supply-chain-guard 5.20.2 → 5.21.0

package/README.md

@@ -131,7 +131,7 @@ Run the scanner as a [pre-commit](https://pre-commit.com) hook (Python-ecosystem
 ```yaml
 repos:
   - repo: https://github.com/homeofe/supply-chain-guard
-    rev: v5.20.2
+    rev: v5.21.0
     hooks:
       - id: supply-chain-guard
 ```

package/dist/cli.js

@@ -22,7 +22,7 @@ const program = new commander_1.Command();
 program
     .name("supply-chain-guard")
     .description("Open-source supply-chain security scanner. Detects GlassWorm and similar malware campaigns in npm packages, PyPI packages, code repos, VS Code extensions, and project dependencies.")
-    .version("5.20.2");
+    .version("5.21.0");
 // ── scan command ────────────────────────────────────────────────────
 program
     .command("scan")

package/dist/dependency-risk-analyzer.d.ts

@@ -5,6 +5,22 @@
  * Checks package names against popular packages to detect mimicry.
  */
 import type { Finding } from "./types.js";
+/**
+ * Resolve an npm alias spec to the package that actually gets installed.
+ *
+ * `"utils": "npm:chalk-tempalte@1.0.0"` installs chalk-tempalte and calls it
+ * `utils` in the tree. The KEY is a local label chosen by whoever wrote the
+ * manifest; the TARGET is the real registry package. Checking the key is
+ * therefore checking attacker-controlled text, which is how a known-malicious
+ * package used to scan completely clean: every consumer here read the key.
+ *
+ * Returns null for anything that is not an `npm:` alias, so callers can fall
+ * back to the literal name.
+ */
+export declare function resolveNpmAlias(spec: string | undefined): {
+    name: string;
+    version?: string;
+} | null;
 /**
  * Calculate Levenshtein distance between two strings.
  */

package/dist/dependency-risk-analyzer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dependency-risk-analyzer.d.ts","sourceRoot":"","sources":["../src/dependency-risk-analyzer.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAsC1C;;GAEG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAsBxD;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CACpC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACpC,YAAY,EAAE,MAAM,GACnB,OAAO,EAAE,CA0EX"}
+{"version":3,"file":"dependency-risk-analyzer.d.ts","sourceRoot":"","sources":["../src/dependency-risk-analyzer.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AA8D1C;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,GAAG,SAAS,GACvB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAsB3C;AAeD;;GAEG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAsBxD;AAmDD;;GAEG;AACH,wBAAgB,sBAAsB,CACpC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACpC,YAAY,EAAE,MAAM,GACnB,OAAO,EAAE,CA8JX"}

