supply-chain-guard 5.27.0 → 5.28.1

package/README.md

@@ -1,10 +1,10 @@
 # supply-chain-guard
 
-Open-source supply-chain security scanner for npm, PyPI, Cargo, Go, RubyGems, Composer, NuGet, Docker, Terraform, VS Code extensions, GitHub Actions and GitHub repositories. Detects malware campaigns (GlassWorm, Vidar, Shai-Hulud), fake AI tool repos, account takeovers, and 350+ threat indicators across all major lockfile formats (npm, pnpm, yarn, bun). Generates CycloneDX 1.6 SBOMs with real dependency inventories, grades SLSA provenance (parses and structurally validates in-toto/DSSE attestations), and correlates findings into attack-chain incidents.
+Open-source supply-chain security scanner for npm, PyPI, Cargo, Go, RubyGems, Composer, NuGet, Docker, Terraform, VS Code extensions, GitHub Actions and GitHub repositories. Detects malware campaigns (GlassWorm, Vidar, Shai-Hulud), fake AI tool repos, account takeovers, and 350+ threat indicators across all major lockfile formats (npm, pnpm, yarn, bun). Generates CycloneDX 1.6 SBOMs with real dependency inventories, grades SLSA provenance (parses and structurally validates in-toto/DSSE attestations), and correlates findings into attack-chain incidents. Supports EU Cyber Resilience Act SBOM and component-documentation work, and NIS2 supply chain risk-management measures.
 
 [![npm version](https://img.shields.io/npm/v/supply-chain-guard?logo=npm)](https://www.npmjs.com/package/supply-chain-guard)
 [![npm downloads](https://img.shields.io/npm/dw/supply-chain-guard?logo=npm&label=weekly%20downloads)](https://www.npmjs.com/package/supply-chain-guard)
-[![Node.js](https://img.shields.io/badge/Node.js-%3E%3D20-green?logo=node.js)](https://nodejs.org)
+[![Node.js](https://img.shields.io/badge/Node.js-%3E%3D22-green?logo=node.js)](https://nodejs.org)
 [![TypeScript](https://img.shields.io/badge/TypeScript-Strict-blue?logo=typescript)](https://www.typescriptlang.org/)
 [![CI](https://img.shields.io/github/actions/workflow/status/homeofe/supply-chain-guard/ci.yml?branch=main&label=CI&logo=github)](https://github.com/homeofe/supply-chain-guard/actions/workflows/ci.yml)
 [![AAHP Verify](https://github.com/homeofe/supply-chain-guard/actions/workflows/aahp-verify.yml/badge.svg)](https://github.com/homeofe/supply-chain-guard/actions/workflows/aahp-verify.yml)
@@ -36,8 +36,11 @@ Open-source supply-chain security scanner for npm, PyPI, Cargo, Go, RubyGems, Co
 - [Install Guard](#install-guard)
 - [Adding Custom Patterns](#adding-custom-patterns)
 - [Architecture](#architecture)
+- [EU Compliance (CRA / NIS2)](#eu-compliance-cra--nis2)
+- [Show that you scan](#show-that-you-scan)
 - [Contributing](#contributing)
 - [Changelog](#changelog)
+- [License](#license)
 
 ## Background
 
@@ -114,6 +117,12 @@ Links individual findings into incident-level attack chains:
 
 ## Installation
 
+**Requires Node.js 22 or newer.** Node 20 reached end of life on
+2026-04-30; it still installs and is still covered by CI as a transition lane, but it
+is out of support and that lane is removed in 5.29.0. Full policy, including what the
+package is published from and what the Action and container image run on:
+[`docs/node-support.md`](docs/node-support.md).
+
 ```bash
 npm install -g supply-chain-guard
 ```
@@ -131,7 +140,7 @@ Run the scanner as a [pre-commit](https://pre-commit.com) hook (Python-ecosystem
 ```yaml
 repos:
   - repo: https://github.com/homeofe/supply-chain-guard
-    rev: v5.27.0
+    rev: v5.28.1
     hooks:
       - id: supply-chain-guard
 ```
@@ -147,7 +156,7 @@ The hook scans the repository root on every commit and fails on high or critical
 Run the scanner without a Node toolchain via the official multi-arch image (linux/amd64, linux/arm64), published to GHCR on every release tag:
 
 ```bash
-docker run --rm -v ${PWD}:/scan ghcr.io/homeofe/supply-chain-guard scan /scan
+docker run --rm -v ${PWD}:/scan ghcr.io/homeofe/supply-chain-guard:5.28.1 scan /scan
 ```
 
