supply-chain-guard 5.14.0 → 5.16.0

package/README.md

@@ -1,6 +1,6 @@
 # supply-chain-guard
 
-Open-source supply-chain security scanner for npm, PyPI, Cargo, Go, RubyGems, Composer, NuGet, Docker, Terraform, VS Code extensions, GitHub Actions and GitHub repositories. Detects malware campaigns (GlassWorm, Vidar, Shai-Hulud), fake AI tool repos, account takeovers, and 180+ threat indicators across all major lockfile formats (npm, pnpm, yarn, bun). Generates CycloneDX 1.6 SBOMs with real dependency inventories, verifies SLSA provenance, and correlates findings into attack-chain incidents.
+Open-source supply-chain security scanner for npm, PyPI, Cargo, Go, RubyGems, Composer, NuGet, Docker, Terraform, VS Code extensions, GitHub Actions and GitHub repositories. Detects malware campaigns (GlassWorm, Vidar, Shai-Hulud), fake AI tool repos, account takeovers, and 180+ threat indicators across all major lockfile formats (npm, pnpm, yarn, bun). Generates CycloneDX 1.6 SBOMs with real dependency inventories, grades SLSA provenance (parses and structurally validates in-toto/DSSE attestations), and correlates findings into attack-chain incidents.
 
 [![npm version](https://img.shields.io/npm/v/supply-chain-guard?logo=npm)](https://www.npmjs.com/package/supply-chain-guard)
 [![npm downloads](https://img.shields.io/npm/dw/supply-chain-guard?logo=npm&label=weekly%20downloads)](https://www.npmjs.com/package/supply-chain-guard)
@@ -60,6 +60,7 @@ For a deep dive into how GlassWorm infiltrates the software supply chain and the
 - Install hook deep analysis (secret harvesting, download-exec chains, binary blobs)
 - Levenshtein-based typosquatting detection against top 100 npm packages with known-safe whitelist
 - Dependency confusion and namespace squatting
+- Starjacking: in `npm <pkg>` mode, corroborates a package's claimed `repository` against the repo's own `package.json` and flags a repo borrowed from an unrelated popular project to inherit its stars/trust (conservative: monorepos, forks, related names, and unfetchable repos are not flagged)
 - Known-bad version blocklist (axios, ua-parser-js, coa, rc, event-stream, node-ipc, colors, faker)
 - Publishing anomaly detection (maintainer changes, version gaps, script additions)
 
@@ -124,7 +125,7 @@ Run the scanner as a [pre-commit](https://pre-commit.com) hook (Python-ecosystem
 ```yaml
 repos:
   - repo: https://github.com/homeofe/supply-chain-guard
-    rev: v5.14.0
+    rev: v5.16.0
     hooks:
       - id: supply-chain-guard
 ```
@@ -385,7 +386,7 @@ supply-chain-guard is the malware / behavior / campaign-IOC layer: it statically
 
 | Tool | Focus | Malware / behavior detection | Known-CVE lookup | Ecosystems | Open source | Account needed |
 |---|---|---|---|---|---|---|
-| **supply-chain-guard** | Malware campaigns, IOCs, behavior heuristics in installed artifacts; SBOM + SLSA verification | Yes: 180+ static heuristics plus campaign-IOC matching, fully local/offline | No | npm (incl. pnpm/yarn/bun lockfiles), PyPI, Cargo, Go, RubyGems, Composer, NuGet, Docker, Terraform/IaC, VS Code extensions, GitHub Actions, GitHub repos | Yes (Apache-2.0) | No |
+| **supply-chain-guard** | Malware campaigns, IOCs, behavior heuristics in installed artifacts; SBOM + SLSA provenance grading (in-toto/DSSE structural validation) | Yes: 180+ static heuristics plus campaign-IOC matching, fully local/offline | No | npm (incl. pnpm/yarn/bun lockfiles), PyPI, Cargo, Go, RubyGems, Composer, NuGet, Docker, Terraform/IaC, VS Code extensions, GitHub Actions, GitHub repos | Yes (Apache-2.0) | No |
 | [OSV-Scanner](https://github.com/google/osv-scanner) | Known vulnerabilities in dependency inventories (OSV.dev database lookup) | Known-malicious versions via OSV MAL- entries only; no behavior or IOC analysis | Yes (offline mode available) | 11+ ecosystems, 19+ lockfile formats, container images, SBOM input | Yes (Apache-2.0) | No |
 | [Socket](https://socket.dev) | Proactive behavioral analysis of entire registries (SaaS) | Yes: 70+ risk types registry-wide, before advisories exist; engine is closed source and cloud-side | Yes | npm, PyPI, Maven, Go, Cargo, RubyGems, NuGet, more; Actions workflows | CLI only (MIT); detection engine proprietary | Yes (except Firewall Free) |
 | [GuardDog](https://github.com/DataDog/guarddog) | Heuristic 0-10 risk scoring of individual packages (YARA + registry metadata) | Yes: heuristics only, no known-malware or campaign-IOC database; sandboxed scanning | No | npm, PyPI, Go, RubyGems, GitHub Actions, VS Code extensions | Yes (Apache-2.0) | No |

package/dist/cli.js

@@ -20,7 +20,7 @@ const program = new commander_1.Command();
 program
     .name("supply-chain-guard")
     .description("Open-source supply-chain security scanner. Detects GlassWorm and similar malware campaigns in npm packages, PyPI packages, code repos, VS Code extensions, and project dependencies.")
-    .version("5.14.0");
+    .version("5.16.0");
 // ── scan command ────────────────────────────────────────────────────
 program
     .command("scan")

package/dist/index.d.ts

@@ -55,7 +55,7 @@ export { checkSlaCompliance } from "./sla-engine.js";
 export { forecastRisk } from "./risk-forecast.js";
 export { calculateMetrics } from "./metrics.js";
 export { generateSbomDocument } from "./sbom-generator.js";
-export { verifySLSA, getSLSALevel } from "./slsa-verifier.js";
+export { verifySLSA, getSLSALevel, parseAttestation } from "./slsa-verifier.js";
 export { scanPypiDependencyConfusion } from "./dependency-confusion.js";
 export { scanMcpConfigs, scanMcpConfigContent, hasMcpConfigFiles, MCP_CONFIG_FILES } from "./mcp-scanner.js";
 export { scanAgentSkillFiles, scanSkillContent, scanAgentSettingsContent, } from "./skills-scanner.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AACpC,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EACL,aAAa,EACb,WAAW,EACX,WAAW,EACX,aAAa,EACb,aAAa,EACb,cAAc,EACd,mBAAmB,EACnB,aAAa,EACb,gBAAgB,GACjB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAC;AACzE,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAChG,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACpF,OAAO,EAAE,0BAA0B,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAC/I,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAChG,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACzH,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AACvF,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACvF,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACnG,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACzE,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC7E,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAChF,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC7F,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AACrG,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAC7G,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAClF,OAAO,EACL,qBAAqB,EACrB,eAAe,EACf,mBAAmB,EACnB,cAAc,EACd,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,OAAO,EACP,UAAU,EACV,WAAW,EACX,WAAW,EACX,QAAQ,EACR,cAAc,EACd,oBAAoB,EACpB,iBAAiB,EACjB,YAAY,EACZ,cAAc,EACd,eAAe,EACf,cAAc,EACd,YAAY,EACZ,aAAa,EACb,YAAY,GACb,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AACpC,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EACL,aAAa,EACb,WAAW,EACX,WAAW,EACX,aAAa,EACb,aAAa,EACb,cAAc,EACd,mBAAmB,EACnB,aAAa,EACb,gBAAgB,GACjB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAC;AACzE,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAChG,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACpF,OAAO,EAAE,0BAA0B,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAC/I,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAChG,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACzH,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AACvF,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACvF,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACnG,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACzE,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC7E,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAChF,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC7F,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AACrG,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAChF,OAAO,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAC7G,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAClF,OAAO,EACL,qBAAqB,EACrB,eAAe,EACf,mBAAmB,EACnB,cAAc,EACd,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,OAAO,EACP,UAAU,EACV,WAAW,EACX,WAAW,EACX,QAAQ,EACR,cAAc,EACd,oBAAoB,EACpB,iBAAiB,EACjB,YAAY,EACZ,cAAc,EACd,eAAe,EACf,cAAc,EACd,YAAY,EACZ,aAAa,EACb,YAAY,GACb,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -7,8 +7,8 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.applyPolicy = exports.loadPolicyConfig = exports.calculateTrustBreakdown = exports.correlateFindings = exports.scanReleaseArtifacts = exports.fetchNpmLatest = exports.checkRegistryVersionDrift = exports.evaluateVersionDrift = exports.analyzePublishingAnomalies = exports.levenshtein = exports.analyzeDependencyRisks = exports.analyzeInstallHooks = exports.scanReadmeLures = exports.parseGitHubUrl = exports.analyzeGitHubTrust = exports.checkBadVersion = exports.checkIOCBlocklist = exports.scanNuGetFiles = exports.scanComposerFiles = exports.scanRubyGemsFiles = exports.scanGoFiles = exports.scanCargoFiles = exports.shannonEntropy = exports.analyzeEntropy = exports.scanGitSecurity = exports.scanConfigFile = exports.scanConfigFiles = exports.scanDockerFile = exports.scanDockerFiles = exports.scanGitHubActionsWorkflows = exports.checkBunLockfile = exports.checkYarnLockfile = exports.checkPnpmLockfile = exports.checkNpmLockfile = exports.checkLockfile = exports.formatReport = exports.monitorWatchlist = exports.listWatchlist = exports.removeFromWatchlist = exports.addToWatchlist = exports.saveWatchlist = exports.loadWatchlist = exports.formatAlert = exports.checkWallet = exports.monitorWallet = exports.scanDependencyConfusion = exports.scanVscodeExtension = exports.scanPypiPackage = exports.scanNpmPackage = exports.scan = void 0;
-exports.hasMcpConfigFiles = exports.scanMcpConfigContent = exports.scanMcpConfigs = exports.scanPypiDependencyConfusion = exports.getSLSALevel = exports.verifySLSA = exports.generateSbomDocument = exports.calculateMetrics = exports.forecastRisk = exports.checkSlaCompliance = exports.checkTriageGovernance = exports.saveTriageDecisions = exports.loadTriageDecisions = exports.analyzeRiskTrend = exports.saveRiskHistory = exports.loadRiskHistory = exports.calculateOrgPosture = exports.getHoneytokenEnv = exports.checkHoneytokenAccess = exports.scanOpenClawPlugin = exports.parseWorkflow = exports.scanWorkflowGraph = exports.modelWorkflows = exports.promoteConfidence = exports.validateFindings = exports.exportGraphMermaid = exports.buildAttackGraph = exports.exportCsvSummary = exports.exportIncidentMarkdown = exports.exportIncidentBundle = exports.checkDependencyGovernance = exports.generatePlaybooks = exports.generateFixSuggestions = exports.generateRemediations = exports.analyzeOrgFindings = exports.listOrgRepos = exports.getChangedFiles = exports.calculateRiskDimensions = exports.DEFAULT_FEED_URL = exports.parseFeedPayload = exports.refreshFeed = exports.feedStats = exports.getBundledFeed = exports.matchPackageIOC = exports.checkThreatIntel = exports.updateThreatFeed = exports.loadThreatIntel = exports.detectTrustSignals = exports.saveBaseline = exports.applyBaseline = void 0;
-exports.SUPPORTED_MANAGERS = exports.resolveManagerBinary = exports.parseSpecToken = exports.extractInstallSpecs = exports.runInstallGuard = exports.analyzeInstallCommand = exports.startMcpServer = exports.handleMcpLine = exports.handleMcpMessage = exports.scanAgentSettingsContent = exports.scanSkillContent = exports.scanAgentSkillFiles = exports.MCP_CONFIG_FILES = void 0;
+exports.scanMcpConfigContent = exports.scanMcpConfigs = exports.scanPypiDependencyConfusion = exports.parseAttestation = exports.getSLSALevel = exports.verifySLSA = exports.generateSbomDocument = exports.calculateMetrics = exports.forecastRisk = exports.checkSlaCompliance = exports.checkTriageGovernance = exports.saveTriageDecisions = exports.loadTriageDecisions = exports.analyzeRiskTrend = exports.saveRiskHistory = exports.loadRiskHistory = exports.calculateOrgPosture = exports.getHoneytokenEnv = exports.checkHoneytokenAccess = exports.scanOpenClawPlugin = exports.parseWorkflow = exports.scanWorkflowGraph = exports.modelWorkflows = exports.promoteConfidence = exports.validateFindings = exports.exportGraphMermaid = exports.buildAttackGraph = exports.exportCsvSummary = exports.exportIncidentMarkdown = exports.exportIncidentBundle = exports.checkDependencyGovernance = exports.generatePlaybooks = exports.generateFixSuggestions = exports.generateRemediations = exports.analyzeOrgFindings = exports.listOrgRepos = exports.getChangedFiles = exports.calculateRiskDimensions = exports.DEFAULT_FEED_URL = exports.parseFeedPayload = exports.refreshFeed = exports.feedStats = exports.getBundledFeed = exports.matchPackageIOC = exports.checkThreatIntel = exports.updateThreatFeed = exports.loadThreatIntel = exports.detectTrustSignals = exports.saveBaseline = exports.applyBaseline = void 0;
+exports.SUPPORTED_MANAGERS = exports.resolveManagerBinary = exports.parseSpecToken = exports.extractInstallSpecs = exports.runInstallGuard = exports.analyzeInstallCommand = exports.startMcpServer = exports.handleMcpLine = exports.handleMcpMessage = exports.scanAgentSettingsContent = exports.scanSkillContent = exports.scanAgentSkillFiles = exports.MCP_CONFIG_FILES = exports.hasMcpConfigFiles = void 0;
 var scanner_js_1 = require("./scanner.js");
 Object.defineProperty(exports, "scan", { enumerable: true, get: function () { return scanner_js_1.scan; } });
 var npm_scanner_js_1 = require("./npm-scanner.js");
@@ -157,6 +157,7 @@ Object.defineProperty(exports, "generateSbomDocument", { enumerable: true, get:
 var slsa_verifier_js_1 = require("./slsa-verifier.js");
 Object.defineProperty(exports, "verifySLSA", { enumerable: true, get: function () { return slsa_verifier_js_1.verifySLSA; } });
 Object.defineProperty(exports, "getSLSALevel", { enumerable: true, get: function () { return slsa_verifier_js_1.getSLSALevel; } });
+Object.defineProperty(exports, "parseAttestation", { enumerable: true, get: function () { return slsa_verifier_js_1.parseAttestation; } });
 var dependency_confusion_js_2 = require("./dependency-confusion.js");
 Object.defineProperty(exports, "scanPypiDependencyConfusion", { enumerable: true, get: function () { return dependency_confusion_js_2.scanPypiDependencyConfusion; } });
 var mcp_scanner_js_1 = require("./mcp-scanner.js");

