security-mcp 1.1.4 → 1.3.3

package/dist/gate/checks/dependencies.js

@@ -58,6 +58,131 @@ async function fetchScorecardScore(dep) {
         return null;
     }
 }
+// Known public registry scopes — scoped packages under these are NOT private
+const KNOWN_PUBLIC_SCOPES = new Set([
+    "@types", "@babel", "@testing-library", "@jest", "@storybook", "@emotion",
+    "@mui", "@angular", "@vue", "@svelte", "@nestjs", "@aws-sdk", "@google-cloud",
+    "@azure", "@microsoft", "@graphql-codegen", "@typescript-eslint", "@eslint",
+    "@rollup", "@vitejs", "@vitest", "@remix-run", "@next", "@vercel", "@sentry",
+    "@opentelemetry", "@prisma", "@trpc", "@tanstack", "@radix-ui", "@headlessui",
+    "@tailwindcss", "@postcss", "@node-red", "@npmcli"
+]);
+async function checkDependencyConfusion() {
+    const findings = [];
+    try {
+        let pkgRaw;
+        try {
+            pkgRaw = await readFile("package.json", "utf8");
+        }
+        catch {
+            return [];
+        }
+        const pkg = JSON.parse(pkgRaw);
+        const allDeps = {
+            ...pkg.dependencies,
+            ...pkg.devDependencies
+        };
+        // Read .npmrc for private registry scope routing
+        let npmrcContent = "";
+        try {
+            npmrcContent = await readFile(".npmrc", "utf8");
+        }
+        catch {
+            // .npmrc absent
+        }
+        const unprotectedScopes = [];
+        for (const name of Object.keys(allDeps)) {
+            if (!name.startsWith("@"))
+                continue;
+            const scope = name.split("/")[0]; // e.g. "@mycompany"
+            if (!scope)
+                continue;
+            if (KNOWN_PUBLIC_SCOPES.has(scope))
+                continue;
+            // Check if .npmrc has a registry entry for this scope
+            // e.g. @mycompany:registry=https://npm.mycompany.com
+            const escapedScope = scope.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+            const scopeRegistryRe = new RegExp(`${escapedScope}\\s*:.*registry\\s*=|registry\\s*=.*${escapedScope}`, "i");
+            if (!scopeRegistryRe.test(npmrcContent)) {
+                unprotectedScopes.push(`${name} (scope ${scope} has no private registry entry in .npmrc)`);
+            }
+        }
+        // Also check for common typosquat vectors against critical ecosystem packages
+        const EXTENDED_TYPOSQUATS = {
+            "prism": "prisma",
+            "prismaa": "prisma",
+            "nextjs": "next",
+            "nextt": "next",
+            "nuxt3": "nuxt",
+            "vue3": "vue",
+            "sveltejs": "svelte",
+            "mongoosejs": "mongoose",
+            "sequelizejs": "sequelize",
+            "passportjs": "passport",
+            "jsonwebtoken-": "jsonwebtoken",
+            "bcryptjs-": "bcrypt",
+            "multerjs": "multer",
+            "axiosjs": "axios",
+            "socketio": "socket.io",
+            "redisjs": "redis",
+            "mysql-2": "mysql2",
+            "pgg": "pg",
+            "typeormjs": "typeorm",
+            "expressjs": "express",
+            "fastifyjs": "fastify",
+            "helmetjs": "helmet",
+            "corsjs": "cors"
+        };
+        const extendedHits = [];
+        for (const [name] of Object.entries(allDeps)) {
+            const normalized = name.toLowerCase();
+            if (EXTENDED_TYPOSQUATS[normalized]) {
+                extendedHits.push(`"${name}" (possible typo of "${EXTENDED_TYPOSQUATS[normalized]}")`);
+            }
+        }
+        if (unprotectedScopes.length > 0) {
+            findings.push({
+                id: "DEPENDENCY_CONFUSION_RISK",
+                title: `${unprotectedScopes.length} scoped package(s) lack a private registry entry in .npmrc — dependency confusion risk`,
+                severity: "HIGH",
+                evidence: unprotectedScopes.slice(0, 10),
+                requiredActions: [
+                    "Scoped packages without a private registry mapping in .npmrc will resolve from the public npm registry, enabling dependency confusion attacks.",
+                    "ATT&CK T1195.002 — an attacker can publish a higher-versioned package to the public registry under your private scope name.",
+                    "Fix: add to .npmrc: @yourscope:registry=https://your-private-registry.example.com"
+                ]
+            });
+        }
+        if (extendedHits.length > 0) {
+            findings.push({
+                id: "DEP_TYPOSQUAT_EXTENDED",
+                title: "Possible typosquatted ecosystem package name(s) detected",
+                severity: "CRITICAL",
+                evidence: extendedHits.slice(0, 10),
+                requiredActions: [
+                    "Verify each flagged package is the intended dependency — typosquatting replaces legitimate packages with malicious ones.",
+                    "Remove the package, run `npm install` with the correctly-spelled name, and audit `package-lock.json`.",
+                    "Use `npm audit` and review the package on npmjs.com before reinstalling."
