supply-chain-guard 5.18.0 → 5.18.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +1 -1
- package/dist/cli.js +1 -1
- package/dist/continuous-monitor.d.ts.map +1 -1
- package/dist/continuous-monitor.js +3 -3
- package/dist/continuous-monitor.js.map +1 -1
- package/dist/reporter.js +5 -5
- package/dist/scanner.js +1 -1
- package/dist/state-dir.d.ts +28 -0
- package/dist/state-dir.d.ts.map +1 -0
- package/dist/state-dir.js +86 -0
- package/dist/state-dir.js.map +1 -0
- package/dist/triage-engine.d.ts.map +1 -1
- package/dist/triage-engine.js +3 -3
- package/dist/triage-engine.js.map +1 -1
- package/package.json +1 -1
package/README.md
CHANGED
package/dist/cli.js
CHANGED
|
@@ -22,7 +22,7 @@ const program = new commander_1.Command();
|
|
|
22
22
|
program
|
|
23
23
|
.name("supply-chain-guard")
|
|
24
24
|
.description("Open-source supply-chain security scanner. Detects GlassWorm and similar malware campaigns in npm packages, PyPI packages, code repos, VS Code extensions, and project dependencies.")
|
|
25
|
-
.version("5.18.
|
|
25
|
+
.version("5.18.1");
|
|
26
26
|
// ── scan command ────────────────────────────────────────────────────
|
|
27
27
|
program
|
|
28
28
|
.command("scan")
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"continuous-monitor.d.ts","sourceRoot":"","sources":["../src/continuous-monitor.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;
|
|
1
|
+
{"version":3,"file":"continuous-monitor.d.ts","sourceRoot":"","sources":["../src/continuous-monitor.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAOxE;;GAEG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,gBAAgB,EAAE,CAS/D;AAED;;GAEG;AACH,wBAAgB,eAAe,CAC7B,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,UAAU,GACjB,IAAI,CAiBN;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,gBAAgB,EAAE,EAC3B,YAAY,EAAE,MAAM,GACnB,OAAO,EAAE,CAkDX;AAED;;GAEG;AACH,wBAAgB,YAAY,CAC1B,OAAO,EAAE,gBAAgB,EAAE,GAC1B,YAAY,GAAG,QAAQ,GAAG,YAAY,CAUxC"}
|
|
@@ -45,7 +45,8 @@ exports.analyzeRiskTrend = analyzeRiskTrend;
|
|
|
45
45
|
exports.getRiskTrend = getRiskTrend;
|
|
46
46
|
const fs = __importStar(require("node:fs"));
|
|
47
47
|
const path = __importStar(require("node:path"));
|
|
48
|
-
const
|
|
48
|
+
const state_dir_js_1 = require("./state-dir.js");
|
|
49
|
+
const HISTORY_DIR = state_dir_js_1.STATE_DIR;
|
|
49
50
|
const HISTORY_FILE = "risk-history.json";
|
|
50
51
|
const MAX_HISTORY_ENTRIES = 100;
|
|
51
52
|
/**
|
|
@@ -66,8 +67,7 @@ function loadRiskHistory(dir) {
|
|
|
66
67
|
* Save current scan result to risk history.
