supply-chain-guard 5.18.2 → 5.19.0

package/README.md

@@ -131,7 +131,7 @@ Run the scanner as a [pre-commit](https://pre-commit.com) hook (Python-ecosystem
 ```yaml
 repos:
   - repo: https://github.com/homeofe/supply-chain-guard
-    rev: v5.18.2
+    rev: v5.19.0
     hooks:
       - id: supply-chain-guard
 ```

package/dist/cli.js

@@ -22,7 +22,7 @@ const program = new commander_1.Command();
 program
     .name("supply-chain-guard")
     .description("Open-source supply-chain security scanner. Detects GlassWorm and similar malware campaigns in npm packages, PyPI packages, code repos, VS Code extensions, and project dependencies.")
-    .version("5.18.2");
+    .version("5.19.0");
 // ── scan command ────────────────────────────────────────────────────
 program
     .command("scan")

package/dist/reporter.js

@@ -62,7 +62,7 @@ function formatJson(report) {
 function formatText(report) {
     const lines = [];
     // ── layout constants ───────────────────────────────────────────────────────
-    const VERSION = "5.18.2";
+    const VERSION = "5.19.0";
     const W = 76; // visible chars between "│ " and " │" (total line = 80)
     // ── ANSI helpers ───────────────────────────────────────────────────────────
     const stripAnsi = (s) => s.replace(/\x1b\[[0-9;]*m/g, "");
@@ -497,7 +497,7 @@ function formatSarif(report) {
                 tool: {
                     driver: {
                         name: "supply-chain-guard",
-                        version: "5.18.2",
+                        version: "5.19.0",
                         informationUri: "https://github.com/homeofe/supply-chain-guard",
                         rules,
                     },
@@ -559,7 +559,7 @@ function formatSbom(report) {
             timestamp: report.timestamp,
             tools: {
                 components: [
-                    { type: "application", name: "supply-chain-guard", version: "5.18.2" },
+                    { type: "application", name: "supply-chain-guard", version: "5.19.0" },
                 ],
             },
             component: {
@@ -677,7 +677,7 @@ function formatGitlab(report) {
         name: "supply-chain-guard",
         url: "https://github.com/homeofe/supply-chain-guard",
         vendor: { name: "supply-chain-guard" },
-        version: "5.18.2",
+        version: "5.19.0",
     };
     const vulnerabilities = report.findings
         .filter((f) => !f.suppressed)
@@ -907,7 +907,7 @@ footer{text-align:center;padding:24px;color:#94a3b8;font-size:13px}
   ` : ""}
 
   <footer>
-    Generated by <a href="https://github.com/homeofe/supply-chain-guard">supply-chain-guard</a> v5.18.2
+    Generated by <a href="https://github.com/homeofe/supply-chain-guard">supply-chain-guard</a> v5.19.0
   </footer>
 </div>
 <script>

package/dist/scanner.js

@@ -90,7 +90,7 @@ const slsa_verifier_js_1 = require("./slsa-verifier.js");
 const dependency_confusion_js_1 = require("./dependency-confusion.js");
 const mcp_scanner_js_1 = require("./mcp-scanner.js");
 const skills_scanner_js_1 = require("./skills-scanner.js");
-const TOOL_VERSION = "5.18.2";
+const TOOL_VERSION = "5.19.0";
 /**
  * Exact files that contain this package's own inert detector definitions or
  * regression fixtures.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "supply-chain-guard",
-  "version": "5.18.2",
+  "version": "5.19.0",
   "mcpName": "io.github.homeofe/supply-chain-guard",
   "description": "Open-source supply-chain security scanner for npm, PyPI, Cargo, Go, RubyGems, Composer, NuGet, Docker, VS Code extensions, GitHub Actions, IaC and Solana C2. Detects GlassWorm, Shai-Hulud, PPE attacks, dependency confusion and 350+ threat indicators across all major lockfile formats (npm, pnpm, yarn, bun). Generates CycloneDX 1.6 SBOMs, grades SLSA provenance (in-toto/DSSE structural validation), and correlates findings into attack-chain incidents.",
   "main": "dist/index.js",