package/dist/dependency-risk-analyzer.js

@@ -6,6 +6,7 @@
  * Checks package names against popular packages to detect mimicry.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveNpmAlias = resolveNpmAlias;
 exports.levenshtein = levenshtein;
 exports.analyzeDependencyRisks = analyzeDependencyRisks;
 /** Top popular npm packages (targets for typosquatting) */
@@ -29,6 +30,76 @@ const POPULAR_PACKAGES = [
 ];
 /** Packages that are known-safe even when close in name to popular packages */
 const POPULAR_PACKAGES_SET = new Set(POPULAR_PACKAGES);
+/**
+ * Legitimate, widely-used packages that sit one edit from an entry in
+ * POPULAR_PACKAGES and must never be reported as typosquats.
+ *
+ * This is an ADDITIONAL exemption, not a replacement for POPULAR_PACKAGES_SET:
+ * entries here are NOT typosquat targets. The two lists are separate because a
+ * name can need exempting without being worth defending: putting a name in
+ * POPULAR_PACKAGES also makes every name one edit from it a candidate squat, so
+ * the target list has to stay a deliberate choice rather than a dumping ground
+ * for whatever tripped the rule this week.
+ *
+ * Scope note: this set gates exactly one rule (TYPOSQUAT_LEVENSHTEIN, at the
+ * single call site below). It is NOT a malware bypass - feed IOC matches, the
+ * known-bad-version blocklist and every scanner pattern run on separate paths
+ * that never consult it. Do not move this check earlier in install-guard's
+ * checkSpec, where it would start gating real malware verdicts.
+ *
+ * Every entry was verified against the npm registry on 2026-07-29 as a real,
+ * maintained package with an identifiable owner - the same evidentiary bar
+ * src/patterns.ts applies before blocking any bare name.
+ */
+const TYPOSQUAT_ALLOWLIST = new Set([
+    "pathe", // unjs, universal path utils (also a transitive dep of this repo)
+    "color", // Qix-/color; NOT a squat of the sabotaged "colors"
+    "colord", // omgovich, color manipulation
+    "mysql", // the original mysqljs driver; "mysql2" is the successor, both real
+    "nuxt", // the Nuxt framework
+    "ulid", // ULID id generator; near "uuid" by coincidence
+    "preact", // 3kb React-compatible virtual DOM
+    "gaxios", // googleapis HTTP client
+    "enquirer", // interactive CLI prompts
+    "ttypescript", // TypeScript wrapper supporting custom transformers
+]);
+/** Registry name shape, used to validate an alias target. */
+const ALIAS_NAME_RE = /^(@[a-z0-9][a-z0-9-._~]*\/)?[a-z0-9-._~][a-z0-9-._~]*$/i;
+/**
+ * Resolve an npm alias spec to the package that actually gets installed.
+ *
+ * `"utils": "npm:chalk-tempalte@1.0.0"` installs chalk-tempalte and calls it
+ * `utils` in the tree. The KEY is a local label chosen by whoever wrote the
+ * manifest; the TARGET is the real registry package. Checking the key is
+ * therefore checking attacker-controlled text, which is how a known-malicious
+ * package used to scan completely clean: every consumer here read the key.
+ *
+ * Returns null for anything that is not an `npm:` alias, so callers can fall
+ * back to the literal name.
+ */
+function resolveNpmAlias(spec) {
+    if (typeof spec !== "string")
+        return null;
+    const trimmed = spec.trim();
+    if (!trimmed.startsWith("npm:"))
+        return null;
+    const target = trimmed.slice(4);
+    if (target.length === 0)
+        return null;
+    // Same split rule as a plain spec: the LAST "@" separates the version, and
+    // index 0 is a scope marker rather than a separator.
+    const at = target.lastIndexOf("@");
+    const name = at > 0 ? target.substring(0, at) : target;
+    const version = at > 0 ? target.substring(at + 1) : undefined;
+    if (!ALIAS_NAME_RE.test(name))
+        return null;
+    // A nested protocol ("npm:foo@git:...") is not a plain registry pin. Keep the
+    // resolved NAME, which is still checkable, and drop only the version.
+    if (version !== undefined && (version.length === 0 || version.includes(":"))) {
+        return { name };
+    }
+    return version === undefined ? { name } : { name, version };
+}
 /** Patterns that suggest internal/private package names */
 const INTERNAL_PATTERNS = [
     /^@[^/]+\/internal-/,
@@ -60,13 +131,63 @@ function levenshtein(a, b) {
     }
     return dp[m][n];
 }
+/**
+ * Optimal String Alignment distance (Damerau-Levenshtein restricted to adjacent
+ * transpositions), used ONLY by the typosquat heuristic below.
+ *
+ * Deliberately separate from the exported `levenshtein`, which is public API
+ * (re-exported from src/index.ts) and pinned to exact values by its own tests.
+ *
+ * Why the typosquat rule needs transposition awareness: the realistic squat is a
+ * swapped pair of adjacent characters, which plain Levenshtein scores as 2 edits
+ * (two substitutions) rather than 1. The curated squats this rule catches that
+ * are transpositions - "rimarf" -> rimraf, "yarsg" -> yargs, "lodahs" -> lodash,
+ * "axois" -> axios, "raect" -> react - would all be lost at a plain 1-edit
+ * ceiling. Scoring them as 1 is what allows the ceiling to drop from 2 to 1
+ * without losing them.
+ *
+ * Note this rule only ever sees squats of names in POPULAR_PACKAGES. Curated
+ * malicious names whose target is NOT in that list (cyrpto, hardhta, naniod,
+ * suport-color) are matched by exact name in patterns.ts and the feed, never
+ * here - so this heuristic's job is unpublished future squats, not the corpus
+ * already curated.
+ */
+function osaDistance(a, b) {
+    const m = a.length;
+    const n = b.length;
+    const dp = Array.from({ length: m + 1 }, () => Array.from({ length: n + 1 }, () => 0));
+    for (let i = 0; i <= m; i++)
+        dp[i][0] = i;
+    for (let j = 0; j <= n; j++)
+        dp[0][j] = j;
+    for (let i = 1; i <= m; i++) {
+        for (let j = 1; j <= n; j++) {
+            const cost = a[i - 1] === b[j - 1] ? 0 : 1;
+            dp[i][j] = Math.min(dp[i - 1][j] + 1, dp[i][j - 1] + 1, dp[i - 1][j - 1] + cost);
+            // Adjacent transposition counts as a single edit.
+            if (i > 1 && j > 1 && a[i - 1] === b[j - 2] && a[i - 2] === b[j - 1]) {
+                dp[i][j] = Math.min(dp[i][j], dp[i - 2][j - 2] + cost);
+            }
+        }
+    }
+    return dp[m][n];
+}
 /**
  * Analyze dependencies for typosquatting and confusion risks.
  */
 function analyzeDependencyRisks(dependencies, relativePath) {
     const findings = [];
-    const depNames = Object.keys(dependencies);
-    for (const name of depNames) {
+    // Every rule below judges the package that is actually INSTALLED. For an npm
+    // alias ("utils": "npm:lodahs@1.0.0") that is the target, not the manifest
+    // key, which is arbitrary text chosen by whoever wrote the file.
+    const entries = Object.keys(dependencies).map((key) => {
+        const alias = resolveNpmAlias(dependencies[key]);
+        return { key, name: alias ? alias.name : key, aliased: alias !== null };
+    });
+    /** Sorted "a b" keys, so one pair yields one finding rather than one per side. */
+    const reportedPairs = new Set();
+    for (const { key, name, aliased } of entries) {
+        const via = aliased ? ` (installed via the npm alias "${key}")` : "";
         // Skip scoped packages for Levenshtein (handled separately)
         if (name.startsWith("@")) {
             // Check internal name patterns on public registry
@@ -74,7 +195,7 @@ function analyzeDependencyRisks(dependencies, relativePath) {
                 if (pattern.test(name)) {
                     findings.push({
                         rule: "DEP_INTERNAL_NAME_PUBLIC",
-                        description: `Dependency "${name}" looks like an internal package name. If this is on a public registry, it may be a dependency confusion attack.`,
+                        description: `Dependency "${name}" looks like an internal package name${via}. If this is on a public registry, it may be a dependency confusion attack.`,
                         severity: "critical",
                         file: relativePath,
                         confidence: 0.7,
@@ -86,53 +207,122 @@ function analyzeDependencyRisks(dependencies, relativePath) {
             }
             continue;
         }
-        // Levenshtein check against popular packages.
-        // Skip if the name is itself a known popular/safe package — prevents false positives
-        // where two legitimate popular packages happen to be close in name (e.g. next/jest).
-        if (!POPULAR_PACKAGES_SET.has(name) && name.length >= 4) {
+        // Typosquat check against popular packages.
+        //
+        // The ceiling is ONE transposition-aware edit. It used to be two plain
+        // Levenshtein edits, which flagged 321 measured real packages (acorn, preact,
+        // cypress, redux, viem, knex, globby, jose...) against 2 true positives that
