode[]) => {
-    kind: MalwareKinds;
-    comparator: MalwareComparator;
-};
 /**
- * :malware Pseudo-Selector, matches nodes with malware alerts.
+ * :malware Pseudo-Selector, matches nodes with any malware-related alert.
  *
- * Usage:
- * - :malware - matches malware with severity >= medium (critical, high, medium but not low)
- * - :malware(critical) - matches specific malware kind
- * - :malware(>1) - matches malware with severity greater than 1
- * - :malware(">=medium") - matches malware with severity >= medium
+ * This is a binary selector — no parameters. A node matches if it has
+ * at least one alert whose type is `malware` or `gptMalware`.
  */
 export declare const malware: (state: ParserState) => Promise<ParserState & {
     securityArchive: NonNullable<ParserState["securityArchive"]>;

package/dist/pseudo/malware.js

@@ -1,183 +1,23 @@
 import { error } from '@vltpkg/error-cause';
-import { asPostcssNodeWithChildren, asStringNode, asTagNode, isStringNode, isTagNode, } from '@vltpkg/dss-parser';
-import { assertSecurityArchive, removeDanglingEdges, removeNode, removeQuotes, } from "./helpers.js";
-const kindsMap = new Map([
-    ['critical', 'malware'],
-    ['high', 'gptMalware'],
-    ['medium', 'gptSecurity'],
-    ['low', 'gptAnomaly'],
-    ['0', 'malware'],
-    ['1', 'gptMalware'],
-    ['2', 'gptSecurity'],
-    ['3', 'gptAnomaly'],
-]);
-// Map numerical values to their respective kinds for comparison operations
-const kindLevelMap = new Map([
-    ['critical', 0],
-    ['high', 1],
-    ['medium', 2],
-    ['low', 3],
-    ['0', 0],
-    ['1', 1],
-    ['2', 2],
-    ['3', 3],
-]);
-const kinds = new Set(kindsMap.keys());
-export const isMalwareKind = (value) => kinds.has(value);
-export const asMalwareKind = (value) => {
-    if (!isMalwareKind(value)) {
-        throw error('Expected a valid malware kind', {
-            found: value,
-            validOptions: Array.from(kinds),
-        });
-    }
-    return value;
-};
-export const parseInternals = (nodes) => {
-    // Handle case where no parameters are provided (parameterless :malware)
-    if (!nodes[0]) {
-        return { kind: undefined, comparator: undefined };
-    }
-    const selectorNode = asPostcssNodeWithChildren(nodes[0]);
-    if (!selectorNode.nodes[0]) {
-        return { kind: undefined, comparator: undefined };
-    }
-    let kindValue = '';
-    let comparator = undefined;
-    let kind;
-    // Parse the parameter (kind with optional comparator)
-    if (isStringNode(selectorNode.nodes[0])) {
-        kindValue = removeQuotes(asStringNode(selectorNode.nodes[0]).value);
-    }
-    else if (isTagNode(selectorNode.nodes[0])) {
-        kindValue = asTagNode(selectorNode.nodes[0]).value;
-    }
-    // Extract comparator if present
-    if (kindValue.startsWith('>=')) {
-        comparator = '>=';
-        kindValue = kindValue.substring(2);
-    }
-    else if (kindValue.startsWith('<=')) {
-        comparator = '<=';
-        kindValue = kindValue.substring(2);
-    }
-    else if (kindValue.startsWith('>')) {
-        comparator = '>';
-        kindValue = kindValue.substring(1);
-    }
-    else if (kindValue.startsWith('<')) {
-        comparator = '<';
-        kindValue = kindValue.substring(1);
-    }
-    // Validate the kind without comparator
-    if (!comparator) {
-        kind = asMalwareKind(kindValue);
-    }
-    else {
-        // For comparisons, just make sure it's a valid numeric value or a valid kind
-        if (isMalwareKind(kindValue)) {
-            kind = kindValue;
-        }
-        else {
-            throw error('Expected a valid malware kind or number between 0-3', {
-                found: kindValue,
-            });
-        }
-    }
-    return { kind, comparator };
-};
+import { asPostcssNodeWithChildren } from '@vltpkg/dss-parser';
+import { assertSecurityArchive, removeDanglingEdges, removeNode, } from "./helpers.js";
+const malwareAlertTypes = new Set(['malware', 'gptMalware']);
 /**
- * :malware Pseudo-Selector, matches nodes with malware alerts.
+ * :malware Pseudo-Selector, matches nodes with any malware-related alert.
  *
- * Usage:
- * - :malware - matches malware with severity >= medium (critical, high, medium but not low)
- * - :malware(critical) - matches specific malware kind
- * - :malware(>1) - matches malware with severity greater than 1
- * - :malware(">=medium") - matches malware with severity >= medium
+ * This is a binary selector — no parameters. A node matches if it has
+ * at least one alert whose type is `malware` or `gptMalware`.