+                ]
+            });
+        }
+    }
+    catch (err) {
+        console.warn("[checkDependencyConfusion] Internal error:", sanitizeErrorMessage(err instanceof Error ? err.message : String(err)));
+    }
+    return findings;
+}
+// Malicious lifecycle script patterns
+const MALICIOUS_SCRIPT_RES = [
+    /curl\s+[^\s]+\s*\|\s*(?:sh|bash)/,
+    /wget\s+[^\s]+\s*\|\s*(?:sh|bash)/,
+    /node\s+-e\s+['"`]\s*(?:eval|require|exec|spawn)/,
+    /base64\s+--decode\s*\|\s*(?:sh|bash)/,
+    /python\s+-c\s+['"`]\s*(?:import os|exec|eval)/,
+];
+function isScriptMalicious(scriptValue) {
+    return MALICIOUS_SCRIPT_RES.some((re) => re.test(scriptValue));
+}
 async function checkNpmProvenance() {
     const findings = [];
     try {
@@ -99,12 +224,38 @@ async function checkNpmProvenance() {
         catch {
             // npm not available or < v9 — skip gracefully
         }
-        // 2. OpenSSF Scorecard for top 5 production deps
+        // 2. OpenSSF Scorecard — check all prod deps and CI-executed dev deps, up to 20 total
         try {
             const pkgRaw = await readFile("package.json", "utf8");
             const pkg = JSON.parse(pkgRaw);
-            const prodDeps = Object.keys(pkg.dependencies ?? {}).slice(0, 5);
-            for (const dep of prodDeps) {
+            const prodDeps = Object.keys(pkg.dependencies ?? {});
+            // Determine which devDependencies are executed in CI scripts
+            const scriptText = Object.values(pkg.scripts ?? {}).join(" ");
+            const devDepsUsedInScripts = Object.keys(pkg.devDependencies ?? {}).filter((dep) => {
+                // Check if the dep name (or its binary form) is referenced in any script
+                const shortName = dep.replace(/^@[^/]+\//, "").replace(/-/g, "[-_]?");
+                try {
+                    return new RegExp(shortName, "i").test(scriptText);
+                }
+                catch {
+                    return false;
+                }
+            });
+            // Merge: prod deps first, then CI-executed dev deps, up to 20.
+            // CWE-200: never transmit private/internal package names to public
+            // endpoints (registry.npmjs.org / securityscorecards.dev). Skip any
+            // scoped package whose scope is not a known-public scope.
+            const depsToCheck = [...new Set([...prodDeps, ...devDepsUsedInScripts])]
+                .filter((dep) => {
+                const scope = dep.startsWith("@") ? dep.split("/")[0] : null;
+                return scope === null || KNOWN_PUBLIC_SCOPES.has(scope);
+            })
+                .slice(0, 20);
+            const totalAllDeps = prodDeps.length + Object.keys(pkg.devDependencies ?? {}).length;
+            // CWE-200: allow operators of private repos to disable all third-party
+            // network egress (scorecard/EPSS/registry lookups) with SECURITY_OFFLINE.