+        // patterns.ts and the feed already catch by exact name - a ~1:160 signal ratio,
+        // and it got WORSE the more popular the package was (2.37% of packages above
+        // 10M weekly downloads). Two edits against a 4-character name is simply not
+        // evidence of anything. Transposition awareness (see osaDistance) is what makes
+        // the tightening free: every real squat in this repo's threat data is an
+        // adjacent swap, so all of them still score 1 and are still caught.
+        //
+        // No first-character predicate is used. It would cut a further ~24 false
+        // positives, but this repo curates "1odash" and "l0dash" in patterns.ts as
+        // canonical squats, and both change character zero - a leading-homoglyph rule
+        // would make this heuristic structurally unable to generalize them. It is also
+        // published source, so it would be a one-character documented bypass.
+        //
+        // Skip if the name is itself a known popular/safe package - prevents false
+        // positives where two legitimate popular packages are close in name (next/jest).
+        if (!POPULAR_PACKAGES_SET.has(name) &&
+            !TYPOSQUAT_ALLOWLIST.has(name) &&
+            name.length >= 4) {
+            // At a ceiling of 1 every hit is the same distance, so there is no closer
+            // match to search for and the first hit is reported. (Under the old 2-edit
+            // ceiling this loop could report a distance-2 target while a distance-1 one
+            // sat later in the array.) If the ceiling is ever raised, this must go back
+            // to tracking the minimum before reporting.
+            let best;
             for (const popular of POPULAR_PACKAGES) {
                 if (name === popular)
                     continue; // Exact match = legitimate
-                // Skip very short popular packages (ws, pg, nx…) — too many false positives
-                if (popular.length < 4)
+                // Skip short popular targets. The floor is 5, not 4: measured over 29,687
+                // real published npm names, a floor of 4 produced 57 false positives and a
+                // floor of 5 produces 29, with the curated true-positive set unchanged. The
+                // four-letter targets are the damaging ones because almost any short name is
+                // one edit from them - "path" alone accounted for 11 (upath, mpath, xpath,
+                // paths, ...) and "jest" for 5 (test, nest, rest, ...). Floor 6 is too far:
+                // it loses yarsg, axois, raect and chlak.
+                if (popular.length < 5)
                     continue;
-                if (Math.abs(name.length - popular.length) > 2)
+                if (Math.abs(name.length - popular.length) > 1)
                     continue; // Quick skip
-                const dist = levenshtein(name, popular);
-                if (dist > 0 && dist <= 2) {
-                    findings.push({
-                        rule: "TYPOSQUAT_LEVENSHTEIN",
-                        description: `Dependency "${name}" is ${dist} edit(s) away from popular package "${popular}". Likely a typosquat.`,
-                        severity: "high",
-                        file: relativePath,
-                        confidence: dist === 1 ? 0.85 : 0.65,
-                        category: "supply-chain",
-                        recommendation: `Did you mean "${popular}"? Typosquatting replaces popular packages with malicious copies.`,
-                    });
-                    break; // One match per dep is enough
+                const dist = osaDistance(name, popular);
+                if (dist > 0 && dist <= 1 && (!best || dist < best.dist)) {
+                    best = { popular, dist };
+                    break; // Distance 1 is the tightest possible hit; nothing can beat it.
                 }
             }
-        }
-        // Check if name is similar to another direct dependency
-        for (const otherName of depNames) {
-            if (name === otherName)
-                continue;
-            if (name.startsWith("@") || otherName.startsWith("@"))
-                continue;
-            if (Math.abs(name.length - otherName.length) > 2)
-                continue;
-            const dist = levenshtein(name, otherName);
-            if (dist > 0 && dist <= 1) {
+            if (best) {
                 findings.push({
-                    rule: "TYPOSQUAT_SIMILAR_TO_DEP",
-                    description: `Dependencies "${name}" and "${otherName}" differ by only ${dist} character(s). One may be a typosquat of the other.`,
+                    rule: "TYPOSQUAT_LEVENSHTEIN",
+                    // The dependency name MUST stay the first quoted token: policy-engine.ts
+                    // extracts it with /"([^"]+)"/ to honour user `allowlist.packages` rules.
+                    description: `Dependency "${name}"${via} is ${best.dist} edit(s) away from popular package "${best.popular}". Likely a typosquat.`,
                     severity: "high",
                     file: relativePath,
-                    confidence: 0.7,
+                    confidence: 0.85,
                     category: "supply-chain",
-                    recommendation: `Review both "${name}" and "${otherName}". Only one should be in your dependencies.`,
+                    recommendation: `Did you mean "${best.popular}"? Typosquatting replaces popular packages with malicious copies.`,
                 });
-                break;
+            }
+        }
+        // Check if name is similar to another direct dependency.
+        //
+        // Measured over 939 real manifests, this rule fired on 5.0% of them (8.1% of
+        // real repository roots) and every colliding pair was a legitimate co-install:
+        // preact+react, vue+vuex, path+pathe, color+colors, mysql+mysql2, uuid+ulid,
+        // eslint+tslint. Four guards below cut that to under 1% while INCREASING
+        // recall, because switching to osaDistance starts catching the transposition
+        // squats (lodahs+lodash, axois+axios, raect+react, yarsg+yargs) that the rule
+        // was silently missing next to their own target.
+        //
+        // The known-good test is ONE-SIDED on purpose. The outer loop visits both
+        // members of a pair, so testing only the reported side keeps the case this
+        // rule exists for: {expres, express} still reports, because the express-side
+        // pass is dropped while the expres-side pass survives. Testing otherName too
+        // would suppress exactly the squat-next-to-its-target shape (measured: it
+        // drops 11 of 14 true positives).
+        //
+        // Guards are scoped to this block rather than the outer loop so the two
+        // typosquat rules stay independently editable.
+        const skipPairRule = name.length < 4 || POPULAR_PACKAGES_SET.has(name) || TYPOSQUAT_ALLOWLIST.has(name);
+        if (!skipPairRule) {
+            for (const other of entries) {
+                const otherName = other.name;
+                if (name === otherName)
+                    continue;
+                if (name.startsWith("@") || otherName.startsWith("@"))
+                    continue;
+                // Same length floor as the sibling rule: below 4 characters almost any
+                // name is one edit from another (ws/wss, np/nx, fs/fse, qs/q).
+                if (otherName.length < 4)
+                    continue;
+                if (Math.abs(name.length - otherName.length) > 1)
+                    continue;
+                const dist = osaDistance(name, otherName);
+                if (dist > 0 && dist <= 1) {
+                    const pairKey = [name, otherName].sort().join(" ");
+                    if (reportedPairs.has(pairKey))
+                        break;
+                    reportedPairs.add(pairKey);
+                    const otherVia = other.aliased ? ` (installed via the npm alias "${other.key}")` : "";
+                    findings.push({
+                        rule: "TYPOSQUAT_SIMILAR_TO_DEP",
+                        // "name" leads and is guaranteed to be the non-allowlisted side, so
+                        // the suspicious package is named first.
+                        description: `Dependencies "${name}"${via} and "${otherName}"${otherVia} differ by only ${dist} character(s). One may be a typosquat of the other.`,
+                        severity: "high",
+                        file: relativePath,
+                        confidence: 0.7,
+                        category: "supply-chain",
+                        recommendation: `Review both "${name}" and "${otherName}". Only one should be in your dependencies.`,
+                    });
+                    break;
+                }
             }
         }
     }

