supply-chain-guard 5.2.40 → 5.2.41
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +15 -0
- package/dist/cli.js +1 -1
- package/dist/github-trust-scanner.d.ts.map +1 -1
- package/dist/github-trust-scanner.js +30 -7
- package/dist/github-trust-scanner.js.map +1 -1
- package/dist/reporter.js +4 -4
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -343,6 +343,21 @@ See [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines. The most impactful contri
|
|
|
343
343
|
|
|
344
344
|
## Changelog
|
|
345
345
|
|
|
346
|
+
### v5.2.41 (2026-06-28)
|
|
347
|
+
**Security: command injection in the GitHub trust scanner**
|
|
348
|
+
|
|
349
|
+
Remediates a finding from the continuous AAHP Swarm review (elvatis/ideabase#24).
|
|
350
|
+
`github-trust-scanner.ts` built five `gh api repos/${owner}/${repo}` calls as shell
|
|
351
|
+
strings via `execSync`, with `owner` and `repo` unvalidated. Because
|
|
352
|
+
`analyzeGitHubTrust` and `parseGitHubUrl` are public API, a consumer passing crafted
|
|
353
|
+
values could reach shell command execution. No rule or scan-engine change.
|
|
354
|
+
|
|
355
|
+
- Every `gh api` call now uses `execFileSync` (no shell).
|
|
356
|
+
- `analyzeGitHubTrust` validates owner and repo against GitHub-name allowlists (owner
|
|
357
|
+
cannot begin with a hyphen; repo forbids `..`) before any call, and `parseGitHubUrl`
|
|
358
|
+
rejects values that fail the same allowlists.
|
|
359
|
+
- Added regression tests.
|
|
360
|
+
|
|
346
361
|
### v5.2.40 (2026-06-28)
|
|
347
362
|
**Security: org-scanner command injection and suppressed findings in SARIF/SBOM**
|
|
348
363
|
|
package/dist/cli.js
CHANGED
|
@@ -20,7 +20,7 @@ const program = new commander_1.Command();
|
|
|
20
20
|
program
|
|
21
21
|
.name("supply-chain-guard")
|
|
22
22
|
.description("Open-source supply-chain security scanner. Detects GlassWorm and similar malware campaigns in npm packages, PyPI packages, code repos, VS Code extensions, and project dependencies.")
|
|
23
|
-
.version("5.2.
|
|
23
|
+
.version("5.2.41");
|
|
24
24
|
// ── scan command ────────────────────────────────────────────────────
|
|
25
25
|
program
|
|
26
26
|
.command("scan")
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"github-trust-scanner.d.ts","sourceRoot":"","sources":["../src/github-trust-scanner.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;
|
|
1
|
+
{"version":3,"file":"github-trust-scanner.d.ts","sourceRoot":"","sources":["../src/github-trust-scanner.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAgJ1C;;GAEG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,MAAM,GACV;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CASxC;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,GACX,OAAO,EAAE,CAuKX;AAED;;GAEG;AACH,wBAAgB,eAAe,CAC7B,aAAa,EAAE,MAAM,EACrB,YAAY,EAAE,MAAM,GACnB,OAAO,EAAE,CA6BX"}
|
|
@@ -52,38 +52,52 @@ const ioc_blocklist_js_1 = require("./ioc-blocklist.js");
|
|
|
52
52
|
*/
|
|
53
53
|
function hasGhCli() {
|
|
54
54
|
try {
|
|
55
|
-
(0, node_child_process_1.
|
|
55
|
+
(0, node_child_process_1.execFileSync)("gh", ["--version"], { stdio: "pipe" });
|
|
56
56
|
return true;
|
|
57
57
|
}
|
|
58
58
|
catch {
|
|
59
59
|
return false;
|
|
60
60
|
}
|
|
61
61
|
}
|
|
62
|
+
// GitHub owner (user/org) and repo name allowlists. Owner: alphanumeric with
|
|
63
|
+
// hyphens, no leading hyphen, up to 39 chars. Repo: alphanumeric with . _ -, no
|
|
64
|
+
// '..' path traversal. These guard the values interpolated into the gh-api paths
|
|
65
|
+
// below; the calls also use execFileSync (no shell) so a metacharacter can never
|
|
66
|
+
// reach a shell even if validation is ever bypassed.
