fullshield 1.0.1 → 1.2.0

package/models/ssti.json

@@ -0,0 +1,14 @@
+{
+  "entries": [
+    { "member": "ejs.render", "templateIndex": 0 },
+    { "member": "ejs.compile", "templateIndex": 0 },
+    { "member": "pug.render", "templateIndex": 0 },
+    { "member": "pug.compile", "templateIndex": 0 },
+    { "member": "handlebars.compile", "templateIndex": 0 },
+    { "member": "nunjucks.renderString", "templateIndex": 0 },
+    { "member": "_.template", "templateIndex": 0 },
+    { "member": "doT.template", "templateIndex": 0 },
+    { "member": "Mustache.render", "templateIndex": 0 },
+    { "member": "Function", "templateIndex": 0 }
+  ]
+}

package/models/vendored.json

@@ -0,0 +1,15 @@
+{
+  "libraries": [
+    { "package": "jquery", "banner": "jQuery v(\\d+\\.\\d+\\.\\d+)", "version": "jQuery\\.VERSION\\s*=\\s*['\\\"](\\d+\\.\\d+\\.\\d+)" },
+    { "package": "jquery-ui", "banner": "jQuery UI - v(\\d+\\.\\d+\\.\\d+)" },
+    { "package": "bootstrap", "banner": "Bootstrap v(\\d+\\.\\d+\\.\\d+)" },
+    { "package": "angular", "banner": "AngularJS v(\\d+\\.\\d+\\.\\d+)" },
+    { "package": "@angular/core", "banner": "angular v(\\d+\\.\\d+\\.\\d+)" },
+    { "package": "lodash", "banner": "Lodash (\\d+\\.\\d+\\.\\d+)" },
+    { "package": "underscore", "banner": "Underscore\\.js (\\d+\\.\\d+\\.\\d+)" },
+    { "package": "moment", "banner": "Moment\\.js (\\d+\\.\\d+\\.\\d+)" },
+    { "package": "handlebars", "banner": "Handlebars v(\\d+\\.\\d+\\.\\d+)" },
+    { "package": "dompurify", "banner": "DOMPurify (\\d+\\.\\d+\\.\\d+)" },
+    { "package": "knockout", "banner": "Knockout (\\d+\\.\\d+\\.\\d+)" }
+  ]
+}

package/models/webhooks.json

@@ -0,0 +1,9 @@
+{
+  "entries": [
+    { "id": "stripe", "body": "event.type", "verifiers": ["constructEvent"] },
+    { "id": "github", "header": "x-github-event", "verifiers": ["verify", "timingSafeEqual"] },
+    { "id": "slack", "header": "x-slack-signature", "verifiers": ["timingSafeEqual"] },
+    { "id": "shopify", "header": "x-shopify-hmac-sha256", "verifiers": ["timingSafeEqual"] },
+    { "id": "twilio", "header": "x-twilio-signature", "verifiers": ["validateRequest", "timingSafeEqual"] }
+  ]
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullshield",
-  "version": "1.0.1",
+  "version": "1.2.0",
   "description": "Full-cycle security scanner for Node.js/TypeScript backends: detect, classify, report, notify, fix, prevent.",
   "license": "MIT",
   "type": "module",
@@ -119,6 +119,6 @@
     "zod": "^4.6.7"
   },
   "knip": {
-    "ignore": ["test/fixtures/**", "scripts/doc-version-check.mjs"]
+    "ignore": ["test/fixtures/**", "scripts/doc-version-check.mjs", "scripts/autopilot/guard.mjs", "docs/current/guard.mjs"]
   }
 }

package/rules/CONFIG-ELECTRON-001.md

@@ -0,0 +1,11 @@
+# CONFIG-ELECTRON-001
+
+**Unsafe Electron webPreferences.** Experimental (`FULLSHIELD_EXPERIMENTAL_ELECTRON=1`). CWE-749. Severity high.
+
+One finding for each of `nodeIntegration: true`, `contextIsolation: false`, `sandbox: false`, `webSecurity: false`, and `allowRunningInsecureContent: true` inside `webPreferences`. The project must depend on `electron`.
+
+## Remediation
+
+Harden the Electron window. Do not enable Node integration for remote content.
+
+See `SECURITY_SCANNER_SPEC.md` Section 46 phase 102.

