secret-blast-radius 0.2.0 → 0.3.0

package/src/format.js

@@ -16,6 +16,7 @@ export function formatText(result, { color = false } = {}) {
     inc.checklist.forEach((x, i) => lines.push(`  ${i + 1}. ${x}`));
     lines.push('', ...inc.refs.map((r) => `  ${c('2', r)}`), '', c('1', 'What this machine/project has that matters for this incident:'), '');
   }
+  if (result.osvQueried != null) lines.push(c('2', `OSV: checked ${result.osvQueried} package versions against MAL- advisories (online, opt-in).`), '');
   if (!result.findings.length) {
     lines.push(result.incident ? 'Nothing relevant found by these checks.' : 'No reachable secrets found in the places checked. Nice.');
     return lines.join('\n');
@@ -45,7 +46,10 @@ export function formatMarkdown(result) {
   rb.forEach((step, i) => {
     out.push(`## ${i + 1}. ${step.label}`, '');
     for (const it of step.items) out.push(`- [ ] **${it.title}** — \`${it.location}\`${it.fingerprint ? ` (${it.fingerprint})` : ''}`);
-    out.push('', ...step.steps.map((s) => `1. ${s}`), '', `Reference: ${step.url}`, '');
+    out.push('', ...step.steps.map((s) => `1. ${s}`), '');
+    if (step.verify?.length) out.push('**Verify the old credential is dead:**', '', ...step.verify.map((v) => `- ${v}`), '');
+    if (step.redeploy) out.push('**Redeploy** after updating: running processes keep the old value until restart.', '');
+    out.push(`Docs: ${step.docs.map(([t, u]) => `[${t}](${u})`).join(' · ')}`, '');
   });
   return out.join('\n');
 }

