fullshield 1.0.1 → 1.2.0

package/rules/DEPS-SCRIPT-ROLLUP-001.md

@@ -0,0 +1,11 @@
+# DEPS-SCRIPT-ROLLUP-001
+
+**Many production packages have install scripts.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_SCRIPT_ROLLUP=1`). CWE-829. Severity info.
+
+One row for the repo when more than 25 production packages have `hasInstallScript`. The count is printed. The threshold is 25 and is not a vulnerability count. Dev-only packages are not counted. A lock with no `hasInstallScript: true` entry emits nothing. Per-package rows stay on `DEPS-SCRIPT-TRANSITIVE-001`.
+
+## Remediation
+
+Review the install scripts. The number is an inventory count.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 207.

package/rules/DEPS-SCRIPT-SHEBANG-001.md

@@ -0,0 +1,11 @@
+# DEPS-SCRIPT-SHEBANG-001
+
+**Install script shebang is not node or a shell.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_SCRIPT_SHEBANG=1`). CWE-78. Severity medium.
+
+The install script file's first line is a shebang whose interpreter is not `node`, `sh`, or `bash`. `#!/usr/bin/env node` is not this finding. No shebang means no finding. The file is read from the cached tarball descriptor or from `node_modules/<name>/`. It is not executed.
+
+## Remediation
+
+Do not run the install script.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 205.

package/rules/DEPS-SCRIPT-TOKEN-001.md

@@ -0,0 +1,11 @@
+# DEPS-SCRIPT-TOKEN-001
+
+**Lifecycle script reads an npm token.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_SCRIPT_TOKEN=1`). CWE-522. Severity critical.
+
+A cached lifecycle script contains `NPM_TOKEN`, `NODE_AUTH_TOKEN`, or `npm_config__auth`. This lane cannot see phase 173 findings, so it reports the script text it can read. The script is not executed and token values are not printed.
+
+## Remediation
+
+Do not install the package. Rotate npm tokens on machines that already installed it.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 199.

package/rules/DEPS-SCRIPT-TRANSITIVE-001.md

@@ -0,0 +1,11 @@
+# DEPS-SCRIPT-TRANSITIVE-001
+
+**Transitive production dependency install script.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_SCRIPT_TRANSITIVE=1`). CWE-829. Severity medium.
+
+One row per transitive production package whose lock entry sets `hasInstallScript`. Direct dependencies are not this id. An optional package that also matches `DEPS-SCRIPT-OPTIONAL-001` is reported only as that id when both flags are on.
+
+## Remediation
+
+Review the transitive install script before installing. Prefer a release with no install script.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 188.

package/rules/DEPS-SCRIPT-TRUSTED-001.md

@@ -0,0 +1,11 @@
+# DEPS-SCRIPT-TRUSTED-001
+
+**Trusted dependency still has a dangerous lifecycle script.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_SCRIPT_TRUSTED=1`). CWE-829. Severity medium.
+
+The package name is in root `trustedDependencies` and its cached lifecycle script matches the curl, outside-write, lockfile, git, token, or publish patterns. The trust list does not clear those ids. This row is additional. `node scripts/build.js` is not this finding.
+
+## Remediation
+
+Remove the name from `trustedDependencies` until the script is safe.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 201.

package/rules/DEPS-SCRIPT-WRITE-001.md

@@ -0,0 +1,11 @@
+# DEPS-SCRIPT-WRITE-001
+
+**Lifecycle script writes outside the package.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_SCRIPT_WRITE=1`). CWE-22. Severity high.
+
+A cached lifecycle script writes a path that starts with `..`, `/`, `~/`, or an expansion of `HOME` or `USERPROFILE`. A relative path such as `lib/out.js` is not this finding. The script is not executed.
+
+## Remediation
+
+Do not install the package until the write stays inside the package directory.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 196.

package/rules/DEPS-SELFNAME-001.md

@@ -0,0 +1,11 @@
+# DEPS-SELFNAME-001
+
+**A dependency name equals the root package name and is not a workspace path.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_SELFNAME=1`). CWE-694. Severity medium.
+
+A `file:` or `workspace:` spec of the same name, and a different dependency name, are not findings.
+
+## Remediation
+
+Use a workspace: or file: spec for the local package, or rename the dependency.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 224.