  */
 export const malware = async (state) => {
     assertSecurityArchive(state, 'malware');
-    let internals;
-    try {
-        internals = parseInternals(asPostcssNodeWithChildren(state.current).nodes);
-    }
-    catch (err) {
-        throw error('Failed to parse :malware selector', { cause: err });
+    const currentNode = asPostcssNodeWithChildren(state.current);
+    if (currentNode.nodes.length > 0) {
+        throw error(':malware selector does not accept parameters. Use :vuln(<severity>) for severity-based filtering.');
     }
-    const { kind, comparator } = internals;
-    const alertName = comparator ? undefined : kindsMap.get(kind);
     for (const node of state.partial.nodes) {
         const report = state.securityArchive.get(node.id);
-        // Always exclude nodes that don't have security data or alerts
-        if (!report?.alerts || report.alerts.length === 0) {
-            removeNode(state, node);
-        }
-    }
-    for (const node of state.partial.nodes) {
-        const report = state.securityArchive.get(node.id);
-        let exclude = true;
-        if (report) {
-            if (kind === undefined && comparator === undefined) {
-                // Parameterless :malware - match malware alerts with severity >= medium (exclude low/gptAnomaly)
-                exclude = !report.alerts.some(alert => alert.type === 'malware' ||
-                    alert.type === 'gptMalware' ||
-                    alert.type === 'gptSecurity');
-            }
-            else if (comparator) {
-                // retrieve the value to compare against
-                const kindLevel = kindLevelMap.get(kind);
-                // the kindLevel value has already been validated at this point
-                // and thus can never return an undefined/falsy value but ts doesn't
-                // know about that, so we have the extra check here
-                /* c8 ignore next - impossible */
-                if (kindLevel == null)
-                    break;
-                // Check each alert to find any that match our comparison criteria
-                for (const alert of report.alerts) {
-                    // Get the numerical value of the alert type
-                    const alertType = alert.type;
-                    // retrieve a key to the current alert level to be compared against
-                    const currentAlertLevelKey = [...kindsMap.entries()].find(([_, alertValue]) => alertValue === alertType)?.[0];
-                    // perform the comparison based on the user-provided kindLevel
-                    if (currentAlertLevelKey) {
-                        const currentAlertLevel = kindLevelMap.get(currentAlertLevelKey);
-                        /* c8 ignore next - impossible but ts doesn't know */
-                        if (currentAlertLevel == null)
-                            continue;
-                        switch (comparator) {
-                            case '>':
-                                if (currentAlertLevel > kindLevel) {
-                                    exclude = false;
-                                }
-                                break;
-                            case '<':
-                                if (currentAlertLevel < kindLevel) {
-                                    exclude = false;
-                                }
-                                break;
-                            case '>=':
-                                if (currentAlertLevel >= kindLevel) {
-                                    exclude = false;
-                                }
-                                break;
-                            case '<=':
-                                if (currentAlertLevel <= kindLevel) {
-                                    exclude = false;
-                                }
-                                break;
-                        }
-                        // If we've found a match, no need to check other alerts
-                        if (!exclude)
-                            break;
-                    }
-                }
-            }
-            else {
-                // Original exact match behavior
-                exclude = !report.alerts.some(alert => alert.type === alertName);
-            }
-        }
-        if (exclude) {
+        const hasMalware = report?.alerts.some(alert => malwareAlertTypes.has(alert.type));
+        if (!hasMalware) {
             removeNode(state, node);
         }
     }

