supply-chain-guard 6.0.13 → 6.0.15

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (16) hide show
  1. package/README.md +4 -4
  2. package/action.yml +1 -1
  3. package/dist/cli.js +1 -1
  4. package/dist/dependency-confusion.js +1 -1
  5. package/dist/npm-scanner.js +1 -1
  6. package/dist/pypi-scanner.js +1 -1
  7. package/dist/reporter.js +12 -12
  8. package/dist/sbom-generator.js +1 -1
  9. package/dist/scanner.js +1 -1
  10. package/dist/threat-intel.d.ts +1 -1
  11. package/dist/threat-intel.d.ts.map +1 -1
  12. package/dist/threat-intel.js +90 -2
  13. package/dist/threat-intel.js.map +1 -1
  14. package/dist/vscode-scanner.js +1 -1
  15. package/package.json +1 -1
  16. package/self-scan-manifest.json +4 -4
package/README.md CHANGED
@@ -142,7 +142,7 @@ Run the scanner as a [pre-commit](https://pre-commit.com) hook (Python-ecosystem
142
142
  ```yaml
143
143
  repos:
144
144
  - repo: https://github.com/homeofe/supply-chain-guard
145
- rev: v6.0.13
145
+ rev: v6.0.15
146
146
  hooks:
147
147
  - id: supply-chain-guard
148
148
  ```
@@ -174,7 +174,7 @@ The hook scans the repository root on every commit and fails on high or critical
174
174
  Run the scanner without a Node toolchain via the official multi-arch image (linux/amd64, linux/arm64), published to GHCR on every release tag:
175
175
 
176
176
  ```bash
177
- docker run --rm -v ${PWD}:/scan ghcr.io/homeofe/supply-chain-guard:6.0.13 scan /scan
177
+ docker run --rm -v ${PWD}:/scan ghcr.io/homeofe/supply-chain-guard:6.0.15 scan /scan
178
178
  ```
179
179
 
180
180
  `${PWD}` works in bash, zsh, and PowerShell; in cmd.exe use `%cd%` instead.
@@ -859,7 +859,7 @@ jobs:
859
859
  runs-on: ubuntu-latest
860
860
  steps:
861
861
  - uses: actions/checkout@v4
862
- - uses: homeofe/supply-chain-guard@v6.0.13
862
+ - uses: homeofe/supply-chain-guard@v6.0.15
863
863
  with:
864
864
  fail-on: critical
865
865
  comment-on-pr: true
@@ -947,7 +947,7 @@ two are never confused. If a deliberately frozen rule set is the intent, exclude
947
947
  the rule by name:
948
948
 
949
949
  ```yaml
950
- - uses: homeofe/supply-chain-guard@v6.0.13
950
+ - uses: homeofe/supply-chain-guard@v6.0.15
951
951
  with:
952
952
  exclude-rules: THREAT_FEED_STALE
953
953
  ```
package/action.yml CHANGED
@@ -80,7 +80,7 @@ runs:
80
80
 
81
81
  - name: Install supply-chain-guard
82
82
  shell: bash
83
- run: npm install -g supply-chain-guard@6.0.13 --ignore-scripts --no-audit --no-fund
83
+ run: npm install -g supply-chain-guard@6.0.15 --ignore-scripts --no-audit --no-fund
84
84
 
85
85
  - name: Run scan
86
86
  id: scan
package/dist/cli.js CHANGED
@@ -187,7 +187,7 @@ function assertDistinctOutputPaths(options) {
187
187
  program
188
188
  .name("supply-chain-guard")
189
189
  .description("Open-source supply-chain security scanner. Detects GlassWorm and similar malware campaigns in npm packages, PyPI packages, code repos, VS Code extensions, and project dependencies.")