package/rules/DEPS-SEPARATOR-001.md

@@ -0,0 +1,11 @@
+# DEPS-SEPARATOR-001
+
+**Direct dependency swaps separators in a popular package name.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_SEPARATOR=1`). CWE-494. Severity medium.
+
+Treating `.`, `-`, and `_` as the same character, the direct name equals a popular package and the strings differ. The exact popular name, a one-letter difference, and a twin at Levenshtein distance 1 are not findings.
+
+## Remediation
+
+Confirm you intended this name rather than the popular package.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 212.

package/rules/DEPS-SHRINKWRAP-001.md

@@ -0,0 +1,11 @@
+# DEPS-SHRINKWRAP-001
+
+**npm-shrinkwrap.json is the only lockfile.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_SHRINKWRAP=1`). CWE-829. Severity info.
+
+npm-shrinkwrap.json is present and no other lockfile (package-lock.json, yarn.lock, pnpm-lock.yaml, bun.lock) is at the repo root. The file is parsed with the package-lock parser.
+
+## Remediation
+
+Commit one lockfile. Prefer package-lock.json unless the project intentionally publishes a shrinkwrap.
+
+See `SECURITY_SCANNER_SPEC.md` phase 108.

package/rules/DEPS-SHRINKWRAP-002.md

@@ -0,0 +1,11 @@
+# DEPS-SHRINKWRAP-002
+
+**Shrinkwrap and package-lock name@version sets differ.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_SHRINKWRAP=1`). CWE-436. Severity high.
+
+Both npm-shrinkwrap.json and package-lock.json exist and the package name@version sets from the package-lock parser are not the same.
+
+## Remediation
+
+Delete one of the files, or regenerate both from the same install so the sets match.
+
+See `SECURITY_SCANNER_SPEC.md` phase 108.

package/rules/DEPS-SUFFIX-001.md

@@ -0,0 +1,11 @@
+# DEPS-SUFFIX-001
+
+**Direct dependency adds a common suffix to a popular package.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_SUFFIX=1`). CWE-494. Severity low.
+
+The name is a popular package plus `-js`, `-node`, `-npm`, or `-lib`, and it is not itself on the popular list. Confidence is low. The message asks you to confirm intent. The popular name, and any other suffix, are not findings.
+
+## Remediation
+
+Keep the dependency only if that name is the package you meant.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 214.

package/rules/DEPS-TAGSPEC-001.md

@@ -0,0 +1,11 @@
+# DEPS-TAGSPEC-001
+
+**Dist-tag dependency spec.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_TAGSPEC=1`). CWE-829. Severity medium.
+
+A direct spec is the bare dist-tag `next`, `beta`, or `canary`, or `name@tag` whose tag contains no digit. Bare `latest` is `DEPS-FLOAT-001`. `1.2.3-beta.1` and `^1.2.3` are not this finding.
+
+## Remediation
+
+Depend on an exact version or a bounded semver range.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 132.

package/rules/DEPS-TARBALL-BIN-001.md

@@ -0,0 +1,11 @@
+# DEPS-TARBALL-BIN-001
+
+**package.json bin target is missing from the tarball.** Medium. Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_TARBALL_BIN=1`). CWE-427.
+
+Direct production dependency only. The path is inside the package and is not a file in the archive. A path with `..` or an absolute path is `DEPS-TARBALL-PATH-001` only.
+
+## Remediation
+
+Point bin at a file that exists inside the package, or remove the bin entry.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 175.

package/rules/DEPS-TARBALL-CRED-001.md

@@ -0,0 +1,11 @@
+# DEPS-TARBALL-CRED-001
+
+**Lifecycle script reads credentials.** Critical. Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_TARBALL_CRED=1`). CWE-522.
+
+Direct production dependency only. A `preinstall`, `install`, or `postinstall` string contains `.npmrc`, `.ssh`, `.aws`, `.git-credentials`, `NPM_TOKEN`, `NODE_AUTH_TOKEN`, or `npm_config__auth`. The same strings under `test/` are not this finding. No second signal is required.
+
+## Remediation
+
+Do not install this package.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 173.