package/dist/pseudo/vuln.d.ts

@@ -0,0 +1,22 @@
+import type { ParserState } from '../types.ts';
+import type { PostcssNode } from '@vltpkg/dss-parser';
+export type VulnKinds = '0' | '1' | '2' | '3' | 'critical' | 'high' | 'medium' | 'low' | undefined;
+export type VulnComparator = '>' | '<' | '>=' | '<=' | undefined;
+export declare const isVulnKind: (value?: string) => value is VulnKinds;
+export declare const asVulnKind: (value?: string) => VulnKinds;
+export declare const parseInternals: (nodes: PostcssNode[]) => {
+    kind: VulnKinds;
+    comparator: VulnComparator;
+};
+/**
+ * :vuln / :vulnerable Pseudo-Selector, matches nodes with vulnerability alerts.
+ *
+ * Usage:
+ * - :vuln - matches vulnerabilities with severity >= medium (critical, high, medium but not low)
+ * - :vuln(critical) - matches specific vulnerability kind
+ * - :vuln(>1) - matches vulnerabilities with severity greater than 1
+ * - :vuln(">=medium") - matches vulnerabilities with severity >= medium
+ */
+export declare const vuln: (state: ParserState) => Promise<ParserState & {
+    securityArchive: NonNullable<ParserState["securityArchive"]>;
+}>;