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;;;AAEH,2CAAoC;AAA3B,kGAAA,IAAI,OAAA;AACb,mDAAkD;AAAzC,gHAAA,cAAc,OAAA;AACvB,qDAAoD;AAA3C,kHAAA,eAAe,OAAA;AACxB,yDAA0D;AAAjD,wHAAA,mBAAmB,OAAA;AAC5B,qEAAoE;AAA3D,kIAAA,uBAAuB,OAAA;AAChC,yDAU6B;AAT3B,kHAAA,aAAa,OAAA;AACb,gHAAA,WAAW,OAAA;AACX,gHAAA,WAAW,OAAA;AACX,kHAAA,aAAa,OAAA;AACb,kHAAA,aAAa,OAAA;AACb,mHAAA,cAAc,OAAA;AACd,wHAAA,mBAAmB,OAAA;AACnB,kHAAA,aAAa,OAAA;AACb,qHAAA,gBAAgB,OAAA;AAElB,6CAA6C;AAApC,2GAAA,YAAY,OAAA;AACrB,6DAM+B;AAL7B,oHAAA,aAAa,OAAA;AACb,uHAAA,gBAAgB,OAAA;AAChB,wHAAA,iBAAiB,OAAA;AACjB,wHAAA,iBAAiB,OAAA;AACjB,uHAAA,gBAAgB,OAAA;AAElB,yEAAyE;AAAhE,uIAAA,0BAA0B,OAAA;AACnC,iEAA0E;AAAjE,wHAAA,eAAe,OAAA;AAAE,uHAAA,cAAc,OAAA;AACxC,yDAAsE;AAA7D,oHAAA,eAAe,OAAA;AAAE,mHAAA,cAAc,OAAA;AACxC,mDAAmD;AAA1C,iHAAA,eAAe,OAAA;AACxB,2CAA8D;AAArD,4GAAA,cAAc,OAAA;AAAE,4GAAA,cAAc,OAAA;AACvC,uDAAoD;AAA3C,kHAAA,cAAc,OAAA;AACvB,iDAA8C;AAArC,4GAAA,WAAW,OAAA;AACpB,6DAA0D;AAAjD,wHAAA,iBAAiB,OAAA;AAC1B,6DAA0D;AAAjD,wHAAA,iBAAiB,OAAA;AAC1B,uDAAoD;AAA3C,kHAAA,cAAc,OAAA;AACvB,uDAAwE;AAA/D,qHAAA,iBAAiB,OAAA;AAAE,mHAAA,eAAe,OAAA;AAC3C,qEAAgG;AAAvF,6HAAA,kBAAkB,OAAA;AAAE,yHAAA,cAAc,OAAA;AAAE,0HAAA,eAAe,OAAA;AAC5D,qEAAgE;AAAvD,8HAAA,mBAAmB,OAAA;AAC5B,6EAAoF;AAA3E,qIAAA,sBAAsB,OAAA;AAAE,0HAAA,WAAW,OAAA;AAC5C,mFAA+I;AAAtI,4IAAA,0BAA0B,OAAA;AAAE,sIAAA,oBAAoB,OAAA;AAAE,2IAAA,yBAAyB,OAAA;AAAE,gIAAA,cAAc,OAAA;AACpG,2DAA4D;AAAnD,0HAAA,oBAAoB,OAAA;AAC7B,iEAA4D;AAAnD,0HAAA,iBAAiB,OAAA;AAC1B,2DAA+D;AAAtD,6HAAA,uBAAuB,OAAA;AAChC,uDAAgG;AAAvF,oHAAA,gBAAgB,OAAA;AAAE,+GAAA,WAAW,OAAA;AAAE,iHAAA,aAAa,OAAA;AAAE,gHAAA,YAAY,OAAA;AACnE,uDAAwD;AAA/C,sHAAA,kBAAkB,OAAA;AAC3B,qDAAyH;AAAhH,kHAAA,eAAe,OAAA;AAAE,mHAAA,gBAAgB,OAAA;AAAE,mHAAA,gBAAgB,OAAA;AAAE,kHAAA,eAAe,OAAA;AAAE,iHAAA,cAAc,OAAA;AAC7F,qCAAuF;AAA9E,oGAAA,SAAS,OAAA;AAAE,sGAAA,WAAW,OAAA;AAAE,2GAAA,gBAAgB,OAAA;AAAE,2GAAA,gBAAgB,OAAA;AACnE,mDAA2D;AAAlD,yHAAA,uBAAuB,OAAA;AAChC,qDAAoD;AAA3C,kHAAA,eAAe,OAAA;AACxB,mDAAoE;AAA3D,8GAAA,YAAY,OAAA;AAAE,oHAAA,kBAAkB,OAAA;AACzC,iEAAuF;AAA9E,6HAAA,oBAAoB,OAAA;AAAE,+HAAA,sBAAsB,OAAA;AACrD,+CAAmD;AAA1C,iHAAA,iBAAiB,OAAA;AAC1B,uEAAuE;AAA9D,qIAAA,yBAAyB,OAAA;AAClC,qDAAmG;AAA1F,uHAAA,oBAAoB,OAAA;AAAE,yHAAA,sBAAsB,OAAA;AAAE,mHAAA,gBAAgB,OAAA;AACvE,qDAAyE;AAAhE,mHAAA,gBAAgB,OAAA;AAAE,qHAAA,kBAAkB,OAAA;AAC7C,+DAA6E;AAApE,wHAAA,gBAAgB,OAAA;AAAE,yHAAA,iBAAiB,OAAA;AAC5C,6DAAuD;AAA9C,qHAAA,cAAc,OAAA;AACvB,yDAAwD;AAA/C,sHAAA,iBAAiB,OAAA;AAC1B,qDAAkD;AAAzC,gHAAA,aAAa,OAAA;AACtB,2EAAkE;AAAzD,gIAAA,kBAAkB,OAAA;AAC3B,6DAAgF;AAAvE,4HAAA,qBAAqB,OAAA;AAAE,uHAAA,gBAAgB,OAAA;AAChD,yDAA0D;AAAjD,wHAAA,mBAAmB,OAAA;AAC5B,iEAA6F;AAApF,wHAAA,eAAe,OAAA;AAAE,wHAAA,eAAe,OAAA;AAAE,yHAAA,gBAAgB,OAAA;AAC3D,uDAAqG;AAA5F,uHAAA,mBAAmB,OAAA;AAAE,uHAAA,mBAAmB,OAAA;AAAE,yHAAA,qBAAqB,OAAA;AACxE,iDAAqD;AAA5C,mHAAA,kBAAkB,OAAA;AAC3B,uDAAkD;AAAzC,gHAAA,YAAY,OAAA;AACrB,2CAAgD;AAAvC,8GAAA,gBAAgB,OAAA;AACzB,yDAA2D;AAAlD,yHAAA,oBAAoB,OAAA;AAC7B,uDAA8D;AAArD,8GAAA,UAAU,OAAA;AAAE,gHAAA,YAAY,OAAA;AACjC,qEAAwE;AAA/D,sIAAA,2BAA2B,OAAA;AACpC,mDAA6G;AAApG,gHAAA,cAAc,OAAA;AAAE,sHAAA,oBAAoB,OAAA;AAAE,mHAAA,iBAAiB,OAAA;AAAE,kHAAA,gBAAgB,OAAA;AAClF,yDAI6B;AAH3B,wHAAA,mBAAmB,OAAA;AACnB,qHAAA,gBAAgB,OAAA;AAChB,6HAAA,wBAAwB,OAAA;AAE1B,iDAAkF;AAAzE,iHAAA,gBAAgB,OAAA;AAAE,8GAAA,aAAa,OAAA;AAAE,+GAAA,cAAc,OAAA;AACxD,uDAO4B;AAN1B,yHAAA,qBAAqB,OAAA;AACrB,mHAAA,eAAe,OAAA;AACf,uHAAA,mBAAmB,OAAA;AACnB,kHAAA,cAAc,OAAA;AACd,wHAAA,oBAAoB,OAAA;AACpB,sHAAA,kBAAkB,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;;;AAEH,2CAAoC;AAA3B,kGAAA,IAAI,OAAA;AACb,mDAAkD;AAAzC,gHAAA,cAAc,OAAA;AACvB,qDAAoD;AAA3C,kHAAA,eAAe,OAAA;AACxB,yDAA0D;AAAjD,wHAAA,mBAAmB,OAAA;AAC5B,qEAAoE;AAA3D,kIAAA,uBAAuB,OAAA;AAChC,yDAU6B;AAT3B,kHAAA,aAAa,OAAA;AACb,gHAAA,WAAW,OAAA;AACX,gHAAA,WAAW,OAAA;AACX,kHAAA,aAAa,OAAA;AACb,kHAAA,aAAa,OAAA;AACb,mHAAA,cAAc,OAAA;AACd,wHAAA,mBAAmB,OAAA;AACnB,kHAAA,aAAa,OAAA;AACb,qHAAA,gBAAgB,OAAA;AAElB,6CAA6C;AAApC,2GAAA,YAAY,OAAA;AACrB,6DAM+B;AAL7B,oHAAA,aAAa,OAAA;AACb,uHAAA,gBAAgB,OAAA;AAChB,wHAAA,iBAAiB,OAAA;AACjB,wHAAA,iBAAiB,OAAA;AACjB,uHAAA,gBAAgB,OAAA;AAElB,yEAAyE;AAAhE,uIAAA,0BAA0B,OAAA;AACnC,iEAA0E;AAAjE,wHAAA,eAAe,OAAA;AAAE,uHAAA,cAAc,OAAA;AACxC,yDAAsE;AAA7D,oHAAA,eAAe,OAAA;AAAE,mHAAA,cAAc,OAAA;AACxC,mDAAmD;AAA1C,iHAAA,eAAe,OAAA;AACxB,2CAA8D;AAArD,4GAAA,cAAc,OAAA;AAAE,4GAAA,cAAc,OAAA;AACvC,uDAAoD;AAA3C,kHAAA,cAAc,OAAA;AACvB,iDAA8C;AAArC,4GAAA,WAAW,OAAA;AACpB,6DAA0D;AAAjD,wHAAA,iBAAiB,OAAA;AAC1B,6DAA0D;AAAjD,wHAAA,iBAAiB,OAAA;AAC1B,uDAAoD;AAA3C,kHAAA,cAAc,OAAA;AACvB,uDAAwE;AAA/D,qHAAA,iBAAiB,OAAA;AAAE,mHAAA,eAAe,OAAA;AAC3C,qEAAgG;AAAvF,6HAAA,kBAAkB,OAAA;AAAE,yHAAA,cAAc,OAAA;AAAE,0HAAA,eAAe,OAAA;AAC5D,qEAAgE;AAAvD,8HAAA,mBAAmB,OAAA;AAC5B,6EAAoF;AAA3E,qIAAA,sBAAsB,OAAA;AAAE,0HAAA,WAAW,OAAA;AAC5C,mFAA+I;AAAtI,4IAAA,0BAA0B,OAAA;AAAE,sIAAA,oBAAoB,OAAA;AAAE,2IAAA,yBAAyB,OAAA;AAAE,gIAAA,cAAc,OAAA;AACpG,2DAA4D;AAAnD,0HAAA,oBAAoB,OAAA;AAC7B,iEAA4D;AAAnD,0HAAA,iBAAiB,OAAA;AAC1B,2DAA+D;AAAtD,6HAAA,uBAAuB,OAAA;AAChC,uDAAgG;AAAvF,oHAAA,gBAAgB,OAAA;AAAE,+GAAA,WAAW,OAAA;AAAE,iHAAA,aAAa,OAAA;AAAE,gHAAA,YAAY,OAAA;AACnE,uDAAwD;AAA/C,sHAAA,kBAAkB,OAAA;AAC3B,qDAAyH;AAAhH,kHAAA,eAAe,OAAA;AAAE,mHAAA,gBAAgB,OAAA;AAAE,mHAAA,gBAAgB,OAAA;AAAE,kHAAA,eAAe,OAAA;AAAE,iHAAA,cAAc,OAAA;AAC7F,qCAAuF;AAA9E,oGAAA,SAAS,OAAA;AAAE,sGAAA,WAAW,OAAA;AAAE,2GAAA,gBAAgB,OAAA;AAAE,2GAAA,gBAAgB,OAAA;AACnE,mDAA2D;AAAlD,yHAAA,uBAAuB,OAAA;AAChC,qDAAoD;AAA3C,kHAAA,eAAe,OAAA;AACxB,mDAAoE;AAA3D,8GAAA,YAAY,OAAA;AAAE,oHAAA,kBAAkB,OAAA;AACzC,iEAAuF;AAA9E,6HAAA,oBAAoB,OAAA;AAAE,+HAAA,sBAAsB,OAAA;AACrD,+CAAmD;AAA1C,iHAAA,iBAAiB,OAAA;AAC1B,uEAAuE;AAA9D,qIAAA,yBAAyB,OAAA;AAClC,qDAAmG;AAA1F,uHAAA,oBAAoB,OAAA;AAAE,yHAAA,sBAAsB,OAAA;AAAE,mHAAA,gBAAgB,OAAA;AACvE,qDAAyE;AAAhE,mHAAA,gBAAgB,OAAA;AAAE,qHAAA,kBAAkB,OAAA;AAC7C,+DAA6E;AAApE,wHAAA,gBAAgB,OAAA;AAAE,yHAAA,iBAAiB,OAAA;AAC5C,6DAAuD;AAA9C,qHAAA,cAAc,OAAA;AACvB,yDAAwD;AAA/C,sHAAA,iBAAiB,OAAA;AAC1B,qDAAkD;AAAzC,gHAAA,aAAa,OAAA;AACtB,2EAAkE;AAAzD,gIAAA,kBAAkB,OAAA;AAC3B,6DAAgF;AAAvE,4HAAA,qBAAqB,OAAA;AAAE,uHAAA,gBAAgB,OAAA;AAChD,yDAA0D;AAAjD,wHAAA,mBAAmB,OAAA;AAC5B,iEAA6F;AAApF,wHAAA,eAAe,OAAA;AAAE,wHAAA,eAAe,OAAA;AAAE,yHAAA,gBAAgB,OAAA;AAC3D,uDAAqG;AAA5F,uHAAA,mBAAmB,OAAA;AAAE,uHAAA,mBAAmB,OAAA;AAAE,yHAAA,qBAAqB,OAAA;AACxE,iDAAqD;AAA5C,mHAAA,kBAAkB,OAAA;AAC3B,uDAAkD;AAAzC,gHAAA,YAAY,OAAA;AACrB,2CAAgD;AAAvC,8GAAA,gBAAgB,OAAA;AACzB,yDAA2D;AAAlD,yHAAA,oBAAoB,OAAA;AAC7B,uDAAgF;AAAvE,8GAAA,UAAU,OAAA;AAAE,gHAAA,YAAY,OAAA;AAAE,oHAAA,gBAAgB,OAAA;AACnD,qEAAwE;AAA/D,sIAAA,2BAA2B,OAAA;AACpC,mDAA6G;AAApG,gHAAA,cAAc,OAAA;AAAE,sHAAA,oBAAoB,OAAA;AAAE,mHAAA,iBAAiB,OAAA;AAAE,kHAAA,gBAAgB,OAAA;AAClF,yDAI6B;AAH3B,wHAAA,mBAAmB,OAAA;AACnB,qHAAA,gBAAgB,OAAA;AAChB,6HAAA,wBAAwB,OAAA;AAE1B,iDAAkF;AAAzE,iHAAA,gBAAgB,OAAA;AAAE,8GAAA,aAAa,OAAA;AAAE,+GAAA,cAAc,OAAA;AACxD,uDAO4B;AAN1B,yHAAA,qBAAqB,OAAA;AACrB,mHAAA,eAAe,OAAA;AACf,uHAAA,mBAAmB,OAAA;AACnB,kHAAA,cAAc,OAAA;AACd,wHAAA,oBAAoB,OAAA;AACpB,sHAAA,kBAAkB,OAAA"}