 `${PWD}` works in bash, zsh, and PowerShell; in cmd.exe use `%cd%` instead.
@@ -586,8 +595,70 @@ Honest caveats: Socket's registry-wide behavioral detection is deeper than anyth
 - **CI one-two punch**: run `osv-scanner --lockfile=package-lock.json` for known CVEs and MAL- entries, then `supply-chain-guard scan .` for behavioral and campaign-IOC threats in the installed tree. Two axes, one job, both exit-code gated.
 - **Zero-install npm baseline**: `npm audit --audit-level=high` plus `npx supply-chain-guard scan .` covers advisory-known vulnerabilities and unreported malware without adding a single dependency.
 - **Pre-install vetting of a suspicious package**: `guarddog npm scan <pkg>` for an independent heuristic score, plus `supply-chain-guard npm <pkg>` for campaign-IOC and install-hook analysis, before it ever touches your machine.
+## EU Compliance (CRA / NIS2)
+
+supply-chain-guard produces artefacts and findings that **support** compliance
+work under two EU regulations that apply to software manufacturers. It does not
+make an organisation compliant: compliance remains the responsibility of the
+organisation deploying the software, and the mapping below describes what the
+tool produces, not a legal assessment.
+
+### Cyber Resilience Act (CRA)
+
+The CRA requires manufacturers of products with digital elements to identify and
+document the components they ship, to address vulnerabilities in those
+components, and to be able to reason about the integrity of what they build on.
+supply-chain-guard contributes to each of those activities:
+
+- **Component inventory:** generates a [CycloneDX 1.6](https://cyclonedx.org/)
+  SBOM from the real resolved dependency tree, as a machine-readable component
+  list you can attach to technical documentation.
+- **Dependency risk:** detects known-malicious packages and versions,
+  typosquatting, dependency confusion, and compromised publisher activity, at
+  scan time and at install time.
+- **Supply chain integrity:** grades SLSA provenance from levels 0 to 3 by
+  parsing and structurally validating in-toto/DSSE attestations, giving a
+  recorded integrity signal per project.
+
+```bash
+# Write a CycloneDX 1.6 SBOM alongside the scan report
+supply-chain-guard scan ./project --sbom-output sbom.json
+```
+
+Article and paragraph citations are deliberately omitted here. Map these outputs
+to specific provisions against the final published regulation text, with your own
+legal review, rather than against this README.
+
+### NIS2 Directive
+
+NIS2 requires essential and important entities to take measures covering supply
+chain security. The relevant capabilities are:
+
+- **Supply chain risk:** typosquatting, dependency confusion, compromised
+  packages, and malicious GitHub Actions in CI/CD workflows.
+- **Incident evidence:** the correlation engine links individual findings into
+  named attack chains with confidence scores, and reports are exportable as
+  SARIF, JSON, and CycloneDX for retention alongside an incident record.
+- **Configuration exposure:** IaC, Dockerfile, and `.npmrc` / `.yarnrc` scanning
+  surfaces misconfiguration before deployment.
+
+### Operating model
+
+Apache-2.0, no account required, and no telemetry: the scanner reports only to
+its own output. `scan` runs fully offline against the bundled threat feed, so it
+is suitable for air-gapped use. The commands that deliberately reach the network
+are the ones that exist to do so: `supply-chain-guard npm <pkg>` and
+`supply-chain-guard pypi <pkg>` fetch the package under inspection, and the feed
+refresh fetches updated indicators. Offline runs use the feed bundled with the
+installed version, so pin the version you intend to audit against.
+
 ## GitHub Action
 
+**Pin an exact version.** That is the recommended form, and it is the same advice
+this tool gives about your own dependencies: a security scanner should be a
+deterministic input, so you know which detection logic and which IOC feed ran, and
+an upgrade is a reviewable change rather than something that happens to you.
+
 ```yaml
 name: Supply Chain Security
 on: [push, pull_request]
@@ -601,12 +672,37 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: homeofe/supply-chain-guard@v5
+      - uses: homeofe/supply-chain-guard@v5.28.1
         with:
           fail-on: critical
           comment-on-pr: true
 ```
 
+Let Dependabot keep the pin current:
+
+```yaml
+# .github/dependabot.yml
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+```
+
+### `@v5`, and what it does and does not guarantee
+
+`@v5` also works and stays supported. It is a floating **branch**, fast-forwarded
+to each release by CI, and the composite action on it pins an exact npm version
+that is bumped and build-gated on every release. So `@v5` is not `latest`: every
+resolution still installs one exact, release-gated version.
+
+The caveat is what happens after a major. If the v5 line stops being released once
+v6 ships, `@v5` keeps resolving a frozen action that pins an old npm version, and
+the IOC feed it installs stops updating. For a scanner that is a silent
+false-negative generator, and nothing in your workflow would report it. An exact
+pin turns that into a visible out-of-date dependency instead.
+
 ### Action Inputs
 
 | Input | Description | Default |

package/action.yml

@@ -66,7 +66,7 @@ runs:
 
     - name: Install supply-chain-guard
       shell: bash
-      run: npm install -g supply-chain-guard@5.27.0 --ignore-scripts --no-audit --no-fund
+      run: npm install -g supply-chain-guard@5.28.1 --ignore-scripts --no-audit --no-fund
 
     - name: Run scan
       id: scan

package/dist/cli.js

@@ -187,7 +187,7 @@ function assertDistinctOutputPaths(options) {
 program
     .name("supply-chain-guard")
     .description("Open-source supply-chain security scanner. Detects GlassWorm and similar malware campaigns in npm packages, PyPI packages, code repos, VS Code extensions, and project dependencies.")
-    .version("5.27.0");
+    .version("5.28.1");
 // ── scan command ────────────────────────────────────────────────────
 program
     .command("scan")

package/dist/dependency-confusion.js

@@ -49,7 +49,7 @@ const path = __importStar(require("node:path"));
 const https = __importStar(require("node:https"));
 const types_js_1 = require("./types.js");
 const pattern_scanner_js_1 = require("./pattern-scanner.js");
-const TOOL_VERSION = "5.27.0";
+const TOOL_VERSION = "5.28.1";
 const NPM_REGISTRY = "https://registry.npmjs.org";
 const NPM_DOWNLOADS_API = "https://api.npmjs.org/downloads/point/last-week";
 const PYPI_REGISTRY = "https://pypi.org/pypi";

package/dist/install-guard.d.ts

@@ -79,6 +79,14 @@ export interface InstallCommandAnalysis {
  * matcher as mcp-server.ts matchBarePackageIOC.
  */
 export declare function matchBareNpmIOC(name: string, version: string | undefined, feed: FeedIOC[]): FeedIOC | null;
+/**
+ * Reference implementation, kept so the index has something to be proved
+ * against. install-guard.test.ts asserts the two agree across the WHOLE bundled
+ * feed; without that, an index bug becomes a silent false negative in the most
+ * security-critical matcher in the project. Same arrangement as
+ * matchPackageIOCLinear in threat-intel.ts.
+ */
+export declare function matchBareNpmIOCLinear(name: string, version: string | undefined, feed: FeedIOC[]): FeedIOC | null;
 /**
  * Pure analysis of an install command: no spawn, no network, no filesystem
  * writes (loadThreatIntel reads the local feed cache when no feed is given).