package/rules/DEPS-TARBALL-DYNAMIC-001.md

@@ -0,0 +1,11 @@
+# DEPS-TARBALL-DYNAMIC-001
+
+**Top-level dynamic require or import in the package entry.** Medium. Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_TARBALL_DYNAMIC=1`). CWE-829.
+
+Direct production dependency only. `main` or an `exports` file contains `require(` or `import(` whose argument is not a string literal, and the call is not inside a function. A literal `require('fs')` and a call inside a function are not this finding.
+
+## Remediation
+
+Use a string literal, or move the call inside a function.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 186.

package/rules/DEPS-TARBALL-ENV-001.md

@@ -0,0 +1,11 @@
+# DEPS-TARBALL-ENV-001
+
+**Package entry passes process.env to a request.** Critical. Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_TARBALL_ENV=1`). CWE-200.
+
+Direct production dependency only. A `main` or `exports` file passes the whole `process.env` object to `fetch`, `http.request`, or `https.request`. `process.env.NODE_ENV` is not this finding. Fixture hosts are `example.invalid`.
+
+## Remediation
+
+Do not pass the process.env object to those calls.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 185.

package/rules/DEPS-TARBALL-HASH-001.md

@@ -0,0 +1,11 @@
+# DEPS-TARBALL-HASH-001
+
+**Tarball bytes do not match dist.integrity.** Critical. Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_TARBALL_HASH=1`). CWE-353.
+
+Direct production dependency only. The sha512 of cached tarball bytes is compared with the lock integrity, or with packument `dist.integrity` when the lock has none. A mismatch stops extraction for that package. No network fetch.
+
+## Remediation
+
+Replace the cached tarball with the registry.npmjs.org artifact that matches the lock integrity.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 168.

package/rules/DEPS-TARBALL-HIDDEN-001.md

@@ -0,0 +1,11 @@
+# DEPS-TARBALL-HIDDEN-001
+
+**Tarball path uses a bidi override or a hidden non-latin segment.** Medium. Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_TARBALL_HIDDEN=1`). CWE-451.
+
+Direct production dependency only. A segment contains a bidi override or isolate (U+202A–U+202E, U+2066–U+2069), or a segment other than `.npmignore`, `.gitignore`, or `.github` starts with `.` and contains a non-latin letter. `.gitignore` and `lib/index.js` are not this finding.
+
+## Remediation
+
+Reject the archive.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 178.

package/rules/DEPS-TARBALL-HOOK-001.md

@@ -0,0 +1,11 @@
+# DEPS-TARBALL-HOOK-001
+
+**Tarball contains a git hook or GitHub workflow.** Critical. Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_TARBALL_HOOK=1`). CWE-829.
+
+Direct production dependency only. An archived path includes `.git/hooks/` or `.github/workflows/`. A README that only mentions those words is not this finding. Distinct from `SUPPLY-WORKFLOW-001`, which is source that writes those paths.
+
+## Remediation
+
+Do not install this package.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 177.

package/rules/DEPS-TARBALL-ID-001.md

@@ -0,0 +1,11 @@
+# DEPS-TARBALL-ID-001
+
+**Tarball package.json name or version differs from the lock.** Critical. Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_TARBALL_ID=1`). CWE-494.
+
+Direct production dependency only. Compared against `package/package.json` in the cached tarball. A missing manifest is not this finding.
+
+## Remediation
+
+Do not install the archive. The packed name and version must match the lock.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 169.

package/rules/DEPS-TARBALL-INSTALLJS-001.md

@@ -0,0 +1,11 @@
+# DEPS-TARBALL-INSTALLJS-001
+
+**Loose install.js without a matching scripts key.** Medium. Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_TARBALL_INSTALLJS=1`). CWE-829.
+
+Direct production dependency only. The archive contains `package/install.js`, `package/preinstall.js`, or `package/postinstall.js` and `scripts` has no matching key. A declared key, or no such file, is not this finding.
+
+## Remediation
+
+Remove the loose file or declare the matching scripts key.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 183.

package/rules/DEPS-TARBALL-LICENSE-001.md

@@ -0,0 +1,11 @@
+# DEPS-TARBALL-LICENSE-001
+
+**Tarball license string differs from the packument.** Info. Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_TARBALL_LICENSE=1`). CWE-1104.
+
+Direct production dependency only. Both license fields are strings and they differ. A match, or either side missing, is not this finding. This is not `DEPS-LICENSE-001` and it does not judge the license.
+
+## Remediation
+
+Compare the two license strings.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 181.

