supply-chain-guard 5.26.7 → 5.28.0

package/README.md

@@ -1,10 +1,10 @@
 # supply-chain-guard
 
-Open-source supply-chain security scanner for npm, PyPI, Cargo, Go, RubyGems, Composer, NuGet, Docker, Terraform, VS Code extensions, GitHub Actions and GitHub repositories. Detects malware campaigns (GlassWorm, Vidar, Shai-Hulud), fake AI tool repos, account takeovers, and 350+ threat indicators across all major lockfile formats (npm, pnpm, yarn, bun). Generates CycloneDX 1.6 SBOMs with real dependency inventories, grades SLSA provenance (parses and structurally validates in-toto/DSSE attestations), and correlates findings into attack-chain incidents.
+Open-source supply-chain security scanner for npm, PyPI, Cargo, Go, RubyGems, Composer, NuGet, Docker, Terraform, VS Code extensions, GitHub Actions and GitHub repositories. Detects malware campaigns (GlassWorm, Vidar, Shai-Hulud), fake AI tool repos, account takeovers, and 350+ threat indicators across all major lockfile formats (npm, pnpm, yarn, bun). Generates CycloneDX 1.6 SBOMs with real dependency inventories, grades SLSA provenance (parses and structurally validates in-toto/DSSE attestations), and correlates findings into attack-chain incidents. Supports EU Cyber Resilience Act SBOM and component-documentation work, and NIS2 supply chain risk-management measures.
 
 [![npm version](https://img.shields.io/npm/v/supply-chain-guard?logo=npm)](https://www.npmjs.com/package/supply-chain-guard)
 [![npm downloads](https://img.shields.io/npm/dw/supply-chain-guard?logo=npm&label=weekly%20downloads)](https://www.npmjs.com/package/supply-chain-guard)
-[![Node.js](https://img.shields.io/badge/Node.js-%3E%3D20-green?logo=node.js)](https://nodejs.org)
+[![Node.js](https://img.shields.io/badge/Node.js-%3E%3D22-green?logo=node.js)](https://nodejs.org)
 [![TypeScript](https://img.shields.io/badge/TypeScript-Strict-blue?logo=typescript)](https://www.typescriptlang.org/)
 [![CI](https://img.shields.io/github/actions/workflow/status/homeofe/supply-chain-guard/ci.yml?branch=main&label=CI&logo=github)](https://github.com/homeofe/supply-chain-guard/actions/workflows/ci.yml)
 [![AAHP Verify](https://github.com/homeofe/supply-chain-guard/actions/workflows/aahp-verify.yml/badge.svg)](https://github.com/homeofe/supply-chain-guard/actions/workflows/aahp-verify.yml)
@@ -36,8 +36,11 @@ Open-source supply-chain security scanner for npm, PyPI, Cargo, Go, RubyGems, Co
 - [Install Guard](#install-guard)
 - [Adding Custom Patterns](#adding-custom-patterns)
 - [Architecture](#architecture)
+- [EU Compliance (CRA / NIS2)](#eu-compliance-cra--nis2)
+- [Show that you scan](#show-that-you-scan)
 - [Contributing](#contributing)
 - [Changelog](#changelog)
+- [License](#license)
 
 ## Background
 
@@ -114,6 +117,12 @@ Links individual findings into incident-level attack chains:
 
 ## Installation
 
+**Requires Node.js 22 or newer.** Node 20 reached end of life on
+2026-04-30; it still installs and is still covered by CI as a transition lane, but it
+is out of support and that lane is removed in 5.29.0. Full policy, including what the
+package is published from and what the Action and container image run on:
+[`docs/node-support.md`](docs/node-support.md).
+
 ```bash
 npm install -g supply-chain-guard
 ```
@@ -131,7 +140,7 @@ Run the scanner as a [pre-commit](https://pre-commit.com) hook (Python-ecosystem
 ```yaml
 repos:
   - repo: https://github.com/homeofe/supply-chain-guard
-    rev: v5.26.7
+    rev: v5.28.0
     hooks:
       - id: supply-chain-guard
 ```
@@ -147,7 +156,7 @@ The hook scans the repository root on every commit and fails on high or critical
 Run the scanner without a Node toolchain via the official multi-arch image (linux/amd64, linux/arm64), published to GHCR on every release tag:
 
 ```bash
-docker run --rm -v ${PWD}:/scan ghcr.io/homeofe/supply-chain-guard scan /scan
+docker run --rm -v ${PWD}:/scan ghcr.io/homeofe/supply-chain-guard:5.28.0 scan /scan
 ```
 
 `${PWD}` works in bash, zsh, and PowerShell; in cmd.exe use `%cd%` instead.
@@ -586,8 +595,70 @@ Honest caveats: Socket's registry-wide behavioral detection is deeper than anyth
 - **CI one-two punch**: run `osv-scanner --lockfile=package-lock.json` for known CVEs and MAL- entries, then `supply-chain-guard scan .` for behavioral and campaign-IOC threats in the installed tree. Two axes, one job, both exit-code gated.
 - **Zero-install npm baseline**: `npm audit --audit-level=high` plus `npx supply-chain-guard scan .` covers advisory-known vulnerabilities and unreported malware without adding a single dependency.
 - **Pre-install vetting of a suspicious package**: `guarddog npm scan <pkg>` for an independent heuristic score, plus `supply-chain-guard npm <pkg>` for campaign-IOC and install-hook analysis, before it ever touches your machine.
+## EU Compliance (CRA / NIS2)
+
+supply-chain-guard produces artefacts and findings that **support** compliance
+work under two EU regulations that apply to software manufacturers. It does not
+make an organisation compliant: compliance remains the responsibility of the
+organisation deploying the software, and the mapping below describes what the
+tool produces, not a legal assessment.
+
+### Cyber Resilience Act (CRA)
+
+The CRA requires manufacturers of products with digital elements to identify and
+document the components they ship, to address vulnerabilities in those
+components, and to be able to reason about the integrity of what they build on.
+supply-chain-guard contributes to each of those activities:
+
+- **Component inventory:** generates a [CycloneDX 1.6](https://cyclonedx.org/)
+  SBOM from the real resolved dependency tree, as a machine-readable component
+  list you can attach to technical documentation.
+- **Dependency risk:** detects known-malicious packages and versions,
+  typosquatting, dependency confusion, and compromised publisher activity, at
+  scan time and at install time.
+- **Supply chain integrity:** grades SLSA provenance from levels 0 to 3 by
+  parsing and structurally validating in-toto/DSSE attestations, giving a
+  recorded integrity signal per project.
+
+```bash
+# Write a CycloneDX 1.6 SBOM alongside the scan report
+supply-chain-guard scan ./project --sbom-output sbom.json
+```
+
+Article and paragraph citations are deliberately omitted here. Map these outputs
+to specific provisions against the final published regulation text, with your own
+legal review, rather than against this README.
+
+### NIS2 Directive
+
+NIS2 requires essential and important entities to take measures covering supply
+chain security. The relevant capabilities are:
+
+- **Supply chain risk:** typosquatting, dependency confusion, compromised
+  packages, and malicious GitHub Actions in CI/CD workflows.
+- **Incident evidence:** the correlation engine links individual findings into
+  named attack chains with confidence scores, and reports are exportable as
+  SARIF, JSON, and CycloneDX for retention alongside an incident record.
+- **Configuration exposure:** IaC, Dockerfile, and `.npmrc` / `.yarnrc` scanning
+  surfaces misconfiguration before deployment.
+
+### Operating model
+
+Apache-2.0, no account required, and no telemetry: the scanner reports only to
+its own output. `scan` runs fully offline against the bundled threat feed, so it
+is suitable for air-gapped use. The commands that deliberately reach the network
+are the ones that exist to do so: `supply-chain-guard npm <pkg>` and
+`supply-chain-guard pypi <pkg>` fetch the package under inspection, and the feed
+refresh fetches updated indicators. Offline runs use the feed bundled with the
+installed version, so pin the version you intend to audit against.
+
 ## GitHub Action
 
+**Pin an exact version.** That is the recommended form, and it is the same advice
+this tool gives about your own dependencies: a security scanner should be a
+deterministic input, so you know which detection logic and which IOC feed ran, and
+an upgrade is a reviewable change rather than something that happens to you.
+
 ```yaml
 name: Supply Chain Security
 on: [push, pull_request]
@@ -601,12 +672,37 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: homeofe/supply-chain-guard@v5
+      - uses: homeofe/supply-chain-guard@v5.28.0
         with:
           fail-on: critical
           comment-on-pr: true
 ```
 