190
- .version("6.0.13");
190
+ .version("6.0.15");
191
191
  // ── scan command ────────────────────────────────────────────────────
192
192
  program
193
193
  .command("scan")
package/dist/dependency-confusion.js CHANGED
@@ -50,7 +50,7 @@ const https = __importStar(require("node:https"));
50
50
  const types_js_1 = require("./types.js");
51
51
  const pattern_scanner_js_1 = require("./pattern-scanner.js");
52
52
  const json_utils_js_1 = require("./json-utils.js");
53
- const TOOL_VERSION = "6.0.13";
53
+ const TOOL_VERSION = "6.0.15";
54
54
  const NPM_REGISTRY = "https://registry.npmjs.org";
55
55
  const NPM_DOWNLOADS_API = "https://api.npmjs.org/downloads/point/last-week";
56
56
  const PYPI_REGISTRY = "https://pypi.org/pypi";
package/dist/npm-scanner.js CHANGED
@@ -65,7 +65,7 @@ const threat_intel_js_1 = require("./threat-intel.js");
65
65
  const install_guard_js_1 = require("./install-guard.js");
66
66
  const json_utils_js_1 = require("./json-utils.js");
67
67
  const remote_download_js_1 = require("./remote-download.js");
68
- const TOOL_VERSION = "6.0.13";
68
+ const TOOL_VERSION = "6.0.15";
69
69
  const NPM_REGISTRY = "https://registry.npmjs.org";
70
70
  const NPM_REGISTRY_HOST = "registry.npmjs.org";
71
71
  const RAW_GITHUB_HOST = "raw.githubusercontent.com";
package/dist/pypi-scanner.js CHANGED
@@ -56,7 +56,7 @@ const patterns_js_1 = require("./patterns.js");
56
56
  const pattern_scanner_js_1 = require("./pattern-scanner.js");
57
57
  const extracted_file_walker_js_1 = require("./extracted-file-walker.js");
58
58
  const remote_download_js_1 = require("./remote-download.js");
59
- const TOOL_VERSION = "6.0.13";
59
+ const TOOL_VERSION = "6.0.15";
60
60
  const PYPI_API = "https://pypi.org/pypi";
61
61
  const PYPI_METADATA_HOST = "pypi.org";
62
62
  const PYPI_ARTIFACT_HOST = "files.pythonhosted.org";
package/dist/reporter.js CHANGED
@@ -235,7 +235,7 @@ function formatJson(report) {
235
235
  function formatText(report, options = {}) {
236
236
  const lines = [];
237
237
  // ── layout constants ───────────────────────────────────────────────────────
238
- const VERSION = "6.0.13";
238
+ const VERSION = "6.0.15";
239
239
  const W = 76; // visible chars between "│ " and " │" (total line = 80)
240
240
  // ── ANSI helpers ───────────────────────────────────────────────────────────
241
241
  const stripAnsi = (s) => s.replace(/\x1b\[[0-9;]*m/g, "");
@@ -663,7 +663,7 @@ function formatMarkdown(report) {
663
663
  lines.push("");
664
664
  lines.push(`| Property | Value |`);
665
665
  lines.push(`|----------|-------|`);
666
- lines.push(`| Tool | \`${mdCell(report.tool || "supply-chain-guard v6.0.13")}\` |`);
666
+ lines.push(`| Tool | \`${mdCell(report.tool || "supply-chain-guard v6.0.15")}\` |`);
667
667
  lines.push(`| Target | \`${mdCell(report.target)}\` |`);
668
668
  lines.push(`| Type | ${mdText(report.scanType)} |`);
669
669
  lines.push(`| Time | ${mdText(report.timestamp)} |`);
@@ -911,7 +911,7 @@ function formatSarif(report) {
911
911
  tool: {
912
912
  driver: {
913
913
  name: "supply-chain-guard",
914
- version: "6.0.13",
914
+ version: "6.0.15",
915
915
  informationUri: "https://github.com/homeofe/supply-chain-guard",
916
916
  rules,
917
917
  },
@@ -1120,7 +1120,7 @@ function formatSbom(report) {
1120
1120
  ...(properties.length > 0 ? { properties } : {}),
1121
1121
  };
1122
1122
  });
1123
- const annotations = buildIncidentAnnotations(report.incidents, subjectsByIncident, metadata.timestamp, metadata.tools.components[0]?.version ?? "6.0.13");
1123
+ const annotations = buildIncidentAnnotations(report.incidents, subjectsByIncident, metadata.timestamp, metadata.tools.components[0]?.version ?? "6.0.15");
1124
1124
  const withVulns = {
1125
1125
  ...document,
1126
1126
  metadata: {
@@ -1169,7 +1169,7 @@ function formatSbom(report) {
1169
1169
  ...(properties.length > 0 ? { properties } : {}),
1170
1170
  };
1171
1171
  });
1172
- const fallbackAnnotations = buildIncidentAnnotations(report.incidents, fallbackSubjectsByIncident, report.timestamp, "6.0.13");
1172
+ const fallbackAnnotations = buildIncidentAnnotations(report.incidents, fallbackSubjectsByIncident, report.timestamp, "6.0.15");
1173
1173
  const sbom = {
1174
1174
  bomFormat: "CycloneDX",
1175
1175
  specVersion: "1.6",
@@ -1179,7 +1179,7 @@ function formatSbom(report) {
1179
1179
  timestamp: report.timestamp,
1180
1180
  tools: {
1181
1181
  components: [
1182
- { type: "application", name: "supply-chain-guard", version: "6.0.13" },
1182
+ { type: "application", name: "supply-chain-guard", version: "6.0.15" },
1183
1183
  ],
1184
1184
  },
1185
1185
  component: {
@@ -1255,8 +1255,8 @@ function formatBadge(report) {
1255
1255
  label: "supply-chain-guard",
1256
1256
  message,
1257
1257
  color,
1258
- tool: report.tool || "supply-chain-guard v6.0.13",
1259
- version: report.tool ? (report.tool.includes("@") ? report.tool.split("@")[1] : report.tool.replace(/^supply-chain-guard v?/, "")) : "6.0.13",
1258
+ tool: report.tool || "supply-chain-guard v6.0.15",
1259
+ version: report.tool ? (report.tool.includes("@") ? report.tool.split("@")[1] : report.tool.replace(/^supply-chain-guard v?/, "")) : "6.0.15",
1260
1260
  timestamp: report.timestamp,
1261
1261
  commit: report.commit ?? "none",
1262
1262
  detectionSet: report.detectionSet,
@@ -1312,7 +1312,7 @@ function formatGitlab(report) {
1312
1312
  name: "supply-chain-guard",
1313
1313
  url: "https://github.com/homeofe/supply-chain-guard",
1314
1314
  vendor: { name: "supply-chain-guard" },
1315
- version: "6.0.13",
1315
+ version: "6.0.15",
1316
1316
  };
1317
1317
  const vulnerabilities = report.findings
1318
1318
  .filter((f) => !f.suppressed)
@@ -1434,7 +1434,7 @@ function formatJunit(report) {
1434
1434
  // (unreleased, issue 205): the coverage properties are ALWAYS emitted, so a JUnit
1435
1435
  // artefact states its own denominator instead of only what was found.