package/rules/CONFIG-ELECTRON-002.md

@@ -0,0 +1,11 @@
+# CONFIG-ELECTRON-002
+
+**shell.openExternal without an https scheme check.** Experimental (`FULLSHIELD_EXPERIMENTAL_ELECTRON=1`). CWE-939. Severity high.
+
+A non-literal argument to `shell.openExternal` with no `https:` check in the file. A string literal is not a finding.
+
+## Remediation
+
+Allow only `https:` URLs before calling `shell.openExternal`.
+
+See `SECURITY_SCANNER_SPEC.md` Section 46 phase 102.

package/rules/CONFIG-ELECTRON-003.md

@@ -0,0 +1,11 @@
+# CONFIG-ELECTRON-003
+
+**BrowserWindow loads a remote URL without navigation guards.** Experimental (`FULLSHIELD_EXPERIMENTAL_ELECTRON=1`). CWE-749. Severity medium.
+
+`loadURL` of an `http:` or `https:` URL when the file has neither `setWindowOpenHandler` nor `will-navigate`. `loadFile` and `file:` are not remote.
+
+## Remediation
+
+Guard navigation with `setWindowOpenHandler` or `will-navigate`.
+
+See `SECURITY_SCANNER_SPEC.md` Section 46 phase 102.

package/rules/CONFIG-ENGINES-001.md

@@ -0,0 +1,11 @@
+# CONFIG-ENGINES-001
+
+**engines.node does not include the pinned Node version.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_ENGINES=1`). CWE-1104. Severity medium. Module `config`.
+
+`.nvmrc` or `.node-version` pins `MAJOR.MINOR.PATCH` and `engines.node` does not include it. The comparison uses the existing semver helper. If that helper cannot parse the range, this rule emits nothing. A pin the range includes, a repository with no pin file, and a pin that is not `MAJOR.MINOR.PATCH` (for example `lts/iron`) are not findings. A pin with no `engines.node` string does not include that version.
+
+## Remediation
+
+Widen engines.node to include the pinned version, or change the pin file.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 142.

package/rules/CONFIG-LIFECYCLE-001.md

@@ -0,0 +1,11 @@
+# CONFIG-LIFECYCLE-001
+
+**Root lifecycle script downloads remote code.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_LIFECYCLE=1`). CWE-829. Severity high. Module `config`.
+
+The root `package.json` `scripts` `preinstall`, `install`, `postinstall`, or `prepare` contains `curl`, `wget`, `Invoke-WebRequest`, or an `http` URL piped to a shell. `"postinstall": "node scripts/build.js"` with no URL is not this finding. This is the application manifest. Lockfile `hasInstallScript` is unchanged.
+
+## Remediation
+
+Remove the downloader from the lifecycle script and run a local file instead.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 136.

package/rules/CONFIG-NEXT-001.md

@@ -0,0 +1,11 @@
+# CONFIG-NEXT-001
+
+**Auth enforced only in middleware.** Experimental (`FULLSHIELD_EXPERIMENTAL_NEXT=1`). CWE-306. Severity info. One finding per app.
+
+`middleware.ts` calls auth and its matcher is present, while a route under `app/` or `pages/` does not. The message names the 2025 middleware-bypass class and says to enforce auth in the handler.
+
+## Remediation
+
+Enforce authentication in the route handler, not only in middleware.
+
+See `SECURITY_SCANNER_SPEC.md` Section 46 phase 103.

package/rules/CONFIG-NEXT-002.md

@@ -0,0 +1,11 @@
+# CONFIG-NEXT-002
+
+**Next.js image remote pattern is unrestricted.** Experimental (`FULLSHIELD_EXPERIMENTAL_NEXT=1`). CWE-942. Severity medium.
+
+`images.remotePatterns` uses hostname `**`, or `images.domains` includes `*`.
+
+## Remediation
+
+List explicit image hostnames.
+
+See `SECURITY_SCANNER_SPEC.md` Section 46 phase 103.

package/rules/DEPS-ALIAS-SQUAT-001.md

@@ -0,0 +1,11 @@
+# DEPS-ALIAS-SQUAT-001
+
+**An npm: alias requests a popular package and installs a different package.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_ALIAS_SQUAT=1`). CWE-494. Severity high.
+
+The requested name is on the popular list and the target name is not that package. An alias whose target is the same popular package is not a finding.
+
+## Remediation
+
+Point the alias at the popular package you meant, or rename the request.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 223.

