supply-chain-guard 6.0.17 → 6.0.18

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (16) hide show
  1. package/README.md +4 -4
  2. package/action.yml +1 -1
  3. package/dist/cli.js +1 -1
  4. package/dist/dependency-confusion.js +1 -1
  5. package/dist/npm-scanner.js +1 -1
  6. package/dist/pypi-scanner.js +1 -1
  7. package/dist/reporter.js +12 -12
  8. package/dist/sbom-generator.js +1 -1
  9. package/dist/scanner.js +1 -1
  10. package/dist/threat-intel.d.ts +1 -1
  11. package/dist/threat-intel.d.ts.map +1 -1
  12. package/dist/threat-intel.js +66 -2
  13. package/dist/threat-intel.js.map +1 -1
  14. package/dist/vscode-scanner.js +1 -1
  15. package/package.json +1 -1
  16. package/self-scan-manifest.json +5 -5
package/README.md CHANGED
@@ -142,7 +142,7 @@ Run the scanner as a [pre-commit](https://pre-commit.com) hook (Python-ecosystem
142
142
  ```yaml
143
143
  repos:
144
144
  - repo: https://github.com/homeofe/supply-chain-guard
145
- rev: v6.0.17
145
+ rev: v6.0.18
146
146
  hooks:
147
147
  - id: supply-chain-guard
148
148
  ```
@@ -174,7 +174,7 @@ The hook scans the repository root on every commit and fails on high or critical
174
174
  Run the scanner without a Node toolchain via the official multi-arch image (linux/amd64, linux/arm64), published to GHCR on every release tag:
175
175
 
176
176
  ```bash
177
- docker run --rm -v ${PWD}:/scan ghcr.io/homeofe/supply-chain-guard:6.0.17 scan /scan
177
+ docker run --rm -v ${PWD}:/scan ghcr.io/homeofe/supply-chain-guard:6.0.18 scan /scan
178
178
  ```
179
179
 
180
180
  `${PWD}` works in bash, zsh, and PowerShell; in cmd.exe use `%cd%` instead.
@@ -859,7 +859,7 @@ jobs:
859
859
  runs-on: ubuntu-latest
860
860
  steps:
861
861
  - uses: actions/checkout@v4
862
- - uses: homeofe/supply-chain-guard@v6.0.17
862
+ - uses: homeofe/supply-chain-guard@v6.0.18
863
863
  with:
864
864
  fail-on: critical
865
865
  comment-on-pr: true
@@ -947,7 +947,7 @@ two are never confused. If a deliberately frozen rule set is the intent, exclude
947
947
  the rule by name:
948
948
 
949
949
  ```yaml
950
- - uses: homeofe/supply-chain-guard@v6.0.17
950
+ - uses: homeofe/supply-chain-guard@v6.0.18
951
951
  with:
952
952
  exclude-rules: THREAT_FEED_STALE
953
953
  ```
package/action.yml CHANGED
@@ -80,7 +80,7 @@ runs:
80
80
 
81
81
  - name: Install supply-chain-guard
82
82
  shell: bash
83
- run: npm install -g supply-chain-guard@6.0.17 --ignore-scripts --no-audit --no-fund
83
+ run: npm install -g supply-chain-guard@6.0.18 --ignore-scripts --no-audit --no-fund
84
84
 
85
85
  - name: Run scan
86
86
  id: scan
package/dist/cli.js CHANGED
@@ -187,7 +187,7 @@ function assertDistinctOutputPaths(options) {
187
187
  program
188
188
  .name("supply-chain-guard")
189
189
  .description("Open-source supply-chain security scanner. Detects GlassWorm and similar malware campaigns in npm packages, PyPI packages, code repos, VS Code extensions, and project dependencies.")