package/dist/npm-scanner.d.ts

@@ -11,6 +11,35 @@ import type { Finding, ScanReport, ScanOptions } from "./types.js";
 export declare function scanNpmPackage(packageName: string, options: Omit<ScanOptions, "target"> & {
     target?: string;
 }): Promise<ScanReport>;
+/**
+ * Normalize the many shapes of a package.json `repository` field to a GitHub
+ * owner/repo (+ monorepo subdirectory), or null when it is not a GitHub repo.
+ */
+export declare function parseRepositoryField(repository: unknown): {
+    owner: string;
+    repo: string;
+    directory?: string;
+} | null;
+/**
+ * Corroborate a package's claimed source repository (starjacking detection).
+ *
+ * A malicious package can set `repository` to a popular project's URL to inherit
+ * its trust score and stars. We fetch the claimed repo's root package.json and
+ * flag ONLY the high-confidence borrowed-trust case: the repo publishes a
+ * DIFFERENT, unrelated package and is not a monorepo containing this one.
+ *
+ * Deliberately conservative (best-effort, medium severity) - every ambiguous or
+ * benign case is left unflagged:
+ *   - no repository field, or a non-GitHub host           -> skip
+ *   - repository.directory set (a monorepo subdirectory)  -> skip (legit)
+ *   - the repo declares `workspaces` (a monorepo)         -> skip (legit)
+ *   - the repo could not be fetched (404/private/network) -> skip
+ *   - the repo's package.json name equals this package    -> skip (corroborated)
+ *   - the names share a significant token (same project)  -> skip
+ */
+export declare function checkRepositoryClaim(packageName: string, versionData: {
+    repository?: unknown;
+}, findings: Finding[]): Promise<void>;
 /**
  * Scan the extracted tarball contents for malicious patterns.
  * Exported for tests (the download path needs network; this walker does not).

package/dist/npm-scanner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"npm-scanner.d.ts","sourceRoot":"","sources":["../src/npm-scanner.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,OAAO,KAAK,EAAE,OAAO,EAAkB,UAAU,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AA4BnF;;GAEG;AACH,wBAAsB,cAAc,CAClC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,GAAG;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GACzD,OAAO,CAAC,UAAU,CAAC,CAsErB;AAuJD;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,OAAO,EAAE,GAClB,IAAI,CA0CN"}
+{"version":3,"file":"npm-scanner.d.ts","sourceRoot":"","sources":["../src/npm-scanner.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,OAAO,KAAK,EAAE,OAAO,EAAkB,UAAU,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AA8BnF;;GAEG;AACH,wBAAsB,cAAc,CAClC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,GAAG;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GACzD,OAAO,CAAC,UAAU,CAAC,CA2ErB;AAqHD;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,OAAO,GAClB;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAqB5D;AAmCD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,oBAAoB,CACxC,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE;IAAE,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,EACrC,QAAQ,EAAE,OAAO,EAAE,GAClB,OAAO,CAAC,IAAI,CAAC,CAiEf;AAqED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,OAAO,EAAE,GAClB,IAAI,CA0CN"}