1436
1436
  lines.push(" <properties>");
1437
- lines.push(` <property name="supply-chain-guard:tool-version" value="${xmlEscape(report.tool || "supply-chain-guard v6.0.13")}"/>`);
1437
+ lines.push(` <property name="supply-chain-guard:tool-version" value="${xmlEscape(report.tool || "supply-chain-guard v6.0.15")}"/>`);
1438
1438
  lines.push(` <property name="supply-chain-guard:timestamp" value="${xmlEscape(report.timestamp)}"/>`);
1439
1439
  lines.push(` <property name="supply-chain-guard:commit" value="${xmlEscape(report.commit ?? "none (not a git repository)")}"/>`);
1440
1440
  if (report.detectionSet) {
@@ -1560,7 +1560,7 @@ footer{text-align:center;padding:24px;color:#94a3b8;font-size:13px}
1560
1560
  <body>
1561
1561
  <div class="container">
1562
1562
  <header>
1563
- <h1>${escapeHtml(report.tool || "supply-chain-guard v6.0.13")} Scan Report</h1>
1563
+ <h1>${escapeHtml(report.tool || "supply-chain-guard v6.0.15")} Scan Report</h1>
1564
1564
  <div class="meta">
1565
1565
  <span>Target: ${escapeHtml(report.target)}</span>
1566
1566
  <span>Type: ${report.scanType}</span>
@@ -1621,7 +1621,7 @@ footer{text-align:center;padding:24px;color:#94a3b8;font-size:13px}
1621
1621
  ` : ""}
1622
1622
 
1623
1623
  <footer>
1624
- Generated by <a href="https://github.com/homeofe/supply-chain-guard">${escapeHtml(report.tool || "supply-chain-guard v6.0.13")}</a>
1624
+ Generated by <a href="https://github.com/homeofe/supply-chain-guard">${escapeHtml(report.tool || "supply-chain-guard v6.0.15")}</a>
1625
1625
  </footer>
1626
1626
  </div>
1627
1627
  <script>
package/dist/sbom-generator.js CHANGED
@@ -87,7 +87,7 @@ const fs = __importStar(require("node:fs"));
87
87
  const path = __importStar(require("node:path"));
88
88
  const node_crypto_1 = require("node:crypto");
89
89
  const json_utils_js_1 = require("./json-utils.js");
90
- const TOOL_VERSION = "6.0.13";
90
+ const TOOL_VERSION = "6.0.15";
91
91
  /** bom-ref of the component the document is about. */
92
92
  const SUBJECT_BOM_REF = "target";
93
93
  /** Property namespace, matching the `supply-chain-guard:scan-status` property reporter.ts adds. */
package/dist/scanner.js CHANGED
@@ -100,7 +100,7 @@ const dependency_confusion_js_1 = require("./dependency-confusion.js");
100
100
  const mcp_scanner_js_1 = require("./mcp-scanner.js");
101
101
  const skills_scanner_js_1 = require("./skills-scanner.js");
102
102
  const self_scan_trust_js_1 = require("./self-scan-trust.js");
103
- const TOOL_VERSION = "6.0.13";
103
+ const TOOL_VERSION = "6.0.15";
104
104
  /**
105
105
  * Pattern literals in this matcher module deliberately spell out signatures
106
106
  * that the public scanner detects. Suppress only those exact rule definitions
package/dist/threat-intel.d.ts CHANGED
@@ -24,7 +24,7 @@ export type FeedIOCInput = Omit<FeedIOC, "confidence"> & {
24
24
  * Generation timestamp for the bundled IOC feed (v5.29, issue #208).