package/src/incidents.js

@@ -13,6 +13,17 @@ export const INCIDENTS = {
     ],
     refs: ['https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/', 'https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching'],
   },
+  glassworm: {
+    title: 'GlassWorm — malicious and sleeper Open VSX / VS Code extensions (Mar–Oct 2026)',
+    status: 'Confirmed by Socket research; extensions removed from Open VSX after reports. Sleeper extensions were benign when published and are flagged as high risk, not proven malicious.',
+    scanners: ['extensions', 'persistence', 'host-persistence', 'github', 'npm'],
+    checklist: [
+      'Uninstall every flagged extension in every editor (VS Code, Cursor, Windsurf, VSCodium, remote servers). Extension packs can pull a flagged extension in transitively.',
+      'From a clean machine, rotate GitHub, npm and Open VSX tokens and move crypto wallets: these are what GlassWorm steals.',
+      'Turn off extension auto-update for publishers you do not know; prefer verified publishers.',
+    ],
+    refs: ['https://socket.dev/blog/open-vsx-transitive-glassworm-campaign', 'https://socket.dev/blog/73-open-vsx-sleeper-extensions-glassworm', 'https://socket.dev/blog/glassworm-loader-hits-open-vsx-via-suspected-developer-account-compromise'],
+  },
   railway: {
     title: 'Railway environment-variable exposure (disclosed Oct 21, 2026)',
     status: 'Confirmed by Railway; scope still being determined ("may be limited to a subset of users"). Railway advises all users to act.',
@@ -29,7 +40,7 @@ export const INCIDENTS = {
   tensorlake: {
     title: 'tensorlake@0.5.144 — Mini Shai-Hulud worm with gh-token-monitor dead-man\'s switch (Oct 8, 2026)',
     status: 'Confirmed by the maintainer (GHSA-8g63-53c9-65j2), Socket, StepSecurity and Aikido.',
-    scanners: ['malicious', 'persistence', 'host-persistence', 'repo', 'npm', 'github', 'cloud', 'kubernetes', 'ssh', 'ai', 'dotenv', 'env'],
+    scanners: ['malicious', 'npm-cache', 'history', 'ecosystems', 'persistence', 'host-persistence', 'repo', 'npm', 'github', 'cloud', 'kubernetes', 'ssh', 'ai', 'dotenv', 'env'],
     checklist: [
       'Search lockfiles and CI logs for tensorlake@0.5.144 and tensorlake-native-*@0.5.144 (live 01:12–02:54 UTC, Oct 8).',
       'If it ran: disconnect, then REMOVE gh-token-monitor before revoking any GitHub token (revocation triggers `rm -rf ~`).',
@@ -42,7 +53,7 @@ export const INCIDENTS = {
   subql: {
     title: '@subql/common@5.8.3 — credential stealer + remote shell (Oct 5, 2026)',
     status: 'Confirmed: GHSA-9333-3c4x-x3h5 / MAL-2026-17571; analysed by StepSecurity and GMO Flatt Security.',
-    scanners: ['malicious', 'host-persistence', 'cloud', 'github', 'npm', 'ssh', 'kubernetes', 'env', 'dotenv'],
+    scanners: ['malicious', 'npm-cache', 'history', 'ecosystems', 'host-persistence', 'cloud', 'github', 'npm', 'ssh', 'kubernetes', 'env', 'dotenv'],
     checklist: [
       'Search lockfiles, caches and CI logs for @subql/common@5.8.3. 5.8.2 is the last known-good release.',
       '`--ignore-scripts` is NOT enough: importing the package also starts the payload.',
@@ -55,7 +66,7 @@ export const INCIDENTS = {
   ghostaction: {
     title: 'GhostAction — malicious "security audit" workflows + VS Code fake-font stealer (Oct 7–15, 2026)',
     status: 'Confirmed by StepSecurity, Socket, GitGuardian and OpenSourceMalware. ~1,900 accounts, 30,000+ repos targeted.',
-    scanners: ['repo', 'host-persistence', 'github', 'npm', 'cloud', 'kubernetes', 'ssh', 'ai'],
+    scanners: ['repo', 'host-persistence', 'github', 'npm', 'cloud', 'kubernetes', 'ssh', 'ai', 'ecosystems'],
     checklist: [
       'Revoke GitHub sessions, PATs, OAuth grants (incl. client ID Ov23ctrqCqZ79UaYKwyq), SSH and deploy keys FIRST: deleting the workflow does not revoke the token that pushed it.',
       'In every repo you can write to, remove workflows contacting 193.32.204.199 (security-audit.yml, lint.yml, ci-check.yml, …), .vscode/tasks.json "eslint-check" tasks and public/fonts/*.woff2 files that are really JS.',

package/src/index.js

@@ -4,12 +4,13 @@ import { spawnSync } from 'node:child_process';
 import { SCANNERS } from './scanners.js';
 import { SUPPLY_SCANNERS, loadIocs } from './supply.js';
 import { INCIDENTS } from './incidents.js';
+import { V3_SCANNERS, osvMalicious } from './v3.js';
 
-export const ALL_SCANNERS = { ...SCANNERS, ...SUPPLY_SCANNERS };
+export const ALL_SCANNERS = { ...SCANNERS, ...SUPPLY_SCANNERS, ...V3_SCANNERS };
 
 function defaultExec(cmd, args) {
   try {
-    const r = spawnSync(cmd, args, { encoding: 'utf8', timeout: 4000, windowsHide: true, stdio: ['ignore', 'pipe', 'ignore'] });
+    const r = spawnSync(cmd, args, { encoding: 'utf8', timeout: cmd === 'git' ? 30000 : 4000, maxBuffer: 256 * 1024 * 1024, windowsHide: true, stdio: ['ignore', 'pipe', 'ignore'] });
     return r.status === 0 ? r.stdout : null;
   } catch {
     return null;
@@ -18,73 +19,108 @@ function defaultExec(cmd, args) {
 
 export const SEVERITY = ['critical', 'high', 'medium', 'low'];
 