package/dist/npm-scanner.js

@@ -40,6 +40,8 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.scanNpmPackage = scanNpmPackage;
+exports.parseRepositoryField = parseRepositoryField;
+exports.checkRepositoryClaim = checkRepositoryClaim;
 exports.scanExtractedNpmFiles = scanExtractedNpmFiles;
 const fs = __importStar(require("node:fs"));
 const os = __importStar(require("node:os"));
@@ -48,6 +50,7 @@ const https = __importStar(require("node:https"));
 const types_js_1 = require("./types.js");
 const archive_extractor_js_1 = require("./archive-extractor.js");
 const patterns_js_1 = require("./patterns.js");
+const github_trust_scanner_js_1 = require("./github-trust-scanner.js");
 const TOOL_VERSION = "1.0.0";
 const NPM_REGISTRY = "https://registry.npmjs.org";
 /**
@@ -72,6 +75,10 @@ async function scanNpmPackage(packageName, options) {
     checkPackageScripts(versionData, findings);
     // Check dependencies against known malicious packages
     checkDependencies(versionData, findings);
+    // Corroborate the claimed source repository (starjacking): a package that
+    // points its `repository` at a popular project it does not own inherits that
+    // project's trust/stars. Network-requiring, so best-effort; never throws.
+    await checkRepositoryClaim(packageName, versionData, findings);
     // Download and scan tarball
     const tarballUrl = versionData.dist?.tarball;
     if (tarballUrl) {
@@ -185,6 +192,186 @@ function checkDependencies(pkg, findings) {
         }
     }
 }
+// ---------------------------------------------------------------------------
+// Repository-claim corroboration (starjacking) - v5.16.0
+// ---------------------------------------------------------------------------
+/** Tokens too generic to prove two package names refer to the same project. */
+const GENERIC_NAME_TOKENS = new Set([
+    "js", "ts", "lib", "libs", "core", "sdk", "api", "utils", "util", "common",
+    "node", "cli", "app", "client", "server", "plugin", "tool", "tools", "kit",
+    "pkg", "package", "module", "src", "www", "web", "main", "index", "project",
+]);
+/** Split a package name into significant lowercase tokens (scope stripped). */
+function significantTokens(name) {
+    const unscoped = name.replace(/^@[^/]+\//, "");
+    return new Set(unscoped
+        .toLowerCase()
+        .split(/[-_./@]+/)
+        .filter((t) => t.length >= 3 && !GENERIC_NAME_TOKENS.has(t)));
+}
+/**
+ * Two package names are "related" (likely the same project) if they share any
+ * significant token, so `cool-lib` published from the `cool-project` repo is
+ * not flagged. Purely a false-positive guard.
+ */
+function namesAreRelated(a, b) {
+    const ta = significantTokens(a);
+    for (const t of significantTokens(b))
+        if (ta.has(t))
+            return true;
+    return false;
+}
+/**
+ * Normalize the many shapes of a package.json `repository` field to a GitHub
+ * owner/repo (+ monorepo subdirectory), or null when it is not a GitHub repo.
+ */
+function parseRepositoryField(repository) {
+    let url;
+    let directory;
+    if (typeof repository === "string") {
+        url = repository;
+    }
+    else if (repository && typeof repository === "object") {
+        const r = repository;
+        if (typeof r.url === "string")
+            url = r.url;
+        if (typeof r.directory === "string")
+            directory = r.directory;
+    }
+    if (!url)
+        return null;
+    // Shorthand forms: "github:owner/repo", "owner/repo".
+    const shorthand = url.match(/^(?:github:)?([a-zA-Z0-9_.-]+)\/([a-zA-Z0-9_.-]+)$/);
+    if (shorthand && !url.includes("://") && !url.includes("github.com")) {
+        const parsed = (0, github_trust_scanner_js_1.parseGitHubUrl)(`github.com/${shorthand[1]}/${shorthand[2]}`);
+        return parsed ? { ...parsed, directory } : null;
+    }
+    const parsed = (0, github_trust_scanner_js_1.parseGitHubUrl)(url);
+    return parsed ? { ...parsed, directory } : null;
+}
+/** GET a URL over HTTPS, resolving null on any non-200 / error (never throws). */
+function httpsGetTextOrNull(url) {
+    return new Promise((resolve) => {
+        let settled = false;
+        const done = (v) => {
+            if (!settled) {
+                settled = true;
+                resolve(v);
+            }
+        };
+        try {
+            const req = https.get(url, { headers: { Accept: "application/json", "User-Agent": "supply-chain-guard" } }, (res) => {
+                if (res.statusCode !== 200) {
+                    res.resume?.();
+                    done(null);
+                    return;
+                }
+                let data = "";
+                let size = 0;
+                res.on("data", (chunk) => {
+                    size += chunk.length;
+                    if (size > patterns_js_1.MAX_FILE_SIZE) {
+                        done(null);
+                        req.destroy?.();
+                        return;
+                    }
+                    data += chunk.toString();
+                });
+                res.on("end", () => done(data));
+                res.on("error", () => done(null));
+            });
+            // Bound the wait so a hung/slow host cannot stall the whole npm scan.
+            req.setTimeout?.(10_000, () => { done(null); req.destroy?.(); });
+            req.on("error", () => done(null));
+        }
+        catch {
+            done(null);
+        }
+    });
+}
+/**
+ * Corroborate a package's claimed source repository (starjacking detection).
+ *
+ * A malicious package can set `repository` to a popular project's URL to inherit
+ * its trust score and stars. We fetch the claimed repo's root package.json and
+ * flag ONLY the high-confidence borrowed-trust case: the repo publishes a
+ * DIFFERENT, unrelated package and is not a monorepo containing this one.
+ *
+ * Deliberately conservative (best-effort, medium severity) - every ambiguous or
+ * benign case is left unflagged:
+ *   - no repository field, or a non-GitHub host           -> skip
+ *   - repository.directory set (a monorepo subdirectory)  -> skip (legit)
+ *   - the repo declares `workspaces` (a monorepo)         -> skip (legit)
+ *   - the repo could not be fetched (404/private/network) -> skip
+ *   - the repo's package.json name equals this package    -> skip (corroborated)
+ *   - the names share a significant token (same project)  -> skip
+ */
+async function checkRepositoryClaim(packageName, versionData, findings) {
+    const claim = parseRepositoryField(versionData.repository);
+    if (!claim)
+        return;
+    // A monorepo subdirectory legitimately means the root name differs.
+    if (claim.directory)
+        return;
+    // The package's scope matching the repo owner is a strong ownership signal: an
+    // org publishing @acme/* from github.com/acme/<mono> is the common legit case
+    // (and the dominant pnpm/lerna monorepo layout). Cheap, no fetch. Skip.
+    const scope = packageName.match(/^@([^/]+)\//)?.[1];
+    if (scope && scope.toLowerCase() === claim.owner.toLowerCase())
+        return;
+    // If either name reduces to no SIGNIFICANT token (e.g. "core"/"cli"/"@x/api"),
+    // relatedness cannot be judged, so unrelatedness cannot be proven - skip
+    // rather than emit a maximally-FP-prone flag (v5.16.0 gate finding).
+    if (significantTokens(packageName).size === 0)
+        return;
+    const body = await httpsGetTextOrNull(`https://raw.githubusercontent.com/${claim.owner}/${claim.repo}/HEAD/package.json`);
+    if (body === null)
+        return; // unfetchable: too benign to flag
+    let repoPkg;
+    try {
+        repoPkg = JSON.parse(body);
+    }
+    catch {
+        return;
+    }
+    // Monorepo / workspace-root signals: a root that declares `workspaces`, or is
+    // marked private (the near-universal marker of an unpublished monorepo root
+    // that legitimately publishes many differently-named member packages).
+    if (repoPkg.workspaces !== undefined)
+        return;
+    if (repoPkg.private === true)
+        return;
+    const repoName = typeof repoPkg.name === "string" ? repoPkg.name : undefined;
+    if (!repoName)
+        return; // no name to compare
+    if (repoName === packageName)
+        return; // corroborated
+    if (significantTokens(repoName).size === 0)
+        return; // repo name too generic to judge
+    if (namesAreRelated(packageName, repoName))
+        return; // likely the same project
+    // Last-resort monorepo check (only on the would-flag path, so no latency on
+    // the common case): pnpm/lerna monorepos leave the package.json workspaces key
+    // empty. If a workspace manifest exists in the repo, treat it as a monorepo.
+    for (const manifest of ["pnpm-workspace.yaml", "lerna.json"]) {
+        const m = await httpsGetTextOrNull(`https://raw.githubusercontent.com/${claim.owner}/${claim.repo}/HEAD/${manifest}`);
+        if (m !== null)
+            return;
+    }
+    findings.push({
+        rule: "STARJACKING_SUSPECTED",
+        description: `Package "${packageName}" claims repository github.com/${claim.owner}/${claim.repo}, but that ` +
+            `repository publishes a different, unrelated package ("${repoName}") and is not a monorepo ` +
+            "containing this one - the repository may be borrowed to inherit its stars/trust.",
+        severity: "medium",
+        confidence: 0.7,
+        category: "supply-chain",
+        file: "package.json",
+        recommendation: `Verify that github.com/${claim.owner}/${claim.repo} is really the source of "${packageName}". ` +
+            "Starjacking points a malicious package at a popular project's repo to inflate trust scores; " +
+            "confirm the repo actually builds and publishes this package before trusting it.",
+    });
+}
 /**
  * Fetch package metadata from the npm registry.
  */

