fullshield 1.0.1 → 1.2.0

package/rules/DEPS-OVERRIDE-WIDE-001.md

@@ -0,0 +1,11 @@
+# DEPS-OVERRIDE-WIDE-001
+
+**Override value has no upper bound.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_OVERRIDE_WIDE=1`). CWE-829. Severity medium.
+
+An override value is `*`, `latest`, or a `>=` / `>` range with no `<` upper bound. An exact version and a `^` range are not this finding.
+
+## Remediation
+
+Pin the override to an exact version or a caret range.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 134.

package/rules/DEPS-PACKAGEMANAGER-001.md

@@ -0,0 +1,13 @@
+# DEPS-PACKAGEMANAGER-001
+
+**packageManager is missing while a lockfile exists.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_PACKAGEMANAGER=1`). CWE-1104. Severity low.
+
+`package.json` has no `packageManager` field and a lockfile is present (`package-lock.json`, `npm-shrinkwrap.json`, `yarn.lock`, `pnpm-lock.yaml`, or `bun.lock`).
+
+Narrowed for R12: a package with `"private": true` whose every direct dependency spec is a caret range (`^MAJOR.MINOR.PATCH`) is not this finding. A public package, a private package with no direct specs, and a private package with any non-caret direct spec still match when the field is missing and a lockfile exists.
+
+## Remediation
+
+Set packageManager to the lockfile manager at an exact version, for example npm@10.9.2.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 140.

package/rules/DEPS-PACKAGEMANAGER-002.md

@@ -0,0 +1,11 @@
+# DEPS-PACKAGEMANAGER-002
+
+**packageManager is not name@exact or does not match the lockfile.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_PACKAGEMANAGER=1`). CWE-1104. Severity medium.
+
+`packageManager` is present and is not `<name>@<exact semver>` for `npm`, `pnpm`, `yarn`, or `bun`, or the name does not match the lockfile that is present (`package-lock.json` and `npm-shrinkwrap.json` are `npm`, `yarn.lock` is `yarn`, `pnpm-lock.yaml` is `pnpm`, `bun.lock` is `bun`). `npm@10.9.2` next to `package-lock.json` is not this finding. A `+sha512.` suffix does not by itself make the field invalid.
+
+## Remediation
+
+Set packageManager to the lockfile manager at an exact version, such as npm@10.9.2.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 140.

package/rules/DEPS-PEER-MISSING-001.md

@@ -0,0 +1,11 @@
+# DEPS-PEER-MISSING-001
+
+**Non-optional peer missing from the lock.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_GRAPH_PEER=1`). CWE-829. Severity medium.
+
+A `peerDependencies` entry is not optional in `peerDependenciesMeta` and no copy of that package is in the lock. An optional peer is not a finding, whether or not it is installed. A peer that is present is not a finding. This does not change `DEPS-PEER-UNDECLARED-001`.
+
+## Remediation
+
+Add the peer to the root dependencies so the lock installs it, or declare the peer optional.
+
+See `SECURITY_SCANNER_SPEC.md` Phase 230.

package/rules/DEPS-PEER-UNDECLARED-001.md

@@ -0,0 +1,11 @@
+# DEPS-PEER-UNDECLARED-001
+
+**Production code imports an undeclared peer.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_PEER=1`). CWE-829. Severity medium.
+
+Production code imports a package the lock marks peer: true and the root peerDependencies does not name it. A declared peer, or an import that exists only in a test file, is not a finding.
+
+## Remediation
+
+Add the package to peerDependencies, or remove the import.
+
+See `SECURITY_SCANNER_SPEC.md` phase 123.

package/rules/DEPS-PHANTOM-002.md

@@ -0,0 +1,11 @@
+# DEPS-PHANTOM-002
+
+**Undeclared dynamic import.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_PHANTOM_DEEP=1`). CWE-829. Severity medium.
+
+A literal `import()`, `require.resolve`, or `createRequire(...)()` names a package that is not in `dependencies`, `devDependencies`, `optionalDependencies`, or `peerDependencies`. A declared name is not a finding. A non-literal argument is not a finding. Node built-ins and relative specifiers are not packages. This does not change `DEPS-PHANTOM-001`.
+
+## Remediation
+
+Add the package to `package.json`, or remove the dynamic import.
+
+See `SECURITY_SCANNER_SPEC.md` Phase 242.