-/** Order in which to rotate after a suspected compromise. Lower = earlier. */
+/**
+ * Rotation plan v2. Order = what to do first after a suspected compromise (lower = earlier).
+ * steps: what to do; verify: how to confirm the old credential is dead; docs: provider docs the text is based on.
+ */
 export const ROTATION = {
   persistence: {
-    order: 0, label: 'Stop the worm first',
+    order: 0, label: 'Stop the malware first (worm services, malicious packages/extensions)',
     steps: [
-      'Disconnect the machine from the network.',
+      'Disconnect the machine from the network. Do every rotation below from a different, clean machine.',
       'Remove gh-token-monitor BEFORE revoking any GitHub token (revoking first triggers `rm -rf ~`). Linux: `systemctl --user disable --now gh-token-monitor.service`; macOS: `launchctl bootout gui/$(id -u) ~/Library/LaunchAgents/com.user.gh-token-monitor.plist`; Windows: delete the gh-token-monitor scheduled task.',
-      'Do every rotation below from a different, clean machine, then rebuild this one.',
+      'Uninstall flagged editor extensions and remove known-bad package versions; check crontab, systemd user units, LaunchAgents and .vscode/tasks.json for anything you did not add.',
+      'Then rebuild or reimage the machine; removing the package does not undo what its install script already did.',
     ],
-    url: 'https://github.com/tensorlakeai/tensorlake/security/advisories/GHSA-8g63-53c9-65j2',
+    verify: ['`systemctl --user list-units | grep -i token`, `crontab -l`, `ls ~/Library/LaunchAgents` show nothing unexpected.'],
+    docs: [['tensorlake advisory (GHSA-8g63-53c9-65j2)', 'https://github.com/tensorlakeai/tensorlake/security/advisories/GHSA-8g63-53c9-65j2'], ['CISA: widespread npm supply chain compromise', 'https://www.cisa.gov/news-events/alerts/2025/09/23/widespread-supply-chain-compromise-impacting-npm-ecosystem']],
   },
   npm: {
-    order: 1, label: 'npm publish tokens (stops the worm republishing your packages)',
-    steps: ['Revoke every token: `npm token list` then `npm token revoke <id>`, or npmjs.com → Access Tokens.', 'Check your packages for versions you did not publish: `npm view <pkg> time`.', 'Move publishing to trusted publishing (OIDC) or granular tokens with expiry.'],
-    url: 'https://docs.npmjs.com/revoking-access-tokens',
+    order: 1, label: 'Package registry tokens: npm, PyPI, RubyGems, crates.io, Composer (stops a worm republishing your packages)',
+    steps: [
+      'npm: `npm token list`, then `npm token delete <id>` for each (use the token ID, not the truncated token), or npmjs.com → Access Tokens. npm notes revocation can take up to an hour.',
+      'PyPI: delete the token under Account settings → API tokens; recreate it scoped to one project, or switch to Trusted Publishing.',
+      'RubyGems: delete the key at rubygems.org → Settings → API keys (delete `legacy-key` if present); `gem signout` then `gem signin` with a gem-scoped key with an expiry and MFA.',
+      'crates.io: revoke at crates.io/settings/tokens; `cargo logout`, set `registry.global-credential-providers` to an OS keychain provider, `cargo login`.',
+      'Look for versions you did not publish: `npm view <pkg> time`, your PyPI/RubyGems/crates.io project history.',
+      'Move CI publishing to trusted publishing (OIDC). Provenance proves where a package was built, not that it is safe: @subql/common@5.8.3 and tensorlake@0.5.144 both shipped with valid provenance.',
+    ],
+    verify: ['`npm token list` no longer shows the old ID; `npm whoami` with the old token fails (allow up to an hour).'],
+    docs: [['npm: Revoking access tokens', 'https://docs.npmjs.com/revoking-access-tokens'], ['PyPI help: API tokens', 'https://pypi.org/help/#apitoken'], ['RubyGems: API key scopes', 'https://guides.rubygems.org/api-key-scopes/'], ['Cargo: registry authentication', 'https://doc.rust-lang.org/cargo/reference/registry-authentication.html'], ['npm trusted publishing', 'https://docs.npmjs.com/trusted-publishers']],
   },
   github: {
     order: 2, label: 'GitHub tokens and sessions',
-    steps: ['`gh auth logout` then `gh auth login` (stores the new token in the OS keyring).', 'Revoke old PATs and OAuth apps: github.com/settings/tokens and /settings/applications.', 'Look for commits you did not make (e.g. author "claude", message "chore: update dependencies") and unexpected workflows or branches.'],