25
25
  * Pure function of feed updates; preserved across builds.
26
26
  */
27
- export declare const FEED_GENERATED_AT = "2026-09-05T00:00:00.000Z";
27
+ export declare const FEED_GENERATED_AT = "2026-09-07T00:00:00.000Z";
28
28
  export declare const CACHE_DIR = ".scg-cache";
29
29
  export declare const FEED_CACHE_FILE = "threat-feed.json";
30
30
  /**
package/dist/threat-intel.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"threat-intel.d.ts","sourceRoot":"","sources":["../src/threat-intel.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAqB,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAMrF,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,QAAQ,GAAG,IAAI,GAAG,KAAK,GAAG,MAAM,GAAG,SAAS,CAAC;IACnD,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;IAC1D,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,+EAA+E;AAC/E,MAAM,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,GAAG;IACvD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,iBAAiB,6BAA6B,CAAC;AA+tpB5D,eAAO,MAAM,SAAS,eAAe,CAAC;AACtC,eAAO,MAAM,eAAe,qBAAqB,CAAC;AAelD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,kBAAkB;;;;EAI7B,CAAC;AAEH,+DAA+D;AAC/D,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,IAAI,OAAO,EAAE,CAE1C;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAgB,iBAAiB,IAAI,SAAS,OAAO,EAAE,CAEtD;AAeD,4EAA4E;AAC5E,MAAM,WAAW,cAAc;IAC7B,oDAAoD;IACpD,OAAO,EAAE,OAAO,CAAC;IACjB,gDAAgD;IAChD,UAAU,EAAE,MAAM,CAAC;IACnB,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,KAAK,EAAE,OAAO,CAAC;CAChB;AAID;;;;;;GAMG;AACH,wBAAgB,iBAAiB,IAAI,cAAc,CAElD;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,IAAI,IAAI,CAE5C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,CAAC,EAAE,MAAM,EACjB,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,EAAE,CA0DX;AAqDD;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM,EACjB,cAAc,GAAE,kBAAuB,GACtC,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAqC3C;AAkBD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAwBhF;AAsID;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,YAAY,CAgDpE;AAED,kFAAkF;AAClF,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAa7D;AASD,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,OAAO,EAAE,GACd,OAAO,EAAE,CAiEX;AAMD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,eAAe,CAC7B,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE,OAAO,EAAE,GACf,OAAO,GAAG,IAAI,CAuBhB;AAiHD;;GAEG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,sBAAsB,CAiCnF"}
1
+ {"version":3,"file":"threat-intel.d.ts","sourceRoot":"","sources":["../src/threat-intel.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAqB,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAMrF,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,QAAQ,GAAG,IAAI,GAAG,KAAK,GAAG,MAAM,GAAG,SAAS,CAAC;IACnD,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;IAC1D,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,+EAA+E;AAC/E,MAAM,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,GAAG;IACvD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,iBAAiB,6BAA6B,CAAC;AAyzpB5D,eAAO,MAAM,SAAS,eAAe,CAAC;AACtC,eAAO,MAAM,eAAe,qBAAqB,CAAC;AAelD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,kBAAkB;;;;EAI7B,CAAC;AAEH,+DAA+D;AAC/D,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,IAAI,OAAO,EAAE,CAE1C;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAgB,iBAAiB,IAAI,SAAS,OAAO,EAAE,CAEtD;AAeD,4EAA4E;AAC5E,MAAM,WAAW,cAAc;IAC7B,oDAAoD;IACpD,OAAO,EAAE,OAAO,CAAC;IACjB,gDAAgD;IAChD,UAAU,EAAE,MAAM,CAAC;IACnB,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,KAAK,EAAE,OAAO,CAAC;CAChB;AAID;;;;;;GAMG;AACH,wBAAgB,iBAAiB,IAAI,cAAc,CAElD;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,IAAI,IAAI,CAE5C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,CAAC,EAAE,MAAM,EACjB,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,EAAE,CA0DX;AAqDD;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM,EACjB,cAAc,GAAE,kBAAuB,GACtC,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAqC3C;AAkBD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAwBhF;AAsID;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,YAAY,CAgDpE;AAED,kFAAkF;AAClF,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAa7D;AASD,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,OAAO,EAAE,GACd,OAAO,EAAE,CAiEX;AAMD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,eAAe,CAC7B,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE,OAAO,EAAE,GACf,OAAO,GAAG,IAAI,CAuBhB;AAiHD;;GAEG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,sBAAsB,CAiCnF"}
package/dist/threat-intel.js CHANGED
@@ -58,7 +58,7 @@ const path = __importStar(require("node:path"));
58
58
  * Generation timestamp for the bundled IOC feed (v5.29, issue #208).
59
59
  * Pure function of feed updates; preserved across builds.