+            const offline = process.env["SECURITY_OFFLINE"] === "1" || process.env["SECURITY_OFFLINE"] === "true";
+            for (const dep of (offline ? [] : depsToCheck)) {
                 const score = await fetchScorecardScore(dep);
                 if (score !== null && score < 5.0) {
                     findings.push({
@@ -119,6 +270,20 @@ async function checkNpmProvenance() {
                     });
                 }
             }
+            // Report partial coverage when total deps exceed the cap
+            if (totalAllDeps > 20) {
+                findings.push({
+                    id: "SUPPLY_CHAIN_SCORECARD_PARTIAL",
+                    title: `OpenSSF Scorecard checked ${depsToCheck.length} of ${totalAllDeps} total dependencies — coverage is partial`,
+                    severity: "LOW",
+                    evidence: [`Checked: ${depsToCheck.length} deps. Unchecked: ${totalAllDeps - depsToCheck.length} deps.`],
+                    requiredActions: [
+                        `${totalAllDeps - depsToCheck.length} dependencies were not checked against OpenSSF Scorecard due to the 20-dep cap.`,
+                        "Run `npx ossf-scorecard` or review https://scorecard.dev for full coverage.",
+                        "Consider using socket.dev or Snyk for continuous supply chain monitoring across all dependencies."
+                    ]
+                });
+            }
         }
         catch {
             // package.json unreadable or API unavailable — skip
@@ -174,8 +339,18 @@ export async function checkDependencies(_) {
     findings.push(...transitive);
     const typosquat = await checkTyposquatting();
     findings.push(...typosquat);
+    const depConfusion = await checkDependencyConfusion();
+    findings.push(...depConfusion);
     const threatIntel = await checkCveExploitation();
     findings.push(...threatIntel);
+    const goSum = await checkGoSumMissing();
+    findings.push(...goSum);
+    const cargoLock = await checkCargoLockMissing();
+    findings.push(...cargoLock);
+    const lockfileSync = await checkLockfileSync();
+    findings.push(...lockfileSync);
+    const maintainerRisk = await checkMaintainerRisk();
+    findings.push(...maintainerRisk);
     return findings;
 }
 function extractCveIds(audit) {
@@ -265,35 +440,163 @@ function hasLifecycleScript(pkg) {
 function scanLockfilePackages(packages) {
     const scriptPkgs = [];
     const missingIntegrityPkgs = [];
+    const maliciousScriptPkgs = [];
     for (const [name, pkg] of Object.entries(packages)) {
         if (!name)
             continue; // skip root entry
         const pkgName = name.replace(/^node_modules\//, "");
-        if (hasLifecycleScript(pkg))
+        if (hasLifecycleScript(pkg)) {
             scriptPkgs.push(pkgName);
+            // Check each lifecycle script VALUE for malicious patterns
+            for (const scriptKey of LIFECYCLE_SCRIPTS) {
+                const scriptVal = pkg.scripts?.[scriptKey];
+                if (scriptVal && isScriptMalicious(scriptVal)) {
+                    maliciousScriptPkgs.push(`${pkgName} [${scriptKey}]: ${scriptVal.slice(0, 120)}`);
+                }
+            }
+        }
         if (pkg.version && !pkg.integrity)
             missingIntegrityPkgs.push(pkgName);
     }
-    return { scriptPkgs, missingIntegrityPkgs };
+    return { scriptPkgs, missingIntegrityPkgs, maliciousScriptPkgs };
+}
+/**
+ * Scan yarn.lock content for lifecycle script values using a regex-based approach
+ * (yarn.lock is a custom format, not JSON/YAML, so we use heuristic line scanning).
+ * We look for `postinstall`, `preinstall`, or `install` key lines followed by a value
+ * in the same stanza, and check the value for malicious patterns.