package/rules/DEPS-TARBALL-LIFECYCLE-001.md

@@ -0,0 +1,11 @@
+# DEPS-TARBALL-LIFECYCLE-001
+
+**Tarball lifecycle script hidden by the packument.** High. Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_TARBALL_LIFECYCLE=1`). CWE-829.
+
+Direct production dependency only. `preinstall`, `install`, or `postinstall` is present in the tarball and the cached packument `hasInstallScript` is `false`. A missing flag, a `true` flag, or no such scripts is not this finding.
+
+## Remediation
+
+Treat the package as untrusted. The tarball runs an install script the packument marked absent.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 170.

package/rules/DEPS-TARBALL-MANIFEST-001.md

@@ -0,0 +1,11 @@
+# DEPS-TARBALL-MANIFEST-001
+
+**Tarball dependencies differ from the packument.** High. Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_TARBALL_MANIFEST=1`). CWE-494.
+
+Direct production dependency only. Both `dependencies` objects are present and the key set or a range string differs. Name and version mismatches stay `DEPS-TARBALL-ID-001`. A missing object on either side is not this finding.
+
+## Remediation
+
+Treat the tarball as a swapped manifest.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 182.

package/rules/DEPS-TARBALL-NATIVE-001.md

@@ -0,0 +1,11 @@
+# DEPS-TARBALL-NATIVE-001
+
+**Tarball contains a prebuilt .node file.** Medium. Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_TARBALL_NATIVE=1`). CWE-829.
+
+Direct production dependency only. Medium is not a malware claim. A `binding.gyp` with no `.node` file is not this finding. A prebuilt binary could not be reviewed as source.
+
+## Remediation
+
+Review the package before trusting the binary.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 176.

package/rules/DEPS-TARBALL-NET-001.md

@@ -0,0 +1,11 @@
+# DEPS-TARBALL-NET-001
+
+**Lifecycle script contains a network token.** High. Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_TARBALL_NET=1`). CWE-829.
+
+Direct production dependency only. A `preinstall`, `install`, or `postinstall` string contains `http://`, `https://`, `fetch(`, or `dns`. Fixture hosts are `example.invalid`.
+
+## Remediation
+
+Remove the install script or pin a release whose lifecycle script does not fetch remote code.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 171.

package/rules/DEPS-TARBALL-OBFUSC-001.md

@@ -0,0 +1,11 @@
+# DEPS-TARBALL-OBFUSC-001
+
+**Lifecycle script passes a long base64 literal to eval, Function, or spawn.** High. Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_TARBALL_OBFUSC=1`). CWE-506.
+
+Direct production dependency only. The literal is at least 32 characters and sits inside the call. A shorter literal, or a long literal that is only assigned, is not this finding. This id is the tarball lifecycle script, distinct from `SUPPLY-OBFUSCATE-001`.
+
+## Remediation
+
+Do not install this package.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 174.

package/rules/DEPS-TARBALL-PATH-001.md

@@ -0,0 +1,11 @@
+# DEPS-TARBALL-PATH-001
+
+**Tarball entry or bin path escapes the package.** Critical. Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_TARBALL_PATH=1`). CWE-22.
+
+Direct production dependency only. An entry name, after `\\` is normalized to `/`, is absolute or contains a `..` segment. The extractor skips that entry. This check runs when this flag is on even if later tarball flags are off. A normal `package/lib/index.js` is not this finding.
+
+## Remediation
+
+Do not extract the entry.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 179.

package/rules/DEPS-TARBALL-SHELL-001.md

@@ -0,0 +1,11 @@
+# DEPS-TARBALL-SHELL-001
+
+**Lifecycle script invokes a shell or downloader.** High. Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_TARBALL_SHELL=1`). CWE-78.
+
+Direct production dependency only. A `preinstall`, `install`, or `postinstall` string contains `curl`, `wget`, `bash`, `sh -c`, `powershell`, or `child_process`.
+
+## Remediation
+
+Remove those tokens from the install script.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 172.