package/dist/pseudo/vuln.js

@@ -0,0 +1,220 @@
+import { error } from '@vltpkg/error-cause';
+import { asPostcssNodeWithChildren, asStringNode, asTagNode, isStringNode, isTagNode, } from '@vltpkg/dss-parser';
+import { assertSecurityArchive, removeDanglingEdges, removeNode, removeQuotes, } from "./helpers.js";
+// Valid vulnerability kind names
+const kinds = new Set([
+    'critical',
+    'high',
+    'medium',
+    'low',
+    '0',
+    '1',
+    '2',
+    '3',
+]);
+// Map numerical values to their respective kinds for comparison operations
+const kindLevelMap = new Map([
+    ['critical', 0],
+    ['high', 1],
+    ['medium', 2],
+    ['low', 3],
+    ['0', 0],
+    ['1', 1],
+    ['2', 2],
+    ['3', 3],
+]);
+// Maps alert types to their severity level for comparison operations.
+// gptSecurity maps to medium (2), gptAnomaly maps to low (3).
+const alertLevelMap = new Map([
+    ['criticalCVE', 0],
+    ['cve', 1],
+    ['potentialVulnerability', 2],
+    ['gptSecurity', 2],
+    ['mildCVE', 3],
+    ['gptAnomaly', 3],
+]);
+// Maps alert.severity strings to numeric levels for cveId-bearing alerts
+// whose type may not be in alertLevelMap.
+const severityLevelMap = new Map([
+    ['critical', 0],
+    ['high', 1],
+    ['medium', 2],
+    ['low', 3],
+]);
+/**
+ * Returns the severity level for an alert, considering both its type
+ * (via alertLevelMap) and its cveId + severity fields. Alerts with a
+ * cveId are treated as vulnerability alerts even if their type is not
+ * in the closed set.
+ */
+const getAlertLevel = (alert) => {
+    const level = alertLevelMap.get(alert.type);
+    if (level != null)
+        return level;
+    // Fall back to severity field for alerts carrying a CVE id
+    if (alert.props?.cveId && alert.severity) {
+        return severityLevelMap.get(alert.severity);
+    }
+    return undefined;
+};
+export const isVulnKind = (value) => kinds.has(value);
+export const asVulnKind = (value) => {
+    if (!isVulnKind(value)) {
+        throw error('Expected a valid vuln kind', {
+            found: value,
+            validOptions: Array.from(kinds),
+        });
+    }
+    return value;
+};
+export const parseInternals = (nodes) => {
+    // Handle case where no parameters are provided (parameterless :vuln)
+    if (!nodes[0]) {
+        return { kind: undefined, comparator: undefined };
+    }
+    const selectorNode = asPostcssNodeWithChildren(nodes[0]);
+    if (!selectorNode.nodes[0]) {
+        return { kind: undefined, comparator: undefined };
+    }
+    let kindValue = '';
+    let comparator = undefined;
+    let kind;
+    // Parse the parameter (kind with optional comparator)
+    if (isStringNode(selectorNode.nodes[0])) {
+        kindValue = removeQuotes(asStringNode(selectorNode.nodes[0]).value);
+    }
+    else if (isTagNode(selectorNode.nodes[0])) {
+        kindValue = asTagNode(selectorNode.nodes[0]).value;
+    }
+    // Extract comparator if present
+    if (kindValue.startsWith('>=')) {
+        comparator = '>=';
+        kindValue = kindValue.substring(2);
+    }
+    else if (kindValue.startsWith('<=')) {
+        comparator = '<=';
+        kindValue = kindValue.substring(2);
+    }
+    else if (kindValue.startsWith('>')) {
+        comparator = '>';
+        kindValue = kindValue.substring(1);
+    }
+    else if (kindValue.startsWith('<')) {
+        comparator = '<';
+        kindValue = kindValue.substring(1);
+    }
+    // Validate the kind without comparator
+    if (!comparator) {
+        kind = asVulnKind(kindValue);
+    }
+    else {
+        // For comparisons, just make sure it's a valid numeric value or a valid kind
+        if (isVulnKind(kindValue)) {
+            kind = kindValue;
+        }
+        else {
+            throw error('Expected a valid vuln kind or number between 0-3', {
+                found: kindValue,
+            });
+        }
+    }
+    return { kind, comparator };
+};
+/**
+ * :vuln / :vulnerable Pseudo-Selector, matches nodes with vulnerability alerts.
+ *
+ * Usage:
+ * - :vuln - matches vulnerabilities with severity >= medium (critical, high, medium but not low)
+ * - :vuln(critical) - matches specific vulnerability kind
+ * - :vuln(>1) - matches vulnerabilities with severity greater than 1
+ * - :vuln(">=medium") - matches vulnerabilities with severity >= medium
+ */
+export const vuln = async (state) => {
+    assertSecurityArchive(state, 'vuln');
+    let internals;
+    try {
+        internals = parseInternals(asPostcssNodeWithChildren(state.current).nodes);
+    }
+    catch (err) {
+        throw error('Failed to parse :vuln selector', { cause: err });
+    }
+    const { kind, comparator } = internals;
+    for (const node of state.partial.nodes) {
+        const report = state.securityArchive.get(node.id);
+        // Always exclude nodes that don't have security data or alerts
+        if (!report?.alerts || report.alerts.length === 0) {
+            removeNode(state, node);
+        }
+    }
+    for (const node of state.partial.nodes) {
+        const report = state.securityArchive.get(node.id);
+        let exclude = true;
+        if (report) {
+            if (kind === undefined && comparator === undefined) {
+                // Parameterless :vuln - match vuln alerts with severity >= medium
+                // Includes: criticalCVE, cve, potentialVulnerability, gptSecurity,
+                //           and any alert carrying a cveId prop
+                // Excludes: mildCVE, gptAnomaly (low severity)
+                exclude = !report.alerts.some(alert => {
+                    const level = getAlertLevel(alert);
+                    return level != null && level <= 2;
+                });
+            }
+            else if (comparator) {
+                // retrieve the value to compare against
+                const kindLevel = kindLevelMap.get(kind);
+                // the kindLevel value has already been validated at this point
+                // and thus can never return an undefined/falsy value but ts doesn't
+                // know about that, so we have the extra check here
+                /* c8 ignore next - impossible */
+                if (kindLevel == null)
+                    break;
+                // Check each alert to find any that match our comparison criteria
+                for (const alert of report.alerts) {
+                    const currentAlertLevel = getAlertLevel(alert);
+                    if (currentAlertLevel == null)
+                        continue;
+                    switch (comparator) {
+                        case '>':
+                            if (currentAlertLevel > kindLevel) {
+                                exclude = false;
+                            }
+                            break;
+                        case '<':
+                            if (currentAlertLevel < kindLevel) {
+                                exclude = false;
+                            }
+                            break;
+                        case '>=':
+                            if (currentAlertLevel >= kindLevel) {
+                                exclude = false;
+                            }
+                            break;
+                        case '<=':
+                            if (currentAlertLevel <= kindLevel) {
+                                exclude = false;
+                            }
+                            break;
+                    }
+                    // If we've found a match, no need to check other alerts
+                    if (!exclude)
+                        break;
+                }
+            }
+            else {
+                // Exact match behavior — also matches gptSecurity/gptAnomaly
+                // at the same level as their mapped kind, and cveId-bearing alerts
+                const targetLevel = kindLevelMap.get(kind);
+                exclude = !report.alerts.some(alert => {
+                    const level = getAlertLevel(alert);
+                    return level != null && level === targetLevel;
+                });
+            }
+        }
+        if (exclude) {
+            removeNode(state, node);
+        }
+    }
+    removeDanglingEdges(state);
+    return state;
+};