+ */
+function scanYarnLockForMaliciousScripts(content) {
+    const maliciousScriptPkgs = [];
+    const scriptPkgs = [];
+    const lines = content.split("\n");
+    let currentPkg = "";
+    for (const line of lines) {
+        // New stanza starts with a non-space character that ends with a colon (package header)
+        const pkgHeader = /^"?([^"#\s][^:]*)(?:@[^:]+)?":?\s*$/.exec(line);
+        if (pkgHeader) {
+            currentPkg = pkgHeader[1].trim();
+            continue;
+        }
+        // Lifecycle script lines inside a stanza look like:  postinstall "cmd"
+        const scriptLine = /^\s+(postinstall|preinstall|install)\s+"([^"]+)"/.exec(line);
+        if (scriptLine && currentPkg) {
+            const scriptKey = scriptLine[1];
+            const scriptVal = scriptLine[2];
+            scriptPkgs.push(`${currentPkg} [${scriptKey}]`);
+            if (isScriptMalicious(scriptVal)) {
+                maliciousScriptPkgs.push(`${currentPkg} [${scriptKey}]: ${scriptVal.slice(0, 120)}`);
+            }
+        }
+    }
+    return { maliciousScriptPkgs, scriptPkgs };
+}
+/**
+ * Scan pnpm-lock.yaml content for lifecycle script values.
+ * pnpm-lock.yaml stores scripts in `requiresBuild: true` stanzas; the actual
+ * script content is in node_modules (not the lockfile itself). We flag any
+ * package that sets `requiresBuild: true` as having a lifecycle script,
+ * and also scan for inline `scripts:` blocks using a heuristic regex.
+ */
+function scanPnpmLockForMaliciousScripts(content) {
+    const maliciousScriptPkgs = [];
+    const scriptPkgs = [];
+    const lines = content.split("\n");
+    let currentPkg = "";
+    for (const line of lines) {
+        // pnpm-lock.yaml package stanza: starts with exactly 2-space indent + "/" or name
+        const pkgHeader = /^ {2}\/?([^\s:][^:]+):$/.exec(line);
+        if (pkgHeader) {
+            currentPkg = pkgHeader[1].trim();
+            continue;
+        }
+        // requiresBuild: true means the package has a lifecycle script
+        if (/^\s+requiresBuild:\s*true/.test(line) && currentPkg) {
+            scriptPkgs.push(currentPkg);
+        }
+        // Inline script value (rare in pnpm-lock but possible in older format)
+        const scriptLine = /^\s+(?:postinstall|preinstall|install):\s+"?([^"]+)"?/.exec(line);
+        if (scriptLine && currentPkg) {
+            const scriptVal = scriptLine[1];
+            if (isScriptMalicious(scriptVal)) {
+                maliciousScriptPkgs.push(`${currentPkg}: ${scriptVal.slice(0, 120)}`);
+            }
+        }
+    }
+    return { maliciousScriptPkgs, scriptPkgs };
 }
 async function checkTransitiveDependencies() {
     const findings = [];
     try {
-        let lockRaw;
+        // Try package-lock.json first (npm), then yarn.lock, then pnpm-lock.yaml.
+        // Each lockfile type has different structure; we use format-specific parsers.
+        let scriptPkgs = [];
+        let missingIntegrityPkgs = [];
+        let maliciousScriptPkgs = [];
+        let lockfileFound = false;
+        // ── npm package-lock.json ──────────────────────────────────────────────
         try {
-            lockRaw = await readFile("package-lock.json", "utf8");
+            const lockRaw = await readFile("package-lock.json", "utf8");
+            let lock;
+            try {
+                lock = JSON.parse(lockRaw);
+                const result = scanLockfilePackages(lock.packages ?? {});
+                scriptPkgs = result.scriptPkgs;
+                missingIntegrityPkgs = result.missingIntegrityPkgs;
+                maliciousScriptPkgs = result.maliciousScriptPkgs;
+                lockfileFound = true;
+            }
+            catch {
+                // JSON parse failure — skip
+            }
         }
         catch {
-            return [];
+            // package-lock.json not present — try alternatives
         }
-        let lock;
-        try {
-            lock = JSON.parse(lockRaw);
+        // ── yarn.lock ──────────────────────────────────────────────────────────
+        if (!lockfileFound) {
+            try {
+                const yarnRaw = await readFile("yarn.lock", "utf8");
+                const result = scanYarnLockForMaliciousScripts(yarnRaw);
+                scriptPkgs = result.scriptPkgs;
+                maliciousScriptPkgs = result.maliciousScriptPkgs;
+                lockfileFound = true;
+                // yarn.lock does not encode integrity per entry the same way; skip integrity check