package/dist/dependency-risk-analyzer.js.map

@@ -1 +1 @@
-{"version":3,"file":"dependency-risk-analyzer.js","sourceRoot":"","sources":["../src/dependency-risk-analyzer.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;;AAIH,2DAA2D;AAC3D,MAAM,gBAAgB,GAAa;IACjC,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO;IACpE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO;IACjE,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU;IAClE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,SAAS,EAAE,YAAY;IAClE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW;IACnE,UAAU,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS;IAC3D,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,cAAc;IACxE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW;IAC9E,SAAS,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,uBAAuB;IACrE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa;IACjE,SAAS,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS;IAC7D,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,aAAa;IAChE,WAAW,EAAE,cAAc,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK;IAC/D,MAAM,EAAE,SAAS;IACjB,iFAAiF;IACjF,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ;CAC3D,CAAC;AAEF,+EAA+E;AAC/E,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,CAAC;AAEvD,2DAA2D;AAC3D,MAAM,iBAAiB,GAAG;IACxB,oBAAoB;IACpB,mBAAmB;IACnB,sBAAsB;IACtB,kBAAkB;IAClB,kBAAkB;IAClB,oBAAoB;IACpB,qBAAqB;IACrB,mBAAmB;IACnB,qBAAqB;CACtB,CAAC;AAEF;;GAEG;AACH,qBAA4B,CAAS,EAAE,CAAS;IAC9C,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IACnB,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IACnB,MAAM,EAAE,GAAe,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,CACxD,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CACvC,CAAC;IAEF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE;QAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC1C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE;QAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAE1C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3C,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CACjB,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAChB,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,EAChB,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CACxB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,gCACE,YAAoC,EACpC,YAAoB;IAEpB,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAE3C,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,4DAA4D;QAC5D,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,kDAAkD;YAClD,KAAK,MAAM,OAAO,IAAI,iBAAiB,EAAE,CAAC;gBACxC,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBACvB,QAAQ,CAAC,IAAI,CAAC;wBACZ,IAAI,EAAE,0BAA0B;wBAChC,WAAW,EAAE,eAAe,IAAI,kHAAkH;wBAClJ,QAAQ,EAAE,UAAU;wBACpB,IAAI,EAAE,YAAY;wBAClB,UAAU,EAAE,GAAG;wBACf,QAAQ,EAAE,cAAc;wBACxB,cAAc,EAAE,WAAW,IAAI,8EAA8E;qBAC9G,CAAC,CAAC;oBACH,MAAM;gBACR,CAAC;YACH,CAAC;YACD,SAAS;QACX,CAAC;QAED,8CAA8C;QAC9C,qFAAqF;QACrF,qFAAqF;QACrF,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YACxD,KAAK,MAAM,OAAO,IAAI,gBAAgB,EAAE,CAAC;gBACvC,IAAI,IAAI,KAAK,OAAO;oBAAE,SAAS,CAAC,2BAA2B;gBAC3D,4EAA4E;gBAC5E,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;oBAAE,SAAS;gBACjC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC;oBAAE,SAAS,CAAC,aAAa;gBAEvE,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBACxC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;oBAC1B,QAAQ,CAAC,IAAI,CAAC;wBACZ,IAAI,EAAE,uBAAuB;wBAC7B,WAAW,EAAE,eAAe,IAAI,QAAQ,IAAI,uCAAuC,OAAO,wBAAwB;wBAClH,QAAQ,EAAE,MAAM;wBAChB,IAAI,EAAE,YAAY;wBAClB,UAAU,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;wBACpC,QAAQ,EAAE,cAAc;wBACxB,cAAc,EAAE,iBAAiB,OAAO,mEAAmE;qBAC5G,CAAC,CAAC;oBACH,MAAM,CAAC,8BAA8B;gBACvC,CAAC;YACH,CAAC;QACH,CAAC;QAED,wDAAwD;QACxD,KAAK,MAAM,SAAS,IAAI,QAAQ,EAAE,CAAC;YACjC,IAAI,IAAI,KAAK,SAAS;gBAAE,SAAS;YACjC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,SAAS;YAChE,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC;gBAAE,SAAS;YAE3D,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YAC1C,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;gBAC1B,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,0BAA0B;oBAChC,WAAW,EAAE,iBAAiB,IAAI,UAAU,SAAS,oBAAoB,IAAI,qDAAqD;oBAClI,QAAQ,EAAE,MAAM;oBAChB,IAAI,EAAE,YAAY;oBAClB,UAAU,EAAE,GAAG;oBACf,QAAQ,EAAE,cAAc;oBACxB,cAAc,EAAE,gBAAgB,IAAI,UAAU,SAAS,6CAA6C;iBACrG,CAAC,CAAC;gBACH,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}
+{"version":3,"file":"dependency-risk-analyzer.js","sourceRoot":"","sources":["../src/dependency-risk-analyzer.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;;;AAIH,2DAA2D;AAC3D,MAAM,gBAAgB,GAAa;IACjC,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO;IACpE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO;IACjE,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU;IAClE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,SAAS,EAAE,YAAY;IAClE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW;IACnE,UAAU,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS;IAC3D,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,cAAc;IACxE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW;IAC9E,SAAS,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,uBAAuB;IACrE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa;IACjE,SAAS,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS;IAC7D,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,aAAa;IAChE,WAAW,EAAE,cAAc,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK;IAC/D,MAAM,EAAE,SAAS;IACjB,iFAAiF;IACjF,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ;CAC3D,CAAC;AAEF,+EAA+E;AAC/E,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,CAAC;AAEvD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,OAAO,EAAE,kEAAkE;IAC3E,OAAO,EAAE,oDAAoD;IAC7D,QAAQ,EAAE,+BAA+B;IACzC,OAAO,EAAE,oEAAoE;IAC7E,MAAM,EAAE,qBAAqB;IAC7B,MAAM,EAAE,gDAAgD;IACxD,QAAQ,EAAE,mCAAmC;IAC7C,QAAQ,EAAE,yBAAyB;IACnC,UAAU,EAAE,0BAA0B;IACtC,aAAa,EAAE,oDAAoD;CACpE,CAAC,CAAC;AAEH,6DAA6D;AAC7D,MAAM,aAAa,GAAG,yDAAyD,CAAC;AAEhF;;;;;;;;;;;GAWG;AACH,yBACE,IAAwB;IAExB,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAE7C,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAChC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAErC,2EAA2E;IAC3E,qDAAqD;IACrD,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACvD,MAAM,OAAO,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAE9D,