package/rules/DEPS-PUBLISHCONFIG-001.md

@@ -0,0 +1,11 @@
+# DEPS-PUBLISHCONFIG-001
+
+**publishConfig.registry is not the npm registry.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_PUBLISHCONFIG=1`). CWE-494. Severity high.
+
+`private` is not `true` and `publishConfig.registry` is an `http:` or `https:` URL whose host is not `registry.npmjs.org`. A public package whose publishConfig registry is the npm registry is not this finding.
+
+## Remediation
+
+Publish to registry.npmjs.org, or set private to true.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 145.

package/rules/DEPS-PUBLISHCONFIG-002.md

@@ -0,0 +1,11 @@
+# DEPS-PUBLISHCONFIG-002
+
+**Private package sets publishConfig.access to public.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_PUBLISHCONFIG=1`). CWE-668. Severity medium.
+
+`private` is `true` and `publishConfig.access` is `public`. A private package with no publishConfig is not this finding.
+
+## Remediation
+
+Remove publishConfig.access or set it to restricted.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 145.

package/rules/DEPS-REG-AGE-001.md

@@ -0,0 +1,11 @@
+# DEPS-REG-AGE-001
+
+**Transitive production release is inside the age window.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_REG_TRANSITIVE_AGE=1`). CWE-1104. Severity low.
+
+A transitive production package time[version] is younger than deps.minReleaseAgeHours (default 72). Direct dependencies are not reported here. Missing time is not a finding. FullShield reads the registry cache only and does not contact the network.
+
+## Remediation
+
+Compare the lock with the cached packument and decide whether to keep the dependency. FullShield does not name a replacement package and does not rewrite the lock.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 159.

package/rules/DEPS-REG-BIN-001.md

@@ -0,0 +1,11 @@
+# DEPS-REG-BIN-001
+
+**Packument bin path escapes the package.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_REG_BIN=1`). CWE-22. Severity high.
+
+A bin target contains a .. segment, is absolute, or contains a backslash parent segment. bin/cli.js is not a finding. This is the path, not a name collision. FullShield reads the registry cache only and does not contact the network.
+
+## Remediation
+
+Compare the lock with the cached packument and decide whether to keep the dependency. FullShield does not name a replacement package and does not rewrite the lock.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 166.

package/rules/DEPS-REG-BUILDER-001.md

@@ -0,0 +1,11 @@
+# DEPS-REG-BUILDER-001
+
+**Attestation builder is not in the allowlist.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_REG_BUILDER=1`). CWE-494. Severity medium.
+
+dist.attestations is present and a builder identity read from that object is not in models/npm-builders.json. No attestation is not this finding. The allowlist is not downloaded. FullShield reads the registry cache only and does not contact the network.
+
+## Remediation
+
+Compare the lock with the cached packument and decide whether to keep the dependency. FullShield does not name a replacement package and does not rewrite the lock.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 155.

package/rules/DEPS-REG-DEPRECATED-001.md

@@ -0,0 +1,11 @@
+# DEPS-REG-DEPRECATED-001
+
+**Registry deprecation is missing from the lock.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_REG_DEPRECATED=1`). CWE-1104. Severity info.
+
+The packument version has a non-empty deprecated string and the lock entry does not. The same string on the lock stays DEPS-DEPRECATED-001 only. FullShield reads the registry cache only and does not contact the network.
+
+## Remediation
+
+Compare the lock with the cached packument and decide whether to keep the dependency. FullShield does not name a replacement package and does not rewrite the lock.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 150.

package/rules/DEPS-REG-DEPS-001.md

@@ -0,0 +1,11 @@
+# DEPS-REG-DEPS-001
+
+**Locked dependency misses the packument range.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_REG_DEPS=1`). CWE-1104. Severity medium.
+
+versions[version].dependencies[name] is a range the semver helper understands and the locked version of name does not satisfy it. An unparseable range is not a finding. The lock is not rewritten. FullShield reads the registry cache only and does not contact the network.
+
+## Remediation
+
+Compare the lock with the cached packument and decide whether to keep the dependency. FullShield does not name a replacement package and does not rewrite the lock.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 164.

