fullshield 0.1.3 → 0.3.0

package/dist/supply.js

@@ -168,14 +168,24 @@ function checkLockfileIntegrity(lock) {
     if (name === "") continue;
     const resolved = entry.resolved;
     if (!resolved) continue;
+    if (entry.integrity === void 0 || entry.integrity.length === 0) {
+      findings.push(
+        finding(
+          "SUPPLY-LOCKINTEGRITY-001",
+          "Lockfile entry has no integrity hash",
+          `${name} resolved without an integrity hash`,
+          "package-lock.json"
+        )
+      );
+    }
     try {
-      const host = new URL(resolved).hostname;
-      if (host !== REGISTRY_HOST) {
+      const url = new URL(resolved);
+      if (url.protocol !== "https:" || url.hostname !== REGISTRY_HOST) {
         findings.push(
           finding(
             "SUPPLY-LOCKURL-001",
             "Lockfile entry resolves from a non-npm registry host",
-            `${name} resolved host ${host}`,
+            `${name} resolved host ${url.hostname || resolved}`,
             "package-lock.json"
           )
         );

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullshield",
-  "version": "0.1.3",
+  "version": "0.3.0",
   "description": "Full-cycle security scanner for Node.js/TypeScript backends: detect, classify, report, notify, fix, prevent.",
   "license": "MIT",
   "type": "module",
@@ -9,7 +9,7 @@
     "url": "git+https://github.com/kathanp/fullshield.git"
   },
   "engines": {
-    "node": ">=22.13"
+    "node": ">=20.11"
   },
   "bin": {
     "fullshield": "dist/cli/index.js"

package/rules/SAST-SKIP-001.md

@@ -0,0 +1,9 @@
+# SAST-SKIP-001
+
+**A source file was not parsed.** Severity info.
+
+The file is larger than `sast.maxFileBytes` (default 1 MB) or it contains NUL bytes. This is a skip notice, not a vulnerability.
+
+## Remediation
+
+Raise `sast.maxFileBytes` in `fullshield.config.json` when the file should be parsed. Generated and vendored trees are excluded before this check.