supply-chain-guard 5.25.4 → 5.25.5

package/README.md

@@ -131,7 +131,7 @@ Run the scanner as a [pre-commit](https://pre-commit.com) hook (Python-ecosystem
 ```yaml
 repos:
   - repo: https://github.com/homeofe/supply-chain-guard
-    rev: v5.25.4
+    rev: v5.25.5
     hooks:
       - id: supply-chain-guard
 ```

package/action.yml

@@ -66,7 +66,7 @@ runs:
 
     - name: Install supply-chain-guard
       shell: bash
-      run: npm install -g supply-chain-guard@5.25.4 --ignore-scripts --no-audit --no-fund
+      run: npm install -g supply-chain-guard@5.25.5 --ignore-scripts --no-audit --no-fund
 
     - name: Run scan
       id: scan
@@ -417,10 +417,17 @@ runs:
           // Treat every scanner-rendered line as inert code. Even the Markdown
           // formatter contains package-controlled text, which must not create
           // links, images, headings, mentions, or other active PR content.
+          // Guard on the SOURCE, not the indented result. Indenting an empty
+          // report yields '    ', which is truthy, so every `if (reportForComment)`
+          // below would fire and the clean-scan fallback would be unreachable -
+          // a run that recovered to clean would replace a stale warning comment
+          // with a blank indented line instead of saying so.
           let reportForComment = escapedReport
-            .split(/\r?\n/)
-            .map((line) => `    ${line}`)
-            .join('\n');
+            ? escapedReport
+                .split(/\r?\n/)
+                .map((line) => `    ${line}`)
+                .join('\n')
+            : '';
           if (reportReadTruncated && reportForComment) {
             reportForComment += '\n\n> Report excerpt truncated before comment construction.';
           }

package/dist/cli.js

@@ -187,7 +187,7 @@ function assertDistinctOutputPaths(options) {
 program
     .name("supply-chain-guard")
     .description("Open-source supply-chain security scanner. Detects GlassWorm and similar malware campaigns in npm packages, PyPI packages, code repos, VS Code extensions, and project dependencies.")
-    .version("5.25.4");
+    .version("5.25.5");
 // ── scan command ────────────────────────────────────────────────────
 program
     .command("scan")

package/dist/dependency-confusion.js

@@ -49,7 +49,7 @@ const path = __importStar(require("node:path"));
 const https = __importStar(require("node:https"));
 const types_js_1 = require("./types.js");
 const pattern_scanner_js_1 = require("./pattern-scanner.js");
-const TOOL_VERSION = "5.25.4";
+const TOOL_VERSION = "5.25.5";
 const NPM_REGISTRY = "https://registry.npmjs.org";
 const NPM_DOWNLOADS_API = "https://api.npmjs.org/downloads/point/last-week";
 const PYPI_REGISTRY = "https://pypi.org/pypi";

package/dist/npm-scanner.js

@@ -61,7 +61,7 @@ const extracted_file_walker_js_1 = require("./extracted-file-walker.js");
 const threat_intel_js_1 = require("./threat-intel.js");
 const install_guard_js_1 = require("./install-guard.js");
 const remote_download_js_1 = require("./remote-download.js");
-const TOOL_VERSION = "5.25.4";
+const TOOL_VERSION = "5.25.5";
 const NPM_REGISTRY = "https://registry.npmjs.org";
 const NPM_REGISTRY_HOST = "registry.npmjs.org";
 const RAW_GITHUB_HOST = "raw.githubusercontent.com";

package/dist/pypi-scanner.js

@@ -56,7 +56,7 @@ const patterns_js_1 = require("./patterns.js");
 const pattern_scanner_js_1 = require("./pattern-scanner.js");
 const extracted_file_walker_js_1 = require("./extracted-file-walker.js");
 const remote_download_js_1 = require("./remote-download.js");
-const TOOL_VERSION = "5.25.4";
+const TOOL_VERSION = "5.25.5";
 const PYPI_API = "https://pypi.org/pypi";
 const PYPI_METADATA_HOST = "pypi.org";
 const PYPI_ARTIFACT_HOST = "files.pythonhosted.org";