190
- .version("6.0.17");
190
+ .version("6.0.18");
191
191
  // ── scan command ────────────────────────────────────────────────────
192
192
  program
193
193
  .command("scan")
package/dist/dependency-confusion.js CHANGED
@@ -50,7 +50,7 @@ const https = __importStar(require("node:https"));
50
50
  const types_js_1 = require("./types.js");
51
51
  const pattern_scanner_js_1 = require("./pattern-scanner.js");
52
52
  const json_utils_js_1 = require("./json-utils.js");
53
- const TOOL_VERSION = "6.0.17";
53
+ const TOOL_VERSION = "6.0.18";
54
54
  const NPM_REGISTRY = "https://registry.npmjs.org";
55
55
  const NPM_DOWNLOADS_API = "https://api.npmjs.org/downloads/point/last-week";
56
56
  const PYPI_REGISTRY = "https://pypi.org/pypi";
package/dist/npm-scanner.js CHANGED
@@ -65,7 +65,7 @@ const threat_intel_js_1 = require("./threat-intel.js");
65
65
  const install_guard_js_1 = require("./install-guard.js");
66
66
  const json_utils_js_1 = require("./json-utils.js");
67
67
  const remote_download_js_1 = require("./remote-download.js");
68
- const TOOL_VERSION = "6.0.17";
68
+ const TOOL_VERSION = "6.0.18";
69
69
  const NPM_REGISTRY = "https://registry.npmjs.org";
70
70
  const NPM_REGISTRY_HOST = "registry.npmjs.org";
71
71
  const RAW_GITHUB_HOST = "raw.githubusercontent.com";
package/dist/pypi-scanner.js CHANGED
@@ -56,7 +56,7 @@ const patterns_js_1 = require("./patterns.js");
56
56
  const pattern_scanner_js_1 = require("./pattern-scanner.js");
57
57
  const extracted_file_walker_js_1 = require("./extracted-file-walker.js");
58
58
  const remote_download_js_1 = require("./remote-download.js");
59
- const TOOL_VERSION = "6.0.17";
59
+ const TOOL_VERSION = "6.0.18";
60
60
  const PYPI_API = "https://pypi.org/pypi";
61
61
  const PYPI_METADATA_HOST = "pypi.org";
62
62
  const PYPI_ARTIFACT_HOST = "files.pythonhosted.org";
package/dist/reporter.js CHANGED
@@ -235,7 +235,7 @@ function formatJson(report) {
235
235
  function formatText(report, options = {}) {
236
236
  const lines = [];
237
237
  // ── layout constants ───────────────────────────────────────────────────────
238
- const VERSION = "6.0.17";
238
+ const VERSION = "6.0.18";
239
239
  const W = 76; // visible chars between "│ " and " │" (total line = 80)
240
240
  // ── ANSI helpers ───────────────────────────────────────────────────────────
241
241
  const stripAnsi = (s) => s.replace(/\x1b\[[0-9;]*m/g, "");
@@ -663,7 +663,7 @@ function formatMarkdown(report) {
663
663
  lines.push("");
664
664
  lines.push(`| Property | Value |`);
665
665
  lines.push(`|----------|-------|`);
666
- lines.push(`| Tool | \`${mdCell(report.tool || "supply-chain-guard v6.0.17")}\` |`);
666
+ lines.push(`| Tool | \`${mdCell(report.tool || "supply-chain-guard v6.0.18")}\` |`);
667
667
  lines.push(`| Target | \`${mdCell(report.target)}\` |`);
668
668
  lines.push(`| Type | ${mdText(report.scanType)} |`);
669
669
  lines.push(`| Time | ${mdText(report.timestamp)} |`);
@@ -911,7 +911,7 @@ function formatSarif(report) {
911
911
  tool: {
912
912
  driver: {
913
913
  name: "supply-chain-guard",
914
- version: "6.0.17",
914
+ version: "6.0.18",
915
915
  informationUri: "https://github.com/homeofe/supply-chain-guard",
916
916
  rules,
917
917
  },
@@ -1120,7 +1120,7 @@ function formatSbom(report) {
1120
1120
  ...(properties.length > 0 ? { properties } : {}),
1121
1121
  };
1122
1122
  });
1123
- const annotations = buildIncidentAnnotations(report.incidents, subjectsByIncident, metadata.timestamp, metadata.tools.components[0]?.version ?? "6.0.17");
1123
+ const annotations = buildIncidentAnnotations(report.incidents, subjectsByIncident, metadata.timestamp, metadata.tools.components[0]?.version ?? "6.0.18");