package/rules/DEPS-BADINTEGRITY-001.md

@@ -0,0 +1,11 @@
+# DEPS-BADINTEGRITY-001
+
+**Integrity is not valid algo-base64.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_BADINTEGRITY=1`). CWE-353. Severity high.
+
+integrity is non-empty and is not algo-base64 for sha1, sha256, or sha512, or the base64 does not decode. A well-formed sha512 value is not a finding. A well-formed sha1 value is the weak-hash rule only.
+
+## Remediation
+
+Regenerate the lockfile so integrity is a sha512- base64 value.
+
+See `SECURITY_SCANNER_SPEC.md` phase 118.

package/rules/DEPS-BIDI-001.md

@@ -0,0 +1,11 @@
+# DEPS-BIDI-001
+
+**Dependency name contains a bidi or zero-width character.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_BIDI=1`). CWE-1007. Severity critical.
+
+The name contains a character in U+202A–U+202E, U+2066–U+2069, or U+200B–U+200F. An ASCII name is not a finding.
+
+## Remediation
+
+Remove the dependency and use an ASCII package name.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 210.

package/rules/DEPS-BIN-SHADOW-001.md

@@ -0,0 +1,11 @@
+# DEPS-BIN-SHADOW-001
+
+**Dependency bin shadows a Node builtin or the root package.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_BINSHADOW=1`). CWE-427. Severity medium.
+
+A direct dependency's bin name is `fs`, `path`, `child_process`, `http`, `https`, `net`, `tls`, `crypto`, `os`, or `dns`, or it equals a bin name of the root package. The bin is read from `node_modules/<name>/package.json` when that file exists. Otherwise it is read from the lock entry `bin`, then from the packument cache at `{cache}/registry/<name>.json` for the locked version. No local file and no cache entry for that version is not a finding. A bin named `my-cli` is not this finding unless the root package uses the same name.
+
+## Remediation
+
+Rename the bin so it is not a Node builtin and not a root package bin.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 146.

package/rules/DEPS-BUNDLED-001.md

@@ -0,0 +1,11 @@
+# DEPS-BUNDLED-001
+
+**Bundled package is not named by the root bundle list.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_BUNDLED=1`). CWE-829. Severity medium.
+
+A lock entry has inBundle: true or bundled: true and the root bundleDependencies / bundledDependencies array does not name that package. The package is not skipped.
+
+## Remediation
+
+Add the package to bundleDependencies, or remove the bundled flag.
+
+See `SECURITY_SCANNER_SPEC.md` phase 122.

package/rules/DEPS-COREPACK-001.md

@@ -0,0 +1,11 @@
+# DEPS-COREPACK-001
+
+**packageManager has no Corepack integrity hash.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_COREPACK=1`). CWE-353. Severity info.
+
+`packageManager` is `name@exact` and has no `+sha512.` suffix, and `devEngines.packageManager` has no hash. A field that already contains `+sha512.` is not this finding. This check does not download the package-manager tarball.
+
+## Remediation
+
+Append the Corepack +sha512. hash, or set devEngines.packageManager to a hashed version.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 141.

package/rules/DEPS-DEPRECATED-REPLACE-001.md

@@ -0,0 +1,11 @@
+# DEPS-DEPRECATED-REPLACE-001
+
+**Deprecation notice names a replacement that is not a direct dependency.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_DEPRECATED_REPLACE=1`). CWE-1104. Severity info.
+
+The `deprecated` string contains `use <name>` or `replaced by <name>`, and `<name>` matches package-name grammar. A notice without that name, and a replacement that is already a direct dependency, are not findings.
+
+## Remediation
+
+Read the deprecation notice and decide whether to depend on the named package.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 218.

package/rules/DEPS-DEV-PROD-EDGE-001.md

@@ -0,0 +1,11 @@
+# DEPS-DEV-PROD-EDGE-001
+
+**Dev package is required by production.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_DEVPROD=1`). CWE-829. Severity medium.
+
+A package marked dev: true is also required by a package that is not dev: true. A dev-only package, and a production package that does not require a dev package, are not findings. This is the edge, not a second advisory.
+
+## Remediation
+
+Move the package out of the production graph, or stop marking it dev.
+
+See `SECURITY_SCANNER_SPEC.md` phase 127.