+Let Dependabot keep the pin current:
+
+```yaml
+# .github/dependabot.yml
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+```
+
+### `@v5`, and what it does and does not guarantee
+
+`@v5` also works and stays supported. It is a floating **branch**, fast-forwarded
+to each release by CI, and the composite action on it pins an exact npm version
+that is bumped and build-gated on every release. So `@v5` is not `latest`: every
+resolution still installs one exact, release-gated version.
+
+The caveat is what happens after a major. If the v5 line stops being released once
+v6 ships, `@v5` keeps resolving a frozen action that pins an old npm version, and
+the IOC feed it installs stops updating. For a scanner that is a silent
+false-negative generator, and nothing in your workflow would report it. An exact
+pin turns that into a visible out-of-date dependency instead.
+
 ### Action Inputs
 
 | Input | Description | Default |

package/action.yml

@@ -66,7 +66,7 @@ runs:
 
     - name: Install supply-chain-guard
       shell: bash
-      run: npm install -g supply-chain-guard@5.26.7 --ignore-scripts --no-audit --no-fund
+      run: npm install -g supply-chain-guard@5.28.0 --ignore-scripts --no-audit --no-fund
 
     - name: Run scan
       id: scan

package/dist/cli.js

@@ -187,7 +187,7 @@ function assertDistinctOutputPaths(options) {
 program
     .name("supply-chain-guard")
     .description("Open-source supply-chain security scanner. Detects GlassWorm and similar malware campaigns in npm packages, PyPI packages, code repos, VS Code extensions, and project dependencies.")
-    .version("5.26.7");
+    .version("5.28.0");
 // ── scan command ────────────────────────────────────────────────────
 program
     .command("scan")

package/dist/dependency-confusion.js

@@ -49,7 +49,7 @@ const path = __importStar(require("node:path"));
 const https = __importStar(require("node:https"));
 const types_js_1 = require("./types.js");
 const pattern_scanner_js_1 = require("./pattern-scanner.js");
-const TOOL_VERSION = "5.26.7";
+const TOOL_VERSION = "5.28.0";
 const NPM_REGISTRY = "https://registry.npmjs.org";
 const NPM_DOWNLOADS_API = "https://api.npmjs.org/downloads/point/last-week";
 const PYPI_REGISTRY = "https://pypi.org/pypi";

package/dist/install-guard.d.ts

@@ -79,6 +79,14 @@ export interface InstallCommandAnalysis {
  * matcher as mcp-server.ts matchBarePackageIOC.
  */
 export declare function matchBareNpmIOC(name: string, version: string | undefined, feed: FeedIOC[]): FeedIOC | null;
+/**
+ * Reference implementation, kept so the index has something to be proved
+ * against. install-guard.test.ts asserts the two agree across the WHOLE bundled
+ * feed; without that, an index bug becomes a silent false negative in the most
+ * security-critical matcher in the project. Same arrangement as
+ * matchPackageIOCLinear in threat-intel.ts.
+ */
+export declare function matchBareNpmIOCLinear(name: string, version: string | undefined, feed: FeedIOC[]): FeedIOC | null;
 /**
  * Pure analysis of an install command: no spawn, no network, no filesystem
  * writes (loadThreatIntel reads the local feed cache when no feed is given).

package/dist/install-guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"install-guard.d.ts","sourceRoot":"","sources":["../src/install-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EAAoC,KAAK,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAEnF,OAAO,EAA0B,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACxF,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAI1C,OAAO,EAAE,eAAe,EAAE,CAAC;AAM3B,eAAO,MAAM,kBAAkB,YAAI,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAU,CAAC;AAC1E,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC;AAmCjE;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,cAAc,EACvB,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,MAAM,CAER;AAMD,MAAM,WAAW,kBAAkB;IACjC,iDAAiD;IACjD,GAAG,EAAE,MAAM,CAAC;IACZ,6CAA6C;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,qFAAqF;IACrF,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AASD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,kBAAkB,GAAG,IAAI,CAgCvE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,cAAc,EACvB,IAAI,EAAE,MAAM,EAAE,GACb;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,kBAAkB,EAAE,CAAA;CAAE,CAoCtE;AA6BD,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,kBAAkB,CAAC;IACzB,0DAA0D;IAC1D,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,6CAA6C;IAC7C,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,4DAA4D;IAC5D,QAAQ,EAAE,OAAO,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,cAAc,CAAC;IACxB,2EAA2E;IAC3E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iEAAiE;IACjE,WAAW,EAAE,OAAO,CAAC;IACrB,KAAK,EAAE,kBAAkB,EAAE,CAAC;IAC5B,mDAAmD;IACnD,QAAQ,EAAE,mBAAmB,EAAE,CAAC;IAChC,yDAAyD;IACzD,OAAO,EAAE,OAAO,CAAC;IACjB,0DAA0D;IAC1D,MAAM,EAAE,OAAO,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,IAAI,EAAE,OAAO,EAAE,GACd,OAAO,GAAG,IAAI,CAehB;AAwCD;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,CAAC,EAAE,OAAO,EAAE,GACf,sBAAsB,CA2BxB;AAMD,8EAA8E;AAC9E,MAAM,MAAM,SAAS,GAAG,CACtB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,EAAE;IAAE,KAAK,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,KAAK,CAAA;CAAE,KACxC;IAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,KAAK,CAAC,EAAE,KAAK,CAAA;CAAE,CAAC;AAK9C;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAI7D;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAIrD;AA0BD,MAAM,WAAW,mBAAmB;IAClC,+CAA+C;IAC/C,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,oDAAoD;IACpD,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,4DAA4D;IAC5D,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC;IACjB,wEAAwE;IACxE,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,qDAAqD;IACrD,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9B;AA2BD;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EAAE,EACrB,OAAO,GAAE,mBAAwB,GAChC,MAAM,CAyCR"}
+{"version":3,"file":"install-guard.d.ts","sourceRoot":"","sources":["../src/install-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EAAoC,KAAK,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAEnF,OAAO,EAA0B,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACxF,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAI1C,OAAO,EAAE,eAAe,EAAE,CAAC;AAM3B,eAAO,MAAM,kBAAkB,YAAI,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAU,CAAC;AAC1E,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC;AAmCjE;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,cAAc,EACvB,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,MAAM,CAER;AAMD,MAAM,WAAW,kBAAkB;IACjC,iDAAiD;IACjD,GAAG,EAAE,MAAM,CAAC;IACZ,6CAA6C;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,qFAAqF;IACrF,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AASD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,kBAAkB,GAAG,IAAI,CAgCvE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,cAAc,EACvB,IAAI,EAAE,MAAM,EAAE,GACb;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,kBAAkB,EAAE,CAAA;CAAE,CAoCtE;AA6BD,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,kBAAkB,CAAC;IACzB,0DAA0D;IAC1D,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,6CAA6C;IAC7C,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,4DAA4D;IAC5D,QAAQ,EAAE,OAAO,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,cAAc,CAAC;IACxB,2EAA2E;IAC3E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iEAAiE;IACjE,WAAW,EAAE,OAAO,CAAC;IACrB,KAAK,EAAE,kBAAkB,EAAE,CAAC;IAC5B,mDAAmD;IACnD,QAAQ,EAAE,mBAAmB,EAAE,CAAC;IAChC,yDAAyD;IACzD,OAAO,EAAE,OAAO,CAAC;IACjB,0DAA0D;IAC1D,MAAM,EAAE,OAAO,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,IAAI,EAAE,OAAO,EAAE,GACd,OAAO,GAAG,IAAI,CAWhB;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,IAAI,EAAE,OAAO,EAAE,GACd,OAAO,GAAG,IAAI,CAehB;AAmFD;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,CAAC,EAAE,OAAO,EAAE,GACf,sBAAsB,CA2BxB;AAMD,8EAA8E;AAC9E,MAAM,MAAM,SAAS,GAAG,CACtB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,EAAE;IAAE,KAAK,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,KAAK,CAAA;CAAE,KACxC;IAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,KAAK,CAAC,EAAE,KAAK,CAAA;CAAE,CAAC;AAK9C;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAI7D;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAIrD;AA0BD,MAAM,WAAW,mBAAmB;IAClC,+CAA+C;IAC/C,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,oDAAoD;IACpD,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,4DAA4D;IAC5D,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC;IACjB,wEAAwE;IACxE,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,qDAAqD;IACrD,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9B;AA2BD;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EAAE,EACrB,OAAO,GAAE,mBAAwB,GAChC,MAAM,CAyCR"}