1124
1124
  const withVulns = {
1125
1125
  ...document,
1126
1126
  metadata: {
@@ -1169,7 +1169,7 @@ function formatSbom(report) {
1169
1169
  ...(properties.length > 0 ? { properties } : {}),
1170
1170
  };
1171
1171
  });
1172
- const fallbackAnnotations = buildIncidentAnnotations(report.incidents, fallbackSubjectsByIncident, report.timestamp, "6.0.17");
1172
+ const fallbackAnnotations = buildIncidentAnnotations(report.incidents, fallbackSubjectsByIncident, report.timestamp, "6.0.18");
1173
1173
  const sbom = {
1174
1174
  bomFormat: "CycloneDX",
1175
1175
  specVersion: "1.6",
@@ -1179,7 +1179,7 @@ function formatSbom(report) {
1179
1179
  timestamp: report.timestamp,
1180
1180
  tools: {
1181
1181
  components: [
1182
- { type: "application", name: "supply-chain-guard", version: "6.0.17" },
1182
+ { type: "application", name: "supply-chain-guard", version: "6.0.18" },
1183
1183
  ],
1184
1184
  },
1185
1185
  component: {
@@ -1255,8 +1255,8 @@ function formatBadge(report) {
1255
1255
  label: "supply-chain-guard",
1256
1256
  message,
1257
1257
  color,
1258
- tool: report.tool || "supply-chain-guard v6.0.17",
1259
- version: report.tool ? (report.tool.includes("@") ? report.tool.split("@")[1] : report.tool.replace(/^supply-chain-guard v?/, "")) : "6.0.17",
1258
+ tool: report.tool || "supply-chain-guard v6.0.18",
1259
+ version: report.tool ? (report.tool.includes("@") ? report.tool.split("@")[1] : report.tool.replace(/^supply-chain-guard v?/, "")) : "6.0.18",
1260
1260
  timestamp: report.timestamp,
1261
1261
  commit: report.commit ?? "none",
1262
1262
  detectionSet: report.detectionSet,
@@ -1312,7 +1312,7 @@ function formatGitlab(report) {
1312
1312
  name: "supply-chain-guard",
1313
1313
  url: "https://github.com/homeofe/supply-chain-guard",
1314
1314
  vendor: { name: "supply-chain-guard" },
1315
- version: "6.0.17",
1315
+ version: "6.0.18",
1316
1316
  };
1317
1317
  const vulnerabilities = report.findings
1318
1318
  .filter((f) => !f.suppressed)
@@ -1434,7 +1434,7 @@ function formatJunit(report) {
1434
1434
  // (unreleased, issue 205): the coverage properties are ALWAYS emitted, so a JUnit
1435
1435
  // artefact states its own denominator instead of only what was found.
1436
1436
  lines.push(" <properties>");
1437
- lines.push(` <property name="supply-chain-guard:tool-version" value="${xmlEscape(report.tool || "supply-chain-guard v6.0.17")}"/>`);
1437
+ lines.push(` <property name="supply-chain-guard:tool-version" value="${xmlEscape(report.tool || "supply-chain-guard v6.0.18")}"/>`);
1438
1438
  lines.push(` <property name="supply-chain-guard:timestamp" value="${xmlEscape(report.timestamp)}"/>`);
1439
1439
  lines.push(` <property name="supply-chain-guard:commit" value="${xmlEscape(report.commit ?? "none (not a git repository)")}"/>`);
1440
1440
  if (report.detectionSet) {
@@ -1560,7 +1560,7 @@ footer{text-align:center;padding:24px;color:#94a3b8;font-size:13px}
1560
1560
  <body>
1561
1561
  <div class="container">
1562
1562
  <header>
1563
- <h1>${escapeHtml(report.tool || "supply-chain-guard v6.0.17")} Scan Report</h1>
1563
+ <h1>${escapeHtml(report.tool || "supply-chain-guard v6.0.18")} Scan Report</h1>
1564
1564
  <div class="meta">
1565
1565
  <span>Target: ${escapeHtml(report.target)}</span>
1566
1566
  <span>Type: ${report.scanType}</span>
@@ -1621,7 +1621,7 @@ footer{text-align:center;padding:24px;color:#94a3b8;font-size:13px}
1621
1621
  ` : ""}
1622
1622
 
1623
1623
  <footer>
1624
- Generated by <a href="https://github.com/homeofe/supply-chain-guard">${escapeHtml(report.tool || "supply-chain-guard v6.0.17")}</a>
1624