60
60
  */
61
- exports.FEED_GENERATED_AT = "2026-09-05T00:00:00.000Z";
61
+ exports.FEED_GENERATED_AT = "2026-09-07T00:00:00.000Z";
62
62
  // ---------------------------------------------------------------------------
63
63
  // Default bundled feed (curated by supply-chain-guard)
64
64
  // ---------------------------------------------------------------------------
@@ -21064,6 +21064,94 @@ const FEED_CHUNK_20 = [
21064
21064
  { type: "package", value: "@bx-ui-framework/authentication@16.0.0", severity: "critical", confidence: 1.0, source: "GHSA-9q5c-jq8f-775p, MAL-2026-15866 (amazon-inspector)", firstSeen: "2026-09-04" },
21065
21065
  { type: "package", value: "eslint-rxjs@1.0.0", severity: "critical", confidence: 1.0, source: "GHSA-45hh-8cg6-r5qp, MAL-2026-15812 (amazon-inspector+ossf-package-analysis)", firstSeen: "2026-09-02" },
21066
21066
  { type: "package", value: "n8n-nodes-social-facebook@0.2.0", severity: "critical", confidence: 0.9, source: "MAL-2026-10536 (amazon-inspector)", firstSeen: "2026-07-14" },
21067
+ // Imported from GitHub Advisory Database (2026-09-05) - see docs/threat-feed-sources.md
21068
+ { type: "package", value: "@liuliang520500/sinataoke_cn_test", severity: "critical", confidence: 0.9, source: "GHSA-36jr-wqjh-q55x", firstSeen: "2026-09-06" },
21069
+ { type: "package", value: "@liuliang520500/sinataoke_cn", severity: "critical", confidence: 0.9, source: "GHSA-jjx2-vpx2-qp32", firstSeen: "2026-09-06" },
21070
+ { type: "package", value: "@liuliang520500/pdd-sdk-new", severity: "critical", confidence: 0.9, source: "GHSA-jp84-gqp2-j9qq", firstSeen: "2026-09-06" },
21071
+ { type: "package", value: "@liuliang520500/pdd-sdk", severity: "critical", confidence: 0.9, source: "GHSA-g9hc-xr9f-27g4", firstSeen: "2026-09-06" },
21072
+ { type: "package", value: "@liuliang520500/jd-sdk", severity: "critical", confidence: 0.9, source: "GHSA-j849-992g-rggr", firstSeen: "2026-09-06" },
21073
+ { type: "package", value: "@liuliang520500/taobao-topclient", severity: "critical", confidence: 0.9, source: "GHSA-75r6-9fpm-rf6j", firstSeen: "2026-09-06" },
21074
+ { type: "package", value: "@pilllesss/yorn", severity: "critical", confidence: 0.9, source: "GHSA-rghh-4gfg-jvqc", firstSeen: "2026-09-06" },
21075
+ { type: "package", value: "dcftunnel", severity: "critical", confidence: 0.9, source: "GHSA-4c2f-x64v-297x", firstSeen: "2026-09-06" },
21076
+ { type: "package", value: "1cattunnel", severity: "critical", confidence: 0.9, source: "GHSA-r35j-cv2x-mm7h", firstSeen: "2026-09-06" },
21077
+ { type: "package", value: "multicore-kit", severity: "critical", confidence: 0.9, source: "GHSA-q588-cfvg-8346", firstSeen: "2026-09-06" },
21078
+ { type: "package", value: "date-fns-formatter", severity: "critical", confidence: 0.9, source: "GHSA-h258-m2gc-2p4q", firstSeen: "2026-09-06" },
21079
+ { type: "package", value: "array-frames", severity: "critical", confidence: 0.9, source: "GHSA-24hx-4mc8-g9q7", firstSeen: "2026-09-06" },
21080
+ { type: "package", value: "node-helper", severity: "critical", confidence: 0.9, source: "GHSA-2ggc-wmq2-3whp", firstSeen: "2026-09-06" },
21081
+ { type: "package", value: "jwt-logger", severity: "critical", confidence: 0.9, source: "GHSA-rpqx-cp2g-55w5", firstSeen: "2026-09-05" },
21082
+ { type: "package", value: "array-scala", severity: "critical", confidence: 0.9, source: "GHSA-rx3f-9hxc-773g", firstSeen: "2026-09-05" },
21083
+ { type: "package", value: "pypi:trongridew@0.0.1", severity: "critical", confidence: 1.0, source: "GHSA-vjjx-756v-6p3x, MAL-2026-15936 (kam193)", firstSeen: "2026-09-05" },
21084
+ { type: "package", value: "@domyjs/i18n", severity: "critical", confidence: 0.9, source: "GHSA-22jr-v88r-5cj6", firstSeen: "2026-09-05" },
21085