package/dist/npm-scanner.js.map

@@ -1 +1 @@
-{"version":3,"file":"npm-scanner.js","sourceRoot":"","sources":["../src/npm-scanner.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,MAAY,EAAE,oCAAgB;AAC9B,MAAY,EAAE,oCAAgB;AAC9B,MAAY,IAAI,sCAAkB;AAClC,MAAY,KAAK,uCAAmB;AAEpC,yCAA6C;AAC7C,iEAAsD;AACtD,+CAOuB;AAEvB,MAAM,YAAY,GAAG,OAAO,CAAC;AAC7B,MAAM,YAAY,GAAG,4BAA4B,CAAC;AAelD;;GAEG;AACI,KAAK,yBACV,WAAmB,EACnB,OAA0D;IAE1D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,sDAAsD;IACtD,gBAAgB,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAExC,uCAAuC;IACvC,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,WAAW,CAAC,CAAC;IACzD,MAAM,aAAa,GAAG,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IACpD,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,0CAA0C,WAAW,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,WAAW,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC,aAAa,CAAC,CAAC;IACvD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,8BAA8B,WAAW,IAAI,aAAa,EAAE,CAAC,CAAC;IAChF,CAAC;IAED,6BAA6B;IAC7B,mBAAmB,CAAC,WAA6B,EAAE,QAAQ,CAAC,CAAC;IAE7D,sDAAsD;IACtD,iBAAiB,CAAC,WAA6B,EAAE,QAAQ,CAAC,CAAC;IAE3D,4BAA4B;IAC5B,MAAM,UAAU,GAAI,WAA8B,CAAC,IAAI,EAAE,OAAO,CAAC;IACjE,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,sBAAsB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IACrD,CAAC;IAED,oBAAoB;IACpB,MAAM,OAAO,GAAG;QACd,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,CAAC;QACf,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,MAAM;QAClE,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,MAAM;QAC1D,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,MAAM;QAC9D,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,MAAM;QACxD,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,MAAM;KAC3D,CAAC;IAEF,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,KAAK,IAAI,0BAAe,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC7C,CAAC;IACD,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAE7B,MAAM,SAAS,GAAG,KAAK,KAAK,CAAC;QAC3B,CAAC,CAAC,OAAgB;QAClB,CAAC,CAAC,KAAK,IAAI,EAAE;YACX,CAAC,CAAC,KAAc;YAChB,CAAC,CAAC,KAAK,IAAI,EAAE;gBACX,CAAC,CAAC,QAAiB;gBACnB,CAAC,CAAC,KAAK,IAAI,EAAE;oBACX,CAAC,CAAC,MAAe;oBACjB,CAAC,CAAC,UAAmB,CAAC;IAE9B,OAAO;QACL,IAAI,EAAE,uBAAuB,YAAY,EAAE;QAC3C,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,MAAM,EAAE,GAAG,WAAW,IAAI,aAAa,EAAE;QACzC,QAAQ,EAAE,KAAK;QACf,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;QAClC,QAAQ;QACR,OAAO;QACP,KAAK;QACL,SAAS;QACT,eAAe,EAAE,0BAA0B,CAAC,QAAQ,EAAE,WAAW,CAAC;KACnE,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,gBAAgB,CAAC,IAAY,EAAE,QAAmB;IACzD,KAAK,MAAM,OAAO,IAAI,wCAA0B,EAAE,CAAC;QACjD,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,wBAAwB;gBAC9B,WAAW,EAAE,iBAAiB,IAAI,sDAAsD;gBACxF,QAAQ,EAAE,MAAM;gBAChB,cAAc,EAAE,wGAAwG;aACzH,CAAC,CAAC;YACH,MAAM;QACR,CAAC;IACH,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,mBAAmB,CAC1B,GAAmB,EACnB,QAAmB;IAEnB,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;IAC5B,IAAI,CAAC,OAAO;QAAE,OAAO;IAErB,MAAM,cAAc,GAAG,CAAC,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,eAAe,CAAC,CAAC;IAEtF,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,MAAM;YAAE,SAAS;QAEtB,KAAK,MAAM,OAAO,IAAI,gCAAkB,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAC/C,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;gBACvB,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,OAAO,CAAC,IAAI;oBAClB,WAAW,EAAE,OAAO,IAAI,KAAK,OAAO,CAAC,WAAW,EAAE;oBAClD,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,IAAI,EAAE,cAAc;oBACpB,KAAK,EAAE,GAAG,IAAI,KAAK,MAAM,EAAE;oBAC3B,cAAc,EAAE,cAAc,IAAI,yCAAyC;iBAC5E,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB,CACxB,GAAmB,EACnB,QAAmB;IAEnB,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC;IAC9B,MAAM,OAAO,GAAG,GAAG,CAAC,eAAe,CAAC;IAEpC,IAAI,IAAI;QAAE,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7C,IAAI,OAAO;QAAE,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAEnD,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,KAAK,MAAM,OAAO,IAAI,wCAA0B,EAAE,CAAC;YACjD,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;YAClC,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBACpB,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,sBAAsB;oBAC5B,WAAW,EAAE,eAAe,GAAG,sDAAsD;oBACrF,QAAQ,EAAE,MAAM;oBAChB,IAAI,EAAE,cAAc;oBACpB,cAAc,EAAE,gBAAgB,GAAG,gDAAgD;iBACpF,CAAC,CAAC;gBACH,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,oBAAoB,CACjC,WAAmB;IAEnB,MAAM,GAAG,GAAG,GAAG,YAAY,IAAI,kBAAkB,CAAC,WAAW,CAAC,EAAE,CAAC;IAEjE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,KAAK;aACF,GAAG,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE;YAC7D,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;gBAC3B,MAAM,CAAC,IAAI,KAAK,CAAC,sBAAsB,WAAW,EAAE,CAAC,CAAC,CAAC;gBACvD,OAAO;YACT,CAAC;YACD,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;gBAC3B,MAAM,CACJ,IAAI,KAAK,CACP,gCAAgC,GAAG,CAAC,UAAU,QAAQ,WAAW,EAAE,CACpE,CACF,CAAC;gBACF,OAAO;YACT,CAAC;YAED,IAAI,IAAI,GAAG,EAAE,CAAC;YACd,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;gBAC/B,IAAI,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YAC3B,CAAC,CAAC,CAAC;YACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,IAAI,CAAC;oBACH,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAwB,CAAC,CAAC;gBACnD,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,CAAC,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC,CAAC;gBAC7D,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;aACD,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,sBAAsB,CACnC,UAAkB,EAClB,QAAmB;IAEnB,MAAM,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC;IACnE,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAEtD,IAAI,CAAC;QACH,mBAAmB;QACnB,MAAM,YAAY,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QAE5C,kBAAkB;QAClB,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACnD,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,IAAA,mCAAY,EAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QAEtC,uBAAuB;QACvB,qBAAqB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAC9C,CAAC;YAAS,CAAC;QACT,UAAU;QACV,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACvD,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,+BACE,UAAkB,EAClB,QAAmB;IAEnB,MAAM,KAAK,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;IAEhD,KAAK,MAAM,QAAQ,IAAI,KAAK,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;QACjD,IAAI,CAAC,kCAAoB,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAE7C,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,IAAI,CAAC,IAAI,GAAG,2BAAa,EAAE,CAAC;YAC9B,sEAAsE;YACtE,QAAQ,CAAC,IAAI,CAAC,IAAA,sCAAwB,EAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YACxF,SAAS;QACX,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACnD,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YAEzD,KAAK,MAAM,OAAO,IAAI,2BAAa,EAAE,CAAC;gBACpC,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;gBAC/C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAElC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;oBACtC,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;oBACzC,IAAI,KAAK,EAAE,CAAC;wBACV,QAAQ,CAAC,IAAI,CAAC;4BACZ,IAAI,EAAE,OAAO,CAAC,IAAI;4BAClB,WAAW,EAAE,OAAO,CAAC,WAAW;4BAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ;4BAC1B,IAAI,EAAE,YAAY;4BAClB,IAAI,EAAE,CAAC,GAAG,CAAC;4BACX,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC;4BACjC,cAAc,EAAE,mCAAmC,OAAO,CAAC,WAAW,EAAE;yBACzE,CAAC,CAAC;wBACH,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;oBACtB,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,wBAAwB;QAC1B,CAAC;IACH,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,YAAY,CAAC,GAAW,EAAE,IAAY;IAC7C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,IAAI,GAAG,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACxC,KAAK;aACF,GAAG,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE;YACrB,mBAAmB;YACnB,IAAI,QAAQ,CAAC,UAAU,KAAK,GAAG,IAAI,QAAQ,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;gBAC/D,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC;gBAC9C,IAAI,WAAW,EAAE,CAAC;oBAChB,IAAI,CAAC,KAAK,EAAE,CAAC;oBACb,YAAY,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;oBACtD,OAAO;gBACT,CAAC;YACH,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACpB,IAAI,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;gBACrB,IAAI,CAAC,KAAK,EAAE,CAAC;gBACb,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;aACD,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACnB,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YACpB,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,SAAS,qBAAqB,CAAC,GAAW;IACxC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,OAAoB,CAAC;IAEzB,IAAI,CAAC;QACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,KAAK,CAAC,WAAW,EAAE,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YACzD,KAAK,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC,CAAC;QACjD,CAAC;aAAM,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YAC1B,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,SAAS,0BAA0B,CACjC,QAAmB,EACnB,WAAmB;IAEnB,MAAM,eAAe,GAAa,EAAE,CAAC;IAErC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,wBAAwB,CAAC,EAAE,CAAC;QAC9D,eAAe,CAAC,IAAI,CAClB,qBAAqB,WAAW,0EAA0E,CAC3G,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;QACvD,eAAe,CAAC,IAAI,CAClB,yGAAyG,CAC1G,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,EAAE,CAAC;QACpD,eAAe,CAAC,IAAI,CAClB,8FAA8F,CAC/F,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,sBAAsB,CAAC,EAAE,CAAC;QAC5D,eAAe,CAAC,IAAI,CAClB,qGAAqG,CACtG,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,eAAe,CAAC,IAAI,CAClB,oCAAoC,WAAW,qDAAqD,CACrG,CAAC;IACJ,CAAC;IAED,OAAO,eAAe,CAAC;AACzB,CAAC"}
+{"version":3,"file":"npm-scanner.js","sourceRoot":"","sources":["../src/npm-scanner.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,MAAY,EAAE,oCAAgB;AAC9B,MAAY,EAAE,oCAAgB;AAC9B,MAAY,IAAI,sCAAkB;AAClC,MAAY,KAAK,uCAAmB;AAEpC,yCAA6C;AAC7C,iEAAsD;AACtD,+CAOuB;AACvB,uEAA2D;AAE3D,MAAM,YAAY,GAAG,OAAO,CAAC;AAC7B,MAAM,YAAY,GAAG,4BAA4B,CAAC;AAgBlD;;GAEG;AACI,KAAK,yBACV,WAAmB,EACnB,OAA0D;IAE1D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,sDAAsD;IACtD,gBAAgB,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAExC,uCAAuC;IACvC,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,WAAW,CAAC,CAAC;IACzD,MAAM,aAAa,GAAG,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IACpD,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,0CAA0C,WAAW,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,WAAW,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC,aAAa,CAAC,CAAC;IACvD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,8BAA8B,WAAW,IAAI,aAAa,EAAE,CAAC,CAAC;IAChF,CAAC;IAED,6BAA6B;IAC7B,mBAAmB,CAAC,WAA6B,EAAE,QAAQ,CAAC,CAAC;IAE7D,sDAAsD;IACtD,iBAAiB,CAAC,WAA6B,EAAE,QAAQ,CAAC,CAAC;IAE3D,0EAA0E;IAC1E,6EAA6E;IAC7E,0EAA0E;IAC1E,MAAM,oBAAoB,CAAC,WAAW,EAAE,WAA6B,EAAE,QAAQ,CAAC,CAAC;IAEjF,4BAA4B;IAC5B,MAAM,UAAU,GAAI,WAA8B,CAAC,IAAI,EAAE,OAAO,CAAC;IACjE,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,sBAAsB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IACrD,CAAC;IAED,oBAAoB;IACpB,MAAM,OAAO,GAAG;QACd,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,CAAC;QACf,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,MAAM;QAClE,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,MAAM;QAC1D,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,MAAM;QAC9D,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,MAAM;QACxD,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,MAAM;KAC3D,CAAC;IAEF,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,KAAK,IAAI,0BAAe,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC7C,CAAC;IACD,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAE7B,MAAM,SAAS,GAAG,KAAK,KAAK,CAAC;QAC3B,CAAC,CAAC,OAAgB;QAClB,CAAC,CAAC,KAAK,IAAI,EAAE;YACX,CAAC,CAAC,KAAc;YAChB,CAAC,CAAC,KAAK,IAAI,EAAE;gBACX,CAAC,CAAC,QAAiB;gBACnB,CAAC,CAAC,KAAK,IAAI,EAAE;oBACX,CAAC,CAAC,MAAe;oBACjB,CAAC,CAAC,UAAmB,CAAC;IAE9B,OAAO;QACL,IAAI,EAAE,uBAAuB,YAAY,EAAE;QAC3C,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,MAAM,EAAE,GAAG,WAAW,IAAI,aAAa,EAAE;QACzC,QAAQ,EAAE,KAAK;QACf,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;QAClC,QAAQ;QACR,OAAO;QACP,KAAK;QACL,SAAS;QACT,eAAe,EAAE,0BAA0B,CAAC,QAAQ,EAAE,WAAW,CAAC;KACnE,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,gBAAgB,CAAC,IAAY,EAAE,QAAmB;IACzD,KAAK,MAAM,OAAO,IAAI,wCAA0B,EAAE,CAAC;QACjD,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,wBAAwB;gBAC9B,WAAW,EAAE,iBAAiB,IAAI,sDAAsD;gBACxF,QAAQ,EAAE,MAAM;gBAChB,cAAc,EAAE,wGAAwG;aACzH,CAAC,CAAC;YACH,MAAM;QACR,CAAC;IACH,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,mBAAmB,CAC1B,GAAmB,EACnB,QAAmB;IAEnB,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;IAC5B,IAAI,CAAC,OAAO;QAAE,OAAO;IAErB,MAAM,cAAc,GAAG,CAAC,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,eAAe,CAAC,CAAC;IAEtF,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,MAAM;YAAE,SAAS;QAEtB,KAAK,MAAM,OAAO,IAAI,gCAAkB,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAC/C,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;gBACvB,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,OAAO,CAAC,IAAI;oBAClB,WAAW,EAAE,OAAO,IAAI,KAAK,OAAO,CAAC,WAAW,EAAE;oBAClD,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,IAAI,EAAE,cAAc;oBACpB,KAAK,EAAE,GAAG,IAAI,KAAK,MAAM,EAAE;oBAC3B,cAAc,EAAE,cAAc,IAAI,yCAAyC;iBAC5E,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB,CACxB,GAAmB,EACnB,QAAmB;IAEnB,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC;IAC9B,MAAM,OAAO,GAAG,GAAG,CAAC,eAAe,CAAC;IAEpC,IAAI,IAAI;QAAE,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7C,IAAI,OAAO;QAAE,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAEnD,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,KAAK,MAAM,OAAO,IAAI,wCAA0B,EAAE,CAAC;YACjD,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;YAClC,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBACpB,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,sBAAsB;oBAC5B,WAAW,EAAE,eAAe,GAAG,sDAAsD;oBACrF,QAAQ,EAAE,MAAM;oBAChB,IAAI,EAAE,cAAc;oBACpB,cAAc,EAAE,gBAAgB,GAAG,gDAAgD;iBACpF,CAAC,CAAC;gBACH,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,yDAAyD;AACzD,8EAA8E;AAE9E,+EAA+E;AAC/E,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ;IAC1E,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK;IAC1E,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS;CAC5E,CAAC,CAAC;AAEH,+EAA+E;AAC/E,SAAS,iBAAiB,CAAC,IAAY;IACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAC/C,OAAO,IAAI,GAAG,CACZ,QAAQ;SACL,WAAW,EAAE;SACb,KAAK,CAAC,UAAU,CAAC;SACjB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAC/D,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,CAAS,EAAE,CAAS;IAC3C,MAAM,EAAE,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,iBAAiB,CAAC,CAAC,CAAC;QAAE,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IACjE,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,8BACE,UAAmB;IAEnB,IAAI,GAAuB,CAAC;IAC5B,IAAI,SAA6B,CAAC;IAClC,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QACnC,GAAG,GAAG,UAAU,CAAC;IACnB,CAAC;SAAM,IAAI,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QACxD,MAAM,CAAC,GAAG,UAAoD,CAAC;QAC/D,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ;YAAE,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC;QAC3C,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;YAAE,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC;IAC/D,CAAC;IACD,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAEtB,sDAAsD;IACtD,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,oDAAoD,CAAC,CAAC;IAClF,IAAI,SAAS,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACrE,MAAM,MAAM,GAAG,IAAA,wCAAc,EAAC,cAAc,SAAS,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC5E,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAClD,CAAC;IAED,MAAM,MAAM,GAAG,IAAA,wCAAc,EAAC,GAAG,CAAC,CAAC;IACnC,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAClD,CAAC;AAED,kFAAkF;AAClF,SAAS,kBAAkB,CAAC,GAAW;IACrC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,IAAI,GAAG,CAAC,CAAgB,EAAQ,EAAE;YACtC,IAAI,CAAC,OAAO,EAAE,CAAC;gBAAC,OAAO,GAAG,IAAI,CAAC;gBAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAAC,CAAC;QAC/C,CAAC,CAAC;QACF,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,YAAY,EAAE,oBAAoB,EAAE,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE;gBAClH,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;oBAC3B,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;oBACf,IAAI,CAAC,IAAI,CAAC,CAAC;oBACX,OAAO;gBACT,CAAC;gBACD,IAAI,IAAI,GAAG,EAAE,CAAC;gBACd,IAAI,IAAI,GAAG,CAAC,CAAC;gBACb,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;oBAC/B,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;oBACrB,IAAI,IAAI,GAAG,2BAAa,EAAE,CAAC;wBAAC,IAAI,CAAC,IAAI,CAAC,CAAC;wBAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;wBAAC,OAAO;oBAAC,CAAC;oBAClE,IAAI,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;gBAC3B,CAAC,CAAC,CAAC;gBACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;gBAChC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YACpC,CAAC,CAAC,CAAC;YACH,sEAAsE;YACtE,GAAG,CAAC,UAAU,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YACjE,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACI,KAAK,+BACV,WAAmB,EACnB,WAAqC,EACrC,QAAmB;IAEnB,MAAM,KAAK,GAAG,oBAAoB,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;IAC3D,IAAI,CAAC,KAAK;QAAE,OAAO;IACnB,oEAAoE;IACpE,IAAI,KAAK,CAAC,SAAS;QAAE,OAAO;IAE5B,+EAA+E;IAC/E,8EAA8E;IAC9E,wEAAwE;IACxE,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACpD,IAAI,KAAK,IAAI,KAAK,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE;QAAE,OAAO;IAEvE,+EAA+E;IAC/E,yEAAyE;IACzE,qEAAqE;IACrE,IAAI,iBAAiB,CAAC,WAAW,CAAC,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO;IAEtD,MAAM,IAAI,GAAG,MAAM,kBAAkB,CACnC,qCAAqC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,oBAAoB,CACnF,CAAC;IACF,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,CAAC,kCAAkC;IAE7D,IAAI,OAAoE,CAAC;IACzE,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAgE,CAAC;IAC5F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,8EAA8E;IAC9E,4EAA4E;IAC5E,uEAAuE;IACvE,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS;QAAE,OAAO;IAC7C,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI;QAAE,OAAO;IAErC,MAAM,QAAQ,GAAG,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7E,IAAI,CAAC,QAAQ;QAAE,OAAO,CAAC,qBAAqB;IAC5C,IAAI,QAAQ,KAAK,WAAW;QAAE,OAAO,CAAC,eAAe;IACrD,IAAI,iBAAiB,CAAC,QAAQ,CAAC,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,CAAC,iCAAiC;IACrF,IAAI,eAAe,CAAC,WAAW,EAAE,QAAQ,CAAC;QAAE,OAAO,CAAC,0BAA0B;IAE9E,4EAA4E;IAC5E,+EAA+E;IAC/E,6EAA6E;IAC7E,KAAK,MAAM,QAAQ,IAAI,CAAC,qBAAqB,EAAE,YAAY,CAAC,EAAE,CAAC;QAC7D,MAAM,CAAC,GAAG,MAAM,kBAAkB,CAChC,qCAAqC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,SAAS,QAAQ,EAAE,CAClF,CAAC;QACF,IAAI,CAAC,KAAK,IAAI;YAAE,OAAO;IACzB,CAAC;IAED,QAAQ,CAAC,IAAI,CAAC;QACZ,IAAI,EAAE,uBAAuB;QAC7B,WAAW,EACT,YAAY,WAAW,kCAAkC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,aAAa;YAC/F,yDAAyD,QAAQ,2BAA2B;YAC5F,kFAAkF;QACpF,QAAQ,EAAE,QAAQ;QAClB,UAAU,EAAE,GAAG;QACf,QAAQ,EAAE,cAAc;QACxB,IAAI,EAAE,cAAc;QACpB,cAAc,EACZ,0BAA0B,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,6BAA6B,WAAW,KAAK;YAChG,8FAA8F;YAC9F,iFAAiF;KACpF,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,oBAAoB,CACjC,WAAmB;IAEnB,MAAM,GAAG,GAAG,GAAG,YAAY,IAAI,kBAAkB,CAAC,WAAW,CAAC,EAAE,CAAC;IAEjE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,KAAK;aACF,GAAG,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE;YAC7D,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;gBAC3B,MAAM,CAAC,IAAI,KAAK,CAAC,sBAAsB,WAAW,EAAE,CAAC,CAAC,CAAC;gBACvD,OAAO;YACT,CAAC;YACD,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;gBAC3B,MAAM,CACJ,IAAI,KAAK,CACP,gCAAgC,GAAG,CAAC,UAAU,QAAQ,WAAW,EAAE,CACpE,CACF,CAAC;gBACF,OAAO;YACT,CAAC;YAED,IAAI,IAAI,GAAG,EAAE,CAAC;YACd,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;gBAC/B,IAAI,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YAC3B,CAAC,CAAC,CAAC;YACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,IAAI,CAAC;oBACH,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAwB,CAAC,CAAC;gBACnD,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,CAAC,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC,CAAC;gBAC7D,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;aACD,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,sBAAsB,CACnC,UAAkB,EAClB,QAAmB;IAEnB,MAAM,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC;IACnE,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAEtD,IAAI,CAAC;QACH,mBAAmB;QACnB,MAAM,YAAY,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QAE5C,kBAAkB;QAClB,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACnD,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,IAAA,mCAAY,EAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QAEtC,uBAAuB;QACvB,qBAAqB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAC9C,CAAC;YAAS,CAAC;QACT,UAAU;QACV,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACvD,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,+BACE,UAAkB,EAClB,QAAmB;IAEnB,MAAM,KAAK,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;IAEhD,KAAK,MAAM,QAAQ,IAAI,KAAK,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;QACjD,IAAI,CAAC,kCAAoB,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAE7C,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,IAAI,CAAC,IAAI,GAAG,2BAAa,EAAE,CAAC;YAC9B,sEAAsE;YACtE,QAAQ,CAAC,IAAI,CAAC,IAAA,sCAAwB,EAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YACxF,SAAS;QACX,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACnD,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YAEzD,KAAK,MAAM,OAAO,IAAI,2BAAa,EAAE,CAAC;gBACpC,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;gBAC/C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAElC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;oBACtC,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;oBACzC,IAAI,KAAK,EAAE,CAAC;wBACV,QAAQ,CAAC,IAAI,CAAC;4BACZ,IAAI,EAAE,OAAO,CAAC,IAAI;4BAClB,WAAW,EAAE,OAAO,CAAC,WAAW;4BAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ;4BAC1B,IAAI,EAAE,YAAY;4BAClB,IAAI,EAAE,CAAC,GAAG,CAAC;4BACX,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC;4BACjC,cAAc,EAAE,mCAAmC,OAAO,CAAC,WAAW,EAAE;yBACzE,CAAC,CAAC;wBACH,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;oBACtB,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,wBAAwB;QAC1B,CAAC;IACH,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,YAAY,CAAC,GAAW,EAAE,IAAY;IAC7C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,IAAI,GAAG,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACxC,KAAK;aACF,GAAG,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE;YACrB,mBAAmB;YACnB,IAAI,QAAQ,CAAC,UAAU,KAAK,GAAG,IAAI,QAAQ,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;gBAC/D,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC;gBAC9C,IAAI,WAAW,EAAE,CAAC;oBAChB,IAAI,CAAC,KAAK,EAAE,CAAC;oBACb,YAAY,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;oBACtD,OAAO;gBACT,CAAC;YACH,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACpB,IAAI,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;gBACrB,IAAI,CAAC,KAAK,EAAE,CAAC;gBACb,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;aACD,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACnB,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YACpB,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,SAAS,qBAAqB,CAAC,GAAW;IACxC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,OAAoB,CAAC;IAEzB,IAAI,CAAC;QACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,KAAK,CAAC,WAAW,EAAE,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YACzD,KAAK,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC,CAAC;QACjD,CAAC;aAAM,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YAC1B,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,SAAS,0BAA0B,CACjC,QAAmB,EACnB,WAAmB;IAEnB,MAAM,eAAe,GAAa,EAAE,CAAC;IAErC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,wBAAwB,CAAC,EAAE,CAAC;QAC9D,eAAe,CAAC,IAAI,CAClB,qBAAqB,WAAW,0EAA0E,CAC3G,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;QACvD,eAAe,CAAC,IAAI,CAClB,yGAAyG,CAC1G,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,EAAE,CAAC;QACpD,eAAe,CAAC,IAAI,CAClB,8FAA8F,CAC/F,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,sBAAsB,CAAC,EAAE,CAAC;QAC5D,eAAe,CAAC,IAAI,CAClB,qGAAqG,CACtG,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,eAAe,CAAC,IAAI,CAClB,oCAAoC,WAAW,qDAAqD,CACrG,CAAC;IACJ,CAAC;IAED,OAAO,eAAe,CAAC;AACzB,CAAC"}