|
|
67
68
|
*/
|
|
68
69
|
function saveRiskHistory(dir, report) {
|
|
69
|
-
const historyDir =
|
|
70
|
-
fs.mkdirSync(historyDir, { recursive: true });
|
|
70
|
+
const historyDir = (0, state_dir_js_1.ensureStateDir)(dir);
|
|
71
71
|
const history = loadRiskHistory(dir);
|
|
72
72
|
history.push({
|
|
73
73
|
timestamp: report.timestamp,
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"continuous-monitor.js","sourceRoot":"","sources":["../src/continuous-monitor.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,MAAY,EAAE,oCAAgB;AAC9B,MAAY,IAAI,sCAAkB;
|
|
1
|
+
{"version":3,"file":"continuous-monitor.js","sourceRoot":"","sources":["../src/continuous-monitor.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,MAAY,EAAE,oCAAgB;AAC9B,MAAY,IAAI,sCAAkB;AAElC,iDAA2D;AAE3D,MAAM,WAAW,GAAG,wBAAS,CAAC;AAC9B,MAAM,YAAY,GAAG,mBAAmB,CAAC;AACzC,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAEhC;;GAEG;AACH,yBAAgC,GAAW;IACzC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC;IAC9D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC;QAAE,OAAO,EAAE,CAAC;IAE3C,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAuB,CAAC;IACjF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,yBACE,GAAW,EACX,MAAkB;IAElB,MAAM,UAAU,GAAG,IAAA,6BAAc,EAAC,GAAG,CAAC,CAAC;IAEvC,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACrC,OAAO,CAAC,IAAI,CAAC;QACX,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;QACrC,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ;KACvC,CAAC,CAAC;IAEH,2BAA2B;IAC3B,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,mBAAmB,CAAC,CAAC;IACpD,EAAE,CAAC,aAAa,CACd,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,EACnC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CACjC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,0BACE,OAA2B,EAC3B,YAAoB;IAEpB,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IAExC,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACjC,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC;IAC1E,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;IAEpD,+CAA+C;IAC/C,IAAI,YAAY,GAAG,SAAS,GAAG,CAAC,IAAI,YAAY,GAAG,EAAE,EAAE,CAAC;QACtD,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,kBAAkB;YACxB,WAAW,EAAE,0BAA0B,SAAS,OAAO,YAAY,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,YAAY,GAAG,SAAS,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,0CAA0C;YAClK,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,IAAI;YAChB,QAAQ,EAAE,OAAO;YACjB,cAAc,EAAE,yGAAyG;SAC1H,CAAC,CAAC;IACL,CAAC;IAED,uEAAuE;IACvE,IAAI,OAAO,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC;QACvE,IAAI,SAAS,GAAG,QAAQ,GAAG,GAAG,IAAI,SAAS,GAAG,EAAE,EAAE,CAAC;YACjD,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,uBAAuB;gBAC7B,WAAW,EAAE,8CAA8C,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,gBAAgB,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,iCAAiC;gBACrJ,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,GAAG;gBACf,QAAQ,EAAE,OAAO;gBACjB,cAAc,EAAE,wFAAwF;aACzG,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,kEAAkE;IAClE,IAAI,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QACnF,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,sBAAsB;YAC5B,WAAW,EAAE,iDAAiD,MAAM,CAAC,MAAM,4CAA4C;YACvH,QAAQ,EAAE,MAAM;YAChB,UAAU,EAAE,GAAG;YACf,QAAQ,EAAE,OAAO;YACjB,cAAc,EAAE,sFAAsF;SACvG,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,sBACE,OAA2B;IAE3B,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IAExC,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACtD,MAAM,YAAY,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC5E,MAAM,YAAY,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAE5E,IAAI,YAAY;QAAE,OAAO,YAAY,CAAC;IACtC,IAAI,YAAY;QAAE,OAAO,YAAY,CAAC;IACtC,OAAO,QAAQ,CAAC;AAClB,CAAC"}
|
package/dist/reporter.js
CHANGED
|
@@ -62,7 +62,7 @@ function formatJson(report) {
|
|
|
62
62
|
function formatText(report) {
|
|
63
63
|
const lines = [];
|
|
64
64
|
// ── layout constants ───────────────────────────────────────────────────────
|
|
65
|
-
const VERSION = "5.18.
|
|
65
|
+
const VERSION = "5.18.1";
|
|
66
66
|
const W = 76; // visible chars between "│ " and " │" (total line = 80)
|
|
67
67
|
// ── ANSI helpers ───────────────────────────────────────────────────────────
|
|
68
68
|
const stripAnsi = (s) => s.replace(/\x1b\[[0-9;]*m/g, "");
|
|
@@ -497,7 +497,7 @@ function formatSarif(report) {
|
|
|
497
497
|
tool: {
|
|
498
498
|
driver: {
|
|
499
499
|
name: "supply-chain-guard",
|
|
500
|
-
version: "5.18.
|
|
500
|
+
version: "5.18.1",
|
|
501
501
|
informationUri: "https://github.com/homeofe/supply-chain-guard",
|
|
502
502
|
rules,
|
|
503
503
|
},
|
|
@@ -559,7 +559,7 @@ function formatSbom(report) {
|
|
|
559
559
|
timestamp: report.timestamp,
|
|
560
560
|
tools: {
|
|
561
561
|
components: [
|
|
562
|
-
{ type: "application", name: "supply-chain-guard", version: "5.18.