package/dist/install-guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"install-guard.d.ts","sourceRoot":"","sources":["../src/install-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EAAoC,KAAK,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAEnF,OAAO,EAA0B,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACxF,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAI1C,OAAO,EAAE,eAAe,EAAE,CAAC;AAM3B,eAAO,MAAM,kBAAkB,YAAI,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAU,CAAC;AAC1E,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC;AAmCjE;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,cAAc,EACvB,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,MAAM,CAER;AAMD,MAAM,WAAW,kBAAkB;IACjC,iDAAiD;IACjD,GAAG,EAAE,MAAM,CAAC;IACZ,6CAA6C;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,qFAAqF;IACrF,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AASD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,kBAAkB,GAAG,IAAI,CAgCvE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,cAAc,EACvB,IAAI,EAAE,MAAM,EAAE,GACb;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,kBAAkB,EAAE,CAAA;CAAE,CAoCtE;AA6BD,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,kBAAkB,CAAC;IACzB,0DAA0D;IAC1D,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,6CAA6C;IAC7C,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,4DAA4D;IAC5D,QAAQ,EAAE,OAAO,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,cAAc,CAAC;IACxB,2EAA2E;IAC3E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iEAAiE;IACjE,WAAW,EAAE,OAAO,CAAC;IACrB,KAAK,EAAE,kBAAkB,EAAE,CAAC;IAC5B,mDAAmD;IACnD,QAAQ,EAAE,mBAAmB,EAAE,CAAC;IAChC,yDAAyD;IACzD,OAAO,EAAE,OAAO,CAAC;IACjB,0DAA0D;IAC1D,MAAM,EAAE,OAAO,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,IAAI,EAAE,OAAO,EAAE,GACd,OAAO,GAAG,IAAI,CAehB;AAwCD;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,CAAC,EAAE,OAAO,EAAE,GACf,sBAAsB,CA2BxB;AAMD,8EAA8E;AAC9E,MAAM,MAAM,SAAS,GAAG,CACtB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,EAAE;IAAE,KAAK,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,KAAK,CAAA;CAAE,KACxC;IAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,KAAK,CAAC,EAAE,KAAK,CAAA;CAAE,CAAC;AAK9C;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAI7D;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAIrD;AA0BD,MAAM,WAAW,mBAAmB;IAClC,+CAA+C;IAC/C,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,oDAAoD;IACpD,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,4DAA4D;IAC5D,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC;IACjB,wEAAwE;IACxE,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,qDAAqD;IACrD,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9B;AA2BD;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EAAE,EACrB,OAAO,GAAE,mBAAwB,GAChC,MAAM,CAyCR"}
+{"version":3,"file":"install-guard.d.ts","sourceRoot":"","sources":["../src/install-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EAAoC,KAAK,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAEnF,OAAO,EAA0B,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACxF,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAI1C,OAAO,EAAE,eAAe,EAAE,CAAC;AAM3B,eAAO,MAAM,kBAAkB,YAAI,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAU,CAAC;AAC1E,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC;AAmCjE;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,cAAc,EACvB,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,MAAM,CAER;AAMD,MAAM,WAAW,kBAAkB;IACjC,iDAAiD;IACjD,GAAG,EAAE,MAAM,CAAC;IACZ,6CAA6C;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,qFAAqF;IACrF,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AASD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,kBAAkB,GAAG,IAAI,CAgCvE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,cAAc,EACvB,IAAI,EAAE,MAAM,EAAE,GACb;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,kBAAkB,EAAE,CAAA;CAAE,CAoCtE;AA6BD,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,kBAAkB,CAAC;IACzB,0DAA0D;IAC1D,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,6CAA6C;IAC7C,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,4DAA4D;IAC5D,QAAQ,EAAE,OAAO,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,cAAc,CAAC;IACxB,2EAA2E;IAC3E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iEAAiE;IACjE,WAAW,EAAE,OAAO,CAAC;IACrB,KAAK,EAAE,kBAAkB,EAAE,CAAC;IAC5B,mDAAmD;IACnD,QAAQ,EAAE,mBAAmB,EAAE,CAAC;IAChC,yDAAyD;IACzD,OAAO,EAAE,OAAO,CAAC;IACjB,0DAA0D;IAC1D,MAAM,EAAE,OAAO,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,IAAI,EAAE,OAAO,EAAE,GACd,OAAO,GAAG,IAAI,CAWhB;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,IAAI,EAAE,OAAO,EAAE,GACd,OAAO,GAAG,IAAI,CAehB;AAmFD;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,CAAC,EAAE,OAAO,EAAE,GACf,sBAAsB,CA2BxB;AAMD,8EAA8E;AAC9E,MAAM,MAAM,SAAS,GAAG,CACtB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,EAAE;IAAE,KAAK,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,KAAK,CAAA;CAAE,KACxC;IAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,KAAK,CAAC,EAAE,KAAK,CAAA;CAAE,CAAC;AAK9C;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAI7D;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAIrD;AA0BD,MAAM,WAAW,mBAAmB;IAClC,+CAA+C;IAC/C,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,oDAAoD;IACpD,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,4DAA4D;IAC5D,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC;IACjB,wEAAwE;IACxE,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,qDAAqD;IACrD,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9B;AA2BD;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EAAE,EACrB,OAAO,GAAE,mBAAwB,GAChC,MAAM,CAyCR"}