+ { type: "package", value: "@domyjs/reactive", severity: "critical", confidence: 0.9, source: "GHSA-3ggc-3pw2-c9v9", firstSeen: "2026-09-05" },
21086
+ { type: "package", value: "@domyjs/router", severity: "critical", confidence: 0.9, source: "GHSA-j7wp-3648-mh57", firstSeen: "2026-09-05" },
21087
+ { type: "package", value: "@domyjs/mask", severity: "critical", confidence: 0.9, source: "GHSA-93j2-q7r7-7qhh", firstSeen: "2026-09-05" },
21088
+ { type: "package", value: "@domyjs/throttle", severity: "critical", confidence: 0.9, source: "GHSA-fr62-p59g-hr9f", firstSeen: "2026-09-05" },
21089
+ { type: "package", value: "@domyjs/intersect", severity: "critical", confidence: 0.9, source: "GHSA-v8xv-9q46-8h3x", firstSeen: "2026-09-05" },
21090
+ { type: "package", value: "@yoannchb/wtf-json", severity: "critical", confidence: 0.9, source: "GHSA-82x7-44x9-7295", firstSeen: "2026-09-05" },
21091
+ { type: "package", value: "enqueu", severity: "critical", confidence: 0.9, source: "GHSA-352p-f6j8-qxxh", firstSeen: "2026-09-05" },
21092
+ { type: "package", value: "puppeteer-obscura", severity: "critical", confidence: 0.9, source: "GHSA-cxwq-q9c5-424v", firstSeen: "2026-09-05" },
21093
+ { type: "package", value: "inner-svg-ts", severity: "critical", confidence: 0.9, source: "GHSA-rx43-xhjx-3xq6", firstSeen: "2026-09-05" },
21094
+ { type: "package", value: "pipipe", severity: "critical", confidence: 0.9, source: "GHSA-pmm9-p62g-hvp5", firstSeen: "2026-09-05" },
21095
+ { type: "package", value: "@yoannchb/tokenize", severity: "critical", confidence: 0.9, source: "GHSA-4qx6-wqw8-r2qr", firstSeen: "2026-09-05" },
21096
+ { type: "package", value: "chrome-speech-recognition", severity: "critical", confidence: 0.9, source: "GHSA-wvfg-ghw3-64q7", firstSeen: "2026-09-05" },
21097
+ { type: "package", value: "@domyjs/domy", severity: "critical", confidence: 0.9, source: "GHSA-f553-q356-4cmc", firstSeen: "2026-09-05" },
21098
+ { type: "package", value: "drive-album", severity: "critical", confidence: 0.9, source: "GHSA-xwpg-4hvv-jxjq", firstSeen: "2026-09-05" },
21099
+ { type: "package", value: "@domyjs/debounce", severity: "critical", confidence: 0.9, source: "GHSA-pp6m-2fxr-qjhf", firstSeen: "2026-09-05" },
21100
+ { type: "package", value: "card3d", severity: "critical", confidence: 0.9, source: "GHSA-gggp-h9vj-pw3p", firstSeen: "2026-09-05" },
21101
+ { type: "package", value: "@domyjs/anchor", severity: "critical", confidence: 0.9, source: "GHSA-x2rm-5qrx-62mg", firstSeen: "2026-09-05" },
21102
+ { type: "package", value: "parallaxy-img", severity: "critical", confidence: 0.9, source: "GHSA-mhp3-rpvj-vrpx", firstSeen: "2026-09-05" },
21103
+ { type: "package", value: "@yoannchb/langy", severity: "critical", confidence: 0.9, source: "GHSA-92qv-fgvj-ccf4", firstSeen: "2026-09-05" },
21104
+ { type: "package", value: "@domyjs/collapse", severity: "critical", confidence: 0.9, source: "GHSA-39q9-7vqg-3m6w", firstSeen: "2026-09-05" },
21105
+ { type: "package", value: "iframe-to-video", severity: "critical", confidence: 0.9, source: "GHSA-hh9g-3hm5-vcch", firstSeen: "2026-09-05" },
21106
+ { type: "package", value: "@yoannchb/cattract", severity: "critical", confidence: 0.9, source: "GHSA-76pv-jq47-p439", firstSeen: "2026-09-05" },
21107
+ { type: "package", value: "jimg", severity: "critical", confidence: 0.9, source: "GHSA-53xc-j4p4-52q3", firstSeen: "2026-09-05" },
21108
+ { type: "package", value: "tempjs-template", severity: "critical", confidence: 0.9, source: "GHSA-5x3v-r6fj-vf2p", firstSeen: "2026-09-05" },
21109
+ { type: "package", value: "memov", severity: "critical", confidence: 0.9, source: "GHSA-6q78-8863-ww8m", firstSeen: "2026-09-05" },
21110
+ { type: "package", value: "muswish", severity: "critical", confidence: 0.9, source: "GHSA-295f-26rf-f8f4", firstSeen: "2026-09-05" },
21111