+            }
+            catch {
+                // yarn.lock not present
+            }
         }
-        catch {
-            return [];
+        // ── pnpm-lock.yaml ─────────────────────────────────────────────────────
+        if (!lockfileFound) {
+            try {
+                const pnpmRaw = await readFile("pnpm-lock.yaml", "utf8");
+                const result = scanPnpmLockForMaliciousScripts(pnpmRaw);
+                scriptPkgs = result.scriptPkgs;
+                maliciousScriptPkgs = result.maliciousScriptPkgs;
+                lockfileFound = true;
+            }
+            catch {
+                // pnpm-lock.yaml not present
+            }
+        }
+        if (!lockfileFound) {
+            return findings;
+        }
+        // Report malicious script patterns first — CRITICAL severity
+        if (maliciousScriptPkgs.length > 0) {
+            findings.push({
+                id: "DEPENDENCY_MALICIOUS_SCRIPT",
+                title: `${maliciousScriptPkgs.length} transitive dependency lifecycle script(s) contain malicious execution patterns`,
+                severity: "CRITICAL",
+                evidence: maliciousScriptPkgs.slice(0, 10),
+                requiredActions: [
+                    "A transitive dependency has a lifecycle script matching known malicious patterns (download-and-execute, inline eval, base64 decode).",
+                    "CWE-494 / ATT&CK T1195.002 — malicious postinstall scripts run automatically on every npm install.",
+                    "Remove or replace these dependencies immediately. Treat the development environment as potentially compromised and rotate all secrets."
+                ]
+            });
         }
-        const { scriptPkgs, missingIntegrityPkgs } = scanLockfilePackages(lock.packages ?? {});
         if (scriptPkgs.length > 0) {
             findings.push({
                 id: "DEP_LIFECYCLE_SCRIPTS",
@@ -398,7 +701,31 @@ const KNOWN_TYPOSQUATS = {
     "debugg": "debug",
     "debu": "debug",
     "async-": "async",
-    "asyncs": "async"
+    "asyncs": "async",
+    // Extended ecosystem packages
+    "prism": "prisma",
+    "prismaa": "prisma",
+    "nextjs": "next",
+    "nextt": "next",
+    "nuxt3": "nuxt",
+    "vue3": "vue",
+    "sveltejs": "svelte",
+    "mongoosejs": "mongoose",
+    "sequelizejs": "sequelize",
+    "passportjs": "passport",
+    "jsonwebtoken-": "jsonwebtoken",
+    "bcryptjs-": "bcrypt",
+    "multerjs": "multer",
+    "axiosjs": "axios",
+    "socketio": "socket.io",
+    "redisjs": "redis",
+    "mysql-2": "mysql2",
+    "pgg": "pg",
+    "typeormjs": "typeorm",
+    "expressjs": "express",
+    "fastifyjs": "fastify",
+    "helmetjs": "helmet",
+    "corsjs": "cors"
 };
 // Suspicious version patterns used in dependency confusion / version injection attacks
 const SUSPICIOUS_VERSION_RE = /^\^?999\.|^0\.0\.[01]$/;
@@ -462,3 +789,243 @@ async function checkTyposquatting() {
     }
     return findings;
 }
+// ─── Go module integrity ────────────────────────────────────────────────────
+async function checkGoSumMissing() {
+    const findings = [];
+    try {
+        const goModFiles = await fg(["**/go.mod"], {
+            dot: true,
+            ignore: ["**/node_modules/**", "**/dist/**", "**/.git/**"]
+        });
+        const missing = [];
+        for (const goModPath of goModFiles) {
+            const dir = goModPath.replace(/\/go\.mod$/, "") || ".";
+            const goSumPath = dir === "." ? "go.sum" : `${dir}/go.sum`;
+            try {
+                const content = await readFileSafe(goSumPath);
+                if (!content) {
+                    missing.push(goModPath);
+                }
+            }
+            catch {
+                missing.push(goModPath);
+            }
+        }
+        if (missing.length > 0) {
+            findings.push({
+                id: "GO_SUM_MISSING",
+                title: `${missing.length} go.mod file(s) present without a corresponding go.sum — Go module integrity unverified`,
+                severity: "HIGH",
+                evidence: missing.slice(0, 10),
+                requiredActions: [
+                    "go.mod present without go.sum — Go module integrity unverified, compromised proxy can serve any content (ATT&CK T1195.001)",
+                    "Run `go mod tidy` to generate go.sum, then commit it alongside go.mod.",
+                    "Without go.sum, the Go toolchain cannot verify cryptographic hashes of downloaded modules."