package/dist/install-guard.js

@@ -17,6 +17,7 @@ exports.resolveManagerBinary = resolveManagerBinary;
 exports.parseSpecToken = parseSpecToken;
 exports.extractInstallSpecs = extractInstallSpecs;
 exports.matchBareNpmIOC = matchBareNpmIOC;
+exports.matchBareNpmIOCLinear = matchBareNpmIOCLinear;
 exports.analyzeInstallCommand = analyzeInstallCommand;
 exports.escapeCmdShellCommand = escapeCmdShellCommand;
 exports.escapeCmdShellArg = escapeCmdShellArg;
@@ -198,6 +199,27 @@ const WARN_ONLY_RULES = new Set(["DEP_INTERNAL_NAME_PUBLIC"]);
  * matcher as mcp-server.ts matchBarePackageIOC.
  */
 function matchBareNpmIOC(name, version, feed) {
+    // Candidates are held in original feed order, so "first match wins" is
+    // preserved exactly, identical to the linear reference below.
+    const candidates = getBareNpmIndex(feed).get(name);
+    if (!candidates)
+        return null;
+    for (const { ioc, version: iocVersion } of candidates) {
+        if (iocVersion === undefined)
+            return ioc; // bare-name IOC: any version
+        if (version !== undefined && iocVersion === version)
+            return ioc;
+    }
+    return null;
+}
+/**
+ * Reference implementation, kept so the index has something to be proved
+ * against. install-guard.test.ts asserts the two agree across the WHOLE bundled
+ * feed; without that, an index bug becomes a silent false negative in the most
+ * security-critical matcher in the project. Same arrangement as
+ * matchPackageIOCLinear in threat-intel.ts.
+ */
+function matchBareNpmIOCLinear(name, version, feed) {
     for (const ioc of feed) {
         if (ioc.type !== "package")
             continue;
@@ -216,6 +238,42 @@ function matchBareNpmIOC(name, version, feed) {
     }
     return null;
 }
+/**
+ * Lazily-built lookup index over a feed array, keyed by bare npm package name.
+ *
+ * Keyed on the feed array identity via a WeakMap, so a caller-supplied feed and
+ * the memoized shared feed each get their own index and neither leaks. Mirrors
+ * packageIndexCache in threat-intel.ts.
+ *
+ * Why this exists (T-017): the linear scan cost one full pass over the feed PER
+ * CALL, so a scan of N dependencies cost N x feed. The feed grows by 100-200
+ * entries per daily sweep, and collection-reachability.test.ts, which calls the
+ * real matcher once per entry, is quadratic in feed size - it went red on CI
+ * during the v5.25.6 release and was carrying a 30s timeout as a stopgap.
+ */
+const bareNpmIndexCache = new WeakMap();
+function getBareNpmIndex(feed) {
+    const cached = bareNpmIndexCache.get(feed);
+    if (cached)
+        return cached;
+    const index = new Map();
+    for (const ioc of feed) {
+        if (ioc.type !== "package")
+            continue;
+        if (ioc.value.includes(":"))
+            continue;
+        const at = ioc.value.lastIndexOf("@");
+        const iocName = at > 0 ? ioc.value.substring(0, at) : ioc.value;
+        const iocVersion = at > 0 ? ioc.value.substring(at + 1) : undefined;
+        const bucket = index.get(iocName);
+        if (bucket)
+            bucket.push({ ioc, version: iocVersion });
+        else
+            index.set(iocName, [{ ioc, version: iocVersion }]);
+    }
+    bareNpmIndexCache.set(feed, index);
+    return index;
+}
 function checkSpec(spec, feed) {
     const findings = [];
     // 1. Threat-intel package IOCs (bundled + refreshed .scg-cache feed).