-    url: 'https://github.com/settings/tokens',
+    steps: [
+      'Make sure persistence is gone first (step above).',
+      'Revoke PATs at github.com/settings/tokens and OAuth/GitHub App authorizations at /settings/applications; `gh auth logout` then `gh auth login` (stores the new token in the OS keyring).',
+      'Replace classic `ghp_` tokens with fine-grained tokens that have an expiry and only the repos they need.',
+      'Review your security log for `oauth_authorization` and token events, and repos for commits, branches or workflows you did not create.',
+    ],
+    verify: ['`gh api user` with the old token returns 401; the token is gone from /settings/tokens.'],
+    docs: [['GitHub: token expiration and revocation', 'https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/token-expiration-and-revocation'], ['GitHub: managing personal access tokens', 'https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens']],
   },
   cloud: {
-    order: 3, label: 'Cloud credentials',
-    steps: ['AWS: deactivate then delete the access key in IAM, create a new one, or better, switch to `aws sso login`.', 'GCP: `gcloud auth application-default revoke`; delete service-account keys in IAM.', 'Azure: `az logout`, revoke sessions in Entra ID.', 'Review CloudTrail / audit logs for activity from unknown IPs.'],
-    url: 'https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html#rotating_access_keys_console',
+    order: 3, label: 'Cloud and IaC credentials (AWS, GCP, Azure, Terraform, Pulumi)',
+    steps: [
+      'AWS: create a new access key, update users of it, deactivate the old key, confirm nothing breaks, then delete it. Better: `aws sso login` (short-lived).',
+      'GCP: `gcloud auth application-default revoke`; delete exposed service-account keys in IAM.',
+      'Azure: `az logout`; revoke sessions for the user in Entra ID.',
+      'Terraform/Pulumi: `terraform logout` / `pulumi logout`, delete the token in HCP Terraform / Pulumi Cloud, log in again. Rotate secrets that sit in local .tfstate files.',
+      'Review CloudTrail / audit logs (including SSM Parameter Store and Secrets Manager reads) from the exposure window.',
+    ],
+    verify: ['`aws iam list-access-keys` shows the old key as deleted; calls with it return InvalidClientTokenId.'],
+    docs: [['AWS: rotate access keys', 'https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html#rotating_access_keys_console'], ['gcloud auth application-default revoke', 'https://cloud.google.com/sdk/gcloud/reference/auth/application-default/revoke']],
   },
   kubernetes: {
     order: 4, label: 'Kubernetes and container registries',
-    steps: ['Rotate service-account tokens / client certs referenced by your kubeconfig.', '`docker logout <registry>` and revoke the registry token in its UI; then set "credsStore".'],
-    url: 'https://kubernetes.io/docs/reference/access-authn-authz/service-accounts-admin/',
+    steps: ['Rotate service-account tokens / client certs referenced by your kubeconfig.', '`docker logout <registry>`, revoke the registry token in its UI, then set "credsStore" so new logins go to the OS keychain.'],
+    verify: ['`kubectl auth whoami` with the old credential fails.'],
+    docs: [['Kubernetes: service accounts', 'https://kubernetes.io/docs/reference/access-authn-authz/service-accounts-admin/'], ['Docker: credential stores', 'https://docs.docker.com/reference/cli/docker/login/#credential-stores']],
+  },
+  paas: {
+    order: 5, label: 'Deploy platforms (Railway, Vercel, Fly, Render, Heroku, Netlify)', redeploy: true,
+    steps: ['Rotate every secret stored in the platform\'s env store at its provider (DB, Stripe, AI keys), then update the variable.', 'Redeploy: services read env vars at start-up.', 'Log the CLI out and back in, and revoke old platform tokens.'],
+    verify: ['The old DB password / API key is rejected by its provider; the redeployed service is healthy.'],
+    docs: [['Railway security disclosure (Oct 21, 2026)', 'https://blog.railway.com/p/security-disclosure-wednesday-october-21st']],
   },
   env: {
-    order: 5, label: 'Secrets present in the environment / CI',
+    order: 6, label: 'Secrets present in the environment / CI', redeploy: true,
     steps: ['Rotate each listed variable at its provider and update the CI secret store.', 'In CI, pass secrets only to the steps that need them, never to `npm install`.'],