package/dist/pseudo.js

@@ -58,7 +58,7 @@ import { unknown } from "./pseudo/unknown.js";
 import { unmaintained } from "./pseudo/unmaintained.js";
 import { unpopular } from "./pseudo/unpopular.js";
 import { unstable } from "./pseudo/unstable.js";
-import { vulnerable } from "./pseudo/vulnerable.js";
+import { vuln } from "./pseudo/vuln.js";
 import { workspace } from "./pseudo/workspace.js";
 /**
  * :has Pseudo-Selector, matches only nodes that have valid results
@@ -341,8 +341,8 @@ const pseudoSelectors = new Map(Object.entries({
     unpopular,
     unstable,
     v: semver,
-    vuln: vulnerable,
-    vulnerable,
+    vuln,
+    vulnerable: vuln,
     workspace,
 }));
 /**

package/dist/types.d.ts

@@ -75,7 +75,7 @@ export type Insights = {
     eval?: boolean;
     fs?: boolean;
     license?: LicenseInsights;
-    malware?: MalwareInsights;
+    malware?: boolean;
     minified?: boolean;
     native?: boolean;
     network?: boolean;
@@ -95,6 +95,7 @@ export type Insights = {
     unmaintained?: boolean;
     unpopular?: boolean;
     unstable?: boolean;
+    vuln?: VulnInsights;
 };
 export type LicenseInsights = {
     unlicensed: boolean;
@@ -112,8 +113,8 @@ export type LeveledInsights = {
     high: boolean;
     critical: boolean;
 };
-export type MalwareInsights = LeveledInsights;
 export type SeverityInsights = LeveledInsights;
+export type VulnInsights = LeveledInsights;
 export type SquatInsights = {
     medium: boolean;
     critical: boolean;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@vltpkg/query",
   "description": "Query syntax parser that retrieves items from a graph",
-  "version": "1.0.0-rc.33",
+  "version": "1.0.0-rc.34",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/vltpkg/vltpkg.git",
@@ -13,12 +13,12 @@
     "url": "http://vlt.sh"
   },
   "dependencies": {
-    "@vltpkg/dep-id": "1.0.0-rc.33",
-    "@vltpkg/dss-parser": "1.0.0-rc.33",
-    "@vltpkg/error-cause": "1.0.0-rc.33",
-    "@vltpkg/security-archive": "1.0.0-rc.33",
-    "@vltpkg/semver": "1.0.0-rc.33",
-    "@vltpkg/types": "1.0.0-rc.33",
+    "@vltpkg/dep-id": "1.0.0-rc.34",
+    "@vltpkg/dss-parser": "1.0.0-rc.34",
+    "@vltpkg/error-cause": "1.0.0-rc.34",
+    "@vltpkg/security-archive": "1.0.0-rc.34",
+    "@vltpkg/semver": "1.0.0-rc.34",
+    "@vltpkg/types": "1.0.0-rc.34",
     "minimatch": "^10.1.1",
     "p-retry": "^7.1.1",
     "postcss-selector-parser": "^7.1.1"
@@ -26,7 +26,7 @@
   "devDependencies": {
     "@eslint/js": "^9.39.1",
     "@types/node": "^22.19.2",
-    "@vltpkg/spec": "1.0.0-rc.33",
+    "@vltpkg/spec": "1.0.0-rc.34",
     "eslint": "^9.39.1",
     "prettier": "^3.7.4",
     "tap": "^21.5.0",

package/skills/dss-query/REFERENCE.md

@@ -88,10 +88,14 @@ Package properties:
 Severity args accept names or numbers (`critical`/`0`, `high`/`1`,
 `medium`/`2`, `low`/`3`) and comparators: `:severity(">=medium")`.
 