|
|
67
|
+
const GH_OWNER = /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})$/;
|
|
68
|
+
const GH_REPO = /^[A-Za-z0-9._-]{1,100}$/;
|
|
69
|
+
function validGitHubName(owner, repo) {
|
|
70
|
+
return (GH_OWNER.test(owner) &&
|
|
71
|
+
GH_REPO.test(repo) &&
|
|
72
|
+
repo !== "." &&
|
|
73
|
+
repo !== ".." &&
|
|
74
|
+
!repo.includes(".."));
|
|
75
|
+
}
|
|
62
76
|
/**
|
|
63
77
|
* Fetch repo metadata via `gh api`.
|
|
64
78
|
*/
|
|
65
79
|
function fetchRepoMetadata(owner, repo) {
|
|
66
80
|
try {
|
|
67
|
-
const json = (0, node_child_process_1.
|
|
81
|
+
const json = (0, node_child_process_1.execFileSync)("gh", ["api", `repos/${owner}/${repo}`, "--jq", '{stars: .stargazers_count, forks: .forks_count, openIssues: .open_issues_count, hasIssues: .has_issues, createdAt: .created_at, pushedAt: .pushed_at, isOrg: (.owner.type == "Organization"), ownerLogin: .owner.login, defaultBranch: .default_branch}'], { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] });
|
|
68
82
|
const data = JSON.parse(json);
|
|
69
83
|
// Fetch owner account age
|
|
70
84
|
let ownerCreatedAt;
|
|
71
85
|
try {
|
|
72
|
-
const ownerJson = (0, node_child_process_1.
|
|
86
|
+
const ownerJson = (0, node_child_process_1.execFileSync)("gh", ["api", `users/${owner}`, "--jq", ".created_at"], { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] });
|
|
73
87
|
ownerCreatedAt = ownerJson.trim();
|
|
74
88
|
}
|
|
75
89
|
catch { /* skip */ }
|
|
76
90
|
// Fetch commit count
|
|
77
91
|
let commitCount;
|
|
78
92
|
try {
|
|
79
|
-
const commitJson = (0, node_child_process_1.
|
|
93
|
+
const commitJson = (0, node_child_process_1.execFileSync)("gh", ["api", `repos/${owner}/${repo}/commits?per_page=1`, "--jq", "length"], { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] });
|
|
80
94
|
commitCount = parseInt(commitJson.trim(), 10);
|
|
81
95
|
}
|
|
82
96
|
catch { /* skip */ }
|
|
83
97
|
// Fetch contributor count
|
|
84
98
|
let contributorCount;
|
|
85
99
|
try {
|
|
86
|
-
const contribJson = (0, node_child_process_1.
|
|
100
|
+
const contribJson = (0, node_child_process_1.execFileSync)("gh", ["api", `repos/${owner}/${repo}/contributors?per_page=5`, "--jq", "length"], { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] });
|
|
87
101
|
contributorCount = parseInt(contribJson.trim(), 10);
|
|
88
102
|
}
|
|
89
103
|
catch { /* skip */ }
|
|
@@ -112,7 +126,7 @@ function fetchRepoMetadata(owner, repo) {
|
|
|
112
126
|
*/
|
|
113
127
|
function fetchReleases(owner, repo) {
|
|
114
128
|
try {
|
|
115
|
-
const json = (0, node_child_process_1.