+ { type: "package", value: "btn-particles", severity: "critical", confidence: 0.9, source: "GHSA-6w56-62pq-vhph", firstSeen: "2026-09-05" },
21112
+ { type: "package", value: "onetime-rnd", severity: "critical", confidence: 0.9, source: "GHSA-55h6-2qxg-jvqv", firstSeen: "2026-09-05" },
21113
+ { type: "package", value: "google-img-scrap", severity: "critical", confidence: 0.9, source: "GHSA-mwh7-p59x-2f4g", firstSeen: "2026-09-05" },
21114
+ { type: "package", value: "json-into-html", severity: "critical", confidence: 0.9, source: "GHSA-xvrp-hmjm-74qr", firstSeen: "2026-09-05" },
21115
+ { type: "package", value: "fast-html-dom-parser", severity: "critical", confidence: 0.9, source: "GHSA-4wcx-wjq9-25cr", firstSeen: "2026-09-05" },
21116
+ { type: "package", value: "discord-tqr", severity: "critical", confidence: 0.9, source: "GHSA-xp88-72h6-mw9r", firstSeen: "2026-09-05" },
21117
+ { type: "package", value: "anime-vostfr", severity: "critical", confidence: 0.9, source: "GHSA-f6c5-36x2-p79p", firstSeen: "2026-09-05" },
21118
+ { type: "package", value: "infinity-grid", severity: "critical", confidence: 0.9, source: "GHSA-39fr-j2vr-r24p", firstSeen: "2026-09-05" },
21119
+ { type: "package", value: "discord-phub", severity: "critical", confidence: 0.9, source: "GHSA-7693-gh38-7wmj", firstSeen: "2026-09-05" },
21120
+ { type: "package", value: "linkpreview-simple", severity: "critical", confidence: 0.9, source: "GHSA-w9q9-gr86-rr73", firstSeen: "2026-09-05" },
21121
+ { type: "package", value: "lazy-attr", severity: "critical", confidence: 0.9, source: "GHSA-pm6r-2g8f-89qh", firstSeen: "2026-09-05" },
21122
+ { type: "package", value: "trading-bot-utils", severity: "critical", confidence: 0.9, source: "GHSA-2h3c-rw6j-mpq7", firstSeen: "2026-09-05" },
21123
+ { type: "package", value: "eth-query-utils", severity: "critical", confidence: 0.9, source: "GHSA-c33f-ppxr-8r7j", firstSeen: "2026-09-05" },
21124
+ { type: "package", value: "ens-namehash-utils", severity: "critical", confidence: 0.9, source: "GHSA-qfrg-2m38-35gp", firstSeen: "2026-09-05" },
21125
+ { type: "package", value: "gas-price-checker", severity: "critical", confidence: 0.9, source: "GHSA-fw8f-xwq4-q3v8", firstSeen: "2026-09-05" },
21126
+ { type: "package", value: "wallet-watcher", severity: "critical", confidence: 1.0, source: "GHSA-jq3q-655j-wjqh, MAL-2026-15871", firstSeen: "2026-09-05" },
21127
+ { type: "package", value: "eth-lib-helpers", severity: "critical", confidence: 0.9, source: "GHSA-h3xf-4f7r-v9xf", firstSeen: "2026-09-05" },
21128
+ { type: "package", value: "pypi:proxycer@0.1.0", severity: "critical", confidence: 1.0, source: "GHSA-qff6-cqrr-65wv, MAL-2026-15935 (kam193)", firstSeen: "2026-09-05" },
21129
+ { type: "package", value: "pypi:dbt-sa-cli@0.0.1", severity: "critical", confidence: 1.0, source: "GHSA-xf8p-r8w2-fx5m, MAL-2026-15934 (kam193)", firstSeen: "2026-09-05" },
21130
+ // Imported from GitHub Advisory Database (2026-09-07) - see docs/threat-feed-sources.md
21131
+ { type: "package", value: "scw-mobile", severity: "critical", confidence: 0.9, source: "GHSA-h9g8-rwcg-hpmh", firstSeen: "2026-09-07" },
21132
+ { type: "package", value: "base-account-core", severity: "critical", confidence: 0.9, source: "GHSA-vgm8-2vf8-769j", firstSeen: "2026-09-07" },
21133
+ { type: "package", value: "cb-wallet-solana-provider", severity: "critical", confidence: 0.9, source: "GHSA-5cg4-38v4-j4vc", firstSeen: "2026-09-07" },
21134
+ { type: "package", value: "cb-wallet-metadata", severity: "critical", confidence: 0.9, source: "GHSA-cxwc-958j-45g8", firstSeen: "2026-09-07" },
21135
+ { type: "package", value: "cb-wallet-http", severity: "critical", confidence: 1.0, source: "GHSA-mv3f-92cr-83h7, MAL-2026-4507", firstSeen: "2026-09-07" },
21136