package/dist/install-guard.js

@@ -17,6 +17,7 @@ exports.resolveManagerBinary = resolveManagerBinary;
 exports.parseSpecToken = parseSpecToken;
 exports.extractInstallSpecs = extractInstallSpecs;
 exports.matchBareNpmIOC = matchBareNpmIOC;
+exports.matchBareNpmIOCLinear = matchBareNpmIOCLinear;
 exports.analyzeInstallCommand = analyzeInstallCommand;
 exports.escapeCmdShellCommand = escapeCmdShellCommand;
 exports.escapeCmdShellArg = escapeCmdShellArg;
@@ -198,6 +199,27 @@ const WARN_ONLY_RULES = new Set(["DEP_INTERNAL_NAME_PUBLIC"]);
  * matcher as mcp-server.ts matchBarePackageIOC.
  */
 function matchBareNpmIOC(name, version, feed) {
+    // Candidates are held in original feed order, so "first match wins" is
+    // preserved exactly, identical to the linear reference below.
+    const candidates = getBareNpmIndex(feed).get(name);
+    if (!candidates)
+        return null;
+    for (const { ioc, version: iocVersion } of candidates) {
+        if (iocVersion === undefined)
+            return ioc; // bare-name IOC: any version
+        if (version !== undefined && iocVersion === version)
+            return ioc;
+    }
+    return null;
+}
+/**
+ * Reference implementation, kept so the index has something to be proved
+ * against. install-guard.test.ts asserts the two agree across the WHOLE bundled
+ * feed; without that, an index bug becomes a silent false negative in the most
+ * security-critical matcher in the project. Same arrangement as
+ * matchPackageIOCLinear in threat-intel.ts.
+ */
+function matchBareNpmIOCLinear(name, version, feed) {
     for (const ioc of feed) {
         if (ioc.type !== "package")
             continue;
@@ -216,6 +238,42 @@ function matchBareNpmIOC(name, version, feed) {
     }
     return null;
 }
+/**
+ * Lazily-built lookup index over a feed array, keyed by bare npm package name.
+ *
+ * Keyed on the feed array identity via a WeakMap, so a caller-supplied feed and
+ * the memoized shared feed each get their own index and neither leaks. Mirrors
+ * packageIndexCache in threat-intel.ts.
+ *
+ * Why this exists (T-017): the linear scan cost one full pass over the feed PER
+ * CALL, so a scan of N dependencies cost N x feed. The feed grows by 100-200
+ * entries per daily sweep, and collection-reachability.test.ts, which calls the
+ * real matcher once per entry, is quadratic in feed size - it went red on CI
+ * during the v5.25.6 release and was carrying a 30s timeout as a stopgap.
+ */
+const bareNpmIndexCache = new WeakMap();
+function getBareNpmIndex(feed) {
+    const cached = bareNpmIndexCache.get(feed);
+    if (cached)
+        return cached;
+    const index = new Map();
+    for (const ioc of feed) {
+        if (ioc.type !== "package")
+            continue;
+        if (ioc.value.includes(":"))
+            continue;
+        const at = ioc.value.lastIndexOf("@");
+        const iocName = at > 0 ? ioc.value.substring(0, at) : ioc.value;
+        const iocVersion = at > 0 ? ioc.value.substring(at + 1) : undefined;
+        const bucket = index.get(iocName);
+        if (bucket)
+            bucket.push({ ioc, version: iocVersion });
+        else
+            index.set(iocName, [{ ioc, version: iocVersion }]);
+    }
+    bareNpmIndexCache.set(feed, index);
+    return index;
+}
 function checkSpec(spec, feed) {
     const findings = [];
     // 1. Threat-intel package IOCs (bundled + refreshed .scg-cache feed).