+ Generated by <a href="https://github.com/homeofe/supply-chain-guard">${escapeHtml(report.tool || "supply-chain-guard v6.0.18")}</a>
1625
1625
  </footer>
1626
1626
  </div>
1627
1627
  <script>
package/dist/sbom-generator.js CHANGED
@@ -87,7 +87,7 @@ const fs = __importStar(require("node:fs"));
87
87
  const path = __importStar(require("node:path"));
88
88
  const node_crypto_1 = require("node:crypto");
89
89
  const json_utils_js_1 = require("./json-utils.js");
90
- const TOOL_VERSION = "6.0.17";
90
+ const TOOL_VERSION = "6.0.18";
91
91
  /** bom-ref of the component the document is about. */
92
92
  const SUBJECT_BOM_REF = "target";
93
93
  /** Property namespace, matching the `supply-chain-guard:scan-status` property reporter.ts adds. */
package/dist/scanner.js CHANGED
@@ -100,7 +100,7 @@ const dependency_confusion_js_1 = require("./dependency-confusion.js");
100
100
  const mcp_scanner_js_1 = require("./mcp-scanner.js");
101
101
  const skills_scanner_js_1 = require("./skills-scanner.js");
102
102
  const self_scan_trust_js_1 = require("./self-scan-trust.js");
103
- const TOOL_VERSION = "6.0.17";
103
+ const TOOL_VERSION = "6.0.18";
104
104
  /**
105
105
  * Pattern literals in this matcher module deliberately spell out signatures
106
106
  * that the public scanner detects. Suppress only those exact rule definitions
package/dist/threat-intel.d.ts CHANGED
@@ -24,7 +24,7 @@ export type FeedIOCInput = Omit<FeedIOC, "confidence"> & {
24
24
  * Generation timestamp for the bundled IOC feed (v5.29, issue #208).
25
25
  * Pure function of feed updates; preserved across builds.
26
26
  */
27
- export declare const FEED_GENERATED_AT = "2026-09-09T00:00:00.000Z";
27
+ export declare const FEED_GENERATED_AT = "2026-09-10T00:00:00.000Z";
28
28
  export declare const CACHE_DIR = ".scg-cache";
29
29
  export declare const FEED_CACHE_FILE = "threat-feed.json";
30
30
  /**
package/dist/threat-intel.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"threat-intel.d.ts","sourceRoot":"","sources":["../src/threat-intel.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAqB,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAMrF,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,QAAQ,GAAG,IAAI,GAAG,KAAK,GAAG,MAAM,GAAG,SAAS,CAAC;IACnD,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;IAC1D,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,+EAA+E;AAC/E,MAAM,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,GAAG;IACvD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,iBAAiB,6BAA6B,CAAC;AAwhqB5D,eAAO,MAAM,SAAS,eAAe,CAAC;AACtC,eAAO,MAAM,eAAe,qBAAqB,CAAC;AAelD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,kBAAkB;;;;EAI7B,CAAC;AAEH,+DAA+D;AAC/D,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,IAAI,OAAO,EAAE,CAE1C;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAgB,iBAAiB,IAAI,SAAS,OAAO,EAAE,CAEtD;AAeD,4EAA4E;AAC5E,MAAM,WAAW,cAAc;IAC7B,oDAAoD;IACpD,OAAO,EAAE,OAAO,CAAC;IACjB,gDAAgD;IAChD,UAAU,EAAE,MAAM,CAAC;IACnB,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,KAAK,EAAE,OAAO,CAAC;CAChB;AAID;;;;;;GAMG;AACH,wBAAgB,iBAAiB,IAAI,cAAc,CAElD;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,IAAI,IAAI,CAE5C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,CAAC,EAAE,MAAM,EACjB,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,EAAE,CA0DX;AAqDD;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM,EACjB,cAAc,GAAE,kBAAuB,GACtC,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAqC3C;AAkBD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAwBhF;AAsID;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,YAAY,CAgDpE;AAED,kFAAkF;AAClF,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAa7D;AASD,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,OAAO,EAAE,GACd,OAAO,EAAE,CAiEX;AAMD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,eAAe,CAC7B,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE,OAAO,EAAE,GACf,OAAO,GAAG,IAAI,CAuBhB;AAiHD;;GAEG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,sBAAsB,CAiCnF"}
