fullshield 0.3.0 → 0.4.0

package/dist/vex.js

@@ -49,14 +49,16 @@ function openVexStatement(finding) {
     vulnerability: { name: vulnName(finding) },
     products: [{ "@id": npmPurl(finding.snippet) }]
   };
+  const detail = process.env.FULLSHIELD_EXPERIMENTAL_SBOM_REACH === "1" && finding.reachabilityEvidence?.reason !== void 0 ? { detail: finding.reachabilityEvidence.reason } : {};
   if (notImported(finding)) {
     return {
       ...base,
       status: "not_affected",
-      justification: OPENVEX_NOT_AFFECTED_JUSTIFICATION
+      justification: OPENVEX_NOT_AFFECTED_JUSTIFICATION,
+      ...detail
     };
   }
-  return { ...base, status: "under_investigation" };
+  return { ...base, status: "under_investigation", ...detail };
 }
 function buildOpenVex(findings) {
   const statements = depFindings(findings).map(openVexStatement);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullshield",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Full-cycle security scanner for Node.js/TypeScript backends: detect, classify, report, notify, fix, prevent.",
   "license": "MIT",
   "type": "module",
@@ -9,7 +9,7 @@
     "url": "git+https://github.com/kathanp/fullshield.git"
   },
   "engines": {
-    "node": ">=20.11"
+    "node": ">=22.13"
   },
   "bin": {
     "fullshield": "dist/cli/index.js"

package/rules/README.md

@@ -1,5 +1,7 @@
 # FullShield rules
 
+New work is `SECURITY_SCANNER_SPEC.md` Section 32. These pages describe rules that already exist. They are not the Phase 46–59 designs.
+
 Each Core rule has a positive fixture in `test/fixtures/vulnerable-app` and a
 negative counterpart in `test/fixtures/clean-app`.
 

package/rules/SUPPLY-CHAINC2-001.md

@@ -0,0 +1,3 @@
+# SUPPLY-CHAINC2-001
+
+A package file names a public blockchain RPC method (`getSignaturesForAddress` or `eth_getLogs`) and also fetches or evaluates a value. Either signal alone is not a finding. Experimental: `FULLSHIELD_EXPERIMENTAL_SUPPLY=1`. Static only. Fixtures use `example.invalid`.

package/rules/SUPPLY-PLATFORMGATE-001.md

@@ -0,0 +1,3 @@
+# SUPPLY-PLATFORMGATE-001
+
+A `process.platform === 'win32'` or `os.platform()` check, a download, and a process spawn or executable write all appear in the same file. One of those signals alone is not a finding. Experimental: `FULLSHIELD_EXPERIMENTAL_SUPPLY=1`. Fixtures use `example.invalid`.

package/rules/SUPPLY-SECHOLDER-001.md

@@ -0,0 +1,3 @@
+# SUPPLY-SECHOLDER-001
+
+The registry `latest` dist-tag for a locked package is npm's removed-for-security placeholder `0.0.1-security`, and the locked version is not that placeholder. Missing registry data produces no finding. `--offline` reads the cache only. Critical. Not downgraded by reachability. Remove the package, delete `node_modules`, reinstall from a clean lockfile, and rotate credentials the machine could read.

package/rules/SUPPLY-STEALER-001.md

@@ -0,0 +1,3 @@
+# SUPPLY-STEALER-001
+
+A package file names a browser, Discord, or wallet store path and also makes a network call. A path alone, or a network call alone, is not a finding. Experimental: `FULLSHIELD_EXPERIMENTAL_SUPPLY=1`. Critical. Not downgraded by reachability.