package/dist/install-guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"install-guard.js","sourceRoot":"","sources":["../src/install-guard.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;;;;;;;;;;AAEH,2DAA+C;AAC/C,uDAAmF;AACnF,yDAAqD;AACrD,+EAAwF;gGAAvD,6CAAe;AAOhD,8EAA8E;AAC9E,6BAA6B;AAC7B,8EAA8E;AAEjE,QAAA,kBAAkB,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAU,CAAC;AAG1E;;;;;GAKG;AACH,MAAM,aAAa,GAAgD;IACjE,yEAAyE;IACzE,6EAA6E;IAC7E,2CAA2C;IAC3C,GAAG,EAAE,IAAI,GAAG,CAAC;QACX,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ;QAC7D,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS;KACrC,CAAC;IACF,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;IACtC,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;IACtB,GAAG,EAAE,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;CAC3C,CAAC;AAEF,4EAA4E;AAC5E,8EAA8E;AAC9E,gEAAgE;AAChE,oCAAoC;AACpC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC;IAC1B,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,aAAa;IACxE,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,cAAc,EAAE,gBAAgB;IAC5E,YAAY,EAAE,mBAAmB,EAAE,UAAU,EAAE,YAAY,EAAE,cAAc;CAC5E,CAAC,CAAC;AAEH,SAAS,gBAAgB,CAAC,OAAe;IACvC,OAAQ,QAAA,kBAAwC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AACrE,CAAC;AAED;;;GAGG;AACH,8BACE,OAAuB,EACvB,QAAQ,GAAoB,OAAO,CAAC,QAAQ;IAE5C,OAAO,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;AAC3D,CAAC;AAeD;;;;GAIG;AACH,MAAM,gBAAgB,GAAG,yDAAyD,CAAC;AAEnF;;;GAGG;AACH,wBAA+B,KAAa;IAC1C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAE7D,4EAA4E;IAC5E,6EAA6E;IAC7E,+EAA+E;IAC/E,oEAAoE;IACpE,8EAA8E;IAC9E,wEAAwE;IACxE,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACvC,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;QAChB,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAC1C,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC/C,MAAM,KAAK,GAAG,IAAA,6CAAe,EAAC,KAAK,CAAC,SAAS,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;QAC5D,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,OAAO,KAAK,CAAC,OAAO,KAAK,SAAS;YAChC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE;YAClC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;IAC/D,CAAC;IAED,gEAAgE;IAChE,wDAAwD;IACxD,MAAM,EAAE,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACrD,MAAM,OAAO,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAE7D,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,4EAA4E;IAC5E,uCAAuC;IACvC,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAE1F,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AACtF,CAAC;AAED;;;;;;;;;;GAUG;AACH,6BACE,OAAuB,EACvB,IAAc;IAEd,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC;IACjB,IAAI,IAAwB,CAAC;IAE7B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAC7B,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,uEAAuE;YACvE,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM;gBAAE,CAAC,EAAE,CAAC;YACnD,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,SAAS;YAAE,IAAI,GAAG,CAAC,CAAC,CAAC,kCAAkC;QACpE,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAAC,OAAO,GAAG,CAAC,CAAC;YAAC,IAAI,GAAG,CAAC,CAAC;YAAC,MAAM;QAAC,CAAC;QACnD,2EAA2E;QAC3E,IAAI,CAAC,KAAK,QAAQ;YAAE,SAAS;QAC7B,0EAA0E;QAC1E,4CAA4C;QAC5C,MAAM;IACR,CAAC;IAED,IAAI,OAAO,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IAEnE,MAAM,KAAK,GAAyB,EAAE,CAAC;IACvC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;IACrC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,IAAI,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM;gBAAE,CAAC,EAAE,CAAC,CAAC,kBAAkB;YAC1E,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,IAAI;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAC5C,CAAC;AAED,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC;AA2BnF;;;;GAIG;AACH,yBACE,IAAY,EACZ,OAA2B,EAC3B,IAAe;IAEf,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS;YAAE,SAAS;QACrC,gEAAgE;QAChE,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,SAAS;QAEtC,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,OAAO,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;QAChE,MAAM,UAAU,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAEpE,IAAI,OAAO,KAAK,IAAI;YAAE,SAAS;QAC/B,IAAI,UAAU,KAAK,SAAS;YAAE,OAAO,GAAG,CAAC,CAAC,6BAA6B;QACvE,IAAI,OAAO,KAAK,SAAS,IAAI,UAAU,KAAK,OAAO;YAAE,OAAO,GAAG,CAAC;IAClE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,SAAS,CAAC,IAAwB,EAAE,IAAe;IAC1D,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,sEAAsE;IACtE,0EAA0E;IAC1E,0EAA0E;IAC1E,yEAAyE;IACzE,0EAA0E;IAC1E,MAAM,GAAG,GACP,IAAA,iCAAe,EAAC,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC;QACrD,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACjD,IAAI,GAAG,EAAE,CAAC;QACR,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,0BAA0B;YAChC,WAAW,EAAE,sBAAsB,GAAG,CAAC,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;YAChI,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,IAAI,EAAE,IAAI,CAAC,GAAG;YACd,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,QAAQ,EAAE,SAAS;YACnB,cAAc,EAAE,kBAAkB,IAAI,CAAC,GAAG,oDAAoD,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,eAAe,GAAG,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG;SACpJ,CAAC,CAAC;IACL,CAAC;IAED,wEAAwE;IACxE,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,IAAA,kCAAe,EAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC5D,IAAI,GAAG;YAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACrD,CAAC;IAED,2EAA2E;IAC3E,+DAA+D;IAC/D,QAAQ,CAAC,IAAI,CACX,GAAG,IAAA,oDAAsB,EAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,OAAO,IAAI,GAAG,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,CAC1E,CAAC;IAEF,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,+BACE,OAAe,EACf,IAAc,EACd,IAAgB;IAEhB,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,gCAAgC,OAAO,eAAe,QAAA,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YACrF,sDAAsD,CACzD,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACxE,IAAI,CAAC,WAAW,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC5F,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,IAAI,IAAA,iCAAe,GAAE,CAAC;IAC1C,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QAClC,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC1C,OAAO;YACL,IAAI;YACJ,QAAQ;YACR,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC9D,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;SAC9D,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAE3D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC1E,CAAC;AAaD,0EAA0E;AAC1E,MAAM,WAAW,GAAG,0BAA0B,CAAC;AAE/C;;;;;;;GAOG;AACH,+BAAsC,OAAe;IACnD,6EAA6E;IAC7E,uEAAuE;IACvE,OAAO,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;AACzE,CAAC;AAED;;;;;GAKG;AACH,2BAAkC,GAAW;IAC3C,IAAI,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAChD,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC5C,OAAO,IAAI,OAAO,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;AAChF,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,YAAY,GAAc,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE;IACzD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,WAAW,GAAG,CAAC,qBAAqB,CAAC,OAAO,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/F,MAAM,MAAM,GAAG,IAAA,8BAAS,EACtB,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,SAAS,EAChC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,WAAW,GAAG,CAAC,EACtC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,wBAAwB,EAAE,IAAI,EAAE,CACzD,CAAC;QACF,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;IACxD,CAAC;IACD,MAAM,MAAM,GAAG,IAAA,8BAAS,EAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACjD,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;AACxD,CAAC,CAAC;AAeF,SAAS,aAAa,CACpB,QAAgC,EAChC,GAA2B,EAC3B,IAAI,GAA4B,UAAU;IAE1C,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACjE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC3D,MAAM,KAAK,GACT,IAAI,KAAK,UAAU;QACjB,CAAC,CAAC,GAAG,KAAK,aAAa;QACvB,CAAC,CAAC,GAAG,KAAK,sCAAsC,CAAC;IACrD,GAAG,CAAC,EAAE,CAAC,CAAC;IACR,GAAG,CAAC,oBAAoB,KAAK,QAAQ,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,YAAY,CAAC,CAAC;IACpF,KAAK,MAAM,OAAO,IAAI,IAAI,EAAE,CAAC;QAC3B,GAAG,CAAC,EAAE,CAAC,CAAC;QACR,GAAG,CAAC,cAAc,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACtC,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACpC,GAAG,CAAC,QAAQ,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;YACvF,GAAG,CAAC,OAAO,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IACD,GAAG,CAAC,EAAE,CAAC,CAAC;AACV,CAAC;AAED;;;;;;;;;GASG;AACH,yBACE,OAAe,EACf,WAAqB,EACrB,OAAO,GAAwB,EAAE;IAEjC,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,YAAY,CAAC;IAC9C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAEjE,MAAM,QAAQ,GAAG,qBAAqB,CAAC,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAE3E,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACrB,aAAa,CAAC,QAAQ,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;QACzC,mEAAmE;QACnE,aAAa,CAAC,QAAQ,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;QACzC,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,GAAG,CAAC,yCAAyC,CAAC,CAAC;YAC/C,OAAO,CAAC,CAAC;QACX,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACnB,GAAG,CAAC,cAAc,QAAQ,CAAC,OAAO,sEAAsE,CAAC,CAAC;YAC1G,OAAO,CAAC,CAAC;QACX,CAAC;QACD,GAAG,CAAC,qHAAqH,CAAC,CAAC;IAC7H,CAAC;SAAM,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC3B,yEAAyE;QACzE,4EAA4E;QAC5E,6BAA6B;QAC7B,aAAa,CAAC,QAAQ,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;QACzC,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,GAAG,CAAC,iEAAiE,CAAC,CAAC;YACvE,OAAO,CAAC,CAAC;QACX,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QAC1B,GAAG,CACD,8CAA8C,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,WAAW,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,gCAAgC,CAC3H,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,MAAM,GAAG,oBAAoB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAChF,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,iBAAiB,MAAM,KAAK,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;AAC5B,CAAC"}
+{"version":3,"file":"install-guard.js","sourceRoot":"","sources":["../src/install-guard.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;;;;;;;;;;;AAEH,2DAA+C;AAC/C,uDAAmF;AACnF,yDAAqD;AACrD,+EAAwF;gGAAvD,6CAAe;AAOhD,8EAA8E;AAC9E,6BAA6B;AAC7B,8EAA8E;AAEjE,QAAA,kBAAkB,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAU,CAAC;AAG1E;;;;;GAKG;AACH,MAAM,aAAa,GAAgD;IACjE,yEAAyE;IACzE,6EAA6E;IAC7E,2CAA2C;IAC3C,GAAG,EAAE,IAAI,GAAG,CAAC;QACX,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ;QAC7D,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS;KACrC,CAAC;IACF,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;IACtC,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;IACtB,GAAG,EAAE,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;CAC3C,CAAC;AAEF,4EAA4E;AAC5E,8EAA8E;AAC9E,gEAAgE;AAChE,oCAAoC;AACpC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC;IAC1B,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,aAAa;IACxE,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,cAAc,EAAE,gBAAgB;IAC5E,YAAY,EAAE,mBAAmB,EAAE,UAAU,EAAE,YAAY,EAAE,cAAc;CAC5E,CAAC,CAAC;AAEH,SAAS,gBAAgB,CAAC,OAAe;IACvC,OAAQ,QAAA,kBAAwC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AACrE,CAAC;AAED;;;GAGG;AACH,8BACE,OAAuB,EACvB,QAAQ,GAAoB,OAAO,CAAC,QAAQ;IAE5C,OAAO,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;AAC3D,CAAC;AAeD;;;;GAIG;AACH,MAAM,gBAAgB,GAAG,yDAAyD,CAAC;AAEnF;;;GAGG;AACH,wBAA+B,KAAa;IAC1C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAE7D,4EAA4E;IAC5E,6EAA6E;IAC7E,+EAA+E;IAC/E,oEAAoE;IACpE,8EAA8E;IAC9E,wEAAwE;IACxE,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACvC,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;QAChB,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAC1C,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC/C,MAAM,KAAK,GAAG,IAAA,6CAAe,EAAC,KAAK,CAAC,SAAS,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;QAC5D,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,OAAO,KAAK,CAAC,OAAO,KAAK,SAAS;YAChC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE;YAClC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;IAC/D,CAAC;IAED,gEAAgE;IAChE,wDAAwD;IACxD,MAAM,EAAE,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACrD,MAAM,OAAO,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAE7D,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,4EAA4E;IAC5E,uCAAuC;IACvC,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAE1F,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AACtF,CAAC;AAED;;;;;;;;;;GAUG;AACH,6BACE,OAAuB,EACvB,IAAc;IAEd,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC;IACjB,IAAI,IAAwB,CAAC;IAE7B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAC7B,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,uEAAuE;YACvE,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM;gBAAE,CAAC,EAAE,CAAC;YACnD,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,SAAS;YAAE,IAAI,GAAG,CAAC,CAAC,CAAC,kCAAkC;QACpE,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAAC,OAAO,GAAG,CAAC,CAAC;YAAC,IAAI,GAAG,CAAC,CAAC;YAAC,MAAM;QAAC,CAAC;QACnD,2EAA2E;QAC3E,IAAI,CAAC,KAAK,QAAQ;YAAE,SAAS;QAC7B,0EAA0E;QAC1E,4CAA4C;QAC5C,MAAM;IACR,CAAC;IAED,IAAI,OAAO,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IAEnE,MAAM,KAAK,GAAyB,EAAE,CAAC;IACvC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;IACrC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,IAAI,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM;gBAAE,CAAC,EAAE,CAAC,CAAC,kBAAkB;YAC1E,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,IAAI;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAC5C,CAAC;AAED,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC;AA2BnF;;;;GAIG;AACH,yBACE,IAAY,EACZ,OAA2B,EAC3B,IAAe;IAEf,uEAAuE;IACvE,8DAA8D;IAC9D,MAAM,UAAU,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACnD,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAE7B,KAAK,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,UAAU,EAAE,CAAC;QACtD,IAAI,UAAU,KAAK,SAAS;YAAE,OAAO,GAAG,CAAC,CAAC,6BAA6B;QACvE,IAAI,OAAO,KAAK,SAAS,IAAI,UAAU,KAAK,OAAO;YAAE,OAAO,GAAG,CAAC;IAClE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,+BACE,IAAY,EACZ,OAA2B,EAC3B,IAAe;IAEf,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS;YAAE,SAAS;QACrC,gEAAgE;QAChE,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,SAAS;QAEtC,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,OAAO,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;QAChE,MAAM,UAAU,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAEpE,IAAI,OAAO,KAAK,IAAI;YAAE,SAAS;QAC/B,IAAI,UAAU,KAAK,SAAS;YAAE,OAAO,GAAG,CAAC,CAAC,6BAA6B;QACvE,IAAI,OAAO,KAAK,SAAS,IAAI,UAAU,KAAK,OAAO;YAAE,OAAO,GAAG,CAAC;IAClE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAQD;;;;;;;;;;;;GAYG;AACH,MAAM,iBAAiB,GAAG,IAAI,OAAO,EAA+C,CAAC;AAErF,SAAS,eAAe,CAAC,IAAe;IACtC,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,MAAM,KAAK,GAAG,IAAI,GAAG,EAA+B,CAAC;IACrD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS;YAAE,SAAS;QACrC,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,SAAS;QAEtC,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,OAAO,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;QAChE,MAAM,UAAU,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAEpE,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,MAAM;YAAE,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;;YACjD,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;IAC1D,CAAC;IAED,iBAAiB,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACnC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,SAAS,CAAC,IAAwB,EAAE,IAAe;IAC1D,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,sEAAsE;IACtE,0EAA0E;IAC1E,0EAA0E;IAC1E,yEAAyE;IACzE,0EAA0E;IAC1E,MAAM,GAAG,GACP,IAAA,iCAAe,EAAC,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC;QACrD,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACjD,IAAI,GAAG,EAAE,CAAC;QACR,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,0BAA0B;YAChC,WAAW,EAAE,sBAAsB,GAAG,CAAC,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;YAChI,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,IAAI,EAAE,IAAI,CAAC,GAAG;YACd,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,QAAQ,EAAE,SAAS;YACnB,cAAc,EAAE,kBAAkB,IAAI,CAAC,GAAG,oDAAoD,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,eAAe,GAAG,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG;SACpJ,CAAC,CAAC;IACL,CAAC;IAED,wEAAwE;IACxE,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,IAAA,kCAAe,EAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC5D,IAAI,GAAG;YAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACrD,CAAC;IAED,2EAA2E;IAC3E,+DAA+D;IAC/D,QAAQ,CAAC,IAAI,CACX,GAAG,IAAA,oDAAsB,EAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,OAAO,IAAI,GAAG,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,CAC1E,CAAC;IAEF,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,+BACE,OAAe,EACf,IAAc,EACd,IAAgB;IAEhB,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,gCAAgC,OAAO,eAAe,QAAA,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YACrF,sDAAsD,CACzD,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACxE,IAAI,CAAC,WAAW,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC5F,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,IAAI,IAAA,iCAAe,GAAE,CAAC;IAC1C,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QAClC,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC1C,OAAO;YACL,IAAI;YACJ,QAAQ;YACR,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC9D,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;SAC9D,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAE3D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC1E,CAAC;AAaD,0EAA0E;AAC1E,MAAM,WAAW,GAAG,0BAA0B,CAAC;AAE/C;;;;;;;GAOG;AACH,+BAAsC,OAAe;IACnD,6EAA6E;IAC7E,uEAAuE;IACvE,OAAO,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;AACzE,CAAC;AAED;;;;;GAKG;AACH,2BAAkC,GAAW;IAC3C,IAAI,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAChD,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC5C,OAAO,IAAI,OAAO,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;AAChF,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,YAAY,GAAc,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE;IACzD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,WAAW,GAAG,CAAC,qBAAqB,CAAC,OAAO,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/F,MAAM,MAAM,GAAG,IAAA,8BAAS,EACtB,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,SAAS,EAChC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,WAAW,GAAG,CAAC,EACtC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,wBAAwB,EAAE,IAAI,EAAE,CACzD,CAAC;QACF,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;IACxD,CAAC;IACD,MAAM,MAAM,GAAG,IAAA,8BAAS,EAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACjD,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;AACxD,CAAC,CAAC;AAeF,SAAS,aAAa,CACpB,QAAgC,EAChC,GAA2B,EAC3B,IAAI,GAA4B,UAAU;IAE1C,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACjE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC3D,MAAM,KAAK,GACT,IAAI,KAAK,UAAU;QACjB,CAAC,CAAC,GAAG,KAAK,aAAa;QACvB,CAAC,CAAC,GAAG,KAAK,sCAAsC,CAAC;IACrD,GAAG,CAAC,EAAE,CAAC,CAAC;IACR,GAAG,CAAC,oBAAoB,KAAK,QAAQ,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,YAAY,CAAC,CAAC;IACpF,KAAK,MAAM,OAAO,IAAI,IAAI,EAAE,CAAC;QAC3B,GAAG,CAAC,EAAE,CAAC,CAAC;QACR,GAAG,CAAC,cAAc,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACtC,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACpC,GAAG,CAAC,QAAQ,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;YACvF,GAAG,CAAC,OAAO,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IACD,GAAG,CAAC,EAAE,CAAC,CAAC;AACV,CAAC;AAED;;;;;;;;;GASG;AACH,yBACE,OAAe,EACf,WAAqB,EACrB,OAAO,GAAwB,EAAE;IAEjC,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,YAAY,CAAC;IAC9C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAEjE,MAAM,QAAQ,GAAG,qBAAqB,CAAC,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAE3E,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACrB,aAAa,CAAC,QAAQ,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;QACzC,mEAAmE;QACnE,aAAa,CAAC,QAAQ,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;QACzC,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,GAAG,CAAC,yCAAyC,CAAC,CAAC;YAC/C,OAAO,CAAC,CAAC;QACX,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACnB,GAAG,CAAC,cAAc,QAAQ,CAAC,OAAO,sEAAsE,CAAC,CAAC;YAC1G,OAAO,CAAC,CAAC;QACX,CAAC;QACD,GAAG,CAAC,qHAAqH,CAAC,CAAC;IAC7H,CAAC;SAAM,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC3B,yEAAyE;QACzE,4EAA4E;QAC5E,6BAA6B;QAC7B,aAAa,CAAC,QAAQ,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;QACzC,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,GAAG,CAAC,iEAAiE,CAAC,CAAC;YACvE,OAAO,CAAC,CAAC;QACX,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QAC1B,GAAG,CACD,8CAA8C,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,WAAW,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,gCAAgC,CAC3H,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,MAAM,GAAG,oBAAoB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAChF,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,iBAAiB,MAAM,KAAK,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;AAC5B,CAAC"}