+                ]
+            });
+        }
+    }
+    catch (err) {
+        console.warn("[checkGoSumMissing] Internal error:", sanitizeErrorMessage(err instanceof Error ? err.message : String(err)));
+    }
+    return findings;
+}
+// ─── Cargo lock integrity ───────────────────────────────────────────────────
+function isBinaryCrate(tomlContent) {
+    const hasBinSection = /^\[\[bin\]\]/m.test(tomlContent);
+    const hasLibSection = /^\[lib\]/m.test(tomlContent);
+    const hasPackageSection = /^\[package\]/m.test(tomlContent);
+    return hasBinSection || (hasPackageSection && !hasLibSection);
+}
+async function cargoLockMissingForToml(cargoTomlPath) {
+    let tomlContent = "";
+    try {
+        tomlContent = await readFileSafe(cargoTomlPath);
+    }
+    catch {
+        return false;
+    }
+    if (!tomlContent || !isBinaryCrate(tomlContent))
+        return false;
+    const dir = cargoTomlPath.replace(/\/Cargo\.toml$/, "") || ".";
+    const cargoLockPath = dir === "." ? "Cargo.lock" : `${dir}/Cargo.lock`;
+    try {
+        const lockContent = await readFileSafe(cargoLockPath);
+        return !lockContent;
+    }
+    catch {
+        return true;
+    }
+}
+async function checkCargoLockMissing() {
+    const findings = [];
+    try {
+        const cargoTomlFiles = await fg(["**/Cargo.toml"], {
+            dot: true,
+            ignore: ["**/node_modules/**", "**/dist/**", "**/.git/**"]
+        });
+        const results = await Promise.all(cargoTomlFiles.map(async (p) => ({ path: p, missing: await cargoLockMissingForToml(p) })));
+        const missing = results.filter((r) => r.missing).map((r) => r.path);
+        if (missing.length > 0) {
+            findings.push({
+                id: "CARGO_LOCK_MISSING",
+                title: `${missing.length} Cargo.toml binary crate(s) present without Cargo.lock — Rust dependency resolution unverified`,
+                severity: "MEDIUM",
+                evidence: missing.slice(0, 10),
+                requiredActions: [
+                    "Cargo.toml without Cargo.lock — Rust binary crate dependency resolution unverified (ATT&CK T1195.001)",
+                    "Run `cargo generate-lockfile` to create Cargo.lock and commit it to version control.",
+                    "Cargo.lock ensures reproducible builds and prevents silent dependency upgrades."
+                ]
+            });
+        }
+    }
+    catch (err) {
+        console.warn("[checkCargoLockMissing] Internal error:", sanitizeErrorMessage(err instanceof Error ? err.message : String(err)));
+    }
+    return findings;
+}
+// ─── Lockfile sync check ────────────────────────────────────────────────────
+function parsePkgDeps(content) {
+    try {
+        const pkg = JSON.parse(content);
+        return { ...pkg.dependencies, ...pkg.devDependencies };
+    }
+    catch {
+        return null;
+    }
+}
+function parseLockPackages(content) {
+    try {
+        const lock = JSON.parse(content);
+        return lock.packages ?? {};
+    }
+    catch {
+        return null;
+    }
+}
+function findOutOfSyncDeps(allDeps, lockPackages) {
+    const outOfSync = [];
+    for (const depName of Object.keys(allDeps)) {
+        // package-lock.json v2/v3 stores entries as "node_modules/<name>"
+        const key = `node_modules/${depName}`;
+        if (!(key in lockPackages) && !(depName in lockPackages)) {
+            outOfSync.push(depName);
+        }
+    }
+    return outOfSync;
+}
+async function checkLockfileSyncForPkg(pkgPath) {
+    const dir = pkgPath.replace(/\/package\.json$/, "") || ".";
+    const lockPath = dir === "." ? "package-lock.json" : `${dir}/package-lock.json`;
+    let pkgContent = "";
+    try {
+        pkgContent = await readFileSafe(pkgPath);
+    }
+    catch {
+        return [];
+    }
+    if (!pkgContent)
+        return [];
+    const allDeps = parsePkgDeps(pkgContent);