+ { type: "package", value: "cb-wallet-store", severity: "critical", confidence: 0.9, source: "GHSA-gw4f-3mgw-h64x", firstSeen: "2026-09-07" },
21137
+ { type: "package", value: "base-app-data", severity: "critical", confidence: 0.9, source: "GHSA-9hpg-rmwp-vg4p", firstSeen: "2026-09-07" },
21138
+ { type: "package", value: "wallet-engine-signing", severity: "critical", confidence: 0.9, source: "GHSA-qw4m-ccr9-7r43", firstSeen: "2026-09-07" },
21139
+ { type: "package", value: "cb-wallet-env", severity: "critical", confidence: 0.9, source: "GHSA-m477-pr6m-v2fp", firstSeen: "2026-09-07" },
21140
+ { type: "package", value: "cb-wallet-analytics", severity: "critical", confidence: 0.9, source: "GHSA-7944-c265-3ff7", firstSeen: "2026-09-07" },
21141
+ { type: "package", value: "cb-wallet-data", severity: "critical", confidence: 1.0, source: "GHSA-7w56-x3g2-57fg, MAL-2026-4506", firstSeen: "2026-09-07" },
21142
+ { type: "package", value: "scw-core", severity: "critical", confidence: 0.9, source: "GHSA-fv48-xvcx-h3qh", firstSeen: "2026-09-07" },
21143
+ { type: "package", value: "wallet-cds-web", severity: "critical", confidence: 0.9, source: "GHSA-qh9w-32r6-2qpw", firstSeen: "2026-09-07" },
21144
+ { type: "package", value: "cline@2.3.0", severity: "critical", confidence: 1.0, source: "MAL-2026-1380 (amazon-inspector+ghsa-malware+google-open-source-security)", firstSeen: "2026-02-19" },
21145
+ { type: "package", value: "omni-channel-order-frontend@0.0.1", severity: "critical", confidence: 0.9, source: "MAL-2026-15942 (ossf-package-analysis)", firstSeen: "2026-09-06" },
21146
+ { type: "package", value: "omni-channel-order-frontend@9999.0.0", severity: "critical", confidence: 0.9, source: "MAL-2026-15942 (ossf-package-analysis)", firstSeen: "2026-09-06" },
21147
+ { type: "package", value: "oce-configurator-wireless-frontend@0.0.1", severity: "critical", confidence: 0.9, source: "MAL-2026-15940 (ossf-package-analysis)", firstSeen: "2026-09-06" },
21148
+ { type: "package", value: "oce-configurator-wireless-frontend@9999.0.0", severity: "critical", confidence: 0.9, source: "MAL-2026-15940 (ossf-package-analysis)", firstSeen: "2026-09-06" },
21149
+ // Dependency-confusion placeholder campaign, maintainer pr0t31n (September 2026) - siblings above
21150
+ { type: "package", value: "omni-channel-oid-frontend@0.0.1", severity: "critical", confidence: 0.9, source: "GHSA-fc5v-8w4f-376c, MAL-2026-15939 (ossf-package-analysis)", firstSeen: "2026-09-06" },
21151
+ { type: "package", value: "omni-channel-oid-frontend@9999.0.0", severity: "critical", confidence: 0.9, source: "GHSA-fc5v-8w4f-376c, MAL-2026-15939 (ossf-package-analysis)", firstSeen: "2026-09-06" },
21152
+ { type: "package", value: "ocfe-tv-subscription-center-web@0.0.1", severity: "critical", confidence: 0.9, source: "GHSA-4qgp-r5m8-8876, MAL-2026-15941 (ossf-package-analysis)", firstSeen: "2026-09-06" },
21153
+ { type: "package", value: "ocfe-tv-subscription-center-web@9999.0.0", severity: "critical", confidence: 0.9, source: "GHSA-4qgp-r5m8-8876, MAL-2026-15941 (ossf-package-analysis)", firstSeen: "2026-09-06" },
21154
+ { type: "package", value: "pypi:minecraftmodes@0.3.3", severity: "critical", confidence: 0.9, source: "GHSA-m6v9-5p34-2x37, MAL-2026-15937 (kam193)", firstSeen: "2026-09-06" },
21067
21155
  ];
21068
21156
  // Composed from the chunks above. A single array literal of this size trips
21069
21157
  // TS2590 ("union type that is too complex to represent") in tsc; splitting it
@@ -21845,7 +21933,7 @@ function getDetectionSetProvenance(cacheDir) {
21845
21933
  // No cache or invalid cache
21846
21934
  }
21847
21935
  return {
21848
- bundledVersion: "6.0.13",
21936
+ bundledVersion: "6.0.15",
21849
21937
  bundledEntryCount: BUNDLED_FEED.length,
21850
21938
  generatedAt: exports.FEED_GENERATED_AT,
21851
21939
  cacheMerged,