package/dist/install-hook-scanner.d.ts

@@ -6,14 +6,12 @@
  * obfuscated one-liners, and embedded binary blobs.
  */
 import type { Finding } from "./types.js";
-interface InstallScripts {
-    preinstall?: string;
-    postinstall?: string;
-    install?: string;
-    preuninstall?: string;
-    postuninstall?: string;
-    prepare?: string;
-}
+import { type AutoRunLifecycleHook } from "./patterns.js";
+/**
+ * Derived from AUTO_RUN_LIFECYCLE_HOOKS rather than hand-listed, so adding a
+ * hook to that list cannot leave this scanner reading a stale subset.
+ */
+type InstallScripts = Partial<Record<AutoRunLifecycleHook, string>>;
 /**
  * Deep-analyze install hook scripts from package.json.
  */

package/dist/install-hook-scanner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"install-hook-scanner.d.ts","sourceRoot":"","sources":["../src/install-hook-scanner.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AA6C1C,UAAU,cAAc;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,cAAc,EACvB,YAAY,EAAE,MAAM,GACnB,OAAO,EAAE,CA6JX;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,MAAM,GACd,cAAc,GAAG,IAAI,CAevB"}
+{"version":3,"file":"install-hook-scanner.d.ts","sourceRoot":"","sources":["../src/install-hook-scanner.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,eAAe,CAAC;AA8CvB;;;GAGG;AACH,KAAK,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC,CAAC;AAEpE;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,cAAc,EACvB,YAAY,EAAE,MAAM,GACnB,OAAO,EAAE,CA2JX;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,MAAM,GACd,cAAc,GAAG,IAAI,CAavB"}