package/rules/DEPS-TARBALL-SIZE-001.md

@@ -0,0 +1,11 @@
+# DEPS-TARBALL-SIZE-001
+
+**Tarball exceeds the unpack cap.** Info. Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_TARBALL_SIZE=1`). CWE-770.
+
+Direct production dependency only. Unpacked size would exceed 20 MB or the entry count would exceed 2000. Entries past the cap are not extracted. The cap is a limit, not a vulnerability count. A small archive is not this finding.
+
+## Remediation
+
+Inspect the package before raising the cap.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 180.

package/rules/DEPS-TARBALL-SKIP-001.md

@@ -0,0 +1,11 @@
+# DEPS-TARBALL-SKIP-001
+
+**Direct production tarball refused because integrity is missing.** Info. Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_TARBALL_GATE=1`). CWE-353.
+
+One row per direct production dependency that has an `https://registry.npmjs.org` tarball URL and no lock integrity. The tarball is not read. Transitive packages are not downloaded and do not produce this row. A dependency with no tarball URL is not this finding. When every direct production dependency has integrity, no row is emitted.
+
+## Remediation
+
+Add a sha512 integrity to the lock entry before fetching its tarball.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 187.

package/rules/DEPS-TARBALL-TOPLEVEL-001.md

@@ -0,0 +1,11 @@
+# DEPS-TARBALL-TOPLEVEL-001
+
+**Package entry calls the network or child_process outside a function.** High. Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_TARBALL_TOPLEVEL=1`). CWE-829.
+
+Direct production dependency only. `main` or an `exports` file contains `fetch(`, `http.request`, `https.request`, or a `child_process` call that is not inside a function. The file is parsed with the existing parser. A file that does not parse emits nothing. The same call inside a function is not this finding.
+
+## Remediation
+
+Move the call inside a function.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 184.

package/rules/DEPS-TRUSTED-001.md

@@ -0,0 +1,11 @@
+# DEPS-TRUSTED-001
+
+**Install script is not listed in trustedDependencies.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_TRUSTED=1`). CWE-829. Severity medium.
+
+A committed `.npmrc` sets `ignore-scripts=true`, a direct production dependency's lock entry has `hasInstallScript: true`, and that name is absent from the root `trustedDependencies`. A listed name, and `ignore-scripts` that is not `true`, are not this finding. A missing `hasInstallScript` is not a finding; this rule does not guess from the packument.
+
+## Remediation
+
+Add the package to trustedDependencies after reviewing its install script, or remove the dependency.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 144.

package/rules/DEPS-TYPES-001.md

@@ -0,0 +1,11 @@
+# DEPS-TYPES-001
+
+**Project depends on both foo and @types/foo when foo already ships types.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_TYPES=1`). CWE-1104. Severity info.
+
+foo's packument has a non-empty `types` or `typings` field. Neither field, and a missing packument, are not findings.
+
+## Remediation
+
+Remove the @types package if the package's own types are the ones TypeScript should use.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 217.

package/rules/DEPS-TYPO-TRANSITIVE-001.md

@@ -0,0 +1,11 @@
+# DEPS-TYPO-TRANSITIVE-001
+
+**Transitive package name matches a scope, homoglyph, bidi, mixed-script, or separator check.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_TYPO_TRANSITIVE=1`). CWE-494. Severity info.
+
+One informational row per package. The message names the check. Direct names keep their own rule ids.
+
+## Remediation
+
+Confirm the transitive package name.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 219.

package/rules/DEPS-UNFIXED-001.md

@@ -0,0 +1,11 @@
+# DEPS-UNFIXED-001
+
+**Production dependency with no fixed version.** Experimental (`FULLSHIELD_EXPERIMENTAL_HEALTH=1`). CWE-1104. Severity medium.
+
+A production dependency has an OSV advisory with no `fixed` event, and the registry publish date for that version is older than 730 days. An unknown publish date is not a finding. The console shows this only when reachability is `reachable`.
+
+## Remediation
+
+Decide whether to keep this dependency. FullShield does not name a replacement.
+
+See `SECURITY_SCANNER_SPEC.md` Section 46 phase 106.