1
+ {"version":3,"file":"threat-intel.d.ts","sourceRoot":"","sources":["../src/threat-intel.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAqB,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAMrF,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,QAAQ,GAAG,IAAI,GAAG,KAAK,GAAG,MAAM,GAAG,SAAS,CAAC;IACnD,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;IAC1D,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,+EAA+E;AAC/E,MAAM,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,GAAG;IACvD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,iBAAiB,6BAA6B,CAAC;AAylqB5D,eAAO,MAAM,SAAS,eAAe,CAAC;AACtC,eAAO,MAAM,eAAe,qBAAqB,CAAC;AAelD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,kBAAkB;;;;EAI7B,CAAC;AAEH,+DAA+D;AAC/D,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,IAAI,OAAO,EAAE,CAE1C;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAgB,iBAAiB,IAAI,SAAS,OAAO,EAAE,CAEtD;AAeD,4EAA4E;AAC5E,MAAM,WAAW,cAAc;IAC7B,oDAAoD;IACpD,OAAO,EAAE,OAAO,CAAC;IACjB,gDAAgD;IAChD,UAAU,EAAE,MAAM,CAAC;IACnB,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,KAAK,EAAE,OAAO,CAAC;CAChB;AAID;;;;;;GAMG;AACH,wBAAgB,iBAAiB,IAAI,cAAc,CAElD;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,IAAI,IAAI,CAE5C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,CAAC,EAAE,MAAM,EACjB,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,EAAE,CA0DX;AAqDD;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM,EACjB,cAAc,GAAE,kBAAuB,GACtC,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAqC3C;AAkBD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAwBhF;AAsID;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,YAAY,CAgDpE;AAED,kFAAkF;AAClF,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAa7D;AASD,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,OAAO,EAAE,GACd,OAAO,EAAE,CAiEX;AAMD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,eAAe,CAC7B,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE,OAAO,EAAE,GACf,OAAO,GAAG,IAAI,CAuBhB;AAiHD;;GAEG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,sBAAsB,CAiCnF"}
package/dist/threat-intel.js CHANGED
@@ -58,7 +58,7 @@ const path = __importStar(require("node:path"));
58
58
  * Generation timestamp for the bundled IOC feed (v5.29, issue #208).
59
59
  * Pure function of feed updates; preserved across builds.
60
60
  */
61
- exports.FEED_GENERATED_AT = "2026-09-09T00:00:00.000Z";
61
+ exports.FEED_GENERATED_AT = "2026-09-10T00:00:00.000Z";
62
62
  // ---------------------------------------------------------------------------
63
63
  // Default bundled feed (curated by supply-chain-guard)
64
64
  // ---------------------------------------------------------------------------
@@ -21371,6 +21371,70 @@ const FEED_CHUNK_20 = [
21371
21371
  { type: "package", value: "@skyzopedia/libsignal-node", severity: "critical", confidence: 0.85, source: "Xygeni (single-source)", firstSeen: "2026-09-09" },
21372
21372
  { type: "package", value: "cloud-baileys@1.1.37", severity: "critical", confidence: 0.85, source: "Xygeni digest 86 (single-source)", firstSeen: "2026-09-09" },
21373
21373
  { type: "package", value: "cloud-baileys@1.1.38", severity: "critical", confidence: 0.85, source: "Xygeni digest 86 (single-source)", firstSeen: "2026-09-09" },
21374
+ // Imported from GitHub Advisory Database (2026-08-27) - see docs/threat-feed-sources.md
21375