package/rules/DEPS-REG-DRIFT-001.md

@@ -0,0 +1,11 @@
+# DEPS-REG-DRIFT-001
+
+**A newer packument version satisfies the manifest range.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_REG_DRIFT=1`). CWE-1104. Severity info.
+
+The manifest range parses, a greater packument version satisfies it, and the locked version is smaller. This is drift, not an advisory. The named version is a packument key. FullShield reads the registry cache only and does not contact the network.
+
+## Remediation
+
+Compare the lock with the cached packument and decide whether to keep the dependency. FullShield does not name a replacement package and does not rewrite the lock.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 163.

package/rules/DEPS-REG-ENGINES-001.md

@@ -0,0 +1,11 @@
+# DEPS-REG-ENGINES-001
+
+**Dependency engines do not intersect the project.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_REG_ENGINES=1`). CWE-1104. Severity medium.
+
+Project engines.node and the locked version engines.node both parse and do not overlap. An unparseable range is not a finding. FullShield reads the registry cache only and does not contact the network.
+
+## Remediation
+
+Compare the lock with the cached packument and decide whether to keep the dependency. FullShield does not name a replacement package and does not rewrite the lock.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 162.

package/rules/DEPS-REG-INSTALLSCRIPT-001.md

@@ -0,0 +1,11 @@
+# DEPS-REG-INSTALLSCRIPT-001
+
+**Packument lists an install script.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_REG_INSTALLSCRIPT=1`). CWE-829. Severity info.
+
+hasInstallScript is true or the version scripts include preinstall, install, or postinstall. One row per package version. Script bodies are out of scope. FullShield reads the registry cache only and does not contact the network.
+
+## Remediation
+
+Compare the lock with the cached packument and decide whether to keep the dependency. FullShield does not name a replacement package and does not rewrite the lock.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 160.

package/rules/DEPS-REG-INTEGRITY-001.md

@@ -0,0 +1,11 @@
+# DEPS-REG-INTEGRITY-001
+
+**Lock integrity differs from the registry packument.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_REG_INTEGRITY=1`). CWE-353. Severity critical.
+
+Both the lock integrity and versions[version].dist.integrity are present and not equal. A missing value on either side is not a finding. FullShield reads the registry cache only and does not contact the network.
+
+## Remediation
+
+Compare the lock with the cached packument and decide whether to keep the dependency. FullShield does not name a replacement package and does not rewrite the lock.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 148.

package/rules/DEPS-REG-MAINTAINER-001.md

@@ -0,0 +1,11 @@
+# DEPS-REG-MAINTAINER-001
+
+**Maintainer set changed since the previous cache.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_REG_MAINTAINER=1`). CWE-829. Severity medium.
+
+previous.maintainers differs from the sorted maintainers[].name set. The first cache sight emits nothing. This is not SUPPLY-PROVENANCE-001. FullShield reads the registry cache only and does not contact the network.
+
+## Remediation
+
+Compare the lock with the cached packument and decide whether to keep the dependency. FullShield does not name a replacement package and does not rewrite the lock.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 153.

package/rules/DEPS-REG-NPMUSER-001.md

@@ -0,0 +1,11 @@
+# DEPS-REG-NPMUSER-001
+
+**Publisher is not a maintainer.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_REG_NPMUSER=1`). CWE-829. Severity medium.
+
+_npmUser.name is a non-empty string, maintainers is a non-empty array, and the name is not in it. A missing _npmUser is not a finding. FullShield reads the registry cache only and does not contact the network.
+
+## Remediation
+
+Compare the lock with the cached packument and decide whether to keep the dependency. FullShield does not name a replacement package and does not rewrite the lock.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 152.

package/rules/DEPS-REG-PEER-001.md

@@ -0,0 +1,11 @@
+# DEPS-REG-PEER-001
+
+**Packument peer is absent from the lock.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_REG_PEER=1`). CWE-829. Severity medium.
+
+peerDependencies names a package that is not in the lock, unless peerDependenciesMeta marks it optional. FullShield reads the registry cache only and does not contact the network.
+
+## Remediation
+
+Compare the lock with the cached packument and decide whether to keep the dependency. FullShield does not name a replacement package and does not rewrite the lock.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 165.