package/rules/DEPS-URLSPEC-001.md

@@ -0,0 +1,11 @@
+# DEPS-URLSPEC-001
+
+**HTTP(S) dependency URL outside the npm registry.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_URLSPEC=1`). CWE-494. Severity high.
+
+A direct spec is an `http:` or `https:` URL whose host is not `registry.npmjs.org`. A semver range and a `https://registry.npmjs.org/` tarball are not this finding.
+
+## Remediation
+
+Use a registry.npmjs.org tarball or a semver range.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 131.

package/rules/DEPS-VENDORED-001.md

@@ -0,0 +1,11 @@
+# DEPS-VENDORED-001
+
+**Vendored library with an OSV advisory.** Experimental (`FULLSHIELD_EXPERIMENTAL_VENDORED=1`). CWE-1104. Severity comes from OSV.
+
+A JavaScript file under `public/`, `static/`, `assets/`, `vendor/`, `lib/`, or any `*.min.js`, whose banner or exported `VERSION` matches `models/vendored.json`. No match means no finding. The version is never guessed from size or a hash. `--offline` uses the OSV cache; a cache miss is no finding. Reachability is `vendored`.
+
+## Remediation
+
+Replace the file. Do not edit the vendored copy in place.
+
+See `SECURITY_SCANNER_SPEC.md` Section 46 phase 104.

package/rules/DEPS-WEAKINTEGRITY-001.md

@@ -0,0 +1,11 @@
+# DEPS-WEAKINTEGRITY-001
+
+**Integrity uses sha1 or sha256.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_WEAKINTEGRITY=1`). CWE-328. Severity medium.
+
+integrity uses sha1 or sha256. The registry algorithm is sha512. A missing integrity is not this finding. A weak but well-formed hash is not also reported as a grammar failure.
+
+## Remediation
+
+Regenerate the lockfile so integrity starts with sha512-.
+
+See `SECURITY_SCANNER_SPEC.md` phase 117.

package/rules/DEPS-WORKSPACE-NAME-001.md

@@ -0,0 +1,11 @@
+# DEPS-WORKSPACE-NAME-001
+
+**A workspace package name is resolved from registry.npmjs.org.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_WORKSPACE_NAME=1`). CWE-494. Severity high.
+
+The lock `resolved` URL host is the npm registry rather than `link:` or `file:`. A `link:` to the workspace path is not a finding.
+
+## Remediation
+
+Link the workspace package with link: or file: so install does not fetch a registry package of the same name.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 225.

package/rules/README.md

@@ -21,6 +21,12 @@ negative counterpart in `test/fixtures/clean-app`.
 | [SECRET-SESSION-001](SECRET-SESSION-001.md) | Hardcoded express-session secret |
 | [SECRET-ENTROPY-001](SECRET-ENTROPY-001.md) | High-entropy assignment (low confidence) |
 | [SECRET-ENVFILE-001](SECRET-ENVFILE-001.md) | Committed `.env` file |
+| [SECRET-FILE-002](SECRET-FILE-002.md) | `.npmrc` `_authToken` / `_auth` literal (experimental) |
+| [SECRET-FILE-003](SECRET-FILE-003.md) | Docker `config.json` `auths` auth value (experimental) |
+| [SECRET-FILE-004](SECRET-FILE-004.md) | kubeconfig `token` or `client-key-data` (experimental) |
+| [SECRET-FILE-005](SECRET-FILE-005.md) | Committed Terraform state (experimental) |
+| [SECRET-FILE-006](SECRET-FILE-006.md) | JSON service-account `private_key` (experimental) |
+| [SECRET-FILE-007](SECRET-FILE-007.md) | `id_rsa`, `id_ed25519`, `*.p12`, `*.pfx`, `*.keystore` (experimental) |
 | [SECRET-BUNDLE-001](SECRET-BUNDLE-001.md) | Secret-shaped `NEXT_PUBLIC_`/`VITE_` value in a client bundle (experimental) |
 