package/dist/install-hook-scanner.js

@@ -9,6 +9,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.analyzeInstallHooks = analyzeInstallHooks;
 exports.extractInstallScripts = extractInstallScripts;
+const patterns_js_1 = require("./patterns.js");
 // ── INSTALL_HOOK_HOST_RUNTIME_PATCH detection ───────────────────────────────
 // An install hook that patches/mutates a HOST AGENT RUNTIME (OpenClaw, Hermes,
 // Claude Code, ...) - rewriting another installed package's code so the plugin
@@ -27,8 +28,9 @@ const CODE_MUTATE_RE = /\b(?:patch|inject|mutate|overwrite|rewrite|monkey[-\s]?p
 // scheduled task, a Windows Run key, a Startup-folder entry, or a Python .pth
 // that the interpreter auto-imports.
 //
-// Scoped deliberately to the six package.json install-script strings this module
-// already reads. That is the whole reason its false-positive surface is small:
+// Scoped deliberately to the package.json lifecycle-script strings this module
+// already reads - AUTO_RUN_LIFECYCLE_HOOKS, the same list npm-scanner.ts and
+// scanner.ts use. That is the whole reason its false-positive surface is small:
 // installing persistence from an install hook has essentially no legitimate
 // form, whereas the same commands in ordinary source belong to any service
 // manager, installer or devops tool and would false-positive constantly.
@@ -47,9 +49,7 @@ const PERSISTENCE_WRITE_RE = /\blaunchctl\b|\bsystemctl\b[^\n]{0,40}\b(?:enable|
  */
 function analyzeInstallHooks(scripts, relativePath) {
     const findings = [];
-    const hookNames = [
-        "preinstall", "postinstall", "install", "preuninstall", "postuninstall", "prepare",
-    ];
+    const hookNames = patterns_js_1.AUTO_RUN_LIFECYCLE_HOOKS;
     for (const hook of hookNames) {
         const script = scripts[hook];
         if (!script)
@@ -198,14 +198,13 @@ function extractInstallScripts(content) {
         const pkg = JSON.parse(content);
         if (!pkg.scripts)
             return null;
-        return {
-            preinstall: pkg.scripts.preinstall,
-            postinstall: pkg.scripts.postinstall,
-            install: pkg.scripts.install,
-            preuninstall: pkg.scripts.preuninstall,
-            postuninstall: pkg.scripts.postuninstall,
-            prepare: pkg.scripts.prepare,
-        };
+        const scripts = {};
+        for (const hook of patterns_js_1.AUTO_RUN_LIFECYCLE_HOOKS) {
+            const value = pkg.scripts[hook];
+            if (typeof value === "string")
+                scripts[hook] = value;
+        }
+        return scripts;
     }
     catch {
         return null;