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,8EAA8E;IAC9E,sEAAsE;IACtE,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QAC7E,OAAO,EAAE,IAAI,EAAE,CAAC;IAClB,CAAC;IAED,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC9D,CAAC;AAED,2DAA2D;AAC3D,MAAM,iBAAiB,GAAG;IACxB,oBAAoB;IACpB,mBAAmB;IACnB,sBAAsB;IACtB,kBAAkB;IAClB,kBAAkB;IAClB,oBAAoB;IACpB,qBAAqB;IACrB,mBAAmB;IACnB,qBAAqB;CACtB,CAAC;AAEF;;GAEG;AACH,qBAA4B,CAAS,EAAE,CAAS;IAC9C,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IACnB,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IACnB,MAAM,EAAE,GAAe,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,CACxD,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CACvC,CAAC;IAEF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE;QAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC1C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE;QAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAE1C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3C,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CACjB,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAChB,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,EAChB,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CACxB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,SAAS,WAAW,CAAC,CAAS,EAAE,CAAS;IACvC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IACnB,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IACnB,MAAM,EAAE,GAAe,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,CACxD,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CACvC,CAAC;IAEF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE;QAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC1C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE;QAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAE1C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3C,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CACjB,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAChB,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,EAChB,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CACxB,CAAC;YACF,kDAAkD;YAClD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBACrE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,gCACE,YAAoC,EACpC,YAAoB;IAEpB,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,6EAA6E;IAC7E,2EAA2E;IAC3E,iEAAiE;IACjE,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QACpD,MAAM,KAAK,GAAG,eAAe,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;QACjD,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,KAAK,IAAI,EAAE,CAAC;IAC1E,CAAC,CAAC,CAAC;IACH,kFAAkF;IAClF,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;IAExC,KAAK,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,OAAO,EAAE,CAAC;QAC7C,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,kCAAkC,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAErE,4DAA4D;QAC5D,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,kDAAkD;YAClD,KAAK,MAAM,OAAO,IAAI,iBAAiB,EAAE,CAAC;gBACxC,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBACvB,QAAQ,CAAC,IAAI,CAAC;wBACZ,IAAI,EAAE,0BAA0B;wBAChC,WAAW,EAAE,eAAe,IAAI,wCAAwC,GAAG,6EAA6E;wBACxJ,QAAQ,EAAE,UAAU;wBACpB,IAAI,EAAE,YAAY;wBAClB,UAAU,EAAE,GAAG;wBACf,QAAQ,EAAE,cAAc;wBACxB,cAAc,EAAE,WAAW,IAAI,8EAA8E;qBAC9G,CAAC,CAAC;oBACH,MAAM;gBACR,CAAC;YACH,CAAC;YACD,SAAS;QACX,CAAC;QAED,4CAA4C;QAC5C,EAAE;QACF,uEAAuE;QACvE,8EAA8E;QAC9E,6EAA6E;QAC7E,gFAAgF;QAChF,6EAA6E;QAC7E,4EAA4E;QAC5E,gFAAgF;QAChF,yEAAyE;QACzE,oEAAoE;QACpE,EAAE;QACF,yEAAyE;QACzE,2EAA2E;QAC3E,8EAA8E;QAC9E,+EAA+E;QAC/E,sEAAsE;QACtE,EAAE;QACF,2EAA2E;QAC3E,iFAAiF;QACjF,IACE,CAAC,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC;YAC/B,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC;YAC9B,IAAI,CAAC,MAAM,IAAI,CAAC,EAChB,CAAC;YACD,0EAA0E;YAC1E,2EAA2E;YAC3E,4EAA4E;YAC5E,4EAA4E;YAC5E,4CAA4C;YAC5C,IAAI,IAAmD,CAAC;YACxD,KAAK,MAAM,OAAO,IAAI,gBAAgB,EAAE,CAAC;gBACvC,IAAI,IAAI,KAAK,OAAO;oBAAE,SAAS,CAAC,2BAA2B;gBAC3D,0EAA0E;gBAC1E,2EAA2E;gBAC3E,4EAA4E;gBAC5E,6EAA6E;gBAC7E,2EAA2E;gBAC3E,4EAA4E;gBAC5E,0CAA0C;gBAC1C,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;oBAAE,SAAS;gBACjC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC;oBAAE,SAAS,CAAC,aAAa;gBAEvE,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBACxC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBACzD,IAAI,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;oBACzB,MAAM,CAAC,gEAAgE;gBACzE,CAAC;YACH,CAAC;YAED,IAAI,IAAI,EAAE,CAAC;gBACT,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,uBAAuB;oBAC7B,yEAAyE;oBACzE,0EAA0E;oBAC1E,WAAW,EAAE,eAAe,IAAI,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,uCAAuC,IAAI,CAAC,OAAO,wBAAwB;oBAClI,QAAQ,EAAE,MAAM;oBAChB,IAAI,EAAE,YAAY;oBAClB,UAAU,EAAE,IAAI;oBAChB,QAAQ,EAAE,cAAc;oBACxB,cAAc,EAAE,iBAAiB,IAAI,CAAC,OAAO,mEAAmE;iBACjH,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,yDAAyD;QACzD,EAAE;QACF,6EAA6E;QAC7E,+EAA+E;QAC/E,6EAA6E;QAC7E,yEAAyE;QACzE,6EAA6E;QAC7E,8EAA8E;QAC9E,iDAAiD;QACjD,EAAE;QACF,0EAA0E;QAC1E,2EAA2E;QAC3E,6EAA6E;QAC7E,6EAA6E;QAC7E,0EAA0E;QAC1E,kCAAkC;QAClC,EAAE;QACF,wEAAwE;QACxE,+CAA+C;QAC/C,MAAM,YAAY,GAChB,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAErF,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;gBAC5B,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC;gBAC7B,IAAI,IAAI,KAAK,SAAS;oBAAE,SAAS;gBACjC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC;oBAAE,SAAS;gBAChE,uEAAuE;gBACvE,+DAA+D;gBAC/D,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;oBAAE,SAAS;gBACnC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC;oBAAE,SAAS;gBAE3D,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;gBAC1C,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;oBAC1B,MAAM,OAAO,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACnD,IAAI,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC;wBAAE,MAAM;oBACtC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;oBAE3B,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,kCAAkC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;oBACtF,QAAQ,CAAC,IAAI,CAAC;wBACZ,IAAI,EAAE,0BAA0B;wBAChC,oEAAoE;wBACpE,yCAAyC;wBACzC,WAAW,EAAE,iBAAiB,IAAI,IAAI,GAAG,SAAS,SAAS,IAAI,QAAQ,mBAAmB,IAAI,qDAAqD;wBACnJ,QAAQ,EAAE,MAAM;wBAChB,IAAI,EAAE,YAAY;wBAClB,UAAU,EAAE,GAAG;wBACf,QAAQ,EAAE,cAAc;wBACxB,cAAc,EAAE,gBAAgB,IAAI,UAAU,SAAS,6CAA6C;qBACrG,CAAC,CAAC;oBACH,MAAM;gBACR,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/install-guard.d.ts