package/dist/reporter.js

@@ -62,7 +62,7 @@ function formatJson(report) {
 function formatText(report) {
     const lines = [];
     // ── layout constants ───────────────────────────────────────────────────────
-    const VERSION = "5.14.0";
+    const VERSION = "5.16.0";
     const W = 76; // visible chars between "│ " and " │" (total line = 80)
     // ── ANSI helpers ───────────────────────────────────────────────────────────
     const stripAnsi = (s) => s.replace(/\x1b\[[0-9;]*m/g, "");
@@ -497,7 +497,7 @@ function formatSarif(report) {
                 tool: {
                     driver: {
                         name: "supply-chain-guard",
-                        version: "5.14.0",
+                        version: "5.16.0",
                         informationUri: "https://github.com/homeofe/supply-chain-guard",
                         rules,
                     },
@@ -559,7 +559,7 @@ function formatSbom(report) {
             timestamp: report.timestamp,
             tools: {
                 components: [
-                    { type: "application", name: "supply-chain-guard", version: "5.14.0" },
+                    { type: "application", name: "supply-chain-guard", version: "5.16.0" },
                 ],
             },
             component: {
@@ -677,7 +677,7 @@ function formatGitlab(report) {
         name: "supply-chain-guard",
         url: "https://github.com/homeofe/supply-chain-guard",
         vendor: { name: "supply-chain-guard" },
-        version: "5.14.0",
+        version: "5.16.0",
     };
     const vulnerabilities = report.findings
         .filter((f) => !f.suppressed)
@@ -907,7 +907,7 @@ footer{text-align:center;padding:24px;color:#94a3b8;font-size:13px}
   ` : ""}
 
   <footer>
-    Generated by <a href="https://github.com/homeofe/supply-chain-guard">supply-chain-guard</a> v5.14.0
+    Generated by <a href="https://github.com/homeofe/supply-chain-guard">supply-chain-guard</a> v5.16.0
   </footer>
 </div>
 <script>

package/dist/slsa-verifier.d.ts

@@ -8,9 +8,48 @@
  *   0 — No evidence of any build process
  *   1 — Build script present (Dockerfile, CI workflow)
  *   2 — Signed build or slsa-github-generator action used
- *   3 — Hermetic build + provenance attestation file present
+ *   3 — Hermetic build + a VALID parsed provenance statement
+ *
+ * Scope (v5.15.0): provenance files are now PARSED and structurally validated
+ * (in-toto Statement / DSSE envelope / Sigstore bundle -> SLSA predicate type +
+ * digested subjects), not merely detected by filename - a present-but-empty or
+ * malformed provenance file no longer counts. This validates STRUCTURE and
+ * binding fields, not the cryptographic signature / Fulcio certificate chain /
+ * Rekor inclusion proof; full offline signature verification is a follow-up.
  */
 import type { Finding } from "./types.js";
+export interface AttestationResult {
+    /** An attestation STATEMENT file exists (in dir / dist / .github). */
+    present: boolean;
+    /** The file parses as a real in-toto/DSSE/sigstore SLSA provenance statement. */
+    valid: boolean;
+    /**
+     * What the present file is:
+     *  - "slsa": a valid SLSA provenance statement (valid=true)
+     *  - "non-slsa-attestation": a valid in-toto attestation with a non-SLSA
+     *     predicate (e.g. an SBOM/SPDX attestation) - legitimate, NOT flagged
+     *  - "malformed": present but not a usable statement (placeholder/garbage,
+     *     or a SLSA statement missing digested subjects) - this is the problem case
+     */
+    kind?: "slsa" | "non-slsa-attestation" | "malformed";
+    /** Path of the file that was inspected, if any. */
+    file?: string;
+    /** in-toto statement predicateType, when extractable. */
+    predicateType?: string;
+    /** Number of attested subjects (artifacts), when extractable. */
+    subjectCount?: number;
+    /** Builder identity from the SLSA predicate, when extractable. */
+    builderId?: string;
+    /** Why an existing file was judged not-valid-SLSA (for the finding message). */
+    reason?: string;
+}
+/**
+ * Parse and structurally validate the project's attestation statement, if any.
+ * Replaces the old "a file named provenance.json exists" heuristic: a present
+ * but empty / malformed / non-provenance file is reported as NOT valid, so it
+ * can no longer inflate the SLSA level or masquerade as real provenance.
+ */
+export declare function parseAttestation(dir: string): AttestationResult;
 /**
  * Determine SLSA level (0–3) for a project directory.
  *

package/dist/slsa-verifier.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"slsa-verifier.d.ts","sourceRoot":"","sources":["../src/slsa-verifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AA6H1C;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAwChD;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,EAAE,CA4CjD"}
+{"version":3,"file":"slsa-verifier.d.ts","sourceRoot":"","sources":["../src/slsa-verifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAsE1C,MAAM,WAAW,iBAAiB;IAChC,sEAAsE;IACtE,OAAO,EAAE,OAAO,CAAC;IACjB,iFAAiF;IACjF,KAAK,EAAE,OAAO,CAAC;IACf;;;;;;;OAOG;IACH,IAAI,CAAC,EAAE,MAAM,GAAG,sBAAsB,GAAG,WAAW,CAAC;IACrD,mDAAmD;IACnD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yDAAyD;IACzD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iEAAiE;IACjE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kEAAkE;IAClE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gFAAgF;IAChF,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AA8FD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,iBAAiB,CAkD/D;AA0DD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CA0ChD;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,EAAE,CAkEjD"}