|
|
562
|
+
{ type: "application", name: "supply-chain-guard", version: "5.18.1" },
|
|
563
563
|
],
|
|
564
564
|
},
|
|
565
565
|
component: {
|
|
@@ -677,7 +677,7 @@ function formatGitlab(report) {
|
|
|
677
677
|
name: "supply-chain-guard",
|
|
678
678
|
url: "https://github.com/homeofe/supply-chain-guard",
|
|
679
679
|
vendor: { name: "supply-chain-guard" },
|
|
680
|
-
version: "5.18.
|
|
680
|
+
version: "5.18.1",
|
|
681
681
|
};
|
|
682
682
|
const vulnerabilities = report.findings
|
|
683
683
|
.filter((f) => !f.suppressed)
|
|
@@ -907,7 +907,7 @@ footer{text-align:center;padding:24px;color:#94a3b8;font-size:13px}
|
|
|
907
907
|
` : ""}
|
|
908
908
|
|
|
909
909
|
<footer>
|
|
910
|
-
Generated by <a href="https://github.com/homeofe/supply-chain-guard">supply-chain-guard</a> v5.18.
|
|
910
|
+
Generated by <a href="https://github.com/homeofe/supply-chain-guard">supply-chain-guard</a> v5.18.1
|
|
911
911
|
</footer>
|
|
912
912
|
</div>
|
|
913
913
|
<script>
|
package/dist/scanner.js
CHANGED
|
@@ -90,7 +90,7 @@ const slsa_verifier_js_1 = require("./slsa-verifier.js");
|
|
|
90
90
|
const dependency_confusion_js_1 = require("./dependency-confusion.js");
|
|
91
91
|
const mcp_scanner_js_1 = require("./mcp-scanner.js");
|
|
92
92
|
const skills_scanner_js_1 = require("./skills-scanner.js");
|
|
93
|
-
const TOOL_VERSION = "5.18.
|
|
93
|
+
const TOOL_VERSION = "5.18.1";
|
|
94
94
|
/**
|
|
95
95
|
* Exact files that contain this package's own inert detector definitions or
|
|
96
96
|
* regression fixtures.
|
|
@@ -0,0 +1,28 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* The scanner's own state directory inside a scanned repository.
|
|
3
|
+
*
|
|
4
|
+
* Both the risk-history and the triage store write here. The directory is
|
|
5
|
+
* scanner state, not project content, so it must never end up in the
|
|
6
|
+
* consumer's commits. Relying on the consumer to add it to .gitignore does not
|
|
7
|
+
* work: it is created by whichever scan runs first, usually before anyone has
|
|
8
|
+
* thought about it, and a later `git add -A` sweeps it in. That is exactly how
|
|
9
|
+
* a stale history file from one April afternoon ended up committed to a public
|
|
10
|
+
* repository months later, inside an unrelated commit.
|
|
11
|
+
*
|
|
12
|
+
* So the directory ignores itself. Creating it also writes a .gitignore
|
|
13
|
+
* containing `*`, which git honours for everything beneath it including the
|
|
14
|
+
* .gitignore itself. Nothing is required of the consumer and it cannot be
|
|
15
|
+
* forgotten.
|
|
16
|
+
*/
|
|
17
|
+
/** Directory name used for all scanner state inside a scanned repository. */
|
|
18
|
+
export declare const STATE_DIR = ".scg-history";
|
|
19
|
+
/**
|
|
20
|
+
* Create the state directory if needed and make sure it excludes itself.
|
|
21
|
+
*
|
|
22
|
+
* Safe to call on every write. The .gitignore is rewritten only when it is
|
|
23
|
+
* missing or has been altered, so this does not churn the file, and a failure
|
|
24
|
+
* to write it is never fatal: state persistence is a convenience and must not
|
|
25
|
+
* break a scan on a read-only or otherwise restricted filesystem.
|
|
26
|
+
*/
|
|
27
|
+
export declare function ensureStateDir(repoDir: string): string;
|
|
28
|
+
//# sourceMappingURL=state-dir.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"state-dir.d.ts","sourceRoot":"","sources":["../src/state-dir.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAKH,6EAA6E;AAC7E,eAAO,MAAM,SAAS,iBAAiB,CAAC;AASxC;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CActD"}
|
|
@@ -0,0 +1,86 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
/**
|
|
3
|
+
* The scanner's own state directory inside a scanned repository.