+ { type: "package", value: "@sahril2nd/baileys@1.0.21", severity: "critical", confidence: 1.0, source: "GHSA-j2h4-4g8c-mqh9, MAL-2026-16105 (amazon-inspector)", firstSeen: "2026-09-09" },
21376
+ { type: "package", value: "@neroxkira/vangal-baileys@1.0.0", severity: "critical", confidence: 1.0, source: "GHSA-8g69-mcxv-f88g, MAL-2026-16103 (amazon-inspector)", firstSeen: "2026-09-09" },
21377
+ { type: "package", value: "@neroxkira/vangal-baileys@1.0.1", severity: "critical", confidence: 1.0, source: "GHSA-8g69-mcxv-f88g, MAL-2026-16103 (amazon-inspector)", firstSeen: "2026-09-09" },
21378
+ { type: "package", value: "@nexustechpro/baileys@2.2.7", severity: "critical", confidence: 1.0, source: "GHSA-pv55-pgr3-jjrj, MAL-2026-16104 (amazon-inspector)", firstSeen: "2026-09-09" },
21379
+ { type: "package", value: "@auction-fe/reporting-system", severity: "critical", confidence: 0.9, source: "GHSA-4x79-pcqv-r9rf, MAL-2026-16108 (ghsa-malware)", firstSeen: "2026-09-09" },
21380
+ { type: "package", value: "@auction-fe/base", severity: "critical", confidence: 0.9, source: "GHSA-w6hj-c25h-wgh7, MAL-2026-16106 (ghsa-malware)", firstSeen: "2026-09-09" },
21381
+ { type: "package", value: "@auction-fe/ui-kit", severity: "critical", confidence: 0.9, source: "GHSA-2r37-886p-hj65, MAL-2026-16109 (ghsa-malware)", firstSeen: "2026-09-09" },
21382
+ { type: "package", value: "@auction-fe/portal", severity: "critical", confidence: 0.9, source: "GHSA-qmw2-mp2f-cgg3, MAL-2026-16107 (ghsa-malware)", firstSeen: "2026-09-09" },
21383
+ { type: "package", value: "@convertics/script", severity: "critical", confidence: 0.9, source: "GHSA-c74p-4c5p-6v9r, MAL-2026-16110 (ghsa-malware)", firstSeen: "2026-09-09" },
21384
+ { type: "package", value: "pypi:bq-build-probe-vrp-2026@0.2.0", severity: "critical", confidence: 1.0, source: "GHSA-f69f-h5mx-9x8p, MAL-2026-16098 (amazon-inspector)", firstSeen: "2026-09-09" },
21385
+ { type: "package", value: "pypi:bq-sdist-probe-vrp@0.0.1", severity: "critical", confidence: 1.0, source: "GHSA-xhgv-6q3g-2824, MAL-2026-16099 (amazon-inspector)", firstSeen: "2026-09-09" },
21386
+ { type: "package", value: "mfatest2@1.0.0", severity: "critical", confidence: 1.0, source: "GHSA-2cf3-8wq3-f2xq, MAL-2026-16102 (amazon-inspector)", firstSeen: "2026-09-09" },
21387
+ { type: "package", value: "mfaby@1.0.0", severity: "critical", confidence: 1.0, source: "GHSA-x3f6-cx35-q6mw, MAL-2026-16101 (amazon-inspector)", firstSeen: "2026-09-09" },
21388
+ { type: "package", value: "discord-mfa-solver@1.0.2", severity: "critical", confidence: 1.0, source: "GHSA-f5p4-vw6q-5w28, MAL-2026-16100 (amazon-inspector)", firstSeen: "2026-09-09" },
21389
+ { type: "package", value: "discord-mfa-solver@1.0.1", severity: "critical", confidence: 1.0, source: "GHSA-f5p4-vw6q-5w28, MAL-2026-16100 (amazon-inspector)", firstSeen: "2026-09-09" },
21390
+ { type: "package", value: "discord-mfa-solver@1.0.0", severity: "critical", confidence: 1.0, source: "GHSA-f5p4-vw6q-5w28, MAL-2026-16100 (amazon-inspector)", firstSeen: "2026-09-09" },
21391
+ { type: "package", value: "@umschool/platform@999.0.2", severity: "critical", confidence: 1.0, source: "GHSA-vj55-82hp-jrcm, MAL-2026-16082 (amazon-inspector)", firstSeen: "2026-09-09" },
21392
+ { type: "package", value: "@umschool/platform@999.0.1", severity: "critical", confidence: 1.0, source: "GHSA-vj55-82hp-jrcm, MAL-2026-16082 (amazon-inspector)", firstSeen: "2026-09-09" },
21393
+ { type: "package", value: "@umschool/platform@999.0.0", severity: "critical", confidence: 1.0, source: "GHSA-vj55-82hp-jrcm, MAL-2026-16082 (amazon-inspector)", firstSeen: "2026-09-09" },
21394
+ { type: "package", value: "twilio-hackerone-poc-b8f21a@1.0.1", severity: "critical", confidence: 1.0, source: "GHSA-wpq4-r5p3-386q, MAL-2026-16097 (amazon-inspector)", firstSeen: "2026-09-09" },