@@ -11,7 +11,9 @@
  * No network calls are made by this module.
  */
 import { type FeedIOC } from "./threat-intel.js";
+import { resolveNpmAlias } from "./dependency-risk-analyzer.js";
 import type { Finding } from "./types.js";
+export { resolveNpmAlias };
 export declare const SUPPORTED_MANAGERS: readonly ["npm", "pnpm", "yarn", "bun"];
 export type PackageManager = (typeof SUPPORTED_MANAGERS)[number];
 /**
@@ -50,7 +52,12 @@ export declare function extractInstallSpecs(manager: PackageManager, args: strin
 };
 export interface InstallGuardVerdict {
     spec: InstallPackageSpec;
+    /** Every finding, blocking or not. Nothing is dropped. */
     findings: Finding[];
+    /** Findings that carry blocking authority */
+    blocking: Finding[];
+    /** Heuristic findings that are reported but do not block */
+    warnings: Finding[];
 }
 export interface InstallCommandAnalysis {
     manager: PackageManager;
@@ -61,8 +68,10 @@ export interface InstallCommandAnalysis {
     specs: InstallPackageSpec[];
     /** One verdict per spec; findings empty = clean */
     verdicts: InstallGuardVerdict[];
-    /** True when at least one spec has findings */
+    /** True when at least one spec has a BLOCKING finding */
     blocked: boolean;
+    /** True when at least one spec has a warn-only finding */
+    warned: boolean;
 }
 /**
  * npm package IOCs in the feed carry no ecosystem prefix (only ruby:/composer:/