|
|
4
|
+
*
|
|
5
|
+
* Both the risk-history and the triage store write here. The directory is
|
|
6
|
+
* scanner state, not project content, so it must never end up in the
|
|
7
|
+
* consumer's commits. Relying on the consumer to add it to .gitignore does not
|
|
8
|
+
* work: it is created by whichever scan runs first, usually before anyone has
|
|
9
|
+
* thought about it, and a later `git add -A` sweeps it in. That is exactly how
|
|
10
|
+
* a stale history file from one April afternoon ended up committed to a public
|
|
11
|
+
* repository months later, inside an unrelated commit.
|
|
12
|
+
*
|
|
13
|
+
* So the directory ignores itself. Creating it also writes a .gitignore
|
|
14
|
+
* containing `*`, which git honours for everything beneath it including the
|
|
15
|
+
* .gitignore itself. Nothing is required of the consumer and it cannot be
|
|
16
|
+
* forgotten.
|
|
17
|
+
*/
|
|
18
|
+
var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
|
|
19
|
+
if (k2 === undefined) k2 = k;
|
|
20
|
+
var desc = Object.getOwnPropertyDescriptor(m, k);
|
|
21
|
+
if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
|
|
22
|
+
desc = { enumerable: true, get: function() { return m[k]; } };
|
|
23
|
+
}
|
|
24
|
+
Object.defineProperty(o, k2, desc);
|
|
25
|
+
}) : (function(o, m, k, k2) {
|
|
26
|
+
if (k2 === undefined) k2 = k;
|
|
27
|
+
o[k2] = m[k];
|
|
28
|
+
}));
|
|
29
|
+
var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
|
|
30
|
+
Object.defineProperty(o, "default", { enumerable: true, value: v });
|
|
31
|
+
}) : function(o, v) {
|
|
32
|
+
o["default"] = v;
|
|
33
|
+
});
|
|
34
|
+
var __importStar = (this && this.__importStar) || (function () {
|
|
35
|
+
var ownKeys = function(o) {
|
|
36
|
+
ownKeys = Object.getOwnPropertyNames || function (o) {
|
|
37
|
+
var ar = [];
|
|
38
|
+
for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
|
|
39
|
+
return ar;
|
|
40
|
+
};
|
|
41
|
+
return ownKeys(o);
|
|
42
|
+
};
|
|
43
|
+
return function (mod) {
|
|
44
|
+
if (mod && mod.__esModule) return mod;
|
|
45
|
+
var result = {};
|
|
46
|
+
if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
|
|
47
|
+
__setModuleDefault(result, mod);
|
|
48
|
+
return result;
|
|
49
|
+
};
|
|
50
|
+
})();
|
|
51
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
52
|
+
exports.STATE_DIR = void 0;
|
|
53
|
+
exports.ensureStateDir = ensureStateDir;
|
|
54
|
+
const fs = __importStar(require("node:fs"));
|
|
55
|
+
const path = __importStar(require("node:path"));
|
|
56
|
+
/** Directory name used for all scanner state inside a scanned repository. */
|
|
57
|
+
exports.STATE_DIR = ".scg-history";
|
|
58
|
+
const SELF_IGNORE = `# Created automatically by supply-chain-guard.
|
|
59
|
+
# This directory holds scanner state (risk history, triage decisions), not
|
|
60
|
+
# project content, so it is excluded from the repository that is being scanned.
|
|
61
|
+
# Deleting this file would let a later 'git add -A' commit scanner state.
|
|
62
|
+
*
|
|
63
|
+
`;
|
|
64
|
+
/**
|
|
65
|
+
* Create the state directory if needed and make sure it excludes itself.
|
|
66
|
+
*
|
|
67
|
+
* Safe to call on every write. The .gitignore is rewritten only when it is
|
|
68
|
+
* missing or has been altered, so this does not churn the file, and a failure
|
|
69
|
+
* to write it is never fatal: state persistence is a convenience and must not
|
|
70
|
+
* break a scan on a read-only or otherwise restricted filesystem.