21395
+ { type: "package", value: "twilio-hackerone-poc-b8f21a@1.0.0", severity: "critical", confidence: 1.0, source: "GHSA-wpq4-r5p3-386q, MAL-2026-16097 (amazon-inspector)", firstSeen: "2026-09-09" },
21396
+ { type: "package", value: "@staticj/cropperxmjs@1.6.0", severity: "critical", confidence: 1.0, source: "GHSA-8vj5-qr9w-p6p2, MAL-2026-16081 (amazon-inspector)", firstSeen: "2026-09-09" },
21397
+ { type: "package", value: "soltinel-pro@0.2.1", severity: "critical", confidence: 1.0, source: "GHSA-69g5-q5j6-cxx4, MAL-2026-16096 (amazon-inspector)", firstSeen: "2026-09-09" },
21398
+ { type: "package", value: "soltinel-pro@0.2.2", severity: "critical", confidence: 1.0, source: "GHSA-69g5-q5j6-cxx4, MAL-2026-16096 (amazon-inspector)", firstSeen: "2026-09-09" },
21399
+ { type: "package", value: "soltinel-pro@0.2.0", severity: "critical", confidence: 1.0, source: "GHSA-69g5-q5j6-cxx4, MAL-2026-16096 (amazon-inspector)", firstSeen: "2026-09-09" },
21400
+ { type: "package", value: "matrixkit-js@1.0.0", severity: "critical", confidence: 1.0, source: "GHSA-j34m-r83h-m38q, MAL-2026-16095 (amazon-inspector)", firstSeen: "2026-09-09" },
21401
+ { type: "package", value: "gmgn-trading-kit@1.7.0", severity: "critical", confidence: 1.0, source: "GHSA-g6w4-rgw8-65r7, MAL-2026-16094 (amazon-inspector)", firstSeen: "2026-09-09" },
21402
+ { type: "package", value: "gmgn-trading-kit@1.7.1", severity: "critical", confidence: 1.0, source: "GHSA-g6w4-rgw8-65r7, MAL-2026-16094 (amazon-inspector)", firstSeen: "2026-09-09" },
21403
+ { type: "package", value: "gmgn-trading-kit@1.7.2", severity: "critical", confidence: 1.0, source: "GHSA-g6w4-rgw8-65r7, MAL-2026-16094 (amazon-inspector)", firstSeen: "2026-09-09" },
21404
+ { type: "package", value: "chai-as-testkit", severity: "critical", confidence: 1.0, source: "GHSA-wg38-qj68-8g87, MAL-2026-14371 (amazon-inspector+ghsa-malware)", firstSeen: "2026-08-23" },
21405
+ { type: "package", value: "sams-text-style", severity: "critical", confidence: 0.9, source: "GHSA-xqx8-w483-rq8x, MAL-2026-16091 (ghsa-malware)", firstSeen: "2026-09-09" },
21406
+ { type: "package", value: "graphql-js-client-transform", severity: "critical", confidence: 0.9, source: "GHSA-xm59-fwxf-vq6g, MAL-2026-16086 (ghsa-malware)", firstSeen: "2026-09-09" },
21407
+ { type: "package", value: "sams-run-style", severity: "critical", confidence: 0.9, source: "GHSA-2r8h-5pr4-fr3v, MAL-2026-16090 (ghsa-malware)", firstSeen: "2026-09-09" },
21408
+ { type: "package", value: "react-remove-properties", severity: "critical", confidence: 1.0, source: "GHSA-m8m4-9m7c-742j, MAL-2026-14484 (amazon-inspector+ghsa-malware)", firstSeen: "2026-08-25" },
21409
+ { type: "package", value: "polygon-toolkits-validator", severity: "critical", confidence: 1.0, source: "GHSA-cmwm-j5px-xrpf, MAL-2026-16087 (amazon-inspector+ghsa-malware)", firstSeen: "2026-09-09" },
21410
+ { type: "package", value: "raydium-clmm-sdk", severity: "critical", confidence: 0.9, source: "GHSA-cq4p-x9wg-m5wv, MAL-2026-16089 (ghsa-malware)", firstSeen: "2026-09-09" },
21411
+ { type: "package", value: "crypto-validates", severity: "critical", confidence: 0.9, source: "GHSA-v5v6-h869-g34f, MAL-2026-16085 (ghsa-malware)", firstSeen: "2026-09-09" },
21412
+ { type: "package", value: "pumpswap-sdk-v1", severity: "critical", confidence: 0.9, source: "GHSA-5qr5-f8q7-r844, MAL-2026-16088 (ghsa-malware)", firstSeen: "2026-09-09" },
21413
+ { type: "package", value: "vinnleys", severity: "critical", confidence: 1.0, source: "GHSA-p8f8-xjrg-2v4g, MAL-2026-16092 (amazon-inspector+ghsa-malware)", firstSeen: "2026-09-09" },