-    url: 'https://docs.github.com/en/actions/security-for-github-actions/security-guides/using-secrets-in-github-actions',
+    verify: ['Re-run this tool in CI: the variable no longer appears in the install step.'],
+    docs: [['GitHub Actions: using secrets', 'https://docs.github.com/en/actions/security-for-github-actions/security-guides/using-secrets-in-github-actions']],
   },
   ai: {
-    order: 6, label: 'AI provider keys and MCP servers',
-    steps: ['Revoke and reissue the keys in each provider console (OpenAI, Anthropic, etc.).', 'Replace literal values in MCP configs with "${ENV_VAR}" references.'],
-    url: 'https://blog.trailofbits.com/2025/04/30/insecure-credential-storage-plagues-mcp/',
+    order: 7, label: 'AI provider keys and MCP servers',
+    steps: ['Revoke and reissue the keys in each provider console (OpenAI, Anthropic, etc.).', 'Replace literal values in MCP configs with "${ENV_VAR}" references; pin MCP server package versions instead of `npx -y <pkg>`.'],
+    verify: ['A request with the old key returns 401.'],
+    docs: [['Trail of Bits: insecure credential storage in MCP', 'https://blog.trailofbits.com/2025/04/30/insecure-credential-storage-plagues-mcp/']],
   },
   ssh: {
-    order: 7, label: 'SSH keys',
+    order: 8, label: 'SSH keys',
     steps: ['Generate a new key (`ssh-keygen -t ed25519`) with a passphrase.', 'Replace the public key on GitHub/GitLab and in every server\'s authorized_keys; remove the old one.'],
-    url: 'https://docs.github.com/en/authentication/connecting-to-github-with-ssh/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent',
+    verify: ['`ssh -i <old key> git@github.com` is denied.'],
+    docs: [['GitHub: generating a new SSH key', 'https://docs.github.com/en/authentication/connecting-to-github-with-ssh/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent']],
   },
-  paas: {
-    order: 5.5, label: 'Deploy platforms (Railway, Vercel, Fly, Render, Heroku, Netlify)',
-    steps: ['Rotate every secret stored in the platform\'s env store at its provider (DB, Stripe, AI keys), then update the variable.', 'Redeploy: services read env vars at start-up.', 'Log the CLI out and back in, and revoke old platform tokens.'],
-    url: 'https://blog.railway.com/p/security-disclosure-wednesday-october-21st',
+  dotenv: {
+    order: 9, label: 'Application secrets in .env files', redeploy: true,
+    steps: ['Rotate database passwords, payment keys and webhook secrets at each provider.', 'Redeploy: most platforms only read env vars at process start.'],
+    verify: ['The old value is rejected by its provider.'],
+    docs: [['The Twelve-Factor App: config', 'https://12factor.net/config']],
   },
   php: {
-    order: 9, label: 'Patch PHP (PHP2Shell)',
+    order: 10, label: 'Patch PHP (PHP2Shell)', redeploy: true,
     steps: ['Update to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 or later; PHP ≤ 8.1 must be upgraded.', 'Rebuild images with --pull --no-cache and restart all PHP workers.'],
-    url: 'https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching',
+    verify: ['`php -v` in each running container shows a fixed version.'],
+    docs: [['CISA alert (Oct 21, 2026)', 'https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching']],
   },
   certs: {
-    order: 10, label: 'Replace certificates under emSign ECC Root CA - G3',
+    order: 11, label: 'Replace certificates under emSign ECC Root CA - G3',
     steps: ['Issue a replacement certificate from another CA before Oct 27, 2026.', 'Remove the root from custom trust bundles.'],
-    url: 'https://blog.google/security/protecting-chrome-and-android-users-from-compromised-emudhra-intermediate-ca-certificates/',
-  },
-  dotenv: {
-    order: 8, label: 'Application secrets in .env files',
-    steps: ['Rotate database passwords, payment keys and webhook secrets at each provider.', 'Redeploy: most platforms only read env vars at process start.'],
-    url: 'https://12factor.net/config',
+    verify: ['`openssl s_client -connect host:443` shows the new issuer.'],
+    docs: [['Google: compromised eMudhra intermediates', 'https://blog.google/security/protecting-chrome-and-android-users-from-compromised-emudhra-intermediate-ca-certificates/']],
   },
 };
+for (const r of Object.values(ROTATION)) r.url = r.docs[0][1];
 