package/rules/DEPS-REG-PROV-ABSENT-001.md

@@ -0,0 +1,11 @@
+# DEPS-REG-PROV-ABSENT-001
+
+**Direct production dependency has no attestation.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_REG_PROV_ABSENT=1`). CWE-494. Severity info.
+
+A direct production version has no dist.attestations and no dist.signatures. This is not a malicious-package claim and does not replace SUPPLY-PROV-001. A cache miss emits nothing. FullShield reads the registry cache only and does not contact the network.
+
+## Remediation
+
+Compare the lock with the cached packument and decide whether to keep the dependency. FullShield does not name a replacement package and does not rewrite the lock.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 154.

package/rules/DEPS-REG-REPO-001.md

@@ -0,0 +1,11 @@
+# DEPS-REG-REPO-001
+
+**Attested source repository changed.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_REG_REPO=1`). CWE-829. Severity medium.
+
+The previous cache recorded an attested source repo and the current attestation names a different repo. First sight and a missing attestation emit nothing. FullShield reads the registry cache only and does not contact the network.
+
+## Remediation
+
+Compare the lock with the cached packument and decide whether to keep the dependency. FullShield does not name a replacement package and does not rewrite the lock.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 156.

package/rules/DEPS-REG-REPOSITORY-001.md

@@ -0,0 +1,11 @@
+# DEPS-REG-REPOSITORY-001
+
+**Package repository host changed.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_REG_REPOSITORY=1`). CWE-829. Severity info.
+
+A previous cache had a repository host and the current packument host differs, or the repository field disappeared. First sight emits nothing. The repository is not fetched. FullShield reads the registry cache only and does not contact the network.
+
+## Remediation
+
+Compare the lock with the cached packument and decide whether to keep the dependency. FullShield does not name a replacement package and does not rewrite the lock.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 167.

package/rules/DEPS-REG-SIGNATURES-001.md

@@ -0,0 +1,11 @@
+# DEPS-REG-SIGNATURES-001
+
+**Registry signatures are an empty array.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_REG_SIGNATURES=1`). CWE-345. Severity info.
+
+dist.signatures is present and empty. A non-empty array, or a version with no signatures key, is not a finding. FullShield reads the registry cache only and does not contact the network.
+
+## Remediation
+
+Compare the lock with the cached packument and decide whether to keep the dependency. FullShield does not name a replacement package and does not rewrite the lock.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 161.

package/rules/DEPS-REG-SUBJECT-001.md

@@ -0,0 +1,11 @@
+# DEPS-REG-SUBJECT-001
+
+**Attestation subject version is not the locked version.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_REG_SUBJECT=1`). CWE-345. Severity high.
+
+An attestation subject version is present and it is not the locked version. No subject field is not a finding. FullShield reads the registry cache only and does not contact the network.
+
+## Remediation
+
+Compare the lock with the cached packument and decide whether to keep the dependency. FullShield does not name a replacement package and does not rewrite the lock.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 157.

package/rules/DEPS-REG-TARBALL-001.md

@@ -0,0 +1,11 @@
+# DEPS-REG-TARBALL-001
+
+**Lock tarball URL differs from the registry.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_REG_TARBALL=1`). CWE-494. Severity high.
+
+Both URLs are present, both hosts are registry.npmjs.org, and the URLs differ once the query string is removed. A non-registry lock URL is left to Phase 114. FullShield reads the registry cache only and does not contact the network.
+
+## Remediation
+
+Compare the lock with the cached packument and decide whether to keep the dependency. FullShield does not name a replacement package and does not rewrite the lock.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 149.

package/rules/DEPS-REG-TIME-001.md

@@ -0,0 +1,11 @@
+# DEPS-REG-TIME-001
+
+**Packument time is missing, unparseable, or in the future.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_REG_TIME=1`). CWE-345. Severity medium.
+
+time[version] is missing, does not parse, or is after the scan clock. A past timestamp, including a young one, is not this finding. FullShield reads the registry cache only and does not contact the network.
+
+## Remediation
+
+Compare the lock with the cached packument and decide whether to keep the dependency. FullShield does not name a replacement package and does not rewrite the lock.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 158.