package/dist/install-guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"install-guard.js","sourceRoot":"","sources":["../src/install-guard.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;;;;;;;;;;AAEH,2DAA+C;AAC/C,uDAAmF;AACnF,yDAAqD;AACrD,+EAAwF;gGAAvD,6CAAe;AAOhD,8EAA8E;AAC9E,6BAA6B;AAC7B,8EAA8E;AAEjE,QAAA,kBAAkB,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAU,CAAC;AAG1E;;;;;GAKG;AACH,MAAM,aAAa,GAAgD;IACjE,yEAAyE;IACzE,6EAA6E;IAC7E,2CAA2C;IAC3C,GAAG,EAAE,IAAI,GAAG,CAAC;QACX,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ;QAC7D,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS;KACrC,CAAC;IACF,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;IACtC,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;IACtB,GAAG,EAAE,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;CAC3C,CAAC;AAEF,4EAA4E;AAC5E,8EAA8E;AAC9E,gEAAgE;AAChE,oCAAoC;AACpC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC;IAC1B,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,aAAa;IACxE,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,cAAc,EAAE,gBAAgB;IAC5E,YAAY,EAAE,mBAAmB,EAAE,UAAU,EAAE,YAAY,EAAE,cAAc;CAC5E,CAAC,CAAC;AAEH,SAAS,gBAAgB,CAAC,OAAe;IACvC,OAAQ,QAAA,kBAAwC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AACrE,CAAC;AAED;;;GAGG;AACH,8BACE,OAAuB,EACvB,QAAQ,GAAoB,OAAO,CAAC,QAAQ;IAE5C,OAAO,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;AAC3D,CAAC;AAeD;;;;GAIG;AACH,MAAM,gBAAgB,GAAG,yDAAyD,CAAC;AAEnF;;;GAGG;AACH,wBAA+B,KAAa;IAC1C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAE7D,4EAA4E;IAC5E,6EAA6E;IAC7E,+EAA+E;IAC/E,oEAAoE;IACpE,8EAA8E;IAC9E,wEAAwE;IACxE,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACvC,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;QAChB,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAC1C,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC/C,MAAM,KAAK,GAAG,IAAA,6CAAe,EAAC,KAAK,CAAC,SAAS,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;QAC5D,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,OAAO,KAAK,CAAC,OAAO,KAAK,SAAS;YAChC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE;YAClC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;IAC/D,CAAC;IAED,gEAAgE;IAChE,wDAAwD;IACxD,MAAM,EAAE,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACrD,MAAM,OAAO,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAE7D,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,4EAA4E;IAC5E,uCAAuC;IACvC,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAE1F,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AACtF,CAAC;AAED;;;;;;;;;;GAUG;AACH,6BACE,OAAuB,EACvB,IAAc;IAEd,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC;IACjB,IAAI,IAAwB,CAAC;IAE7B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAC7B,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,uEAAuE;YACvE,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM;gBAAE,CAAC,EAAE,CAAC;YACnD,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,SAAS;YAAE,IAAI,GAAG,CAAC,CAAC,CAAC,kCAAkC;QACpE,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAAC,OAAO,GAAG,CAAC,CAAC;YAAC,IAAI,GAAG,CAAC,CAAC;YAAC,MAAM;QAAC,CAAC;QACnD,2EAA2E;QAC3E,IAAI,CAAC,KAAK,QAAQ;YAAE,SAAS;QAC7B,0EAA0E;QAC1E,4CAA4C;QAC5C,MAAM;IACR,CAAC;IAED,IAAI,OAAO,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IAEnE,MAAM,KAAK,GAAyB,EAAE,CAAC;IACvC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;IACrC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,IAAI,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM;gBAAE,CAAC,EAAE,CAAC,CAAC,kBAAkB;YAC1E,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,IAAI;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAC5C,CAAC;AAED,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC;AA2BnF;;;;GAIG;AACH,yBACE,IAAY,EACZ,OAA2B,EAC3B,IAAe;IAEf,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS;YAAE,SAAS;QACrC,gEAAgE;QAChE,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,SAAS;QAEtC,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,OAAO,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;QAChE,MAAM,UAAU,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAEpE,IAAI,OAAO,KAAK,IAAI;YAAE,SAAS;QAC/B,IAAI,UAAU,KAAK,SAAS;YAAE,OAAO,GAAG,CAAC,CAAC,6BAA6B;QACvE,IAAI,OAAO,KAAK,SAAS,IAAI,UAAU,KAAK,OAAO;YAAE,OAAO,GAAG,CAAC;IAClE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,SAAS,CAAC,IAAwB,EAAE,IAAe;IAC1D,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,sEAAsE;IACtE,0EAA0E;IAC1E,0EAA0E;IAC1E,yEAAyE;IACzE,0EAA0E;IAC1E,MAAM,GAAG,GACP,IAAA,iCAAe,EAAC,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC;QACrD,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACjD,IAAI,GAAG,EAAE,CAAC;QACR,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,0BAA0B;YAChC,WAAW,EAAE,sBAAsB,GAAG,CAAC,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;YAChI,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,IAAI,EAAE,IAAI,CAAC,GAAG;YACd,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,QAAQ,EAAE,SAAS;YACnB,cAAc,EAAE,kBAAkB,IAAI,CAAC,GAAG,oDAAoD,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,eAAe,GAAG,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG;SACpJ,CAAC,CAAC;IACL,CAAC;IAED,wEAAwE;IACxE,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,IAAA,kCAAe,EAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC5D,IAAI,GAAG;YAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACrD,CAAC;IAED,2EAA2E;IAC3E,+DAA+D;IAC/D,QAAQ,CAAC,IAAI,CACX,GAAG,IAAA,oDAAsB,EAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,OAAO,IAAI,GAAG,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,CAC1E,CAAC;IAEF,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,+BACE,OAAe,EACf,IAAc,EACd,IAAgB;IAEhB,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,gCAAgC,OAAO,eAAe,QAAA,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YACrF,sDAAsD,CACzD,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACxE,IAAI,CAAC,WAAW,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC5F,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,IAAI,IAAA,iCAAe,GAAE,CAAC;IAC1C,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QAClC,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC1C,OAAO;YACL,IAAI;YACJ,QAAQ;YACR,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC9D,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;SAC9D,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAE3D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC1E,CAAC;AAaD,0EAA0E;AAC1E,MAAM,WAAW,GAAG,0BAA0B,CAAC;AAE/C;;;;;;;GAOG;AACH,+BAAsC,OAAe;IACnD,6EAA6E;IAC7E,uEAAuE;IACvE,OAAO,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;AACzE,CAAC;AAED;;;;;GAKG;AACH,2BAAkC,GAAW;IAC3C,IAAI,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAChD,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC5C,OAAO,IAAI,OAAO,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;AAChF,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,YAAY,GAAc,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE;IACzD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,WAAW,GAAG,CAAC,qBAAqB,CAAC,OAAO,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/F,MAAM,MAAM,GAAG,IAAA,8BAAS,EACtB,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,SAAS,EAChC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,WAAW,GAAG,CAAC,EACtC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,wBAAwB,EAAE,IAAI,EAAE,CACzD,CAAC;QACF,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;IACxD,CAAC;IACD,MAAM,MAAM,GAAG,IAAA,8BAAS,EAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACjD,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;AACxD,CAAC,CAAC;AAeF,SAAS,aAAa,CACpB,QAAgC,EAChC,GAA2B,EAC3B,IAAI,GAA4B,UAAU;IAE1C,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACjE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC3D,MAAM,KAAK,GACT,IAAI,KAAK,UAAU;QACjB,CAAC,CAAC,GAAG,KAAK,aAAa;QACvB,CAAC,CAAC,GAAG,KAAK,sCAAsC,CAAC;IACrD,GAAG,CAAC,EAAE,CAAC,CAAC;IACR,GAAG,CAAC,oBAAoB,KAAK,QAAQ,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,YAAY,CAAC,CAAC;IACpF,KAAK,MAAM,OAAO,IAAI,IAAI,EAAE,CAAC;QAC3B,GAAG,CAAC,EAAE,CAAC,CAAC;QACR,GAAG,CAAC,cAAc,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACtC,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACpC,GAAG,CAAC,QAAQ,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;YACvF,GAAG,CAAC,OAAO,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IACD,GAAG,CAAC,EAAE,CAAC,CAAC;AACV,CAAC;AAED;;;;;;;;;GASG;AACH,yBACE,OAAe,EACf,WAAqB,EACrB,OAAO,GAAwB,EAAE;IAEjC,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,YAAY,CAAC;IAC9C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAEjE,MAAM,QAAQ,GAAG,qBAAqB,CAAC,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAE3E,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACrB,aAAa,CAAC,QAAQ,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;QACzC,mEAAmE;QACnE,aAAa,CAAC,QAAQ,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;QACzC,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,GAAG,CAAC,yCAAyC,CAAC,CAAC;YAC/C,OAAO,CAAC,CAAC;QACX,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACnB,GAAG,CAAC,cAAc,QAAQ,CAAC,OAAO,sEAAsE,CAAC,CAAC;YAC1G,OAAO,CAAC,CAAC;QACX,CAAC;QACD,GAAG,CAAC,qHAAqH,CAAC,CAAC;IAC7H,CAAC;SAAM,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC3B,yEAAyE;QACzE,4EAA4E;QAC5E,6BAA6B;QAC7B,aAAa,CAAC,QAAQ,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;QACzC,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,GAAG,CAAC,iEAAiE,CAAC,CAAC;YACvE,OAAO,CAAC,CAAC;QACX,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QAC1B,GAAG,CACD,8CAA8C,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,WAAW,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,gCAAgC,CAC3H,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,MAAM,GAAG,oBAAoB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAChF,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,iBAAiB,MAAM,KAAK,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;AAC5B,CAAC"}