-Threats: `:malware(sev?)`, `:squat(sev?)`, `:suspicious`, `:confused`.
+Threats: `:malware` (binary, no params), `:squat(sev?)`,
+`:suspicious`, `:confused`.
 
-Vulnerabilities: `:vulnerable` (alias `:vuln`), `:cve(CVE-2023-1234)`,
-`:cve(*)`, `:cwe(CWE-79)`, `:severity(level)`.
+Vulnerabilities: `:vuln(sev?)` (alias `:vulnerable`),
+`:cve(CVE-2023-1234)`, `:cve(*)`, `:cwe(CWE-79)`, `:severity(level)`.
+`:vuln` without params matches severity ≥ medium; `:vuln(critical)`
+exact-matches; `:vuln(">=high")` uses comparators. Also matches alerts
+carrying a `cveId` prop.
 
 Licensing: `:license(type)` — types: `unlicensed`, `misc`,
 `restricted`, `ambiguous`, `copyleft`, `unknown`, `none`, `exception`.
@@ -112,7 +116,7 @@ kinds: `overall` (default), `license`, `maintenance`, `quality`,
 ## Audit query starters
 
 ```bash
-vlt query ':malware(critical), :cve(*), :obfuscated'   # critical issues
+vlt query ':malware, :vuln(critical), :cve(*), :obfuscated'   # critical issues
 vlt query ':abandoned, :unmaintained, :unknown'        # supply chain risk
 vlt query ':license(copyleft), :license(unlicensed)'   # license compliance
 vlt query ':eval, :shell, :network, :fs'               # behavior audit

package/skills/dss-query/SKILL.md

@@ -143,17 +143,17 @@ so the dependency graph doubles as a security scanner. Selectors group
 into four families — compose them with anchors and combinators like
 any other filter:
 
-| Family          | Selectors                                                                   | Ask                            |
-| --------------- | --------------------------------------------------------------------------- | ------------------------------ |
-| Threats         | `:malware(critical)` `:squat` `:obfuscated` `:suspicious`                   | is anything actively hostile?  |
-| Vulnerabilities | `:cve(CVE-…)` `:cve(*)` `:cwe(CWE-79)` `:severity(">=medium")`              | known CVEs, filter by severity |
-| Capabilities    | `:eval` `:network` `:fs` `:shell` `:env`                                    | what _can_ this code do?       |
-| Hygiene         | `:abandoned` `:unmaintained` `:deprecated` `:score("<=0.5", "maintenance")` | will this rot on us?           |
+| Family          | Selectors                                                                        | Ask                                    |
+| --------------- | -------------------------------------------------------------------------------- | -------------------------------------- |
+| Threats         | `:malware` `:squat` `:obfuscated` `:suspicious`                                  | is anything actively hostile?          |
+| Vulnerabilities | `:vuln(critical)` `:cve(CVE-…)` `:cve(*)` `:cwe(CWE-79)` `:severity(">=medium")` | known CVEs / vulns, filter by severity |
+| Capabilities    | `:eval` `:network` `:fs` `:shell` `:env`                                         | what _can_ this code do?               |
+| Hygiene         | `:abandoned` `:unmaintained` `:deprecated` `:score("<=0.5", "maintenance")`      | will this rot on us?                   |
 
 Audit recipes:
 
 ```bash
-vlt query ':malware(critical), :squat, :obfuscated'   # supply-chain sweep
+vlt query ':malware, :vuln(critical), :squat, :obfuscated'   # supply-chain sweep
 vlt query ':workspace > :prod:severity(">=high")'     # release blockers
 vlt query ':dev:shell, :dev:network'                  # dev deps that spawn/phone home
 ```