package/rules/DEPS-REG-UNPUBLISHED-001.md

@@ -0,0 +1,11 @@
+# DEPS-REG-UNPUBLISHED-001
+
+**Locked version is absent from the packument.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_REG_UNPUBLISHED=1`). CWE-829. Severity critical.
+
+The cached packument has a versions object and does not list the locked version. A missing cache file is not unpublished. FullShield reads the registry cache only and does not contact the network.
+
+## Remediation
+
+Compare the lock with the cached packument and decide whether to keep the dependency. FullShield does not name a replacement package and does not rewrite the lock.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 151.

package/rules/DEPS-REPEAT-001.md

@@ -0,0 +1,11 @@
+# DEPS-REPEAT-001
+
+**Direct dependency repeats a popular package basename.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_REPEAT=1`). CWE-494. Severity medium.
+
+The name is `foo-foo` or `@foo/foo` and `foo` is a popular package basename. The basename itself, and a name at Levenshtein distance 1 from a popular package, are not findings.
+
+## Remediation
+
+Confirm you intended this repeated name.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 213.

package/rules/DEPS-RESOLVED-HOST-001.md

@@ -0,0 +1,11 @@
+# DEPS-RESOLVED-HOST-001
+
+**Tarball host is not the npm registry.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_RESOLVED_HOST=1`). CWE-494. Severity high.
+
+resolved is an https URL whose host is not registry.npmjs.org. An http: URL is left to the cleartext rule.
+
+## Remediation
+
+Resolve the package from https://registry.npmjs.org.
+
+See `SECURITY_SCANNER_SPEC.md` phase 114.

package/rules/DEPS-RESOLVED-HTTP-001.md

@@ -0,0 +1,11 @@
+# DEPS-RESOLVED-HTTP-001
+
+**Tarball URL uses cleartext http.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_RESOLVED_HTTP=1`). CWE-319. Severity high.
+
+resolved uses the http: protocol. https://registry.npmjs.org is not a finding. A git+ssh: URL is not this rule.
+
+## Remediation
+
+Use an https://registry.npmjs.org tarball URL.
+
+See `SECURITY_SCANNER_SPEC.md` phase 115.

package/rules/DEPS-ROOTVER-001.md

@@ -0,0 +1,11 @@
+# DEPS-ROOTVER-001
+
+**Root package version differs from the lockfile.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_ROOTVER=1`). CWE-436. Severity medium.
+
+packages[""].version is a string and it differs from package.json version. A missing root entry is not a finding. Workspace package versions are not compared.
+
+## Remediation
+
+Regenerate the lockfile so the root version matches package.json.
+
+See `SECURITY_SCANNER_SPEC.md` phase 111.

package/rules/DEPS-SCOPE-NEW-001.md

@@ -0,0 +1,11 @@
+# DEPS-SCOPE-NEW-001
+
+**Direct scoped dependency was first published within 7 days.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_SCOPE_NEW=1`). CWE-1104. Severity medium.
+
+Age comes from the packument `time` of the earliest version. A missing packument, an older first publish, and the project's own scope are not findings.
+
+## Remediation
+
+Confirm the scope is one you trust before installing a newly published package.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 215.

package/rules/DEPS-SCOPE-SYNTAX-001.md

@@ -0,0 +1,11 @@
+# DEPS-SCOPE-SYNTAX-001
+
+**Dependency name starts with @ but is not @scope/name.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_SCOPE_SYNTAX=1`). CWE-20. Severity high.
+
+The name does not match `@[a-z0-9-~][a-z0-9-._~]*/[a-z0-9-~][a-z0-9-._~]*`. A well-formed `@scope/name` is not a finding. This catches a missing slash and a second slash.
+
+## Remediation
+
+Use a scoped name of the form @scope/name, with a single slash.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 216.

package/rules/DEPS-SCOPE-TYPO-001.md

@@ -0,0 +1,11 @@
+# DEPS-SCOPE-TYPO-001
+
+**Direct dependency scope is one edit from a popular scope.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_SCOPE_TYPO=1`). CWE-494. Severity medium.
+
+A direct `@scope/name` dependency whose scope is Levenshtein distance 1 from a scope on the popular-package list, and whose basename is a popular package in that real scope. The real scope, a distance-1 scope whose basename is not on that list, and unscoped names are not findings.
+
+## Remediation
+
+Depend on the popular scoped package if that is the one you meant.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 208.