 export function scan(options = {}) {
   const ctx = {
@@ -95,6 +131,7 @@ export function scan(options = {}) {
     iocs: options.iocs ?? loadIocs(options.iocFiles ?? []),
     exec: options.exec === false ? null : options.exec ?? defaultExec,
     checkTmp: options.checkTmp ?? options.home === undefined,
+    history: options.history ?? null, // {since?: string}
   };
   let onlyList = options.only;
   if (options.incident) {
@@ -110,9 +147,24 @@ export function scan(options = {}) {
     if ((only && !only.has(name)) || skip.has(name)) continue;
     findings.push(...fn(ctx));
   }
+  return finish(ctx, options, findings);
+}
+
+/** Same as scan(), plus the opt-in OSV lookup (network) when options.osv is set. */
+export async function scanAsync(options = {}) {
+  const result = scan(options);
+  if (!options.osv) return result;
+  const ctx = { home: result.home, projects: result.projects, depth: options.depth ?? 4, iocs: { updated: result.iocsUpdated } };
+  const { findings: osv, queried } = await osvMalicious(ctx, options.osvOptions);
+  const known = new Set(result.findings.filter((f) => f.id === 'supply.malicious-version').map((f) => f.title.split(' ')[2] + '|' + f.location));
+  const findings = osv.filter((f) => !known.has(f.title.split(' ')[2] + '|' + f.location));
+  return { ...finish(ctx, options, [...result.findings, ...findings]), osvQueried: queried };
+}
+
+function finish(ctx, options, findings) {
   findings.sort((a, b) => SEVERITY.indexOf(a.severity) - SEVERITY.indexOf(b.severity) || (ROTATION[a.category]?.order ?? 99) - (ROTATION[b.category]?.order ?? 99));
   const counts = Object.fromEntries(SEVERITY.map((s) => [s, findings.filter((f) => f.severity === s).length]));
-  return { scannedAt: new Date().toISOString(), home: ctx.home, projects: ctx.projects, iocsUpdated: ctx.iocs.updated, incident: options.incident, counts, findings };
+  return { scannedAt: new Date().toISOString(), home: ctx.home, projects: ctx.projects, iocsUpdated: ctx.iocs?.updated ?? options.iocsUpdated, incident: options.incident, counts, findings };
 }
 