package/dist/install-hook-scanner.js.map

@@ -1 +1 @@
-{"version":3,"file":"install-hook-scanner.js","sourceRoot":"","sources":["../src/install-hook-scanner.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;;;AAIH,+EAA+E;AAC/E,+EAA+E;AAC/E,+EAA+E;AAC/E,gFAAgF;AAChF,gFAAgF;AAChF,gFAAgF;AAEhF,oEAAoE;AACpE,MAAM,eAAe,GACnB,gPAAgP,CAAC;AAEnP,+EAA+E;AAC/E,MAAM,oBAAoB,GACxB,2GAA2G,CAAC;AAE9G,kFAAkF;AAClF,MAAM,cAAc,GAClB,0GAA0G,CAAC;AAE7G,+EAA+E;AAC/E,+EAA+E;AAC/E,4EAA4E;AAC5E,8EAA8E;AAC9E,qCAAqC;AACrC,EAAE;AACF,iFAAiF;AACjF,+EAA+E;AAC/E,4EAA4E;AAC5E,2EAA2E;AAC3E,yEAAyE;AACzE,EAAE;AACF,+EAA+E;AAC/E,iFAAiF;AACjF,2EAA2E;AAC3E,EAAE;AACF,4EAA4E;AAC5E,2EAA2E;AAC3E,iFAAiF;AAEjF,yEAAyE;AACzE,MAAM,oBAAoB,GACxB,6TAA6T,CAAC;AAWhU;;GAEG;AACH,6BACE,OAAuB,EACvB,YAAoB;IAEpB,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,SAAS,GAA6B;QAC1C,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,cAAc,EAAE,eAAe,EAAE,SAAS;KACnF,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,MAAM;YAAE,SAAS;QAEtB,oCAAoC;QACpC,IAAI,iFAAiF,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACnG,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,sBAAsB;gBAC5B,WAAW,EAAE,GAAG,IAAI,gFAAgF;gBACpG,QAAQ,EAAE,UAAU;gBACpB,IAAI,EAAE,YAAY;gBAClB,KAAK,EAAE,QAAQ,CAAC,GAAG,IAAI,KAAK,MAAM,EAAE,CAAC;gBACrC,UAAU,EAAE,GAAG;gBACf,QAAQ,EAAE,cAAc;gBACxB,cAAc,EAAE,8EAA8E;aAC/F,CAAC,CAAC;QACL,CAAC;QAED,2BAA2B;QAC3B,IAAI,sFAAsF,CAAC,IAAI,CAAC,MAAM,CAAC;YACnG,sCAAsC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACxD,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,4BAA4B;gBAClC,WAAW,EAAE,GAAG,IAAI,iFAAiF;gBACrG,QAAQ,EAAE,UAAU;gBACpB,IAAI,EAAE,YAAY;gBAClB,KAAK,EAAE,QAAQ,CAAC,GAAG,IAAI,KAAK,MAAM,EAAE,CAAC;gBACrC,UAAU,EAAE,IAAI;gBAChB,QAAQ,EAAE,SAAS;gBACnB,cAAc,EAAE,yFAAyF;aAC1G,CAAC,CAAC;QACL,CAAC;QAED,wDAAwD;QACxD,IAAI,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACtC,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,gCAAgC;gBACtC,WAAW,EAAE,GAAG,IAAI,4RAA4R;gBAChT,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,YAAY;gBAClB,KAAK,EAAE,QAAQ,CAAC,GAAG,IAAI,KAAK,MAAM,EAAE,CAAC;gBACrC,UAAU,EAAE,GAAG;gBACf,QAAQ,EAAE,SAAS;gBACnB,cAAc,EAAE,uPAAuP;aACxQ,CAAC,CAAC;QACL,CAAC;QAED,6EAA6E;QAC7E,IACE,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACnE,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,EAC3B,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,iCAAiC;gBACvC,WAAW,EAAE,GAAG,IAAI,oSAAoS;gBACxT,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,YAAY;gBAClB,KAAK,EAAE,QAAQ,CAAC,GAAG,IAAI,KAAK,MAAM,EAAE,CAAC;gBACrC,UAAU,EAAE,GAAG;gBACf,QAAQ,EAAE,cAAc;gBACxB,cAAc,EAAE,sUAAsU;aACvV,CAAC,CAAC;QACL,CAAC;QAED,4CAA4C;QAC5C,IAAI,sHAAsH,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACxI,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,0BAA0B;gBAChC,WAAW,EAAE,GAAG,IAAI,2EAA2E;gBAC/F,QAAQ,EAAE,UAAU;gBACpB,IAAI,EAAE,YAAY;gBAClB,KAAK,EAAE,QAAQ,CAAC,GAAG,IAAI,KAAK,MAAM,EAAE,CAAC;gBACrC,UAAU,EAAE,IAAI;gBAChB,QAAQ,EAAE,cAAc;gBACxB,cAAc,EAAE,gEAAgE;aACjF,CAAC,CAAC;QACL,CAAC;QAED,kCAAkC;QAClC,IAAI,yFAAyF,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3G,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,yBAAyB;gBAC/B,WAAW,EAAE,GAAG,IAAI,wEAAwE;gBAC5F,QAAQ,EAAE,UAAU;gBACpB,IAAI,EAAE,YAAY;gBAClB,KAAK,EAAE,QAAQ,CAAC,GAAG,IAAI,KAAK,MAAM,EAAE,CAAC;gBACrC,UAAU,EAAE,GAAG;gBACf,QAAQ,EAAE,SAAS;gBACnB,cAAc,EAAE,2EAA2E;aAC5F,CAAC,CAAC;QACL,CAAC;QAED,mBAAmB;QACnB,IAAI,2CAA2C,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7D,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,0BAA0B;gBAChC,WAAW,EAAE,GAAG,IAAI,8DAA8D;gBAClF,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,YAAY;gBAClB,KAAK,EAAE,QAAQ,CAAC,GAAG,IAAI,KAAK,MAAM,EAAE,CAAC;gBACrC,UAAU,EAAE,GAAG;gBACf,QAAQ,EAAE,cAAc;gBACxB,cAAc,EAAE,6CAA6C;aAC9D,CAAC,CAAC;QACL,CAAC;QAED,4BAA4B;QAC5B,IAAI,mFAAmF,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACrG,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,yBAAyB;gBAC/B,WAAW,EAAE,GAAG,IAAI,2GAA2G;gBAC/H,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,YAAY;gBAClB,KAAK,EAAE,QAAQ,CAAC,GAAG,IAAI,KAAK,MAAM,EAAE,CAAC;gBACrC,UAAU,EAAE,GAAG;gBACf,QAAQ,EAAE,SAAS;gBACnB,cAAc,EAAE,0EAA0E;aAC3F,CAAC,CAAC;QACL,CAAC;QAED,+BAA+B;QAC/B,IAAI,MAAM,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAClD,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,4BAA4B;gBAClC,WAAW,EAAE,GAAG,IAAI,gBAAgB,MAAM,CAAC,MAAM,8EAA8E;gBAC/H,QAAQ,EAAE,QAAQ;gBAClB,IAAI,EAAE,YAAY;gBAClB,KAAK,EAAE,QAAQ,CAAC,GAAG,IAAI,KAAK,MAAM,EAAE,CAAC;gBACrC,UAAU,EAAE,GAAG;gBACf,QAAQ,EAAE,cAAc;gBACxB,cAAc,EAAE,0FAA0F;aAC3G,CAAC,CAAC;QACL,CAAC;QAED,sCAAsC;QACtC,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;QACvD,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,0BAA0B;gBAChC,WAAW,EAAE,GAAG,IAAI,6CAA6C,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,gDAAgD;gBACnI,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,YAAY;gBAClB,KAAK,EAAE,QAAQ,CAAC,GAAG,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC;gBAC9D,UAAU,EAAE,IAAI;gBAChB,QAAQ,EAAE,SAAS;gBACnB,cAAc,EAAE,2FAA2F;aAC5G,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,+BACE,OAAe;IAEf,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAyC,CAAC;QACxE,IAAI,CAAC,GAAG,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC9B,OAAO;YACL,UAAU,EAAE,GAAG,CAAC,OAAO,CAAC,UAAU;YAClC,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,WAAW;YACpC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO;YAC5B,YAAY,EAAE,GAAG,CAAC,OAAO,CAAC,YAAY;YACtC,aAAa,EAAE,GAAG,CAAC,OAAO,CAAC,aAAa;YACxC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO;SAC7B,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,CAAS,EAAE,GAAG,GAAG,GAAG;IACpC,OAAO,CAAC,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1D,CAAC"}
+{"version":3,"file":"install-hook-scanner.js","sourceRoot":"","sources":["../src/install-hook-scanner.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;;;AAGH,+CAGuB;AAEvB,+EAA+E;AAC/E,+EAA+E;AAC/E,+EAA+E;AAC/E,gFAAgF;AAChF,gFAAgF;AAChF,gFAAgF;AAEhF,oEAAoE;AACpE,MAAM,eAAe,GACnB,gPAAgP,CAAC;AAEnP,+EAA+E;AAC/E,MAAM,oBAAoB,GACxB,2GAA2G,CAAC;AAE9G,kFAAkF;AAClF,MAAM,cAAc,GAClB,0GAA0G,CAAC;AAE7G,+EAA+E;AAC/E,+EAA+E;AAC/E,4EAA4E;AAC5E,8EAA8E;AAC9E,qCAAqC;AACrC,EAAE;AACF,+EAA+E;AAC/E,6EAA6E;AAC7E,gFAAgF;AAChF,4EAA4E;AAC5E,2EAA2E;AAC3E,yEAAyE;AACzE,EAAE;AACF,+EAA+E;AAC/E,iFAAiF;AACjF,2EAA2E;AAC3E,EAAE;AACF,4EAA4E;AAC5E,2EAA2E;AAC3E,iFAAiF;AAEjF,yEAAyE;AACzE,MAAM,oBAAoB,GACxB,6TAA6T,CAAC;AAQhU;;GAEG;AACH,6BACE,OAAuB,EACvB,YAAoB;IAEpB,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,SAAS,GAAG,sCAAwB,CAAC;IAE3C,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,MAAM;YAAE,SAAS;QAEtB,oCAAoC;QACpC,IAAI,iFAAiF,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACnG,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,sBAAsB;gBAC5B,WAAW,EAAE,GAAG,IAAI,gFAAgF;gBACpG,QAAQ,EAAE,UAAU;gBACpB,IAAI,EAAE,YAAY;gBAClB,KAAK,EAAE,QAAQ,CAAC,GAAG,IAAI,KAAK,MAAM,EAAE,CAAC;gBACrC,UAAU,EAAE,GAAG;gBACf,QAAQ,EAAE,cAAc;gBACxB,cAAc,EAAE,8EAA8E;aAC/F,CAAC,CAAC;QACL,CAAC;QAED,2BAA2B;QAC3B,IAAI,sFAAsF,CAAC,IAAI,CAAC,MAAM,CAAC;YACnG,sCAAsC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACxD,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,4BAA4B;gBAClC,WAAW,EAAE,GAAG,IAAI,iFAAiF;gBACrG,QAAQ,EAAE,UAAU;gBACpB,IAAI,EAAE,YAAY;gBAClB,KAAK,EAAE,QAAQ,CAAC,GAAG,IAAI,KAAK,MAAM,EAAE,CAAC;gBACrC,UAAU,EAAE,IAAI;gBAChB,QAAQ,EAAE,SAAS;gBACnB,cAAc,EAAE,yFAAyF;aAC1G,CAAC,CAAC;QACL,CAAC;QAED,wDAAwD;QACxD,IAAI,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACtC,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,gCAAgC;gBACtC,WAAW,EAAE,GAAG,IAAI,4RAA4R;gBAChT,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,YAAY;gBAClB,KAAK,EAAE,QAAQ,CAAC,GAAG,IAAI,KAAK,MAAM,EAAE,CAAC;gBACrC,UAAU,EAAE,GAAG;gBACf,QAAQ,EAAE,SAAS;gBACnB,cAAc,EAAE,uPAAuP;aACxQ,CAAC,CAAC;QACL,CAAC;QAED,6EAA6E;QAC7E,IACE,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACnE,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,EAC3B,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,iCAAiC;gBACvC,WAAW,EAAE,GAAG,IAAI,oSAAoS;gBACxT,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,YAAY;gBAClB,KAAK,EAAE,QAAQ,CAAC,GAAG,IAAI,KAAK,MAAM,EAAE,CAAC;gBACrC,UAAU,EAAE,GAAG;gBACf,QAAQ,EAAE,cAAc;gBACxB,cAAc,EAAE,sUAAsU;aACvV,CAAC,CAAC;QACL,CAAC;QAED,4CAA4C;QAC5C,IAAI,sHAAsH,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACxI,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,0BAA0B;gBAChC,WAAW,EAAE,GAAG,IAAI,2EAA2E;gBAC/F,QAAQ,EAAE,UAAU;gBACpB,IAAI,EAAE,YAAY;gBAClB,KAAK,EAAE,QAAQ,CAAC,GAAG,IAAI,KAAK,MAAM,EAAE,CAAC;gBACrC,UAAU,EAAE,IAAI;gBAChB,QAAQ,EAAE,cAAc;gBACxB,cAAc,EAAE,gEAAgE;aACjF,CAAC,CAAC;QACL,CAAC;QAED,kCAAkC;QAClC,IAAI,yFAAyF,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3G,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,yBAAyB;gBAC/B,WAAW,EAAE,GAAG,IAAI,wEAAwE;gBAC5F,QAAQ,EAAE,UAAU;gBACpB,IAAI,EAAE,YAAY;gBAClB,KAAK,EAAE,QAAQ,CAAC,GAAG,IAAI,KAAK,MAAM,EAAE,CAAC;gBACrC,UAAU,EAAE,GAAG;gBACf,QAAQ,EAAE,SAAS;gBACnB,cAAc,EAAE,2EAA2E;aAC5F,CAAC,CAAC;QACL,CAAC;QAED,mBAAmB;QACnB,IAAI,2CAA2C,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7D,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,0BAA0B;gBAChC,WAAW,EAAE,GAAG,IAAI,8DAA8D;gBAClF,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,YAAY;gBAClB,KAAK,EAAE,QAAQ,CAAC,GAAG,IAAI,KAAK,MAAM,EAAE,CAAC;gBACrC,UAAU,EAAE,GAAG;gBACf,QAAQ,EAAE,cAAc;gBACxB,cAAc,EAAE,6CAA6C;aAC9D,CAAC,CAAC;QACL,CAAC;QAED,4BAA4B;QAC5B,IAAI,mFAAmF,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACrG,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,yBAAyB;gBAC/B,WAAW,EAAE,GAAG,IAAI,2GAA2G;gBAC/H,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,YAAY;gBAClB,KAAK,EAAE,QAAQ,CAAC,GAAG,IAAI,KAAK,MAAM,EAAE,CAAC;gBACrC,UAAU,EAAE,GAAG;gBACf,QAAQ,EAAE,SAAS;gBACnB,cAAc,EAAE,0EAA0E;aAC3F,CAAC,CAAC;QACL,CAAC;QAED,+BAA+B;QAC/B,IAAI,MAAM,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAClD,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,4BAA4B;gBAClC,WAAW,EAAE,GAAG,IAAI,gBAAgB,MAAM,CAAC,MAAM,8EAA8E;gBAC/H,QAAQ,EAAE,QAAQ;gBAClB,IAAI,EAAE,YAAY;gBAClB,KAAK,EAAE,QAAQ,CAAC,GAAG,IAAI,KAAK,MAAM,EAAE,CAAC;gBACrC,UAAU,EAAE,GAAG;gBACf,QAAQ,EAAE,cAAc;gBACxB,cAAc,EAAE,0FAA0F;aAC3G,CAAC,CAAC;QACL,CAAC;QAED,sCAAsC;QACtC,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;QACvD,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,0BAA0B;gBAChC,WAAW,EAAE,GAAG,IAAI,6CAA6C,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,gDAAgD;gBACnI,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,YAAY;gBAClB,KAAK,EAAE,QAAQ,CAAC,GAAG,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC;gBAC9D,UAAU,EAAE,IAAI;gBAChB,QAAQ,EAAE,SAAS;gBACnB,cAAc,EAAE,2FAA2F;aAC5G,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,+BACE,OAAe;IAEf,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAyC,CAAC;QACxE,IAAI,CAAC,GAAG,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC9B,MAAM,OAAO,GAAmB,EAAE,CAAC;QACnC,KAAK,MAAM,IAAI,IAAI,sCAAwB,EAAE,CAAC;YAC5C,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAChC,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;QACvD,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,CAAS,EAAE,GAAG,GAAG,GAAG;IACpC,OAAO,CAAC,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1D,CAAC"}