 ## Dependencies
@@ -48,6 +54,12 @@ negative counterpart in `test/fixtures/clean-app`.
 | [SAST-REDIRECT-001](SAST-REDIRECT-001.md) | Tainted `res.redirect` |
 | [SAST-JWT-001](SAST-JWT-001.md) | `jwt.decode` / `algorithms: none` |
 | [SAST-CRYPTO-001](SAST-CRYPTO-001.md) | `Math.random` tokens / md5 passwords |
+| [SAST-CIPHER-001](SAST-CIPHER-001.md) | ECB, deprecated cipher, literal IV (experimental) |
+| [SAST-CIPHER-002](SAST-CIPHER-002.md) | String-literal key to `createCipheriv` / `createHmac` (experimental) |
+| [SAST-RSA-001](SAST-RSA-001.md) | RSA below 2048 or `secp192*` (experimental) |
+| [SAST-JWT-002](SAST-JWT-002.md) | `jwt.sign` with no expiry or a short HMAC secret (experimental) |
+| [SAST-TLS-001](SAST-TLS-001.md) | `rejectUnauthorized: false` and a no-op identity check (experimental) |
+| [SAST-TLS-002](SAST-TLS-002.md) | `NODE_TLS_REJECT_UNAUTHORIZED=0` (experimental) |
 | [SAST-PROTO-001](SAST-PROTO-001.md) | Unguarded recursive merge |
 | [SAST-XSS-001](SAST-XSS-001.md) | HTML `res.send` or `<%-` / `{{{` |
 | [SAST-AUTH-001](SAST-AUTH-001.md) | Data route with no auth middleware |
@@ -107,3 +119,26 @@ Requires `FULLSHIELD_EXPERIMENTAL_DLP=1` and `shieldGuard({ dlp: { mode } })`. N
 | [HOST-SSH-001](HOST-SSH-001.md) | OpenSSH version in the CVE-2024-6387 range |
 | [HOST-SSH-002](HOST-SSH-002.md) | Vulnerable OpenSSH without `LoginGraceTime 0` |
 | [HOST-SSH-003](HOST-SSH-003.md) | Possible SSH authentication-timeout attempts |
+
+## Breadth 1.2.0 (experimental, off by default)
+
+| ID | What |
+|---|---|
+| [CONFIG-ELECTRON-001](CONFIG-ELECTRON-001.md) | Unsafe Electron `webPreferences` (`FULLSHIELD_EXPERIMENTAL_ELECTRON`) |
+| [CONFIG-ELECTRON-002](CONFIG-ELECTRON-002.md) | `shell.openExternal` without an https check |
+| [CONFIG-ELECTRON-003](CONFIG-ELECTRON-003.md) | Remote `loadURL` without navigation guards |
+| [DEPS-VENDORED-001](DEPS-VENDORED-001.md) | Vendored library matched by banner or VERSION (`FULLSHIELD_EXPERIMENTAL_VENDORED`) |
+| [DEPS-UNFIXED-001](DEPS-UNFIXED-001.md) | Production dependency with no fixed version, last publish over 730 days (`FULLSHIELD_EXPERIMENTAL_HEALTH`) |
+| [SAST-SSTI-001](SAST-SSTI-001.md) | Tainted template source (`FULLSHIELD_EXPERIMENTAL_SSTI`) |
+| [SAST-WEBHOOK-001](SAST-WEBHOOK-001.md) | Known webhook provider with no verifier (`FULLSHIELD_EXPERIMENTAL_WEBHOOK`) |
+| [SAST-SESSION-002](SAST-SESSION-002.md) | Login session write without regenerate (`FULLSHIELD_EXPERIMENTAL_SESSION2`) |
+| [SAST-LOGLEAK-001](SAST-LOGLEAK-001.md) | Secret written to a log (`FULLSHIELD_EXPERIMENTAL_LOGLEAK`) |
+| [SAST-NEXT-001](SAST-NEXT-001.md) | `use server` write without auth (`FULLSHIELD_EXPERIMENTAL_NEXT`) |
+| [CONFIG-NEXT-001](CONFIG-NEXT-001.md) | Auth only in Next.js middleware |
+| [CONFIG-NEXT-002](CONFIG-NEXT-002.md) | Unrestricted Next.js image hosts |
+| [SECRET-NEXTPUB-001](SECRET-NEXTPUB-001.md) | `NEXT_PUBLIC_` name that looks like a secret |
+| [SAST-DOMXSS-001](SAST-DOMXSS-001.md) | DOM XSS sink (`FULLSHIELD_EXPERIMENTAL_BROWSER`) |
+| [SAST-REACT-001](SAST-REACT-001.md) | Unsanitized HTML binding |
+| [SAST-POSTMSG-001](SAST-POSTMSG-001.md) | postMessage without an origin check |
+| [SAST-TOKENSTORE-001](SAST-TOKENSTORE-001.md) | Token written to localStorage |
+| [SAST-IDOR-001](SAST-IDOR-001.md) | Load-by-id hint that never fails CI (`FULLSHIELD_EXPERIMENTAL_IDOR`) |