 export function runbook(result) {

package/src/scanners.js

@@ -54,7 +54,7 @@ export function scanNpmrc(ctx) {
           (publishable
             ? 'Any install script can read this and republish every package you maintain (this is how Shai-Hulud spreads). '
             : 'Any install script can read this registry credential. ') +
-          'Prefer short-lived tokens or npm trusted publishing (OIDC) from CI.',
+          'Prefer short-lived tokens or npm trusted publishing (OIDC) from CI.' + tokenHint(value),
       });
     }
   }
@@ -73,6 +73,15 @@ export function scanPypirc(ctx) {
 }
 
 /* ---------------- 2. GitHub ---------------- */
+/** Least-privilege hint from the token's public prefix only (never the value). */
+export function tokenHint(v) {
+  if (/^ghp_/.test(v)) return ' This is a classic PAT (ghp_): classic tokens can reach every repo you can; prefer a fine-grained token with an expiry.';
+  if (/^gho_/.test(v)) return ' OAuth token (gho_): it stays valid until revoked or unused for a year.';
+  if (/^npm_/.test(v)) return ' Check at npmjs.com → Access Tokens whether it is a granular token with an expiry and 2FA bypass off.';
+  if (/^(AKIA)/.test(v)) return ' Long-lived IAM user key (AKIA); temporary credentials (ASIA, via SSO/STS) expire on their own.';
+  return '';
+}
+
 export function scanGitHub(ctx) {
   const out = [];
   const hosts = [join(ctx.home, '.config', 'gh', 'hosts.yml'), join(ctx.home, 'AppData', 'Roaming', 'GitHub CLI', 'hosts.yml')];
@@ -90,7 +99,7 @@ export function scanGitHub(ctx) {
         title: 'GitHub CLI token stored in plaintext',
         location: tilde(ctx, f),
         fingerprint: fingerprint(m[1]),
-        detail: 'gh fell back to a plaintext file (no OS keyring). Install scripts can read it and push to every repo you can write to.',
+        detail: 'gh fell back to a plaintext file (no OS keyring). Install scripts can read it and push to every repo you can write to.' + tokenHint(m[1]),
       });
     }
   }
@@ -107,7 +116,7 @@ export function scanGitHub(ctx) {
         title: `Plaintext git credential for ${m[3]}`,
         location: tilde(ctx, gitCreds),
         fingerprint: fingerprint(m[2]),
-        detail: 'git credential.helper=store keeps passwords/tokens unencrypted. Switch to the OS credential manager.',
+        detail: 'git credential.helper=store keeps passwords/tokens unencrypted. Switch to the OS credential manager.' + tokenHint(decodeURIComponent(m[2])),
       });
     }
   }
@@ -236,6 +245,16 @@ function mcpServersFrom(obj, path = []) {
   return found;
 }
 
+export function unpinnedNpx(server) {
+  if (typeof server?.command !== 'string' || !/(^|[\\/])(npx|bunx|pnpx)(\.cmd|\.exe)?$/i.test(server.command)) return null;
+  const args = (server.args || []).filter((a) => typeof a === 'string');
+  const pkg = args.find((a) => !a.startsWith('-'));
+  if (!pkg || /^[./]/.test(pkg)) return null;
+  const at = pkg.lastIndexOf('@');
+  const hasVersion = at > 0 && /^\d/.test(pkg.slice(at + 1));
+  return hasVersion ? null : pkg;
+}
+
 function literalSecretsInServer(server) {
   const hits = [];
   for (const bag of ['env', 'headers', 'http_headers']) {
@@ -288,6 +307,9 @@ export function scanAiConfigs(ctx) {
     let json;
     try { json = JSON.parse(text); } catch { continue; }
     for (const { name, server } of mcpServersFrom(json)) {
+      const pkg = unpinnedNpx(server);
+      if (pkg) out.push({ id: 'ai.mcp-unpinned', category: 'ai', severity: 'low', title: `MCP server "${name}" runs an unpinned package (${pkg})`, location: tilde(ctx, f),
+        detail: '`npx -y <pkg>` fetches whatever version is latest every time the agent starts, with your agent\'s environment. Pin an exact version (pkg@1.2.3) so a hijacked release is not pulled in automatically.' });
       for (const hit of literalSecretsInServer(server)) {
         out.push({
           id: 'ai.mcp-literal-secret', category: 'ai', severity: 'high',
@@ -377,7 +399,7 @@ export function scanDotenv(ctx) {
   for (const root of ctx.projects) {
     for (const f of walk(root, { maxDepth: ctx.depth, skip: SKIP_DIRS })) {
       const base = f.split(/[\\/]/).pop();
-      if (!/^\.env(\..+)?$/.test(base) || /\.(example|sample|template|dist|defaults|demo)$/i.test(base)) continue;
+      if (!/^\.env(\..+)?$/.test(base) || /\.(example|sample|template|dist|defaults|demo|emulated|emulator|mock)$/i.test(base)) continue;
       const text = readText(f);
       if (!text) continue;
       const secrets = parseDotenv(text).filter(([k, v]) => isSecretPair(k, v));
@@ -409,11 +431,20 @@ export function scanHardening(ctx) {
     });
   }
   const pnpmWs = ctx.projects.map((p) => readText(join(p, 'pnpm-workspace.yaml'))).filter(Boolean).join('\n');
-  if (!/min-release-age|minimum-release-age/.test(npmrcs) && !/minimumReleaseAge/.test(pnpmWs)) {
+  const yarnrc = [join(ctx.home, '.yarnrc.yml'), ...ctx.projects.map((p) => join(p, '.yarnrc.yml'))].map(readText).filter(Boolean).join('\n');
+  const bunfig = [join(ctx.home, '.bunfig.toml'), ...ctx.projects.map((p) => join(p, 'bunfig.toml'))].map(readText).filter(Boolean).join('\n');
+  const configured = /^\s*min-release-age\s*=/m.test(npmrcs) || /minimumReleaseAge\s*:/.test(pnpmWs) || /npmMinimalAgeGate\s*:/.test(yarnrc) || /^\s*minimumReleaseAge\s*=/m.test(bunfig);
+  if (!configured) {
+    const has = (f) => ctx.projects.some((p) => exists(join(p, f)));
+    const tips = [];
+    if (has('package-lock.json') || !(has('pnpm-lock.yaml') || has('yarn.lock') || has('bun.lock'))) tips.push('npm ≥ 11.10: `min-release-age=3` in .npmrc (days)');
+    if (has('pnpm-lock.yaml')) tips.push('pnpm ≥ 10.16: `minimumReleaseAge: 4320` in pnpm-workspace.yaml (minutes; pnpm 11 defaults to 1440)');
+    if (has('yarn.lock')) tips.push('Yarn Berry: `npmMinimalAgeGate: 4320` in .yarnrc.yml (minutes)');
+    if (has('bun.lock')) tips.push('Bun ≥ 1.3: `[install] minimumReleaseAge = 259200` in bunfig.toml (seconds)');
     out.push({
       id: 'hardening.release-age', category: 'hardening', severity: 'low',
-      title: 'No dependency cooldown configured', location: '.npmrc',
-      detail: 'Malicious versions are usually pulled within hours. `min-release-age=3` (npm ≥ 11.10, days) or `minimumReleaseAge: 4320` (pnpm, minutes) keeps you out of that window.',
+      title: 'No dependency cooldown configured', location: 'package manager config',
+      detail: `Malicious versions are usually pulled within hours. ${tips.join('; ')}. A cooldown would not have caught a compromise that went unnoticed for longer.`,
     });
   }
   return out;