package/dist/npm-scanner.d.ts

@@ -12,6 +12,14 @@ export declare const NPM_REMOTE_LIMITS: Readonly<{
     timeoutMs: 30000;
     maxRedirects: 5;
 }>;
+export interface NpmVersionData {
+    scripts?: Record<string, string>;
+    dependencies?: Record<string, string>;
+    devDependencies?: Record<string, string>;
+    dist?: NpmDistInfo;
+    repository?: unknown;
+    [key: string]: unknown;
+}
 export interface NpmDistInfo {
     tarball?: string;
     integrity?: string;
@@ -31,6 +39,13 @@ export declare function filterNpmFindings(findings: Finding[], minSeverity: Scan
 export declare function scanNpmPackage(packageName: string, options: Omit<ScanOptions, "target"> & {
     target?: string;
 }): Promise<ScanReport>;
+/**
+ * Check package.json scripts for suspicious entries.
+ *
+ * Exported for tests: the rest of this path needs a live registry fetch, so
+ * without a direct handle the hook coverage can only be asserted indirectly.
+ */
+export declare function checkPackageScripts(pkg: NpmVersionData, findings: Finding[]): void;
 /**
  * Normalize the many shapes of a package.json `repository` field to a GitHub
  * owner/repo (+ monorepo subdirectory), or null when it is not a GitHub repo.

package/dist/npm-scanner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"npm-scanner.d.ts","sourceRoot":"","sources":["../src/npm-scanner.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,OAAO,KAAK,EAAE,OAAO,EAAkB,UAAU,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAiDnF,oEAAoE;AACpE,eAAO,MAAM,iBAAiB;;;;;EAK5B,CAAC;AAgBH,MAAM,WAAW,WAAW;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,0EAA0E;AAC1E,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,IAAI,CAS7D;AAED,wFAAwF;AACxF,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,IAAI,CASrE;AAED,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,OAAO,EAAE,EACnB,WAAW,EAAE,WAAW,CAAC,aAAa,CAAC,GACtC;IAAE,gBAAgB,EAAE,OAAO,EAAE,CAAC;IAAC,WAAW,EAAE,OAAO,CAAA;CAAE,CAgBvD;AAED;;GAEG;AACH,wBAAsB,cAAc,CAClC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,GAAG;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GACzD,OAAO,CAAC,UAAU,CAAC,CAuFrB;AA0JD;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,OAAO,GAClB;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAqB5D;AAkBD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,oBAAoB,CACxC,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE;IAAE,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,EACrC,QAAQ,EAAE,OAAO,EAAE,GAClB,OAAO,CAAC,IAAI,CAAC,CAiEf;AA0ID,uFAAuF;AACvF,wBAAsB,sBAAsB,CAC1C,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,QAAQ,CAAC,GAC9C,OAAO,CAAC,OAAO,CAAC,CAyBlB;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,OAAO,EAAE,GAClB;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAqD9C"}
+{"version":3,"file":"npm-scanner.d.ts","sourceRoot":"","sources":["../src/npm-scanner.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,OAAO,KAAK,EAAE,OAAO,EAAkB,UAAU,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAkDnF,oEAAoE;AACpE,eAAO,MAAM,iBAAiB;;;;;EAK5B,CAAC;AAOH,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,0EAA0E;AAC1E,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,IAAI,CAS7D;AAED,wFAAwF;AACxF,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,IAAI,CASrE;AAED,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,OAAO,EAAE,EACnB,WAAW,EAAE,WAAW,CAAC,aAAa,CAAC,GACtC;IAAE,gBAAgB,EAAE,OAAO,EAAE,CAAC;IAAC,WAAW,EAAE,OAAO,CAAA;CAAE,CAgBvD;AAED;;GAEG;AACH,wBAAsB,cAAc,CAClC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,GAAG;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GACzD,OAAO,CAAC,UAAU,CAAC,CAuFrB;AAqCD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,cAAc,EACnB,QAAQ,EAAE,OAAO,EAAE,GAClB,IAAI,CA+BN;AAiFD;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,OAAO,GAClB;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAqB5D;AAkBD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,oBAAoB,CACxC,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE;IAAE,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,EACrC,QAAQ,EAAE,OAAO,EAAE,GAClB,OAAO,CAAC,IAAI,CAAC,CAiEf;AA0ID,uFAAuF;AACvF,wBAAsB,sBAAsB,CAC1C,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,QAAQ,CAAC,GAC9C,OAAO,CAAC,OAAO,CAAC,CAyBlB;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,OAAO,EAAE,GAClB;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAqD9C"}

package/dist/npm-scanner.js

@@ -44,6 +44,7 @@ exports.recordNpmNoArtifact = recordNpmNoArtifact;
 exports.recordNpmUnverifiedArtifact = recordNpmUnverifiedArtifact;
 exports.filterNpmFindings = filterNpmFindings;
 exports.scanNpmPackage = scanNpmPackage;
+exports.checkPackageScripts = checkPackageScripts;
 exports.parseRepositoryField = parseRepositoryField;
 exports.checkRepositoryClaim = checkRepositoryClaim;
 exports.verifyNpmDistIntegrity = verifyNpmDistIntegrity;
@@ -61,7 +62,7 @@ const extracted_file_walker_js_1 = require("./extracted-file-walker.js");
 const threat_intel_js_1 = require("./threat-intel.js");
 const install_guard_js_1 = require("./install-guard.js");
 const remote_download_js_1 = require("./remote-download.js");
-const TOOL_VERSION = "5.26.7";
+const TOOL_VERSION = "5.28.0";
 const NPM_REGISTRY = "https://registry.npmjs.org";
 const NPM_REGISTRY_HOST = "registry.npmjs.org";
 const RAW_GITHUB_HOST = "raw.githubusercontent.com";
@@ -232,13 +233,18 @@ function checkPackageName(name, findings) {
 }
 /**
  * Check package.json scripts for suspicious entries.
+ *
+ * Exported for tests: the rest of this path needs a live registry fetch, so
+ * without a direct handle the hook coverage can only be asserted indirectly.
  */
 function checkPackageScripts(pkg, findings) {
     const scripts = pkg.scripts;
     if (!scripts)
         return;
-    const dangerousHooks = ["preinstall", "postinstall", "preuninstall", "postuninstall"];
-    for (const hook of dangerousHooks) {
+    // Shared with scanner.ts and install-hook-scanner.ts so the three paths
+    // cannot drift apart again; see AUTO_RUN_LIFECYCLE_HOOKS for why each name
+    // is in the list and why prepublishOnly is not.
+    for (const hook of patterns_js_1.AUTO_RUN_LIFECYCLE_HOOKS) {
         const script = scripts[hook];
         if (!script)
             continue;