+{"version":3,"file":"install-guard.js","sourceRoot":"","sources":["../src/install-guard.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;;;;;;;;;;;AAEH,2DAA+C;AAC/C,uDAAmF;AACnF,yDAAqD;AACrD,+EAAwF;gGAAvD,6CAAe;AAOhD,8EAA8E;AAC9E,6BAA6B;AAC7B,8EAA8E;AAEjE,QAAA,kBAAkB,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAU,CAAC;AAG1E;;;;;GAKG;AACH,MAAM,aAAa,GAAgD;IACjE,yEAAyE;IACzE,6EAA6E;IAC7E,2CAA2C;IAC3C,GAAG,EAAE,IAAI,GAAG,CAAC;QACX,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ;QAC7D,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS;KACrC,CAAC;IACF,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;IACtC,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;IACtB,GAAG,EAAE,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;CAC3C,CAAC;AAEF,4EAA4E;AAC5E,8EAA8E;AAC9E,gEAAgE;AAChE,oCAAoC;AACpC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC;IAC1B,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,aAAa;IACxE,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,cAAc,EAAE,gBAAgB;IAC5E,YAAY,EAAE,mBAAmB,EAAE,UAAU,EAAE,YAAY,EAAE,cAAc;CAC5E,CAAC,CAAC;AAEH,SAAS,gBAAgB,CAAC,OAAe;IACvC,OAAQ,QAAA,kBAAwC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AACrE,CAAC;AAED;;;GAGG;AACH,8BACE,OAAuB,EACvB,QAAQ,GAAoB,OAAO,CAAC,QAAQ;IAE5C,OAAO,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;AAC3D,CAAC;AAeD;;;;GAIG;AACH,MAAM,gBAAgB,GAAG,yDAAyD,CAAC;AAEnF;;;GAGG;AACH,wBAA+B,KAAa;IAC1C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAE7D,4EAA4E;IAC5E,6EAA6E;IAC7E,+EAA+E;IAC/E,oEAAoE;IACpE,8EAA8E;IAC9E,wEAAwE;IACxE,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACvC,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;QAChB,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAC1C,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC/C,MAAM,KAAK,GAAG,IAAA,6CAAe,EAAC,KAAK,CAAC,SAAS,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;QAC5D,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,OAAO,KAAK,CAAC,OAAO,KAAK,SAAS;YAChC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE;YAClC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;IAC/D,CAAC;IAED,gEAAgE;IAChE,wDAAwD;IACxD,MAAM,EAAE,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACrD,MAAM,OAAO,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAE7D,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,4EAA4E;IAC5E,uCAAuC;IACvC,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAE1F,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AACtF,CAAC;AAED;;;;;;;;;;GAUG;AACH,6BACE,OAAuB,EACvB,IAAc;IAEd,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC;IACjB,IAAI,IAAwB,CAAC;IAE7B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAC7B,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,uEAAuE;YACvE,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM;gBAAE,CAAC,EAAE,CAAC;YACnD,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,SAAS;YAAE,IAAI,GAAG,CAAC,CAAC,CAAC,kCAAkC;QACpE,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAAC,OAAO,GAAG,CAAC,CAAC;YAAC,IAAI,GAAG,CAAC,CAAC;YAAC,MAAM;QAAC,CAAC;QACnD,2EAA2E;QAC3E,IAAI,CAAC,KAAK,QAAQ;YAAE,SAAS;QAC7B,0EAA0E;QAC1E,4CAA4C;QAC5C,MAAM;IACR,CAAC;IAED,IAAI,OAAO,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IAEnE,MAAM,KAAK,GAAyB,EAAE,CAAC;IACvC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;IACrC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,IAAI,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM;gBAAE,CAAC,EAAE,CAAC,CAAC,kBAAkB;YAC1E,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,IAAI;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAC5C,CAAC;AAED,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC;AA2BnF;;;;GAIG;AACH,yBACE,IAAY,EACZ,OAA2B,EAC3B,IAAe;IAEf,uEAAuE;IACvE,8DAA8D;IAC9D,MAAM,UAAU,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACnD,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAE7B,KAAK,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,UAAU,EAAE,CAAC;QACtD,IAAI,UAAU,KAAK,SAAS;YAAE,OAAO,GAAG,CAAC,CAAC,6BAA6B;QACvE,IAAI,OAAO,KAAK,SAAS,IAAI,UAAU,KAAK,OAAO;YAAE,OAAO,GAAG,CAAC;IAClE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,+BACE,IAAY,EACZ,OAA2B,EAC3B,IAAe;IAEf,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS;YAAE,SAAS;QACrC,gEAAgE;QAChE,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,SAAS;QAEtC,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,OAAO,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;QAChE,MAAM,UAAU,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAEpE,IAAI,OAAO,KAAK,IAAI;YAAE,SAAS;QAC/B,IAAI,UAAU,KAAK,SAAS;YAAE,OAAO,GAAG,CAAC,CAAC,6BAA6B;QACvE,IAAI,OAAO,KAAK,SAAS,IAAI,UAAU,KAAK,OAAO;YAAE,OAAO,GAAG,CAAC;IAClE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAQD;;;;;;;;;;;;GAYG;AACH,MAAM,iBAAiB,GAAG,IAAI,OAAO,EAA+C,CAAC;AAErF,SAAS,eAAe,CAAC,IAAe;IACtC,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,MAAM,KAAK,GAAG,IAAI,GAAG,EAA+B,CAAC;IACrD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS;YAAE,SAAS;QACrC,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,SAAS;QAEtC,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,OAAO,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;QAChE,MAAM,UAAU,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAEpE,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,MAAM;YAAE,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;;YACjD,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;IAC1D,CAAC;IAED,iBAAiB,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACnC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,SAAS,CAAC,IAAwB,EAAE,IAAe;IAC1D,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,sEAAsE;IACtE,0EAA0E;IAC1E,0EAA0E;IAC1E,yEAAyE;IACzE,0EAA0E;IAC1E,MAAM,GAAG,GACP,IAAA,iCAAe,EAAC,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC;QACrD,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACjD,IAAI,GAAG,EAAE,CAAC;QACR,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,0BAA0B;YAChC,WAAW,EAAE,sBAAsB,GAAG,CAAC,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;YAChI,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,IAAI,EAAE,IAAI,CAAC,GAAG;YACd,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,QAAQ,EAAE,SAAS;YACnB,cAAc,EAAE,kBAAkB,IAAI,CAAC,GAAG,oDAAoD,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,eAAe,GAAG,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG;SACpJ,CAAC,CAAC;IACL,CAAC;IAED,wEAAwE;IACxE,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,IAAA,kCAAe,EAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC5D,IAAI,GAAG;YAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACrD,CAAC;IAED,2EAA2E;IAC3E,+DAA+D;IAC/D,QAAQ,CAAC,IAAI,CACX,GAAG,IAAA,oDAAsB,EAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,OAAO,IAAI,GAAG,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,CAC1E,CAAC;IAEF,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,+BACE,OAAe,EACf,IAAc,EACd,IAAgB;IAEhB,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,gCAAgC,OAAO,eAAe,QAAA,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YACrF,sDAAsD,CACzD,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACxE,IAAI,CAAC,WAAW,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC5F,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,IAAI,IAAA,iCAAe,GAAE,CAAC;IAC1C,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QAClC,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC1C,OAAO;YACL,IAAI;YACJ,QAAQ;YACR,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC9D,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;SAC9D,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAE3D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC1E,CAAC;AAaD,0EAA0E;AAC1E,MAAM,WAAW,GAAG,0BAA0B,CAAC;AAE/C;;;;;;;GAOG;AACH,+BAAsC,OAAe;IACnD,6EAA6E;IAC7E,uEAAuE;IACvE,OAAO,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;AACzE,CAAC;AAED;;;;;GAKG;AACH,2BAAkC,GAAW;IAC3C,IAAI,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAChD,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC5C,OAAO,IAAI,OAAO,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;AAChF,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,YAAY,GAAc,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE;IACzD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,WAAW,GAAG,CAAC,qBAAqB,CAAC,OAAO,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/F,MAAM,MAAM,GAAG,IAAA,8BAAS,EACtB,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,SAAS,EAChC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,WAAW,GAAG,CAAC,EACtC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,wBAAwB,EAAE,IAAI,EAAE,CACzD,CAAC;QACF,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;IACxD,CAAC;IACD,MAAM,MAAM,GAAG,IAAA,8BAAS,EAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACjD,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;AACxD,CAAC,CAAC;AAeF,SAAS,aAAa,CACpB,QAAgC,EAChC,GAA2B,EAC3B,IAAI,GAA4B,UAAU;IAE1C,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACjE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC3D,MAAM,KAAK,GACT,IAAI,KAAK,UAAU;QACjB,CAAC,CAAC,GAAG,KAAK,aAAa;QACvB,CAAC,CAAC,GAAG,KAAK,sCAAsC,CAAC;IACrD,GAAG,CAAC,EAAE,CAAC,CAAC;IACR,GAAG,CAAC,oBAAoB,KAAK,QAAQ,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,YAAY,CAAC,CAAC;IACpF,KAAK,MAAM,OAAO,IAAI,IAAI,EAAE,CAAC;QAC3B,GAAG,CAAC,EAAE,CAAC,CAAC;QACR,GAAG,CAAC,cAAc,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACtC,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACpC,GAAG,CAAC,QAAQ,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;YACvF,GAAG,CAAC,OAAO,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IACD,GAAG,CAAC,EAAE,CAAC,CAAC;AACV,CAAC;AAED;;;;;;;;;GASG;AACH,yBACE,OAAe,EACf,WAAqB,EACrB,OAAO,GAAwB,EAAE;IAEjC,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,YAAY,CAAC;IAC9C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAEjE,MAAM,QAAQ,GAAG,qBAAqB,CAAC,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAE3E,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACrB,aAAa,CAAC,QAAQ,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;QACzC,mEAAmE;QACnE,aAAa,CAAC,QAAQ,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;QACzC,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,GAAG,CAAC,yCAAyC,CAAC,CAAC;YAC/C,OAAO,CAAC,CAAC;QACX,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACnB,GAAG,CAAC,cAAc,QAAQ,CAAC,OAAO,sEAAsE,CAAC,CAAC;YAC1G,OAAO,CAAC,CAAC;QACX,CAAC;QACD,GAAG,CAAC,qHAAqH,CAAC,CAAC;IAC7H,CAAC;SAAM,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC3B,yEAAyE;QACzE,4EAA4E;QAC5E,6BAA6B;QAC7B,aAAa,CAAC,QAAQ,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;QACzC,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,GAAG,CAAC,iEAAiE,CAAC,CAAC;YACvE,OAAO,CAAC,CAAC;QACX,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QAC1B,GAAG,CACD,8CAA8C,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,WAAW,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,gCAAgC,CAC3H,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,MAAM,GAAG,oBAAoB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAChF,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,iBAAiB,MAAM,KAAK,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;AAC5B,CAAC"}