package/rules/SAST-CIPHER-001.md

@@ -0,0 +1,13 @@
+# SAST-CIPHER-001
+
+**Weak cipher mode or IV.** Experimental (`FULLSHIELD_EXPERIMENTAL_CRYPTO2=1`). CWE-327. Severity high.
+
+`createCipheriv` with an `*-ecb` algorithm, deprecated `createCipher` / `createDecipher`, or an IV that is a string literal, `Buffer.from` of a literal, or `Buffer.alloc`. `randomBytes` is not a finding.
+
+Test paths use the phase 95 test-context rule (severity low, `context: "test"`).
+
+## Remediation
+
+Use an authenticated mode such as `aes-256-gcm` and a random IV from `randomBytes`.
+
+See `SECURITY_SCANNER_SPEC.md` Section 46 phase 96.

package/rules/SAST-CIPHER-002.md

@@ -0,0 +1,11 @@
+# SAST-CIPHER-002
+
+**Hardcoded symmetric key.** Experimental (`FULLSHIELD_EXPERIMENTAL_CRYPTO2=1`). CWE-321. Severity high.
+
+A string literal passed as the key to `createCipheriv` or `createHmac`. A key read from `process.env` is not a finding. This rule does not add a second finding on a line already reported as `SECRET-JWT-*` or `SECRET-ENTROPY-001`.
+
+## Remediation
+
+Load the key from an environment variable or a secret manager.
+
+See `SECURITY_SCANNER_SPEC.md` Section 46 phase 96.

package/rules/SAST-DOMXSS-001.md

@@ -0,0 +1,11 @@
+# SAST-DOMXSS-001
+
+**DOM XSS sink.** Experimental (`FULLSHIELD_EXPERIMENTAL_BROWSER=1`). CWE-79. Severity high.
+
+Browser source (`location.hash`, `location.search`, `location.href`, `document.URL`, `document.referrer`, `window.name`, `event.data`) is written to `innerHTML`, `outerHTML`, `insertAdjacentHTML`, `document.write`, `eval`, a string `setTimeout` / `setInterval`, `src` / `href` without an `https:` check, or jQuery `$(source)` / `.html()`. Server taint rules do not run browser sources.
+
+## Remediation
+
+Assign text with `textContent`, or sanitize HTML before writing it.
+
+See `SECURITY_SCANNER_SPEC.md` Section 46 phase 101.

package/rules/SAST-IDOR-001.md

@@ -0,0 +1,11 @@
+# SAST-IDOR-001
+
+**Handler loads by id without an ownership check.** Experimental (`FULLSHIELD_EXPERIMENTAL_IDOR=1`). CWE-639. Severity low. Confidence low. `source` is `rule`, so `failsCi` is false at every fail-on threshold.
+
+An authenticated-looking route with an `:id` param loads by `findById`, `findByPk`, `findUnique`, or `WHERE id =` and the file never references `req.user`, `req.session.user`, or `ctx.state.user`. A middleware name matching `admin`, `role`, `permission`, or `authorize` is not a finding. This is a hint and is not promoted.
+
+## Remediation
+
+Scope the query to the authenticated user.
+
+See `SECURITY_SCANNER_SPEC.md` Section 46 phase 107.

package/rules/SAST-JWT-002.md

@@ -0,0 +1,11 @@
+# SAST-JWT-002
+
+**JWT without expiry or with a short HMAC secret.** Experimental (`FULLSHIELD_EXPERIMENTAL_CRYPTO2=1`). CWE-613. Severity medium.
+
+`jwt.sign` with no `expiresIn` and no `exp`, or an HMAC secret string literal shorter than 32 bytes. `expiresIn: '1h'` with a secret of at least 32 bytes is not a finding.
+
+## Remediation
+
+Set `expiresIn` or `exp`, and use an HMAC secret of at least 32 bytes.
+
+See `SECURITY_SCANNER_SPEC.md` Section 46 phase 96.