package/src/supply.js

@@ -9,10 +9,11 @@ const rel = (root, p) => relative(root, p).replace(/\\/g, '/') || basename(p);
 const tilde = (ctx, p) => (p.startsWith(ctx.home) ? '~' + p.slice(ctx.home.length).replace(/\\/g, '/') : p);
 
 export function loadIocs(extraFiles = []) {
-  const merged = { updated: BUNDLED.updated, packages: [...BUNDLED.packages], markers: structuredClone(BUNDLED.markers) };
+  const merged = { updated: BUNDLED.updated, packages: [...BUNDLED.packages], extensions: [], markers: structuredClone(BUNDLED.markers) };
   for (const f of extraFiles) {
     const j = JSON.parse(readFileSync(f, 'utf8'));
     merged.packages.push(...(j.packages || []));
+    merged.extensions.push(...(j.extensions || []));
     for (const [k, v] of Object.entries(j.markers || {})) merged.markers[k] = [...new Set([...(merged.markers[k] || []), ...v])];
     if (j.updated && j.updated > merged.updated) merged.updated = j.updated;
   }

package/src/util.js

@@ -72,6 +72,7 @@ const SECRET_NAME = /(^|_|-)(api[-_]?key|apikey|token|secret|password|passwd|pwd
 const NOT_SECRET_NAME = /(^|_)(public|publishable|anon|pk|next_public|vite|expo_public|token_url|auth_url|auth_domain|endpoint|region|ttl|expir[a-z]*|length|limit|max|timeout|path|file|enabled|disable|issuer|audience)(_|$)/i;
 
 export function looksLikeSecretName(name) {
+  if (/^(OLD)?PWD$/i.test(name)) return false; // shell's working directory, not a password
   return SECRET_NAME.test(name) && !NOT_SECRET_NAME.test(name);
 }