package/dist/ioc-blocklist.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ioc-blocklist.d.ts","sourceRoot":"","sources":["../src/ioc-blocklist.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,eAAO,MAAM,gBAAgB,EAAE,MAAM,EA2UpC,CAAC;AAMF,eAAO,MAAM,YAAY,EAAE,MAAM,EAgIhC,CAAC;AAMF,eAAO,MAAM,gBAAgB,EAAE,MAAM,EA8IpC,CAAC;AAMF,eAAO,MAAM,sBAAsB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAyWzD,CAAC;AAMF,eAAO,MAAM,+BAA+B,EAAE,MAAM,EA+InD,CAAC;AAMF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAqEnD,CAAC;AAkDF;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE9D;AA6BD,eAAO,MAAM,sBAAsB,EAAE,MAAM,CAAC,MAAM,EAAE;IAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CA61B9F,CAAC;AAMF,eAAO,MAAM,uBAAuB,EAAE,MAAM,CAAC,MAAM,EAAE;IAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAmO/F,CAAC;AAOF,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAW1C,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,GACnB,OAAO,EAAE,CA+FX;AAED;;GAEG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,KAAK,GAAG,MAAM,GAAG,MAAM,GAAG,UAAU,GAAG,OAAO,GAAG,OAAO,GAAG,IAAI,GAAG,SAAS,GACrF,OAAO,GAAG,IAAI,CAoChB;AAqCD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,MAAM,EAIpB,KAAK,GAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAwB,GAChD,OAAO,EAAE,CAiBX"}
+{"version":3,"file":"ioc-blocklist.d.ts","sourceRoot":"","sources":["../src/ioc-blocklist.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,eAAO,MAAM,gBAAgB,EAAE,MAAM,EAgVpC,CAAC;AAMF,eAAO,MAAM,YAAY,EAAE,MAAM,EA4IhC,CAAC;AAMF,eAAO,MAAM,gBAAgB,EAAE,MAAM,EA8IpC,CAAC;AAMF,eAAO,MAAM,sBAAsB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAkXzD,CAAC;AAMF,eAAO,MAAM,+BAA+B,EAAE,MAAM,EA+InD,CAAC;AAMF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAqEnD,CAAC;AAkDF;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE9D;AA6BD,eAAO,MAAM,sBAAsB,EAAE,MAAM,CAAC,MAAM,EAAE;IAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CA61B9F,CAAC;AAMF,eAAO,MAAM,uBAAuB,EAAE,MAAM,CAAC,MAAM,EAAE;IAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAmO/F,CAAC;AAOF,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAW1C,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,GACnB,OAAO,EAAE,CA+FX;AAED;;GAEG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,KAAK,GAAG,MAAM,GAAG,MAAM,GAAG,UAAU,GAAG,OAAO,GAAG,OAAO,GAAG,IAAI,GAAG,SAAS,GACrF,OAAO,GAAG,IAAI,CAoChB;AAqCD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,MAAM,EAIpB,KAAK,GAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAwB,GAChD,OAAO,EAAE,CAiBX"}