21414
+ { type: "package", value: "amprem-activator", severity: "critical", confidence: 1.0, source: "GHSA-4crw-26f5-4v62, MAL-2026-16084 (amazon-inspector+ghsa-malware)", firstSeen: "2026-09-09" },
21415
+ { type: "package", value: "xbailsync", severity: "critical", confidence: 1.0, source: "GHSA-vfrg-29g4-854p, MAL-2026-16093 (amazon-inspector+ghsa-malware)", firstSeen: "2026-09-09" },
21416
+ { type: "package", value: "@vnxsync/libsignal-node", severity: "critical", confidence: 0.9, source: "GHSA-369v-phqf-c9g9, MAL-2026-16083 (ghsa-malware)", firstSeen: "2026-09-09" },
21417
+ { type: "package", value: "@fyxzpediaa/baileys@9.1.0", severity: "critical", confidence: 1.0, source: "GHSA-5wxh-fwcf-rv5j, MAL-2026-16070 (amazon-inspector)", firstSeen: "2026-09-09" },
21418
+ { type: "package", value: "mfafix@1.0.0", severity: "critical", confidence: 1.0, source: "GHSA-f2gv-xpgh-37r5, MAL-2026-15630 (amazon-inspector)", firstSeen: "2026-08-31" },
21419
+ { type: "package", value: "@testrelic/playwright-analytics@2.12.1-next.88", severity: "critical", confidence: 1.0, source: "GHSA-73rf-vqvh-pc36, MAL-2026-15565 (amazon-inspector)", firstSeen: "2026-08-29" },
21420
+ { type: "package", value: "pypi:mlflow-ui@2.7.1", severity: "critical", confidence: 1.0, source: "MAL-2026-10779 (amazon-inspector+kam193)", firstSeen: "2026-07-18" },
21421
+ { type: "package", value: "pypi:mlflow-ui@2.7.2", severity: "critical", confidence: 1.0, source: "MAL-2026-10779 (amazon-inspector+kam193)", firstSeen: "2026-07-18" },
21422
+ { type: "package", value: "pypi:mlflow-ui@2.7.3", severity: "critical", confidence: 1.0, source: "MAL-2026-10779 (amazon-inspector+kam193)", firstSeen: "2026-07-18" },
21423
+ // Baileys WhatsApp fork credential-theft campaign, lotusbail leg (December 2025).
21424
+ // An attacker-authored fork of @whiskeysockets/baileys published by a throwaway
21425
+ // account, which kept the real WhatsApp send/receive behaviour working while
21426
+ // exfiltrating auth tokens, session keys, message history, contacts and media,
21427
+ // and hijacked device linking with a hard-coded pairing code so access survived
21428
+ // uninstall. Roughly 56,000 downloads over about seven months. The advisory
21429
+ // affects ALL versions and npm has replaced the name with a security holding
21430
+ // package, so nothing legitimate can be hit by the bare name. Added by hand
21431
+ // because the advisory published 2025-12-23, outside the importer's 14-day
21432
+ // window, and no rule elsewhere in the scanner covered it. The upstream
21433
+ // WhiskeySockets Baileys maintainers are VICTIMS of the impersonation and are
21434
+ // deliberately NOT blocked. No C2 domain, IP or hash is addable: every vendor
21435
+ // report states the C2 destination is hidden behind Unicode variable mangling,
21436
+ // LZString, Base-91 and AES layers, and none published the decoded value.
21437
+ { type: "package", value: "lotusbail", severity: "critical", confidence: 1.0, source: "GHSA-qmh8-v4jq-m242, MAL-2025-192748 (osv+bleepingcomputer+securityweek+thehackernews)", firstSeen: "2025-12-23" },
21374
21438
  ];
21375
21439
  // Composed from the chunks above. A single array literal of this size trips
21376
21440
  // TS2590 ("union type that is too complex to represent") in tsc; splitting it
@@ -22152,7 +22216,7 @@ function getDetectionSetProvenance(cacheDir) {
22152
22216
  // No cache or invalid cache
22153
22217
  }
22154
22218
  return {
22155
- bundledVersion: "6.0.17",
22219
+ bundledVersion: "6.0.18",
22156
22220
  bundledEntryCount: BUNDLED_FEED.length,
22157
22221
  generatedAt: exports.FEED_GENERATED_AT,
22158
22222
  cacheMerged,