|
|
129
|
+
const json = (0, node_child_process_1.execFileSync)("gh", ["api", `repos/${owner}/${repo}/releases?per_page=5`, "--jq", "[.[] | {tagName: .tag_name, name: .name, createdAt: .created_at, assets: [.assets[] | {name: .name, size: .size, downloadCount: .download_count}]}]"], { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] });
|
|
116
130
|
return JSON.parse(json);
|
|
117
131
|
}
|
|
118
132
|
catch {
|
|
@@ -126,7 +140,11 @@ function parseGitHubUrl(url) {
|
|
|
126
140
|
const match = url.match(/github\.com\/([a-zA-Z0-9_.-]+)\/([a-zA-Z0-9_.-]+)/);
|
|
127
141
|
if (!match)
|
|
128
142
|
return null;
|
|
129
|
-
|
|
143
|
+
const owner = match[1];
|
|
144
|
+
const repo = match[2].replace(/\.git$/, "");
|
|
145
|
+
if (!validGitHubName(owner, repo))
|
|
146
|
+
return null;
|
|
147
|
+
return { owner, repo };
|
|
130
148
|
}
|
|
131
149
|
/**
|
|
132
150
|
* Analyze a GitHub repo for trust signals.
|
|
@@ -135,6 +153,11 @@ function analyzeGitHubTrust(owner, repo) {
|
|
|
135
153
|
if (!hasGhCli())
|
|
136
154
|
return [];
|
|
137
155
|
const findings = [];
|
|
156
|
+
// Reject owner/repo that are not valid GitHub names before any gh-api call,
|
|
157
|
+
// since this function is part of the public API and may be called directly.
|
|
158
|
+
if (!validGitHubName(owner, repo)) {
|
|
159
|
+
return findings;
|
|
160
|
+
}
|
|
138
161
|
// Check known malicious accounts
|
|
139
162
|
if (ioc_blocklist_js_1.KNOWN_MALICIOUS_GITHUB_ACCOUNTS.includes(owner.toLowerCase())) {
|
|
140
163
|
findings.push({
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"github-trust-scanner.js","sourceRoot":"","sources":["../src/github-trust-scanner.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
|
|
1
|
+
{"version":3,"file":"github-trust-scanner.js","sourceRoot":"","sources":["../src/github-trust-scanner.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwJH,wCAWC;AAKD,gDA0KC;AAKD,0CAgCC;AArXD,2DAAkD;AAElD,gDAAkC;AAElC,+CAA8C;AAC9C,yDAAqE;AA+BrE;;GAEG;AACH,SAAS,QAAQ;IACf,IAAI,CAAC;QACH,IAAA,iCAAY,EAAC,IAAI,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QACrD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,gFAAgF;AAChF,iFAAiF;AACjF,iFAAiF;AACjF,qDAAqD;AACrD,MAAM,QAAQ,GAAG,qCAAqC,CAAC;AACvD,MAAM,OAAO,GAAG,yBAAyB,CAAC;AAE1C,SAAS,eAAe,CAAC,KAAa,EAAE,IAAY;IAClD,OAAO,CACL,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;QACpB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;QAClB,IAAI,KAAK,GAAG;QACZ,IAAI,KAAK,IAAI;QACb,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CACrB,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB,CAAC,KAAa,EAAE,IAAY;IACpD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAA,iCAAY,EACvB,IAAI,EACJ,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,IAAI,EAAE,EAAE,MAAM,EAAE,yPAAyP,CAAC,EACpS,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CACvD,CAAC;QACF,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAE9B,0BAA0B;QAC1B,IAAI,cAAkC,CAAC;QACvC,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,IAAA,iCAAY,EAC5B,IAAI,EACJ,CAAC,KAAK,EAAE,SAAS,KAAK,EAAE,EAAE,MAAM,EAAE,aAAa,CAAC,EAChD,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CACvD,CAAC;YACF,cAAc,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC;QAEtB,qBAAqB;QACrB,IAAI,WAA+B,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,IAAA,iCAAY,EAC7B,IAAI,EACJ,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,IAAI,qBAAqB,EAAE,MAAM,EAAE,QAAQ,CAAC,EACtE,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CACvD,CAAC;YACF,WAAW,GAAG,QAAQ,