+    if (!allDeps || Object.keys(allDeps).length === 0)
+        return [];
+    let lockContent = "";
+    try {
+        lockContent = await readFileSafe(lockPath);
+    }
+    catch {
+        return [];
+    }
+    if (!lockContent)
+        return [];
+    const lockPackages = parseLockPackages(lockContent);
+    if (!lockPackages)
+        return [];
+    return findOutOfSyncDeps(allDeps, lockPackages);
+}
+async function checkLockfileSync() {
+    const findings = [];
+    try {
+        const pkgFiles = await fg(["**/package.json"], {
+            dot: true,
+            ignore: ["**/node_modules/**", "**/dist/**", "**/.git/**"]
+        });
+        for (const pkgPath of pkgFiles) {
+            const outOfSync = await checkLockfileSyncForPkg(pkgPath);
+            if (outOfSync.length > 0) {
+                findings.push({
+                    id: "LOCKFILE_OUT_OF_SYNC",
+                    title: `${pkgPath}: ${outOfSync.length} dependency(ies) in package.json not present in package-lock.json`,
+                    severity: "HIGH",
+                    evidence: outOfSync.slice(0, 15),
+                    requiredActions: [
+                        "package.json has dependencies not present in package-lock.json — lockfile out of sync (ATT&CK T1195.001)",
+                        "Run `npm install` to regenerate package-lock.json and commit the updated lockfile.",
+                        "Use `npm ci` in CI/CD pipelines — it fails if package-lock.json is out of sync with package.json."
+                    ]
+                });
+            }
+        }
+    }
+    catch (err) {
+        console.warn("[checkLockfileSync] Internal error:", sanitizeErrorMessage(err instanceof Error ? err.message : String(err)));
+    }
+    return findings;
+}
+// ─── Known supply-chain incident packages ──────────────────────────────────
+const KNOWN_INCIDENT_PACKAGES = new Set([
+    "node-ipc",
+    "event-stream",
+    "ua-parser-js",
+    "faker",
+    "colors",
+    "left-pad"
+]);
+function flaggedIncidentDeps(allDeps) {
+    return Object.keys(allDeps).filter((name) => KNOWN_INCIDENT_PACKAGES.has(name));
+}
+async function maintainerRiskForPkg(pkgPath) {
+    let pkgContent = "";
+    try {
+        pkgContent = await readFileSafe(pkgPath);
+    }
+    catch {
+        return [];
+    }
+    if (!pkgContent)
+        return [];
+    const allDeps = parsePkgDeps(pkgContent);
+    if (!allDeps)
+        return [];
+    return flaggedIncidentDeps(allDeps);
+}
+async function checkMaintainerRisk() {
+    const findings = [];
+    try {
+        const pkgFiles = await fg(["**/package.json"], {
+            dot: true,
+            ignore: ["**/node_modules/**", "**/dist/**", "**/.git/**"]
+        });
+        for (const pkgPath of pkgFiles) {
+            const flagged = await maintainerRiskForPkg(pkgPath);
+            if (flagged.length > 0) {
+                findings.push({
+                    id: "DEP_MAINTAINER_RISK",
+                    title: `${pkgPath}: ${flagged.length} dependency(ies) with known supply-chain incident history detected`,
+                    severity: "MEDIUM",
+                    evidence: flagged.slice(0, 10),
+                    requiredActions: [
+                        "Dependency with known supply-chain incident history detected — review and pin to safe version (ATT&CK T1195.001)",
+                        "Audit each flagged package: verify the current maintainer, review recent publish history on npmjs.com, and pin to a specific safe version.",
+                        "Consider replacing abandoned or historically-compromised packages with actively-maintained alternatives."
+                    ]
+                });
+            }
+        }
+    }
+    catch (err) {
+        console.warn("[checkMaintainerRisk] Internal error:", sanitizeErrorMessage(err instanceof Error ? err.message : String(err)));
+    }
+    return findings;
+}