package/rules/DEPS-SCRIPT-BASE64-001.md

@@ -0,0 +1,11 @@
+# DEPS-SCRIPT-BASE64-001
+
+**Lifecycle script decodes base64 into eval.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_SCRIPT_BASE64=1`). CWE-95. Severity high.
+
+Same condition as phase 174, applied to cached lifecycle script text: a base64 literal of 32 or more characters passed to `eval`, `Function`, or `spawn`. A shorter literal, or a long literal that is only assigned, is not this finding. If the cache file sets `tarballObfuscReported`, phase 174 already reported the package and this id is skipped.
+
+## Remediation
+
+Do not install the package. Treat decode-and-eval in an install script as malicious.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 194.

package/rules/DEPS-SCRIPT-BIN-001.md

@@ -0,0 +1,11 @@
+# DEPS-SCRIPT-BIN-001
+
+**Bin path is the install script.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_SCRIPT_BIN=1`). CWE-829. Severity medium.
+
+A lock `bin` target equals the path named by `scripts.install` or `scripts.preinstall` after a leading `node ` is removed. Different paths are not this finding.
+
+## Remediation
+
+Confirm the command you run is not the package install script.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 204.

package/rules/DEPS-SCRIPT-COND-001.md

@@ -0,0 +1,11 @@
+# DEPS-SCRIPT-COND-001
+
+**Lifecycle script hides behavior behind CI or NODE_ENV.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_SCRIPT_COND=1`). CWE-829. Severity medium.
+
+A cached lifecycle script branches with a brace `if` on `process.env.CI` or `NODE_ENV` compared with `production`, and the non-CI or production branch contains a phase 193–200 script pattern. A branch that only changes a log string is not this finding. An unconditional pattern stays on the earlier phase and this id does not also fire for that pattern.
+
+## Remediation
+
+Read the non-CI and production branches before installing.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 206.

package/rules/DEPS-SCRIPT-CURL-001.md

@@ -0,0 +1,11 @@
+# DEPS-SCRIPT-CURL-001
+
+**Lifecycle script pipes a download to a shell.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_SCRIPT_CURL=1`). CWE-494. Severity critical.
+
+A cached lifecycle script contains `curl` or `wget` and a pipe to `sh`, `bash`, or `node`. A download written to a file with no pipe is not this finding. Fixture hosts are `example.invalid`. The script is not executed.
+
+## Remediation
+
+Do not install the package. A download piped to a shell is remote code execution.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 193.

package/rules/DEPS-SCRIPT-DEV-001.md

@@ -0,0 +1,11 @@
+# DEPS-SCRIPT-DEV-001
+
+**Development-only dependency install script.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_SCRIPT_DEV=1`). CWE-829. Severity info.
+
+A `dev: true` lock entry with `hasInstallScript` that is not also required by a non-dev package. A production install script is not this id.
+
+## Remediation
+
+Confirm the package stays dev-only. Read the install script before a development install.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 190.

package/rules/DEPS-SCRIPT-GIT-001.md

@@ -0,0 +1,11 @@
+# DEPS-SCRIPT-GIT-001
+
+**Lifecycle script invokes git.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_SCRIPT_GIT=1`). CWE-829. Severity high.
+
+A cached lifecycle script contains `git ` or `.git/hooks`. The word `digital` is not this finding. The script is not executed and git is not invoked.
+
+## Remediation
+
+Do not install a package whose install script runs git or writes hooks.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 198.

package/rules/DEPS-SCRIPT-LOCK-001.md

@@ -0,0 +1,11 @@
+# DEPS-SCRIPT-LOCK-001
+
+**Lifecycle script writes the lockfile.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_SCRIPT_LOCK=1`). CWE-506. Severity high.
+
+A cached lifecycle script contains `package-lock.json` or `npm-shrinkwrap.json` next to `write`, `>`, or `fs.write`. A comment in a non-script file is not this finding. A script that does not name the lockfile is not this finding.
+
+## Remediation
+
+Do not install a package that rewrites the lockfile during install.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 197.