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAChD,CAAC;QAAC,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC;QAEtB,0BAA0B;QAC1B,IAAI,gBAAoC,CAAC;QACzC,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,IAAA,iCAAY,EAC9B,IAAI,EACJ,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,IAAI,0BAA0B,EAAE,MAAM,EAAE,QAAQ,CAAC,EAC3E,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CACvD,CAAC;YACF,gBAAgB,GAAG,QAAQ,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QACtD,CAAC;QAAC,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC;QAEtB,OAAO;YACL,KAAK;YACL,IAAI,EAAE,IAAI;YACV,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,CAAC;YACtB,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,CAAC;YACtB,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,CAAC;YAChC,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI;YACjC,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,EAAE;YAC/B,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,EAAE;YAC7B,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,KAAK;YAC1B,cAAc;YACd,aAAa,EAAE,IAAI,CAAC,aAAa,IAAI,MAAM;YAC3C,WAAW;YACX,gBAAgB;SACjB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CAAC,KAAa,EAAE,IAAY;IAChD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAA,iCAAY,EACvB,IAAI,EACJ,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,IAAI,sBAAsB,EAAE,MAAM,EAAE,qJAAqJ,CAAC,EACpN,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CACvD,CAAC;QACF,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAc,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAgB,cAAc,CAC5B,GAAW;IAEX,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CACrB,mDAAmD,CACpD,CAAC;IACF,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACvB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC5C,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC;AAED;;GAEG;AACH,SAAgB,kBAAkB,CAChC,KAAa,EACb,IAAY;IAEZ,IAAI,CAAC,QAAQ,EAAE;QAAE,OAAO,EAAE,CAAC;IAE3B,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,4EAA4E;IAC5E,4EAA4E;IAC5E,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;QAClC,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,iCAAiC;IACjC,IAAI,kDAA+B,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QAClE,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,8BAA8B;YACpC,WAAW,EAAE,qBAAqB,KAAK,wCAAwC;YAC/E,QAAQ,EAAE,UAAU;YACpB,cAAc,EACZ,iGAAiG;SACpG,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,CAAC,2BAA2B;IAC9C,CAAC;IAED,iBAAiB;IACjB,MAAM,IAAI,GAAG,iBAAiB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC5C,IAAI,CAAC,IAAI;QAAE,OAAO,QAAQ,CAAC;IAE3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,OAAO,GAAG,GAAG,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;IACzD,MAAM,iBAAiB,GAAG,OAAO,GAAG,CAAC,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;IAE1D,oBAAoB;IACpB,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;QACxB,MAAM,UAAU,GACd,GAAG,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE,CAAC;QAChD,MAAM,WAAW,GAAG,UAAU,GAAG,CAAC,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;QACvD,IAAI,WAAW,GAAG,EAAE,EAAE,CAAC;YACrB,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,kBAAkB;gBACxB,WAAW,EAAE,+BAA+B,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,sDAAsD;gBACzH,QAAQ,EAAE,MAAM;gBAChB,cAAc,EACZ,2FAA2F;aAC9F,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,wCAAwC;IACxC,IAAI,iBAAiB,GAAG,EAAE,IAAI,IAAI,CAAC,KAAK,GAAG,EAAE,EAAE,CAAC;QAC9C,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,sBAAsB;YAC5B,WAAW,EAAE,iBAAiB,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