package/rules/DEPS-DUALPACKAGE-001.md

@@ -0,0 +1,11 @@
+# DEPS-DUALPACKAGE-001
+
+**CommonJS require of an ESM-only package.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_DUALPACKAGE=1`). CWE-829. Severity medium.
+
+A `require('pkg')` targets a package whose packument `type` is `module` and whose root `exports` has no `require` condition. A `require` condition, an ESM `import`, or a missing packument is not a finding.
+
+## Remediation
+
+Import the package from ESM, or depend on a build that publishes a `require` condition.
+
+See `SECURITY_SCANNER_SPEC.md` Phase 241.

package/rules/DEPS-ENGINE-STRICT-001.md

@@ -0,0 +1,11 @@
+# DEPS-ENGINE-STRICT-001
+
+**engine-strict is false while engines.node is set.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_ENGINE_STRICT=1`). CWE-693. Severity info.
+
+`engines.node` is set and a committed `.npmrc` sets `engine-strict=false`. `engine-strict=true`, and a manifest with no engines field, are not this finding.
+
+## Remediation
+
+Set engine-strict=true so installs honor engines.node.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 143.

package/rules/DEPS-FILESPEC-001.md

@@ -0,0 +1,11 @@
+# DEPS-FILESPEC-001
+
+**file: or link: spec in package.json.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_FILESPEC=1`). CWE-829. Severity medium.
+
+A direct spec uses `file:` or `link:`. A semver range is not this finding. This id is the manifest row for that spec.
+
+## Remediation
+
+Depend on a published registry version instead of a local path.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 130.

package/rules/DEPS-FLOAT-001.md

@@ -0,0 +1,11 @@
+# DEPS-FLOAT-001
+
+**Floating direct dependency spec.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_FLOAT=1`). CWE-829. Severity medium.
+
+A direct dependency spec is `*`, `x`, `X`, `latest`, or empty.
+
+## Remediation
+
+Pin a semver range with an upper bound, or an exact version.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 128.

package/rules/DEPS-FLOAT-002.md

@@ -0,0 +1,11 @@
+# DEPS-FLOAT-002
+
+**Direct production spec with no upper bound.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_FLOAT=1`). CWE-829. Severity low.
+
+A direct production spec (`dependencies` or `optionalDependencies`) is `>=` or `>` and has no `<` upper bound. A caret, tilde, or exact version is not this finding.
+
+## Remediation
+
+Add an upper bound, or switch to a caret, tilde, or exact version.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 128.

package/rules/DEPS-GITDEP-001.md

@@ -0,0 +1,11 @@
+# DEPS-GITDEP-001
+
+**Git dependency.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_GITDEP=1`). CWE-829. Severity high.
+
+A spec or resolved value uses git:, git+https:, git+ssh:, git+http:, github:, gitlab:, bitbucket:, or gist:. The URL is not cloned. A registry tarball is not a finding.
+
+## Remediation
+
+Depend on a registry release with an integrity hash.
+
+See `SECURITY_SCANNER_SPEC.md` phase 120.

package/rules/DEPS-GITSPEC-001.md

@@ -0,0 +1,11 @@
+# DEPS-GITSPEC-001
+
+**Git protocol in a direct package.json spec.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_GITSPEC=1`). CWE-829. Severity high.
+
+A direct spec uses `git:`, `git+https:`, `git+ssh:`, `git+http:`, `github:`, `gitlab:`, `bitbucket:`, or `gist:`. A semver range is not this finding. When the lockfile `resolved` URL is also git, this id is the one emitted for that spec.
+
+## Remediation
+
+Replace the git spec with a registry version that has a lockfile integrity. Do not clone the git URL.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 129.

package/rules/DEPS-GRAPH-ALIAS-001.md

@@ -0,0 +1,11 @@
+# DEPS-GRAPH-ALIAS-001
+
+**npm alias edge.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_GRAPH_ALIAS=1`). CWE-829. Severity info.
+
+A dependency spec uses the `npm:` protocol, or a lockfile path name differs from the entry `name`. The finding records `alias → target`. A normal version range is not a finding. Advisory rows stay on the target version.
+
+## Remediation
+
+Confirm the alias is meant to install the target package.
+
+See `SECURITY_SCANNER_SPEC.md` Phase 231.