package/rules/DEPS-SCRIPT-MISMATCH-001.md

@@ -0,0 +1,11 @@
+# DEPS-SCRIPT-MISMATCH-001
+
+**Install-script flag disagrees with scripts.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_SCRIPT_MISMATCH=1`). CWE-829. Severity medium.
+
+The lock sets `hasInstallScript` and the cached `scripts` object has none of `preinstall`, `install`, or `postinstall`. A present key is not this finding. No tarball cache means no finding.
+
+## Remediation
+
+Refresh the cached package manifest before trusting the lock bit.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 202.

package/rules/DEPS-SCRIPT-MULTI-001.md

@@ -0,0 +1,11 @@
+# DEPS-SCRIPT-MULTI-001
+
+**Several lifecycle scripts.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_SCRIPT_MULTI=1`). CWE-829. Severity info.
+
+A cached package has two or more of `preinstall`, `install`, and `postinstall`. Exactly one is not this finding. Info is an inventory signal, not a claim that the package is malicious.
+
+## Remediation
+
+Read each lifecycle script.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 203.

package/rules/DEPS-SCRIPT-NODEGYP-001.md

@@ -0,0 +1,11 @@
+# DEPS-SCRIPT-NODEGYP-001
+
+**binding.gyp fetches a non-registry URL.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_SCRIPT_NODEGYP=1`). CWE-829. Severity medium.
+
+`binding.gyp` from the cached tarball descriptor, or from `node_modules/<name>/binding.gyp` when that file is present, contains an `http` or `https` URL whose host is not `registry.npmjs.org`. No URL, or only that host, means no finding. The file is not compiled.
+
+## Remediation
+
+Do not run node-gyp. Review the URL before any native build.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 195.

package/rules/DEPS-SCRIPT-OPTIONAL-001.md

@@ -0,0 +1,11 @@
+# DEPS-SCRIPT-OPTIONAL-001
+
+**Optional dependency install script.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_SCRIPT_OPTIONAL=1`). CWE-829. Severity medium.
+
+An `optional: true` lock entry with `hasInstallScript`. When the same package is also a transitive production install script, emit only this id.
+
+## Remediation
+
+Review the optional install script. Optional does not mean the script is skipped on every install.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 189.

package/rules/DEPS-SCRIPT-PREPARE-001.md

@@ -0,0 +1,11 @@
+# DEPS-SCRIPT-PREPARE-001
+
+**Dependency prepare script.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_SCRIPT_PREPARE=1`). CWE-829. Severity high for a git dependency, otherwise medium.
+
+`scripts.prepare` is a non-empty string in the cached tarball descriptor. prepare runs on local npm install for git dependencies. No prepare script means no finding. Missing cache means no finding.
+
+## Remediation
+
+Read the prepare script before installing. Git dependencies run it during npm install.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 191.

package/rules/DEPS-SCRIPT-PREPUBLISH-001.md

@@ -0,0 +1,11 @@
+# DEPS-SCRIPT-PREPUBLISH-001
+
+**Dependency prepublish script.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_SCRIPT_PREPUBLISH=1`). CWE-829. Severity high when `scripts.prepublish` is set, medium when only `scripts.prepublishOnly` is set.
+
+The message names the key. Old npm runs `prepublish` on install. No such keys means no finding.
+
+## Remediation
+
+Replace `prepublish` with `prepublishOnly` if the script should run only for an intentional publish.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 192.

package/rules/DEPS-SCRIPT-PUBLISH-001.md

@@ -0,0 +1,11 @@
+# DEPS-SCRIPT-PUBLISH-001
+
+**Lifecycle script publishes.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_SCRIPT_PUBLISH=1`). CWE-506. Severity high.
+
+A cached lifecycle script contains `npm publish` or `npm whoami`. This is the publish string alone. When `FULLSHIELD_EXPERIMENTAL_VEX=1` and the script also has the `SUPPLY-WORM-001` token-plus-publish combination, this id is not emitted. This lane does not emit `SUPPLY-WORM-001`.
+
+## Remediation
+
+Do not install a package whose install script publishes or queries the npm account.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 200.