,kBAAkB,IAAI,CAAC,KAAK,sEAAsE;YAC7J,QAAQ,EAAE,MAAM;YAChB,cAAc,EACZ,uGAAuG;SAC1G,CAAC,CAAC;IACL,CAAC;IAED,qEAAqE;IACrE,IAAI,IAAI,CAAC,KAAK,GAAG,EAAE,IAAI,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,GAAG,EAAE,CAAC;QACrD,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,sBAAsB;YAC5B,WAAW,EAAE,4BAA4B,IAAI,CAAC,KAAK,aAAa,IAAI,CAAC,KAAK,0DAA0D;YACpI,QAAQ,EAAE,MAAM;YAChB,cAAc,EACZ,qEAAqE;SACxE,CAAC,CAAC;IACL,CAAC;IAED,mCAAmC;IACnC,IACE,IAAI,CAAC,gBAAgB,KAAK,SAAS;QACnC,IAAI,CAAC,gBAAgB,GAAG,CAAC;QACzB,IAAI,CAAC,KAAK,GAAG,GAAG,EAChB,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,uBAAuB;YAC7B,WAAW,EAAE,QAAQ,IAAI,CAAC,gBAAgB,kCAAkC,IAAI,CAAC,KAAK,2EAA2E;YACjK,QAAQ,EAAE,QAAQ;YAClB,cAAc,EACZ,kFAAkF;SACrF,CAAC,CAAC;IACL,CAAC;IAED,4BAA4B;IAC5B,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,UAAU,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC,EAAE,CAAC;QAClE,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,gBAAgB;YACtB,WAAW,EAAE,UAAU,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,cAAc,mBAAmB,IAAI,CAAC,KAAK,gEAAgE;YACzK,QAAQ,EAAE,QAAQ;YAClB,cAAc,EACZ,+EAA+E;SAClF,CAAC,CAAC;IACL,CAAC;IAED,sBAAsB;IACtB,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,GAAG,EAAE,EAAE,CAAC;QAC/E,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,oBAAoB;YAC1B,WAAW,EAAE,QAAQ,IAAI,CAAC,WAAW,6BAA6B,IAAI,CAAC,KAAK,0DAA0D;YACtI,QAAQ,EAAE,MAAM;YAChB,cAAc,EACZ,2FAA2F;SAC9F,CAAC,CAAC;IACL,CAAC;IAED,0CAA0C;IAC1C,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC5C,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,uBAAuB;QACvB,MAAM,cAAc,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QAChF,MAAM,WAAW,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAEpC,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnC,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAEpC,IAAI,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjC,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,sBAAsB;oBAC5B,WAAW,EAAE,oBAAoB,KAAK,CAAC,IAAI,MAAM,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,iBAAiB,OAAO,CAAC,OAAO,oDAAoD;oBAC3J,QAAQ,EAAE,UAAU;oBACpB,cAAc,EACZ,sGAAsG;iBACzG,CAAC,CAAC;YACL,CAAC;YAED,IAAI,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC9B,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,oBAAoB;oBAC1B,WAAW,EAAE,uBAAuB,KAAK,CAAC,IAAI,MAAM,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,iBAAiB,OAAO,CAAC,OAAO,4DAA4D;oBACtK,QAAQ,EAAE,MAAM;oBAChB,cAAc,EACZ,qGAAqG;iBACxG,CAAC,CAAC;YACL,CAAC;YAED,wBAAwB;YACxB,IAAI,KAAK,CAAC,IAAI,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;gBAClC,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,sBAAsB;oBAC5B,WAAW,EAAE,2BAA2B,KAAK,CAAC,IAAI,MAAM,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,uDAAuD;oBACrI,QAAQ,EAAE,MAAM;oBAChB,cAAc,EACZ,oDAAoD;iBACvD,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,qBAAqB;QACrB,MAAM,gBAAgB,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;QACzE,MAAM,YAAY,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;QAC5G,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;YACnC,IAAI,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBACvC,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,mBAAmB;oBACzB,WAAW,EAAE,YAAY,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,OAAO,4BAA4B,OAAO,kEAAkE;oBAC7J,QAAQ,EAAE,MAAM;oBAChB,cAAc,EACZ,iFAAiF;iBACpF,CAAC,CAAC;gBACH,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,SAAgB,eAAe,CAC7B,aAAqB,EACrB,YAAoB;IAEpB,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAExC,KAAK,MAAM,OAAO,IAAI,2BAAa,