package/dist/reporter.js

@@ -111,7 +111,7 @@ function formatJson(report) {
 function formatText(report) {
     const lines = [];
     // ── layout constants ───────────────────────────────────────────────────────
-    const VERSION = "5.25.4";
+    const VERSION = "5.25.5";
     const W = 76; // visible chars between "│ " and " │" (total line = 80)
     // ── ANSI helpers ───────────────────────────────────────────────────────────
     const stripAnsi = (s) => s.replace(/\x1b\[[0-9;]*m/g, "");
@@ -564,7 +564,7 @@ function formatSarif(report) {
                 tool: {
                     driver: {
                         name: "supply-chain-guard",
-                        version: "5.25.4",
+                        version: "5.25.5",
                         informationUri: "https://github.com/homeofe/supply-chain-guard",
                         rules,
                     },
@@ -654,7 +654,7 @@ function formatSbom(report) {
             timestamp: report.timestamp,
             tools: {
                 components: [
-                    { type: "application", name: "supply-chain-guard", version: "5.25.4" },
+                    { type: "application", name: "supply-chain-guard", version: "5.25.5" },
                 ],
             },
             component: {
@@ -777,7 +777,7 @@ function formatGitlab(report) {
         name: "supply-chain-guard",
         url: "https://github.com/homeofe/supply-chain-guard",
         vendor: { name: "supply-chain-guard" },
-        version: "5.25.4",
+        version: "5.25.5",
     };
     const vulnerabilities = report.findings
         .filter((f) => !f.suppressed)
@@ -1019,7 +1019,7 @@ footer{text-align:center;padding:24px;color:#94a3b8;font-size:13px}
   ` : ""}
 
   <footer>
-    Generated by <a href="https://github.com/homeofe/supply-chain-guard">supply-chain-guard</a> v5.25.4
+    Generated by <a href="https://github.com/homeofe/supply-chain-guard">supply-chain-guard</a> v5.25.5
   </footer>
 </div>
 <script>

package/dist/sbom-generator.js

@@ -45,7 +45,7 @@ exports.generateSbomDocument = generateSbomDocument;
 const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
 const node_crypto_1 = require("node:crypto");
-const TOOL_VERSION = "5.25.4";
+const TOOL_VERSION = "5.25.5";
 /**
  * Build a Package URL (purl) for an npm package.
  */

package/dist/scanner.js

@@ -95,7 +95,7 @@ const slsa_verifier_js_1 = require("./slsa-verifier.js");
 const dependency_confusion_js_1 = require("./dependency-confusion.js");
 const mcp_scanner_js_1 = require("./mcp-scanner.js");
 const skills_scanner_js_1 = require("./skills-scanner.js");
-const TOOL_VERSION = "5.25.4";
+const TOOL_VERSION = "5.25.5";
 /**
  * Exact files that contain this package's own inert detector definitions or
  * regression fixtures.

package/dist/vscode-scanner.js

@@ -55,7 +55,7 @@ const patterns_js_1 = require("./patterns.js");
 const pattern_scanner_js_1 = require("./pattern-scanner.js");
 const extracted_file_walker_js_1 = require("./extracted-file-walker.js");
 const remote_download_js_1 = require("./remote-download.js");
-const TOOL_VERSION = "5.25.4";
+const TOOL_VERSION = "5.25.5";
 /** Public and testable acquisition bounds for extension registry data. */
 exports.VSCODE_REMOTE_LIMITS = Object.freeze({
     metadataBytes: 2 * 1024 * 1024,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "supply-chain-guard",
-  "version": "5.25.4",
+  "version": "5.25.5",
   "mcpName": "io.github.homeofe/supply-chain-guard",
   "description": "Open-source supply-chain security scanner for npm, PyPI, Cargo, Go, RubyGems, Composer, NuGet, Docker, VS Code extensions, GitHub Actions, IaC and Solana C2. Detects GlassWorm, Shai-Hulud, PPE attacks, dependency confusion and 350+ threat indicators across all major lockfile formats (npm, pnpm, yarn, bun). Generates CycloneDX 1.6 SBOMs, grades SLSA provenance (in-toto/DSSE structural validation), and correlates findings into attack-chain incidents.",
   "main": "dist/index.js",
@@ -15,8 +15,8 @@
     "test:watch": "vitest",
     "lint": "tsc --noEmit",
     "check:aahp": "npx --no-install aahp check .",
-    "check:handoff": "node scripts/aahp-dashboard.mjs --check",
-    "handoff:refresh": "node scripts/aahp-dashboard.mjs",
+    "check:handoff": "node scripts/scg-handoff-docs.mjs --check",
+    "handoff:refresh": "node scripts/scg-handoff-docs.mjs",
     "feed:generate": "node scripts/generate-feed.mjs",
     "feed:import": "node scripts/import-threat-feed.mjs",
     "check:feed": "node scripts/generate-feed.mjs --check",
@@ -72,7 +72,7 @@
   },
   "devDependencies": {
     "@babel/parser": "^7.29.7",
-    "@elvatis_com/aahp": "3.9.1",
+    "@elvatis_com/aahp": "3.9.2",
     "@types/node": "^26.1.2",
     "@vitest/coverage-v8": "^4.1.10",
     "typescript": "^7.0.2",