cognium-dev 3.146.0 → 3.147.0

package/dist/cli.js

@@ -12318,6 +12318,38 @@ function isSafeGoExecCommandCall(call, pattern, language) {
   ]);
   if (SHELL_PROGRAMS.has(program))
     return false;
+  const PACKAGE_MANAGER_EXEC_SUBCOMMANDS = {
+    go: new Set(["install", "run", "get"]),
+    npm: new Set(["install", "i", "exec"]),
+    npx: new Set(["*"]),
+    pip: new Set(["install"]),
+    pip3: new Set(["install"]),
+    gem: new Set(["install"]),
+    cargo: new Set(["install", "run"]),
+    yarn: new Set(["add", "install", "exec", "dlx"]),
+    pnpm: new Set(["add", "install", "exec", "dlx"])
+  };
+  const pmSubcommands = PACKAGE_MANAGER_EXEC_SUBCOMMANDS[program];
+  if (pmSubcommands !== undefined) {
+    const subcommandArgPos = pattern.method === "CommandContext" ? 2 : 1;
+    const subcommandArg = call.arguments.find((a) => a.position === subcommandArgPos);
+    if (!subcommandArg)
+      return false;
+    let subcommand;
+    if (subcommandArg.literal !== null && subcommandArg.literal !== undefined) {
+      subcommand = String(subcommandArg.literal);
+    } else {
+      const expr = (subcommandArg.expression ?? "").trim();
+      if (expr.startsWith('"') || expr.startsWith("`") || expr.startsWith("'")) {
+        subcommand = expr.slice(1, -1);
+      }
+    }
+    if (subcommand === undefined)
+      return false;
+    if (pmSubcommands.has("*") || pmSubcommands.has(subcommand)) {
+      return false;
+    }
+  }
   return true;
 }
 function isSafeJSChildProcessCall(call, pattern, language) {
@@ -42230,7 +42262,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.146.0";
+var version = "3.147.0";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.146.0",
+  "version": "3.147.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "^1.1.0",
-    "circle-ir": "^3.146.0"
+    "circle-ir": "^3.147.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",