package/dist/ioc-blocklist.js

@@ -307,6 +307,11 @@ exports.KNOWN_C2_DOMAINS = [
     // Lookalike of registry[.]npmjs[.]org, used by @polymarkets/clob-client-v2 to
     // serve a trojanized inquirer tarball through a direct dependency URL.
     "registrynpmjs.to",
+    // arrayref / proc-macro1 crates.io build-time dropper (August 2026). The VPS
+    // hostname that served the stage-2 binary while `cargo build` ran. Only this
+    // specific attacker host is listed; the hostwindsdns[.]com apex is a shared
+    // hosting-provider domain and is deliberately NOT listed.
+    "hwsrv-798836.hostwindsdns.com",
 ];
 // ---------------------------------------------------------------------------
 // Known malicious C2 IPs
@@ -417,6 +422,18 @@ exports.KNOWN_C2_IPS = [
     // is NOT blocked, and two further addresses the sources disagree on are left out.
     "83.142.209.203",
     "83.142.209.11",
+    // arrayref / proc-macro1 crates.io build-time dropper (August 2026). The
+    // poisoned build.rs pulled stage 2 from :9089 and beaconed to :443 on the
+    // first address; the other two served stage-2 C2. Corroborated by
+    // StepSecurity, Wiz and safedep. The maintainer whose crates.io account was
+    // abused to publish arrayref 0.3.10, internment 0.8.7 and append-only-vec
+    // 0.1.9 is a VICTIM and is not listed anywhere in this file.
+    "23.254.165.112",
+    "23.254.167.107",
+    "23.254.167.216",
+    // Same campaign, reported by Wiz only - single-source, so the matching feed
+    // entry carries confidence 0.85 rather than 1.0.
+    "23.254.167.13",
 ];
 // ---------------------------------------------------------------------------
 // Known dead-drop resolver URLs
@@ -883,6 +900,15 @@ exports.KNOWN_MALICIOUS_HASHES = {
     // pins already cover a registry install; these catch a vendored or mirrored copy.
     "6d332f814f15f19758d65026bbfd0a8c49671b319ec77b8fa1b27fc48afff7d9": "Mini Shai-Hulud / Miasma 'Hades' PyPI wave: langchain-core-mcp 1.4.2 artifact, wheel or .pth startup hook (SHA256)",
     "6506d31707a39949f89534bf9705bcf889f1ecae3dbc6f4ff88d67a8be3d01b2": "Mini Shai-Hulud / Miasma 'Hades' PyPI wave: langchain-core-mcp 1.4.2 artifact, wheel or .pth startup hook (SHA256)",
+    // arrayref / proc-macro1 crates.io build-time dropper (August 2026). The .crate
+    // artifacts themselves. The cargo: package@version pins already cover a registry
+    // install, so these catch a vendored, mirrored or offline copy. Each digest was
+    // re-verified character-for-character against two independent write-ups
+    // (StepSecurity, Wiz) after a third extraction returned a corrupted, non-hex
+    // rendering of the 1.0.106 digest.
+    "25ad700976873c76af785cb99b33c48db7df8b81f21d1e9e06b3676b9a9373ae": "arrayref 0.3.10 poisoned .crate artifact, build-time dropper (SHA256)",
+    "61198155da51b838772eecf5bfaac6cbc4dcc388dccc56658fc28a8e831b34d4": "proc-macro1 1.0.107 .crate artifact, build-time dropper (SHA256)",
+    "b5c1b5b0763a8809a644a8f92224653f0aca623a98eecc714d27f74b80fbe436": "proc-macro1 1.0.106 .crate artifact, build-time dropper (SHA256)",
 };
 // ---------------------------------------------------------------------------
 // Known malicious GitHub accounts