package/dist/install-guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"install-guard.d.ts","sourceRoot":"","sources":["../src/install-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EAAoC,KAAK,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAGnF,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAM1C,eAAO,MAAM,kBAAkB,YAAI,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAU,CAAC;AAC1E,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC;AAmCjE;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,cAAc,EACvB,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,MAAM,CAER;AAMD,MAAM,WAAW,kBAAkB;IACjC,iDAAiD;IACjD,GAAG,EAAE,MAAM,CAAC;IACZ,6CAA6C;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,qFAAqF;IACrF,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AASD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,kBAAkB,GAAG,IAAI,CAevE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,cAAc,EACvB,IAAI,EAAE,MAAM,EAAE,GACb;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,kBAAkB,EAAE,CAAA;CAAE,CAoCtE;AAMD,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,kBAAkB,CAAC;IACzB,QAAQ,EAAE,OAAO,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,cAAc,CAAC;IACxB,2EAA2E;IAC3E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iEAAiE;IACjE,WAAW,EAAE,OAAO,CAAC;IACrB,KAAK,EAAE,kBAAkB,EAAE,CAAC;IAC5B,mDAAmD;IACnD,QAAQ,EAAE,mBAAmB,EAAE,CAAC;IAChC,+CAA+C;IAC/C,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,IAAI,EAAE,OAAO,EAAE,GACd,OAAO,GAAG,IAAI,CAehB;AAwCD;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,CAAC,EAAE,OAAO,EAAE,GACf,sBAAsB,CAkBxB;AAMD,8EAA8E;AAC9E,MAAM,MAAM,SAAS,GAAG,CACtB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,EAAE;IAAE,KAAK,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,KAAK,CAAA;CAAE,KACxC;IAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,KAAK,CAAC,EAAE,KAAK,CAAA;CAAE,CAAC;AAK9C;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAI7D;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAIrD;AA0BD,MAAM,WAAW,mBAAmB;IAClC,+CAA+C;IAC/C,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,oDAAoD;IACpD,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,4DAA4D;IAC5D,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC;IACjB,wEAAwE;IACxE,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,qDAAqD;IACrD,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9B;AAkBD;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EAAE,EACrB,OAAO,GAAE,mBAAwB,GAChC,MAAM,CA8BR"}
+{"version":3,"file":"install-guard.d.ts","sourceRoot":"","sources":["../src/install-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EAAoC,KAAK,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAEnF,OAAO,EAA0B,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACxF,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAI1C,OAAO,EAAE,eAAe,EAAE,CAAC;AAM3B,eAAO,MAAM,kBAAkB,YAAI,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAU,CAAC;AAC1E,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC;AAmCjE;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,cAAc,EACvB,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,MAAM,CAER;AAMD,MAAM,WAAW,kBAAkB;IACjC,iDAAiD;IACjD,GAAG,EAAE,MAAM,CAAC;IACZ,6CAA6C;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,qFAAqF;IACrF,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AASD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,kBAAkB,GAAG,IAAI,CAgCvE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,cAAc,EACvB,IAAI,EAAE,MAAM,EAAE,GACb;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,kBAAkB,EAAE,CAAA;CAAE,CAoCtE;AA6BD,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,kBAAkB,CAAC;IACzB,0DAA0D;IAC1D,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,6CAA6C;IAC7C,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,4DAA4D;IAC5D,QAAQ,EAAE,OAAO,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,cAAc,CAAC;IACxB,2EAA2E;IAC3E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iEAAiE;IACjE,WAAW,EAAE,OAAO,CAAC;IACrB,KAAK,EAAE,kBAAkB,EAAE,CAAC;IAC5B,mDAAmD;IACnD,QAAQ,EAAE,mBAAmB,EAAE,CAAC;IAChC,yDAAyD;IACzD,OAAO,EAAE,OAAO,CAAC;IACjB,0DAA0D;IAC1D,MAAM,EAAE,OAAO,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,IAAI,EAAE,OAAO,EAAE,GACd,OAAO,GAAG,IAAI,CAehB;AAwCD;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,CAAC,EAAE,OAAO,EAAE,GACf,sBAAsB,CA2BxB;AAMD,8EAA8E;AAC9E,MAAM,MAAM,SAAS,GAAG,CACtB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,EAAE;IAAE,KAAK,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,KAAK,CAAA;CAAE,KACxC;IAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,KAAK,CAAC,EAAE,KAAK,CAAA;CAAE,CAAC;AAK9C;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAI7D;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAIrD;AA0BD,MAAM,WAAW,mBAAmB;IAClC,+CAA+C;IAC/C,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,oDAAoD;IACpD,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,4DAA4D;IAC5D,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC;IACjB,wEAAwE;IACxE,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,qDAAqD;IACrD,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9B;AA2BD;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EAAE,EACrB,OAAO,GAAE,mBAAwB,GAChC,MAAM,CAyCR"}