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAE/C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC5B,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC/B,IAAI,KAAK,EAAE,CAAC;gBACV,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,OAAO,CAAC,IAAI;oBAClB,WAAW,EAAE,OAAO,CAAC,WAAW;oBAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,IAAI,EAAE,YAAY;oBAClB,IAAI,EAAE,CAAC,GAAG,CAAC;oBACX,KAAK,EACH,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,GAAG;wBACnB,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,KAAK;wBACpC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;oBACd,cAAc,EAAE,qBAAqB,CAAC,OAAO,CAAC,IAAI,CAAC;iBACpD,CAAC,CAAC;gBACH,MAAM,CAAC,iCAAiC;YAC1C,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,IAAI,KAAK,GAAG,IAAI;QAAE,OAAO,GAAG,KAAK,IAAI,CAAC;IACtC,IAAI,KAAK,GAAG,IAAI,GAAG,IAAI;QAAE,OAAO,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;IAClE,OAAO,GAAG,CAAC,KAAK,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;AACpD,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAY;IACzC,MAAM,GAAG,GAA2B;QAClC,kBAAkB,EAChB,qGAAqG;QACvG,iBAAiB,EACf,oGAAoG;QACtG,mBAAmB,EACjB,0GAA0G;QAC5G,oBAAoB,EAClB,gHAAgH;QAClH,qBAAqB,EACnB,mGAAmG;QACrG,iBAAiB,EACf,yFAAyF;KAC5F,CAAC;IACF,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,qDAAqD,CAAC;AAC5E,CAAC"}
|
package/dist/reporter.js
CHANGED
|
@@ -55,7 +55,7 @@ function formatJson(report) {
|
|
|
55
55
|
function formatText(report) {
|
|
56
56
|
const lines = [];
|
|
57
57
|
// ── layout constants ───────────────────────────────────────────────────────
|
|
58
|
-
const VERSION = "5.2.
|
|
58
|
+
const VERSION = "5.2.41";
|
|
59
59
|
const W = 76; // visible chars between "│ " and " │" (total line = 80)
|
|
60
60
|
// ── ANSI helpers ───────────────────────────────────────────────────────────
|
|
61
61
|
const stripAnsi = (s) => s.replace(/\x1b\[[0-9;]*m/g, "");
|
|
@@ -490,7 +490,7 @@ function formatSarif(report) {
|
|
|
490
490
|
tool: {
|
|
491
491
|
driver: {
|
|
492
492
|
name: "supply-chain-guard",
|
|
493
|
-
version: "5.2.
|
|
493
|
+
version: "5.2.41",
|
|
494
494
|
informationUri: "https://github.com/homeofe/supply-chain-guard",
|
|
495
495
|
rules,
|
|
496
496
|
},
|
|
@@ -552,7 +552,7 @@ function formatSbom(report) {
|
|
|
552
552
|
timestamp: report.timestamp,
|
|
553
553
|
tools: {
|
|
554
554
|
components: [
|
|
555
|
-
{ type: "application", name: "supply-chain-guard", version: "5.2.
|
|
555
|
+
{ type: "application", name: "supply-chain-guard", version: "5.2.41" },
|
|
556
556
|
],
|
|
557
557
|
},
|
|
558
558
|
component: {
|
|
@@ -704,7 +704,7 @@ footer{text-align:center;padding:24px;color:#94a3b8;font-size:13px}
|
|
|
704
704
|
` : ""}
|
|
705
705
|
|
|
706
706
|
<footer>
|
|
707
|
-
Generated by <a href="https://github.com/homeofe/supply-chain-guard">supply-chain-guard</a> v5.2.
|
|
707
|
+
Generated by <a href="https://github.com/homeofe/supply-chain-guard">supply-chain-guard</a> v5.2.41
|
|
708
708
|
</footer>
|
|
709
709
|
</div>
|
|
710
710
|
<script>
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "supply-chain-guard",
|
|
3
|
-
"version": "5.2.
|
|
3
|
+
"version": "5.2.41",
|
|
4
4
|
"description": "Open-source supply-chain security scanner for npm, PyPI, Cargo, Go, Docker, VS Code extensions, GitHub Actions, IaC and Solana C2. Detects GlassWorm, Shai-Hulud, PPE attacks, dependency confusion and 120+ malware indicators. Generates CycloneDX 1.6 SBOMs and verifies SLSA provenance.",
|
|
5
5
|
"main": "dist/index.js",
|
|
6
6
|
"types": "dist/index.d.ts",
|