package/dist/slsa-verifier.js

@@ -9,7 +9,14 @@
  *   0 — No evidence of any build process
  *   1 — Build script present (Dockerfile, CI workflow)
  *   2 — Signed build or slsa-github-generator action used
- *   3 — Hermetic build + provenance attestation file present
+ *   3 — Hermetic build + a VALID parsed provenance statement
+ *
+ * Scope (v5.15.0): provenance files are now PARSED and structurally validated
+ * (in-toto Statement / DSSE envelope / Sigstore bundle -> SLSA predicate type +
+ * digested subjects), not merely detected by filename - a present-but-empty or
+ * malformed provenance file no longer counts. This validates STRUCTURE and
+ * binding fields, not the cryptographic signature / Fulcio certificate chain /
+ * Rekor inclusion proof; full offline signature verification is a follow-up.
  */
 var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
     if (k2 === undefined) k2 = k;
@@ -45,10 +52,12 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseAttestation = parseAttestation;
 exports.getSLSALevel = getSLSALevel;
 exports.verifySLSA = verifySLSA;
 const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
+const patterns_js_1 = require("./patterns.js");
 /** Workflow patterns that indicate SLSA Level 2 (signed/generated provenance) */
 const SLSA_LEVEL2_PATTERNS = [
     /slsa-framework\/slsa-github-generator/i,
@@ -92,14 +101,165 @@ const SLSA_LEVEL3_PATTERNS = [
  */
 const NPM_PROVENANCE_PATTERN = /npm\s+publish[^\n]*--provenance/i;
 const OIDC_TOKEN_WRITE_PATTERN = /id-token:\s*write/i;
-/** Attestation file names that indicate provenance is present */
-const ATTESTATION_FILES = [
+/**
+ * Attestation STATEMENT files (an in-toto/DSSE/sigstore provenance document).
+ * cosign.pub is a public key, not a statement, so it is handled separately -
+ * it must never on its own be treated as "provenance is present".
+ */
+const ATTESTATION_STATEMENT_FILES = [
     "provenance.json",
     "attestation.json",
     "provenance.intoto.jsonl",
     ".sigstore",
-    "cosign.pub",
 ];
+/** Recognised in-toto Statement type URIs. */
+const INTOTO_STATEMENT_TYPES = new Set([
+    "https://in-toto.io/Statement/v1",
+    "https://in-toto.io/Statement/v0.1",
+]);
+/** SLSA provenance predicate type prefixes (v0.1, v0.2, v1). */
+const SLSA_PREDICATE_PREFIX = "https://slsa.dev/provenance/";
+/**
+ * Extract and structurally validate an in-toto statement from a parsed value
+ * that may be the statement itself, a DSSE envelope (base64 payload), or a
+ * Sigstore bundle wrapping a DSSE envelope. Returns the statement or null.
+ *
+ * NOTE: this validates STRUCTURE and binding fields (statement type, SLSA
+ * predicate type, subject digests), NOT the cryptographic signature / Fulcio
+ * certificate chain / Rekor inclusion proof. Full signature verification is a
+ * separate, heavier step (see verifySLSA doc). We never claim more than we do.
+ */
+function extractInTotoStatement(parsed, depth = 0) {
+    // Bound the unwrap chain: the input is an untrusted attestation file, and a
+    // crafted bundle/DSSE that nests another envelope in its payload must not
+    // recurse without limit. A real statement is at most bundle -> DSSE -> stmt.
+    if (depth > 4)
+        return null;
+    if (!parsed || typeof parsed !== "object")
+        return null;
+    const obj = parsed;
+    // Sigstore bundle -> unwrap its dsseEnvelope.
+    if (typeof obj.mediaType === "string" && obj.mediaType.includes("sigstore.bundle")) {
+        const env = obj.dsseEnvelope ?? obj.content?.dsseEnvelope;
+        if (env)
+            return extractInTotoStatement(env, depth + 1);
+    }
+    // DSSE envelope -> decode the base64 payload to the statement.
+    if (typeof obj.payload === "string" && obj.payloadType !== undefined) {
+        try {
+            const decoded = Buffer.from(obj.payload, "base64").toString("utf-8");
+            return extractInTotoStatement(JSON.parse(decoded), depth + 1);
+        }
+        catch {
+            return null;
+        }
+    }
+    // Bare in-toto statement.
+    if (typeof obj._type === "string" && INTOTO_STATEMENT_TYPES.has(obj._type)) {
+        return obj;
+    }
+    return null;
+}
+/**
+ * Classify a well-formed in-toto statement: valid SLSA provenance, a valid but
+ * non-SLSA attestation (SBOM/SPDX/other predicate), or a malformed SLSA
+ * statement (SLSA predicate but no digested subject). Never throws.
+ */
+function classifyStatement(stmt) {
+    const predicateType = typeof stmt.predicateType === "string" ? stmt.predicateType : undefined;
+    // A valid in-toto statement whose predicate is NOT SLSA provenance (e.g. an
+    // SBOM/SPDX attestation) is legitimate - it just is not SLSA provenance.
+    if (!predicateType || !predicateType.startsWith(SLSA_PREDICATE_PREFIX)) {
+        return {
+            present: true,
+            valid: false,
+            kind: "non-slsa-attestation",
+            predicateType,
+            reason: `in-toto attestation with a non-SLSA predicate${predicateType ? ` (${predicateType})` : ""}`,
+        };
+    }
+    const subject = Array.isArray(stmt.subject) ? stmt.subject : [];
+    const digestedSubjects = subject.filter((s) => s && typeof s === "object" && s.digest &&
+        typeof s.digest === "object");
+    if (digestedSubjects.length === 0) {
+        return {
+            present: true,
+            valid: false,
+            kind: "malformed",
+            predicateType,
+            reason: "SLSA provenance statement has no digested subject",
+        };
+    }
+    const predicate = (stmt.predicate ?? {});
+    const builder = (predicate.builder ?? predicate.runDetails?.builder);
+    const builderId = builder && typeof builder.id === "string" ? builder.id : undefined;
+    return {
+        present: true,
+        valid: true,
+        kind: "slsa",
+        predicateType,
+        subjectCount: digestedSubjects.length,
+        builderId,
+    };
+}
+/**
+ * Parse and structurally validate the project's attestation statement, if any.
+ * Replaces the old "a file named provenance.json exists" heuristic: a present
+ * but empty / malformed / non-provenance file is reported as NOT valid, so it
+ * can no longer inflate the SLSA level or masquerade as real provenance.
+ */
+function parseAttestation(dir) {
+    const searchDirs = [dir, path.join(dir, "dist"), path.join(dir, ".github")];
+    for (const filename of ATTESTATION_STATEMENT_FILES) {
+        for (const base of searchDirs) {
+            const filePath = path.join(base, filename);
+            if (!fs.existsSync(filePath))
+                continue;
+            // Bound the read like every other scanner: a real provenance file is a few
+            // KB, so an oversized one is skipped rather than read into memory (a
+            // committed multi-hundred-MB file must not become a memory DoS).
+            let content;
+            try {
+                if (fs.statSync(filePath).size > patterns_js_1.MAX_FILE_SIZE)
+                    continue;
+                content = fs.readFileSync(filePath, "utf-8");
+            }
+            catch {
+                return { present: true, valid: false, kind: "malformed", file: filePath, reason: "unreadable" };
+            }
+            // .intoto.jsonl is one DSSE envelope per line; try each line and prefer a
+            // valid SLSA line, falling back to the first classifiable statement.
+            const candidates = filename.endsWith(".jsonl")
+                ? content.split(/\r?\n/).filter((l) => l.trim().length > 0)
+                : [content];
+            let firstClassified = null;
+            for (const candidate of candidates) {
+                let parsed;
+                try {
+                    parsed = JSON.parse(candidate);
+                }
+                catch {
+                    continue;
+                }
+                const stmt = extractInTotoStatement(parsed);
+                if (!stmt)
+                    continue;
+                const cls = { ...classifyStatement(stmt), file: filePath };
+                if (cls.valid)
+                    return cls;
+                firstClassified ??= cls;
+            }
+            return (firstClassified ?? {
+                present: true,
+                valid: false,
+                kind: "malformed",
+                file: filePath,
+                reason: "not a valid in-toto/DSSE statement",
+            });
+        }
+    }
+    return { present: false, valid: false };
+}
 /** Known hermetic build indicators in workflow content */
 const HERMETIC_BUILD_PATTERNS = [
     /reusable_workflow/i,
@@ -137,20 +297,6 @@ function readWorkflows(workflowFiles) {
     })
         .join("\n");
 }
-/**
- * Check if the project root or dist directory contains attestation files.
- */
-function hasAttestationFile(dir) {
-    for (const filename of ATTESTATION_FILES) {
-        if (fs.existsSync(path.join(dir, filename)))
-            return true;
-        if (fs.existsSync(path.join(dir, "dist", filename)))
-            return true;
-        if (fs.existsSync(path.join(dir, ".github", filename)))
-            return true;
-    }
-    return false;
-}
 /**
  * Check for a build script (Dockerfile, CI workflow, Makefile, etc.)
  */
@@ -188,7 +334,9 @@ function getSLSALevel(dir) {
     // Level 3: hermetic reusable workflow + attestation file
     const hasHermeticPattern = SLSA_LEVEL3_PATTERNS.some((p) => p.test(allWorkflowContent));
     const hasHermeticBuild = HERMETIC_BUILD_PATTERNS.some((p) => p.test(allWorkflowContent));
-    const attestation = hasAttestationFile(dir);
+    // A VALID parsed provenance statement, not merely a file named provenance.json
+    // (an empty/garbage file no longer inflates the level - v5.15.0).
+    const attestation = parseAttestation(dir).valid;
     if (hasHermeticPattern && (hasHermeticBuild || attestation))
         return 3;
     // Level 3 (npm-native path): `npm publish --provenance` + OIDC permission.
@@ -212,6 +360,25 @@ function getSLSALevel(dir) {
 function verifySLSA(dir) {
     const findings = [];
     const level = getSLSALevel(dir);
+    // A provenance file that is present but MALFORMED (a placeholder/garbage file,
+    // or a SLSA statement with no digested subject) is worse than none: it looks
+    // like verifiable provenance but attests nothing. A valid non-SLSA in-toto
+    // attestation (e.g. an SBOM/SPDX attestation) is legitimate and NOT flagged.
+    const att = parseAttestation(dir);
+    if (att.present && att.kind === "malformed") {
+        findings.push({
+            rule: "SLSA_PROVENANCE_INVALID",
+            description: `A provenance file (${att.file ? path.basename(att.file) : "provenance"}) is present but is ` +
+                `not usable SLSA provenance: ${att.reason ?? "unparseable"}. It does not actually attest the build.`,
+            severity: "medium",
+            confidence: 0.9,
+            category: "supply-chain",
+            recommendation: "Regenerate provenance with a real tool (npm publish --provenance, " +
+                "actions/attest-build-provenance, or slsa-github-generator). A placeholder or malformed " +
+                "provenance file gives a false sense of verifiability - verify the artifact digest in the " +
+                "statement subject matches the published artifact.",
+        });
+    }
     if (level === 0) {
         findings.push({
             rule: "SLSA_LEVEL_0",