package/dist/install-guard.js

@@ -12,7 +12,7 @@
  * No network calls are made by this module.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SUPPORTED_MANAGERS = void 0;
+exports.SUPPORTED_MANAGERS = exports.resolveNpmAlias = void 0;
 exports.resolveManagerBinary = resolveManagerBinary;
 exports.parseSpecToken = parseSpecToken;
 exports.extractInstallSpecs = extractInstallSpecs;
@@ -25,6 +25,7 @@ const node_child_process_1 = require("node:child_process");
 const threat_intel_js_1 = require("./threat-intel.js");
 const ioc_blocklist_js_1 = require("./ioc-blocklist.js");
 const dependency_risk_analyzer_js_1 = require("./dependency-risk-analyzer.js");
+Object.defineProperty(exports, "resolveNpmAlias", { enumerable: true, get: function () { return dependency_risk_analyzer_js_1.resolveNpmAlias; } });
 // ---------------------------------------------------------------------------
 // Managers and install verbs
 // ---------------------------------------------------------------------------
@@ -79,6 +80,24 @@ const REGISTRY_NAME_RE = /^(@[a-z0-9][a-z0-9-._~]*\/)?[a-z0-9-._~][a-z0-9-._~]*$
 function parseSpecToken(token) {
     if (token.length === 0 || token.startsWith("-"))
         return null;
+    // Alias form FIRST: "utils@npm:chalk-tempalte@1.0.0". This must be detected
+    // before the version split, because lastIndexOf("@") would land on the alias
+    // target's own version and leave an unparseable name. Previously that made the
+    // whole spec fail REGISTRY_NAME_RE and get dropped, so `npm install
+    // x@npm:<malware>` was never checked at all - a complete bypass of the guard.
+    // The installed package is the alias TARGET, so resolve and check that.
+    const aliasAt = token.indexOf("@npm:");
+    if (aliasAt > 0) {
+        const label = token.substring(0, aliasAt);
+        if (!REGISTRY_NAME_RE.test(label))
+            return null;
+        const alias = (0, dependency_risk_analyzer_js_1.resolveNpmAlias)(token.substring(aliasAt + 1));
+        if (!alias)
+            return null;
+        return alias.version === undefined
+            ? { raw: token, name: alias.name }
+            : { raw: token, name: alias.name, version: alias.version };
+    }
     // Split "name@version" / "@scope/name@version" at the LAST "@";
     // index 0 is the scope marker, not a version separator.
     const at = token.lastIndexOf("@");
@@ -86,8 +105,8 @@ function parseSpecToken(token) {
     const version = at > 0 ? token.substring(at + 1) : undefined;
     if (!REGISTRY_NAME_RE.test(name))
         return null;
-    // Protocol versions ("foo@npm:bar@1.0.0" aliases, "foo@git:...") are not
-    // plain registry pins; skip rather than mis-attribute a version.
+    // Other protocol versions ("foo@git:...") are not plain registry pins; skip
+    // rather than mis-attribute a version.
     if (version !== undefined && (version.length === 0 || version.includes(":")))
         return null;
     return version === undefined ? { raw: token, name } : { raw: token, name, version };
@@ -148,6 +167,31 @@ function extractInstallSpecs(manager, args) {
     }
     return { verb, installVerb: true, specs };
 }
+// ---------------------------------------------------------------------------
+// Offline analysis
+// ---------------------------------------------------------------------------
+/**
+ * Rules that are REPORTED but never block an install.
+ *
+ * A deny-list, not an allow-list, on purpose: a new exact-match rule added to
+ * checkSpec keeps blocking authority automatically, and only a rule someone
+ * deliberately lists here loses it. Given that a false negative silently lowers
+ * the bar everywhere this runs, the safe default has to be "blocks".
+ *
+ * Only DEP_INTERNAL_NAME_PUBLIC is demoted. It fires on the NAME SHAPE of a
+ * scoped package (any @scope/*-utils, -api, -core, -service, -shared, -common,
+ * -lib), which matched 1.7% of all real scoped packages in a registry sweep -
+ * including @babel/helper-plugin-utils, @vue/compiler-core and
+ * @tanstack/query-core - and blocked every one of them at critical.
+ *
+ * TYPOSQUAT_LEVENSHTEIN is deliberately NOT demoted, even though it is also a
+ * heuristic. checkSpec never consults src/patterns.ts, so for curated squats
+ * whose target is popular (lodahs, crossenv, cros-env, 1odash, l0dash, expresss,
+ * nodemai1er, reqeust, axois, raect) this rule is the guard's ONLY view of them:
+ * demoting it was measured to lose 10 real blocks. Wiring the curated names into
+ * checkSpec is the prerequisite for ever revisiting that.
+ */
+const WARN_ONLY_RULES = new Set(["DEP_INTERNAL_NAME_PUBLIC"]);
 /**
  * npm package IOCs in the feed carry no ecosystem prefix (only ruby:/composer:/
  * nuget:/go:/jenkins: entries do - see matchPackageIOC). Same companion
@@ -214,12 +258,21 @@ function analyzeInstallCommand(manager, args, feed) {
     }
     const { verb, installVerb, specs } = extractInstallSpecs(manager, args);
     if (!installVerb || specs.length === 0) {
-        return { manager, verb, installVerb, specs, verdicts: [], blocked: false };
+        return { manager, verb, installVerb, specs, verdicts: [], blocked: false, warned: false };
     }
     const entries = feed ?? (0, threat_intel_js_1.loadThreatIntel)();
-    const verdicts = specs.map((spec) => ({ spec, findings: checkSpec(spec, entries) }));
-    const blocked = verdicts.some((v) => v.findings.length > 0);
-    return { manager, verb, installVerb, specs, verdicts, blocked };
+    const verdicts = specs.map((spec) => {
+        const findings = checkSpec(spec, entries);
+        return {
+            spec,
+            findings,
+            blocking: findings.filter((f) => !WARN_ONLY_RULES.has(f.rule)),
+            warnings: findings.filter((f) => WARN_ONLY_RULES.has(f.rule)),
+        };
+    });
+    const blocked = verdicts.some((v) => v.blocking.length > 0);
+    const warned = verdicts.some((v) => v.warnings.length > 0);
+    return { manager, verb, installVerb, specs, verdicts, blocked, warned };
 }
 // cmd.exe metacharacters that must be ^-escaped (cross-spawn's meta set).
 const CMD_META_RE = /([()\][%!^"`<>&|;, *?])/g;
@@ -266,15 +319,20 @@ const defaultSpawn = (command, args, options) => {
     const result = (0, node_child_process_1.spawnSync)(command, args, options);
     return { status: result.status, error: result.error };
 };
-function printVerdicts(analysis, log) {
-    const hits = analysis.verdicts.filter((v) => v.findings.length > 0);
-    const total = hits.reduce((n, v) => n + v.findings.length, 0);
+function printVerdicts(analysis, log, kind = "blocking") {
+    const hits = analysis.verdicts.filter((v) => v[kind].length > 0);
+    if (hits.length === 0)
+        return;
+    const total = hits.reduce((n, v) => n + v[kind].length, 0);
+    const label = kind === "blocking"
+        ? `${total} finding(s)`
+        : `${total} warning(s) (reported, not blocking)`;
     log("");
-    log(`  Install guard: ${total} finding(s) in "${analysis.manager} ${analysis.verb}" command:`);
+    log(`  Install guard: ${label} in "${analysis.manager} ${analysis.verb}" command:`);
     for (const verdict of hits) {
         log("");
         log(`  Package: ${verdict.spec.raw}`);
-        for (const finding of verdict.findings) {
+        for (const finding of verdict[kind]) {
             log(`    [${finding.severity.toUpperCase()}] ${finding.rule}: ${finding.description}`);
             log(`    ${finding.recommendation}`);
         }
@@ -296,7 +354,9 @@ function runInstallGuard(manager, managerArgs, options = {}) {
     const log = options.log ?? ((line) => console.log(line));
     const analysis = analyzeInstallCommand(manager, managerArgs, options.feed);
     if (analysis.blocked) {
-        printVerdicts(analysis, log);
+        printVerdicts(analysis, log, "blocking");
+        // Warn-only findings on a blocked command are still worth showing.
+        printVerdicts(analysis, log, "warnings");
         if (options.dryRun) {
             log("  Dry run: package manager not invoked.");
             return 2;
@@ -307,6 +367,16 @@ function runInstallGuard(manager, managerArgs, options = {}) {
         }
         log("  WARNING: --force is set - proceeding DESPITE the findings above. The packages listed are known-bad or suspicious.");
     }
+    else if (analysis.warned) {
+        // Heuristic-only findings: report in full, then let the install proceed.
+        // These used to exit 2, which made a name-shape guess as authoritative as a
+        // threat-feed malware match.
+        printVerdicts(analysis, log, "warnings");
+        if (options.dryRun) {
+            log("  Dry run: nothing known-bad, warnings above are advisory only.");
+            return 0;
+        }
+    }
     else if (options.dryRun) {
         log(`  Install guard: no known-bad packages in "${[analysis.manager, ...managerArgs].join(" ")}" (dry run, nothing executed).`);
         return 0;