package/rules/DEPS-GRAPH-OPTIONAL-001.md

@@ -0,0 +1,11 @@
+# DEPS-GRAPH-OPTIONAL-001
+
+**Missing optional dependency.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_GRAPH_OPTIONAL=1`). CWE-829. Severity info.
+
+An `optionalDependencies` entry in the lock or root manifest has no installed copy in the lock. The finding names that missing package. A missing optional dependency does not mark its parent `not-imported`. The optional package being present is not a finding.
+
+## Remediation
+
+Install the optional package, or remove it from `optionalDependencies`.
+
+See `SECURITY_SCANNER_SPEC.md` Phase 229.

package/rules/DEPS-HOMOGLYPH-001.md

@@ -0,0 +1,11 @@
+# DEPS-HOMOGLYPH-001
+
+**Dependency name is not ASCII and matches a popular package.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_HOMOGLYPH=1`). CWE-1007. Severity high.
+
+The name's NFKC form equals a popular package, or Cyrillic/Greek lookalikes for a, e, o, p, c, x, and y normalize to one. An ASCII name, and a non-ASCII name that does not map to a popular package, are not findings.
+
+## Remediation
+
+Confirm the package name character by character before installing it.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 209.

package/rules/DEPS-LINKDEP-001.md

@@ -0,0 +1,11 @@
+# DEPS-LINKDEP-001
+
+**file: or link: dependency.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_LINKDEP=1`). CWE-829. Severity medium.
+
+resolved or a manifest spec is file: or link:. The message includes the path. Severity is high, same id, when the path contains .. and resolves outside the repo root. A registry tarball is not a finding.
+
+## Remediation
+
+Prefer a registry release. Keep file: and link: paths inside the repo.
+
+See `SECURITY_SCANNER_SPEC.md` phase 119.

package/rules/DEPS-LOCKOMIT-001.md

@@ -0,0 +1,11 @@
+# DEPS-LOCKOMIT-001
+
+**Manifest dependency omitted from the lock root.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_LOCKOMIT=1`). CWE-829. Severity high.
+
+package.json dependencies names a package that is absent from packages[""].dependencies and from the top-level dependencies object. A name present in either place is not a finding. A range that does not contain the locked version is a different check.
+
+## Remediation
+
+Regenerate the lockfile so the package is a root dependency entry.
+
+See `SECURITY_SCANNER_SPEC.md` phase 126.

package/rules/DEPS-LOCKPATH-001.md

@@ -0,0 +1,11 @@
+# DEPS-LOCKPATH-001
+
+**Lockfile packages key has an unexpected shape.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_LOCKPATH=1`). CWE-22. Severity high.
+
+A packages key is not "" and does not start with node_modules/. A key that contains .. is the same id. node_modules/foo and node_modules/foo/node_modules/bar are not findings.
+
+## Remediation
+
+Regenerate the lockfile so every packages key is "" or a node_modules path with no .. segment.
+
+See `SECURITY_SCANNER_SPEC.md` phase 125.

package/rules/DEPS-LOCKVER-001.md

@@ -0,0 +1,11 @@
+# DEPS-LOCKVER-001
+
+**Unsupported npm lockfileVersion.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_LOCKVER=1`). CWE-1104. Severity medium.
+
+lockfileVersion is missing, 1, or greater than 3. Versions 2 and 3 are accepted. A version 1 file is still read with the dependencies-tree parser.
+
+## Remediation
+
+Regenerate the lockfile with a current npm so lockfileVersion is 2 or 3.
+
+See `SECURITY_SCANNER_SPEC.md` phase 109.

package/rules/DEPS-MIXEDSCRIPT-001.md

@@ -0,0 +1,11 @@
+# DEPS-MIXEDSCRIPT-001
+
+**Dependency name mixes Latin with Cyrillic or Greek.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_MIXEDSCRIPT=1`). CWE-1007. Severity high.
+
+The name contains both a Latin letter and a Cyrillic or Greek letter. Latin-only names, Cyrillic-only names that are not homoglyphs, and names already reported as homoglyphs are not findings.
+
+## Remediation
+
+Use a package name written in one script.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 211.