package/dist/slsa-verifier.js.map

@@ -1 +1 @@
-{"version":3,"file":"slsa-verifier.js","sourceRoot":"","sources":["../src/slsa-verifier.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,MAAY,EAAE,oCAAgB;AAC9B,MAAY,IAAI,sCAAkB;AAGlC,iFAAiF;AACjF,MAAM,oBAAoB,GAAG;IAC3B,wCAAwC;IACxC,0BAA0B;IAC1B,sCAAsC;IACtC,mCAAmC;IACnC,iBAAiB;IACjB,6EAA6E;IAC7E,2EAA2E;IAC3E,yEAAyE;IACzE,WAAW;IACX,kCAAkC;CACnC,CAAC;AAEF,oEAAoE;AACpE,MAAM,oBAAoB,GAAG;IAC3B,uDAAuD;IACvD,gDAAgD;CACjD,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,sBAAsB,GAAG,kCAAkC,CAAC;AAClE,MAAM,wBAAwB,GAAG,oBAAoB,CAAC;AAEtD,iEAAiE;AACjE,MAAM,iBAAiB,GAAG;IACxB,iBAAiB;IACjB,kBAAkB;IAClB,yBAAyB;IACzB,WAAW;IACX,YAAY;CACb,CAAC;AAEF,0DAA0D;AAC1D,MAAM,uBAAuB,GAAG;IAC9B,oBAAoB;IACpB,gBAAgB;CACjB,CAAC;AAEF;;GAEG;AACH,SAAS,gBAAgB,CAAC,GAAW;IACnC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;IAC3D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC;QAAE,OAAO,EAAE,CAAC;IAE3C,IAAI,CAAC;QACH,OAAO,EAAE;aACN,WAAW,CAAC,WAAW,CAAC;aACxB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;aACxD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CAAC,aAAuB;IAC5C,OAAO,aAAa;SACjB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACT,IAAI,CAAC;YACH,OAAO,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,SAAS,kBAAkB,CAAC,GAAW;IACrC,KAAK,MAAM,QAAQ,IAAI,iBAAiB,EAAE,CAAC;QACzC,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACzD,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACjE,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IACtE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,SAAS,cAAc,CAAC,GAAW;IACjC,MAAM,UAAU,GAAG;QACjB,YAAY;QACZ,UAAU;QACV,UAAU;QACV,cAAc;QACd,SAAS;QACT,gBAAgB;KACjB,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IACpD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,sBAA6B,GAAW;IACtC,MAAM,aAAa,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC5C,MAAM,WAAW,GAAG,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7C,MAAM,WAAW,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IAExC,oCAAoC;IACpC,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW;QAAE,OAAO,CAAC,CAAC;IAE3C,2CAA2C;IAC3C,IAAI,CAAC,WAAW;QAAE,OAAO,CAAC,CAAC;IAE3B,MAAM,kBAAkB,GAAG,aAAa,CAAC,aAAa,CAAC,CAAC;IAExD,yDAAyD;IACzD,MAAM,kBAAkB,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CACzD,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAC3B,CAAC;IACF,MAAM,gBAAgB,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAC1D,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAC3B,CAAC;IACF,MAAM,WAAW,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IAE5C,IAAI,kBAAkB,IAAI,CAAC,gBAAgB,IAAI,WAAW,CAAC;QAAE,OAAO,CAAC,CAAC;IAEtE,2EAA2E;IAC3E,0EAA0E;IAC1E,yEAAyE;IACzE,yEAAyE;IACzE,MAAM,gBAAgB,GAAG,sBAAsB,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACzE,MAAM,iBAAiB,GAAG,wBAAwB,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAC5E,IAAI,gBAAgB,IAAI,iBAAiB;QAAE,OAAO,CAAC,CAAC;IAEpD,8CAA8C;IAC9C,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAChD,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAC3B,CAAC;IACF,IAAI,SAAS;QAAE,OAAO,CAAC,CAAC;IAExB,+BAA+B;IAC/B,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;GAEG;AACH,oBAA2B,GAAW;IACpC,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAEhC,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;QAChB,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,cAAc;YACpB,WAAW,EACT,+FAA+F;YACjG,QAAQ,EAAE,MAAM;YAChB,cAAc,EACZ,iFAAiF;gBACjF,qEAAqE;SACxE,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;QACvB,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,oBAAoB;YAC1B,WAAW,EACT,wFAAwF;gBACxF,iDAAiD;YACnD,QAAQ,EAAE,KAAK;YACf,cAAc,EACZ,qFAAqF;gBACrF,qFAAqF;SACxF,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;QACvB,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,yBAAyB;YAC/B,WAAW,EACT,oGAAoG;gBACpG,sCAAsC;YACxC,QAAQ,EAAE,MAAM;YAChB,cAAc,EACZ,6CAA6C;gBAC7C,oFAAoF;gBACpF,uFAAuF;gBACvF,6CAA6C;gBAC7C,oFAAoF;gBACpF,sFAAsF;SACzF,CAAC,CAAC;IACL,CAAC;IACD,yCAAyC;IAEzC,OAAO,QAAQ,CAAC;AAClB,CAAC"}
+{"version":3,"file":"slsa-verifier.js","sourceRoot":"","sources":["../src/slsa-verifier.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;GAkBG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,MAAY,EAAE,oCAAgB;AAC9B,MAAY,IAAI,sCAAkB;AAElC,+CAA8C;AAE9C,iFAAiF;AACjF,MAAM,oBAAoB,GAAG;IAC3B,wCAAwC;IACxC,0BAA0B;IAC1B,sCAAsC;IACtC,mCAAmC;IACnC,iBAAiB;IACjB,6EAA6E;IAC7E,2EAA2E;IAC3E,yEAAyE;IACzE,WAAW;IACX,kCAAkC;CACnC,CAAC;AAEF,oEAAoE;AACpE,MAAM,oBAAoB,GAAG;IAC3B,uDAAuD;IACvD,gDAAgD;CACjD,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,sBAAsB,GAAG,kCAAkC,CAAC;AAClE,MAAM,wBAAwB,GAAG,oBAAoB,CAAC;AAEtD;;;;GAIG;AACH,MAAM,2BAA2B,GAAG;IAClC,iBAAiB;IACjB,kBAAkB;IAClB,yBAAyB;IACzB,WAAW;CACZ,CAAC;AAEF,8CAA8C;AAC9C,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;IACrC,iCAAiC;IACjC,mCAAmC;CACpC,CAAC,CAAC;AAEH,gEAAgE;AAChE,MAAM,qBAAqB,GAAG,8BAA8B,CAAC;AA4B7D;;;;;;;;;GASG;AACH,SAAS,sBAAsB,CAAC,MAAe,EAAE,KAAK,GAAG,CAAC;IACxD,4EAA4E;IAC5E,0EAA0E;IAC1E,6EAA6E;IAC7E,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3B,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACvD,MAAM,GAAG,GAAG,MAAiC,CAAC;IAE9C,8CAA8C;IAC9C,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,IAAI,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACnF,MAAM,GAAG,GAAG,GAAG,CAAC,YAAY,IAAK,GAAG,CAAC,OAA+C,EAAE,YAAY,CAAC;QACnG,IAAI,GAAG;YAAE,OAAO,sBAAsB,CAAC,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;IACzD,CAAC;IAED,+DAA+D;IAC/D,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACrE,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YACrE,OAAO,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QAChE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,0BAA0B;IAC1B,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,sBAAsB,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3E,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,IAA6B;IACtD,MAAM,aAAa,GAAG,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;IAE9F,4EAA4E;IAC5E,yEAAyE;IACzE,IAAI,CAAC,aAAa,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,qBAAqB,CAAC,EAAE,CAAC;QACvE,OAAO;YACL,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,KAAK;YACZ,IAAI,EAAE,sBAAsB;YAC5B,aAAa;YACb,MAAM,EAAE,gDAAgD,aAAa,CAAC,CAAC,CAAC,KAAK,aAAa,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;SACrG,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IAChE,MAAM,gBAAgB,GAAG,OAAO,CAAC,MAAM,CACrC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAK,CAA0B,CAAC,MAAM;QACrE,OAAQ,CAA0B,CAAC,MAAM,KAAK,QAAQ,CACzD,CAAC;IACF,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClC,OAAO;YACL,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,KAAK;YACZ,IAAI,EAAE,WAAW;YACjB,aAAa;YACb,MAAM,EAAE,mDAAmD;SAC5D,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAA4B,CAAC;IACpE,MAAM,OAAO,GAAG,CAAC,SAAS,CAAC,OAAO,IAAK,SAAS,CAAC,UAAkD,EAAE,OAAO,CAE/F,CAAC;IACd,MAAM,SAAS,GAAG,OAAO,IAAI,OAAO,OAAO,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAErF,OAAO;QACL,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,IAAI;QACX,IAAI,EAAE,MAAM;QACZ,aAAa;QACb,YAAY,EAAE,gBAAgB,CAAC,MAAM;QACrC,SAAS;KACV,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,0BAAiC,GAAW;IAC1C,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC;IAC5E,KAAK,MAAM,QAAQ,IAAI,2BAA2B,EAAE,CAAC;QACnD,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;YAC9B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YAC3C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;gBAAE,SAAS;YAEvC,2EAA2E;YAC3E,qEAAqE;YACrE,iEAAiE;YACjE,IAAI,OAAe,CAAC;YACpB,IAAI,CAAC;gBACH,IAAI,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,IAAI,GAAG,2BAAa;oBAAE,SAAS;gBACzD,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC/C,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;YAClG,CAAC;YAED,0EAA0E;YAC1E,qEAAqE;YACrE,MAAM,UAAU,GAAG,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAC5C,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;gBAC3D,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YAEd,IAAI,eAAe,GAA6B,IAAI,CAAC;YACrD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;gBACnC,IAAI,MAAe,CAAC;gBACpB,IAAI,CAAC;oBACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;gBACjC,CAAC;gBAAC,MAAM,CAAC;oBACP,SAAS;gBACX,CAAC;gBACD,MAAM,IAAI,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;gBAC5C,IAAI,CAAC,IAAI;oBAAE,SAAS;gBACpB,MAAM,GAAG,GAAG,EAAE,GAAG,iBAAiB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;gBAC3D,IAAI,GAAG,CAAC,KAAK;oBAAE,OAAO,GAAG,CAAC;gBAC1B,eAAe,KAAK,GAAG,CAAC;YAC1B,CAAC;YACD,OAAO,CACL,eAAe,IAAI;gBACjB,OAAO,EAAE,IAAI;gBACb,KAAK,EAAE,KAAK;gBACZ,IAAI,EAAE,WAAW;gBACjB,IAAI,EAAE,QAAQ;gBACd,MAAM,EAAE,oCAAoC;aAC7C,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAC1C,CAAC;AAED,0DAA0D;AAC1D,MAAM,uBAAuB,GAAG;IAC9B,oBAAoB;IACpB,gBAAgB;CACjB,CAAC;AAEF;;GAEG;AACH,SAAS,gBAAgB,CAAC,GAAW;IACnC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;IAC3D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC;QAAE,OAAO,EAAE,CAAC;IAE3C,IAAI,CAAC;QACH,OAAO,EAAE;aACN,WAAW,CAAC,WAAW,CAAC;aACxB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;aACxD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CAAC,aAAuB;IAC5C,OAAO,aAAa;SACjB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACT,IAAI,CAAC;YACH,OAAO,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,SAAS,cAAc,CAAC,GAAW;IACjC,MAAM,UAAU,GAAG;QACjB,YAAY;QACZ,UAAU;QACV,UAAU;QACV,cAAc;QACd,SAAS;QACT,gBAAgB;KACjB,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IACpD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,sBAA6B,GAAW;IACtC,MAAM,aAAa,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC5C,MAAM,WAAW,GAAG,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7C,MAAM,WAAW,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IAExC,oCAAoC;IACpC,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW;QAAE,OAAO,CAAC,CAAC;IAE3C,2CAA2C;IAC3C,IAAI,CAAC,WAAW;QAAE,OAAO,CAAC,CAAC;IAE3B,MAAM,kBAAkB,GAAG,aAAa,CAAC,aAAa,CAAC,CAAC;IAExD,yDAAyD;IACzD,MAAM,kBAAkB,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CACzD,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAC3B,CAAC;IACF,MAAM,gBAAgB,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAC1D,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAC3B,CAAC;IACF,+EAA+E;IAC/E,kEAAkE;IAClE,MAAM,WAAW,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC;IAEhD,IAAI,kBAAkB,IAAI,CAAC,gBAAgB,IAAI,WAAW,CAAC;QAAE,OAAO,CAAC,CAAC;IAEtE,2EAA2E;IAC3E,0EAA0E;IAC1E,yEAAyE;IACzE,yEAAyE;IACzE,MAAM,gBAAgB,GAAG,sBAAsB,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACzE,MAAM,iBAAiB,GAAG,wBAAwB,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAC5E,IAAI,gBAAgB,IAAI,iBAAiB;QAAE,OAAO,CAAC,CAAC;IAEpD,8CAA8C;IAC9C,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAChD,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAC3B,CAAC;IACF,IAAI,SAAS;QAAE,OAAO,CAAC,CAAC;IAExB,+BAA+B;IAC/B,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;GAEG;AACH,oBAA2B,GAAW;IACpC,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAEhC,+EAA+E;IAC/E,6EAA6E;IAC7E,2EAA2E;IAC3E,6EAA6E;IAC7E,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QAC5C,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,yBAAyB;YAC/B,WAAW,EACT,sBAAsB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,sBAAsB;gBAC7F,+BAA+B,GAAG,CAAC,MAAM,IAAI,aAAa,0CAA0C;YACtG,QAAQ,EAAE,QAAQ;YAClB,UAAU,EAAE,GAAG;YACf,QAAQ,EAAE,cAAc;YACxB,cAAc,EACZ,oEAAoE;gBACpE,yFAAyF;gBACzF,2FAA2F;gBAC3F,mDAAmD;SACtD,CAAC,CAAC;IACL,CAAC;IAED,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;QAChB,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,cAAc;YACpB,WAAW,EACT,+FAA+F;YACjG,QAAQ,EAAE,MAAM;YAChB,cAAc,EACZ,iFAAiF;gBACjF,qEAAqE;SACxE,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;QACvB,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,oBAAoB;YAC1B,WAAW,EACT,wFAAwF;gBACxF,iDAAiD;YACnD,QAAQ,EAAE,KAAK;YACf,cAAc,EACZ,qFAAqF;gBACrF,qFAAqF;SACxF,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;QACvB,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,yBAAyB;YAC/B,WAAW,EACT,oGAAoG;gBACpG,sCAAsC;YACxC,QAAQ,EAAE,MAAM;YAChB,cAAc,EACZ,6CAA6C;gBAC7C,oFAAoF;gBACpF,uFAAuF;gBACvF,6CAA6C;gBAC7C,oFAAoF;gBACpF,sFAAsF;SACzF,CAAC,CAAC;IACL,CAAC;IACD,yCAAyC;IAEzC,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "supply-chain-guard",
-  "version": "5.14.0",
+  "version": "5.16.0",
   "description": "Open-source supply-chain security scanner for npm, PyPI, Cargo, Go, RubyGems, Composer, NuGet, Docker, VS Code extensions, GitHub Actions, IaC and Solana C2. Detects GlassWorm, Shai-Hulud, PPE attacks, dependency confusion and 180+ threat indicators across all major lockfile formats (npm, pnpm, yarn, bun). Generates CycloneDX 1.6 SBOMs, verifies SLSA provenance, and correlates findings into attack-chain incidents.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",