|
|
71
|
+
*/
|
|
72
|
+
function ensureStateDir(repoDir) {
|
|
73
|
+
const stateDir = path.join(repoDir, exports.STATE_DIR);
|
|
74
|
+
fs.mkdirSync(stateDir, { recursive: true });
|
|
75
|
+
const ignorePath = path.join(stateDir, ".gitignore");
|
|
76
|
+
try {
|
|
77
|
+
if (!fs.existsSync(ignorePath) || fs.readFileSync(ignorePath, "utf-8") !== SELF_IGNORE) {
|
|
78
|
+
fs.writeFileSync(ignorePath, SELF_IGNORE);
|
|
79
|
+
}
|
|
80
|
+
}
|
|
81
|
+
catch {
|
|
82
|
+
// A missing self-ignore is a hygiene problem, not a scan failure.
|
|
83
|
+
}
|
|
84
|
+
return stateDir;
|
|
85
|
+
}
|
|
86
|
+
//# sourceMappingURL=state-dir.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"state-dir.js","sourceRoot":"","sources":["../src/state-dir.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;GAeG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,MAAY,EAAE,oCAAgB;AAC9B,MAAY,IAAI,sCAAkB;AAElC,6EAA6E;AAChE,QAAA,SAAS,GAAG,cAAc,CAAC;AAExC,MAAM,WAAW,GAAG;;;;;CAKnB,CAAC;AAEF;;;;;;;GAOG;AACH,wBAA+B,OAAe;IAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAA,SAAS,CAAC,CAAC;IAC/C,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE5C,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IACrD,IAAI,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,KAAK,WAAW,EAAE,CAAC;YACvF,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,kEAAkE;IACpE,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"triage-engine.d.ts","sourceRoot":"","sources":["../src/triage-engine.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAE,cAAc,EAAiB,MAAM,YAAY,CAAC;
|
|
1
|
+
{"version":3,"file":"triage-engine.d.ts","sourceRoot":"","sources":["../src/triage-engine.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAE,cAAc,EAAiB,MAAM,YAAY,CAAC;AAMzE;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,EAAE,CASjE;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,cAAc,EAAE,GAC1B,IAAI,CAMN;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,OAAO,EAAE,EACnB,SAAS,EAAE,cAAc,EAAE,GAC1B,OAAO,EAAE,CA+EX"}
|
package/dist/triage-engine.js
CHANGED
|
@@ -44,7 +44,8 @@ exports.saveTriageDecisions = saveTriageDecisions;
|
|
|
44
44
|
exports.checkTriageGovernance = checkTriageGovernance;
|
|
45
45
|
const fs = __importStar(require("node:fs"));
|
|
46
46
|
const path = __importStar(require("node:path"));
|
|
47
|
-
const
|
|
47
|
+
const state_dir_js_1 = require("./state-dir.js");
|
|
48
|
+
const TRIAGE_DIR = state_dir_js_1.STATE_DIR;
|
|
48
49
|
const TRIAGE_FILE = "triage-decisions.json";
|
|
49
50
|
/**
|
|
50
51
|
* Load triage decisions from persistent storage.
|
|
@@ -64,8 +65,7 @@ function loadTriageDecisions(dir) {
|
|
|
64
65
|
* Save triage decisions.
|
|
65
66
|
*/
|
|
66
67
|
function saveTriageDecisions(dir, decisions) {
|
|
67
|
-
const triageDir =
|
|
68
|
-
fs.mkdirSync(triageDir, { recursive: true });
|
|
68
|
+
const triageDir = (0, state_dir_js_1.ensureStateDir)(dir);
|
|
69
69
|
fs.writeFileSync(path.join(triageDir, TRIAGE_FILE), JSON.stringify(decisions, null, 2));
|
|
70
70
|
}
|
|
71
71
|
/**
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"triage-engine.js","sourceRoot":"","sources":["../src/triage-engine.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,MAAY,EAAE,oCAAgB;AAC9B,MAAY,IAAI,sCAAkB;
|
|
1
|
+