package/rules/DEPS-MULTLOCK-001.md

@@ -0,0 +1,11 @@
+# DEPS-MULTLOCK-001
+
+**Multiple lockfiles at the repo root.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_MULTLOCK=1`). CWE-436. Severity medium.
+
+Two or more of package-lock.json, npm-shrinkwrap.json, yarn.lock, pnpm-lock.yaml, and bun.lock exist at the repo root. The message names the files. No winner is chosen.
+
+## Remediation
+
+Keep a single lockfile.
+
+See `SECURITY_SCANNER_SPEC.md` phase 110.

package/rules/DEPS-NAME-CASE-001.md

@@ -0,0 +1,11 @@
+# DEPS-NAME-CASE-001
+
+**Two locked package names differ only by ASCII case.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_NAME_CASE=1`). CWE-178. Severity high.
+
+One row names both packages. Distinct names are not a finding.
+
+## Remediation
+
+Keep one spelling. npm package names are lowercase.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 221.

package/rules/DEPS-NAME-ENCODED-001.md

@@ -0,0 +1,11 @@
+# DEPS-NAME-ENCODED-001
+
+**Dependency name contains a percent sign.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_NAME_ENCODED=1`). CWE-20. Severity high.
+
+A name without `%` is not a finding.
+
+## Remediation
+
+Depend on the package by its registry name, without percent-encoding.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 222.

package/rules/DEPS-NAME-LENGTH-001.md

@@ -0,0 +1,11 @@
+# DEPS-NAME-LENGTH-001
+
+**Dependency name is empty or longer than 214 characters.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_NAME_LENGTH=1`). CWE-1284. Severity high.
+
+npm's documented package name limit is 214 characters. A normal name is not a finding.
+
+## Remediation
+
+Use a package name within npm's 214 character limit.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 220.

package/rules/DEPS-NOINTEGRITY-001.md

@@ -0,0 +1,11 @@
+# DEPS-NOINTEGRITY-001
+
+**Registry tarball has no integrity.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_NOINTEGRITY=1`). CWE-353. Severity high.
+
+resolved is an https registry.npmjs.org URL and integrity is missing or empty. link: and file: rows are not this finding.
+
+## Remediation
+
+Regenerate the lockfile so the entry has a sha512 integrity.
+
+See `SECURITY_SCANNER_SPEC.md` phase 116.

package/rules/DEPS-NONSEMVER-001.md

@@ -0,0 +1,11 @@
+# DEPS-NONSEMVER-001
+
+**Locked version is not semver.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_NONSEMVER=1`). CWE-1104. Severity medium.
+
+A locked version is not MAJOR.MINOR.PATCH with an optional prerelease. Git shas, file: specs, *, and empty versions match. The locked text is not rewritten for an advisory lookup.
+
+## Remediation
+
+Lock a MAJOR.MINOR.PATCH release from the registry.
+
+See `SECURITY_SCANNER_SPEC.md` phase 112.

package/rules/DEPS-NORESOLVED-001.md

@@ -0,0 +1,11 @@
+# DEPS-NORESOLVED-001
+
+**Semver packages entry has no resolved URL.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_NORESOLVED=1`). CWE-829. Severity medium.
+
+A packages entry has a semver version and no resolved URL. The root "" entry and link: workspace rows are excluded. A row whose only fields are version, name, and license is not an install record and is excluded.
+
+## Remediation
+
+Regenerate the lockfile so the package has a resolved tarball URL.
+
+See `SECURITY_SCANNER_SPEC.md` phase 113.

package/rules/DEPS-NPMALIAS-001.md

@@ -0,0 +1,11 @@
+# DEPS-NPMALIAS-001
+
+**npm alias name does not match the target.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_ALIAS=1`). CWE-829. Severity medium.
+
+A lock key or manifest spec uses npm: and the requested name differs from the target name. The finding is on the requested name and records the target name@version. npm:same-name@1.2.3 is not a finding.
+
+## Remediation
+
+Depend on the target package directly.
+
+See `SECURITY_SCANNER_SPEC.md` phase 121.