{"version":3,"file":"triage-engine.js","sourceRoot":"","sources":["../src/triage-engine.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,MAAY,EAAE,oCAAgB;AAC9B,MAAY,IAAI,sCAAkB;AAElC,iDAA2D;AAE3D,MAAM,UAAU,GAAG,wBAAS,CAAC;AAC7B,MAAM,WAAW,GAAG,uBAAuB,CAAC;AAE5C;;GAEG;AACH,6BAAoC,GAAW;IAC7C,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;IAC3D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,EAAE,CAAC;IAE1C,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAqB,CAAC;IAC9E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,6BACE,GAAW,EACX,SAA2B;IAE3B,MAAM,SAAS,GAAG,IAAA,6BAAc,EAAC,GAAG,CAAC,CAAC;IACtC,EAAE,CAAC,aAAa,CACd,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,EACjC,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CACnC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,+BACE,QAAmB,EACnB,SAA2B;IAE3B,MAAM,WAAW,GAAc,EAAE,CAAC;IAClC,MAAM,WAAW,GAAG,IAAI,GAAG,EAA0B,CAAC;IAEtD,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QAC1B,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,WAAW,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IAChE,CAAC;IAED,6CAA6C;IAC7C,6EAA6E;IAC7E,4EAA4E;IAC5E,6EAA6E;IAC7E,6EAA6E;IAC7E,6BAA6B;IAC7B,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,oBAAoB,GAAG,QAAQ,CAAC,MAAM,CAC1C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC,CAClF,CAAC;QACF,IAAI,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpC,WAAW,CAAC,IAAI,CAAC;gBACf,IAAI,EAAE,2BAA2B;gBACjC,WAAW,EAAE,GAAG,oBAAoB,CAAC,MAAM,iEAAiE;gBAC5G,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,GAAG;gBACf,QAAQ,EAAE,OAAO;gBACjB,cAAc,EAAE,qFAAqF;aACtG,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,0CAA0C;IAC1C,MAAM,gBAAgB,GAAG,SAAS,CAAC,MAAM,CACvC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,eAAe,IAAI,CAAC,CAAC,CAAC,OAAO,CAClD,CAAC;IACF,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,WAAW,CAAC,IAAI,CAAC;YACf,IAAI,EAAE,8BAA8B;YACpC,WAAW,EAAE,GAAG,gBAAgB,CAAC,MAAM,qFAAqF;YAC5H,QAAQ,EAAE,QAAQ;YAClB,UAAU,EAAE,GAAG;YACf,QAAQ,EAAE,OAAO;YACjB,cAAc,EAAE,4EAA4E;SAC7F,CAAC,CAAC;IACL,CAAC;IAED,qCAAqC;IACrC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAC9B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,eAAe,IAAI,CAAC,CAAC,OAAO,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,GAAG,GAAG,CACxF,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,WAAW,CAAC,IAAI,CAAC;YACf,IAAI,EAAE,yBAAyB;YAC/B,WAAW,EAAE,GAAG,OAAO,CAAC,MAAM,0DAA0D;YACxF,QAAQ,EAAE,MAAM;YAChB,UAAU,EAAE,GAAG;YACf,QAAQ,EAAE,OAAO;YACjB,cAAc,EAAE,qFAAqF;SACtG,CAAC,CAAC;IACL,CAAC;IAED,gFAAgF;IAChF,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QACnC,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,gBAAgB;YAAE,OAAO,KAAK,CAAC;QAC1E,MAAM,GAAG,GAAG,GAAG,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;QAClD,OAAO,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,UAAU;IACnD,CAAC,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,WAAW,CAAC,IAAI,CAAC;YACf,IAAI,EAAE,wBAAwB;YAC9B,WAAW,EAAE,GAAG,KAAK,CAAC,MAAM,kFAAkF;YAC9G,QAAQ,EAAE,MAAM;YAChB,UAAU,EAAE,GAAG;YACf,QAAQ,EAAE,OAAO;YACjB,cAAc,EAAE,iFAAiF;SAClG,CAAC,CAAC;IACL,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "supply-chain-guard",
|
|
3
|
-
"version": "5.18.
|
|
3
|
+
"version": "5.18.1",
|
|
4
4
|
"mcpName": "io.github.homeofe/supply-chain-guard",
|
|
5
5
|
"description": "Open-source supply-chain security scanner for npm, PyPI, Cargo, Go, RubyGems, Composer, NuGet, Docker, VS Code extensions, GitHub Actions, IaC and Solana C2. Detects GlassWorm, Shai-Hulud, PPE attacks, dependency confusion and 350+ threat indicators across all major lockfile formats (npm, pnpm, yarn, bun). Generates CycloneDX 1.6 SBOMs, grades SLSA provenance (in-toto/DSSE structural validation), and correlates findings into attack-chain incidents.",
|
|
6
6
|
"main": "dist/index.js",
|