package/rules/DEPS-NPMRC-HOME-001.md

@@ -0,0 +1,11 @@
+# DEPS-NPMRC-HOME-001
+
+**Home .npmrc registry is not registry.npmjs.org.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_NPMRC_HOME=1`). CWE-494. Severity medium.
+
+This is the `scan --include-home` check. The real user home is not read. The test hook is `FULLSHIELD_NPM_HOME`: when that variable is set, this rule reads `$FULLSHIELD_NPM_HOME/.npmrc` and nowhere else outside the project. It also reads a scan file whose path is exactly `home/.npmrc`. Without the variable and without that path, no home file is opened. The default host `registry.npmjs.org` is not a finding. Token values are not printed. A token in `~/.npmrc` is out of scope (the file is not committed).
+
+## Remediation
+
+Point the home registry at https://registry.npmjs.org/.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 139.

package/rules/DEPS-NPMRC-REG-001.md

@@ -0,0 +1,11 @@
+# DEPS-NPMRC-REG-001
+
+**Committed .npmrc registry is not registry.npmjs.org.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_NPMRC_REG=1`). CWE-494. Severity high.
+
+A committed `.npmrc` sets `registry=` or `@scope:registry=` to an `http:` or `https:` URL whose host is not `registry.npmjs.org`. That host, and a file that contains only comments, are not this finding. Token values are not printed.
+
+## Remediation
+
+Point registry at https://registry.npmjs.org/ or remove the line.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 137.

package/rules/DEPS-NPMRC-SCRIPT-001.md

@@ -0,0 +1,11 @@
+# DEPS-NPMRC-SCRIPT-001
+
+**Committed .npmrc sets ignore-scripts=false.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_NPMRC_SCRIPT=1`). CWE-829. Severity info.
+
+A committed `.npmrc` sets `ignore-scripts=false`. `ignore-scripts=true`, and a file with no such key, are not this finding. This is informational. It does not mean the project is compromised.
+
+## Remediation
+
+Set ignore-scripts=true and list the installers you accept in trustedDependencies.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 138.

package/rules/DEPS-OPTIONAL-IMPORT-001.md

@@ -0,0 +1,11 @@
+# DEPS-OPTIONAL-IMPORT-001
+
+**Optional dependency imported outside try/catch.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_OPTIONAL=1`). CWE-703. Severity low.
+
+Production code imports a package the lock marks optional: true and the import is not inside a try/catch. An import inside try/catch, or a package that is not optional, is not a finding. This does not change an advisory on that package.
+
+## Remediation
+
+Import the package inside try/catch, or make the dependency required.
+
+See `SECURITY_SCANNER_SPEC.md` phase 124.

package/rules/DEPS-OSCPU-001.md

@@ -0,0 +1,11 @@
+# DEPS-OSCPU-001
+
+**Direct production package excludes this os or cpu.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_OSCPU=1`). CWE-1104. Severity info.
+
+A direct production lock entry has `os` or `cpu` that excludes `process.platform` or `process.arch`. An array that includes the current value, and an empty field, are not this finding. The package is still sent to OSV.
+
+## Remediation
+
+Confirm the install is intentional for this os and cpu. This finding is informational.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 147.

package/rules/DEPS-OVERRIDE-ALIAS-001.md

@@ -0,0 +1,11 @@
+# DEPS-OVERRIDE-ALIAS-001
+
+**Override installs a different package name.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_OVERRIDE_ALIAS=1`). CWE-829. Severity high.
+
+An override value is `npm:other@version` and `other` is not the overridden package name. An exact version is not this finding. This row is the manifest override only.
+
+## Remediation
+
+Override to the same package name, or remove the npm: alias.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 135.

package/rules/DEPS-OVERRIDE-VULN-001.md

@@ -0,0 +1,11 @@
+# DEPS-OVERRIDE-VULN-001
+
+**Override pins a version the OSV cache marks affected.** Experimental (`FULLSHIELD_EXPERIMENTAL_NPM_OVERRIDE_VULN=1`). CWE-1104. Severity high.
+
+`overrides`, `resolutions`, or `pnpm.overrides` pins one exact version, and `{cache}/osv/<name>@<version>.json` lists at least one advisory. The message cites that OSV id. A missing cache file, or a file whose `vulns` array is empty, is not a finding. This check does not invent an advisory and does not contact the network.
+
+## Remediation
+
+Pin a version that the OSV cache does not list as affected.
+
+See `SECURITY_SCANNER_SPEC.md` Section 47 phase 133.