supply-chain-guard 6.3.0 → 6.3.2

package/README.md

@@ -36,7 +36,7 @@ Gate every pull request:
 
 ```yaml
 - uses: actions/checkout@v4
-- uses: homeofe/supply-chain-guard@v6.3.0
+- uses: homeofe/supply-chain-guard@v6.3.2
 ```
 
 Let your AI coding agent check a package before it installs it (MCP):
@@ -126,6 +126,7 @@ is something to match:
 - Shannon entropy analysis for encoded payloads
 - Proxy handler traps, WebAssembly from external sources
 - Scan-coverage transparency: files above the 5 MB content-scan limit are surfaced as `FILE_TOO_LARGE_SKIPPED` (info severity, never affects exit codes) instead of being silently skipped - padding a payload past the limit no longer hides it from the report
+- Executable scripts without an extension are read in the language their shebang names (`#!/bin/sh`, `#!/usr/bin/env node`, `python3`, `ruby`, `perl` and others), and an extensionless file named like a git hook (`pre-commit`, `pre-push`, ...) is read as shell even without one, so hooks under `scripts/hooks/` or `.husky/` and `bin/` launchers in a directory scan or an npm tarball are content-scanned. `*.bats` suites are read as bash and, like `*.test.ts`, count as test files, and Perl source is read as `.pl`/`.pm` too. A file with no extension, no shebang and no hook name is still not read
 
 ### Supply Chain Attacks
 - Install hook deep analysis (secret harvesting, download-exec chains, binary blobs)
@@ -209,7 +210,7 @@ Run the scanner as a [pre-commit](https://pre-commit.com) hook (Python-ecosystem
 ```yaml
 repos:
   - repo: https://github.com/homeofe/supply-chain-guard
-    rev: v6.3.0
+    rev: v6.3.2
     hooks:
       - id: supply-chain-guard
 ```
@@ -241,7 +242,7 @@ The hook scans the repository root on every commit and fails on high or critical
 Run the scanner without a Node toolchain via the official multi-arch image (linux/amd64, linux/arm64), published to GHCR on every release tag:
 
 ```bash
-docker run --rm -v ${PWD}:/scan ghcr.io/homeofe/supply-chain-guard:6.3.0 scan /scan
+docker run --rm -v ${PWD}:/scan ghcr.io/homeofe/supply-chain-guard:6.3.2 scan /scan
 ```
 
 `${PWD}` works in bash, zsh, and PowerShell; in cmd.exe use `%cd%` instead.
@@ -998,7 +999,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: homeofe/supply-chain-guard@v6.3.0
+      - uses: homeofe/supply-chain-guard@v6.3.2
         with:
           fail-on: critical
           comment-on-pr: true
@@ -1086,7 +1087,7 @@ two are never confused. If a deliberately frozen rule set is the intent, exclude
 the rule by name:
 
 ```yaml
-- uses: homeofe/supply-chain-guard@v6.3.0
+- uses: homeofe/supply-chain-guard@v6.3.2
   with:
     exclude-rules: THREAT_FEED_STALE
 ```
@@ -1157,7 +1158,7 @@ preceding `feed refresh` in the workflow does not count. `catalog: required`
 on the Action therefore needs:
 
 ```yaml
-- uses: homeofe/supply-chain-guard@v6.3.0
+- uses: homeofe/supply-chain-guard@v6.3.2
   with:
     refresh-catalog: true
 ```
@@ -1168,11 +1169,49 @@ setting rather than firing on every scan. If scanning against the bundled set
 alone is the intent, exclude the rule by name:
 
 ```yaml
-- uses: homeofe/supply-chain-guard@v6.3.0
+- uses: homeofe/supply-chain-guard@v6.3.2
   with:
     exclude-rules: THREAT_FEED_CATALOG_MISSING
 ```
 
+### How the Action installs the scanner it runs
+
+The Action does not trust the registry to hand it the right scanner. The npm
+version is pinned in `action.yml`, and that alone would let a registry or CDN
+response carrying other bytes under that version run as the scanner, next to
+your checkout and your token. So before anything is scanned:
+
+1. The pinned version is installed into a throwaway project under
+   `RUNNER_TEMP`, from `https://registry.npmjs.org/`, with `--ignore-scripts`,
+   never globally. Its lockfile records the integrity of the tarball on disk.
+2. `npm audit signatures --include-attestations` verifies the registry
+   signature and the Sigstore provenance of what was installed.
+3. `scripts/verify-action-install.mjs` then requires what npm does not: that
+   the provenance exists at all, that its signing certificate was issued to
+   this repository (by name and by numeric id) running
+   `.github/workflows/ci.yml` at the release tag, and that it describes the
+   tarball the lockfile recorded.
+
+Any failure stops the job with an error annotation naming the check, before the
+scan step runs and before the scanner reaches `PATH`. No input changes this and
+the inputs and outputs are unchanged.
+
+What this covers is the scanner package itself. Its npm dependencies (today one,
+`commander`, resolved within its declared range at install time) are checked by
+registry signature only: they carry no provenance from this repository, and the
+published package ships no shrinkwrap that would pin them.
+
+Two operational requirements follow. The runner needs npm 11.12.0 or later,
+which Node 24.15.0 and later bundle. The Action's `actions/setup-node` step uses
+`check-latest: true`, so a runner whose tool cache holds an older Node 24
+resolves the newest 24.x instead; if npm is still too old after that, the install
+step fails closed with a message saying so. And the step talks to
+`registry.npmjs.org` and to the Sigstore trust root CDN
+(`tuf-repo-cdn.sigstore.dev`). The public registry is set explicitly, whatever a
+runner's `.npmrc` says, because the provenance check is only meaningful against
+the registry that recorded the attestation; a runner that can reach only a
+registry mirror cannot verify the scanner and will not run it.
+
 ### Action Inputs
 
 | Input | Description | Default |

package/action.yml

@@ -76,15 +76,53 @@ outputs:
 runs:
   using: "composite"
   steps:
+    # check-latest: a runner's tool cache can hold an old Node 24 whose npm is
+    # older than 11.12.0, which cannot report the attestations the install step
+    # verifies. Resolving the newest 24.x avoids that; if npm is still too old,
+    # the install step fails closed and says so.
     - name: Setup Node.js
       uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
       with:
         node-version: "24"
+        check-latest: true
         package-manager-cache: false
 
+    # The scanner is verified before it runs, not only pinned by version: a
+    # registry or CDN response carrying other bytes under this version would
+    # otherwise run with the checkout and the token in reach. It is installed
+    # into a throwaway project (never -g, so a lockfile records exactly what was
+    # installed), npm verifies the registry signature and the Sigstore
+    # provenance, and scripts/verify-action-install.mjs then requires that the
+    # provenance exists and was signed by this repository's release workflow at
+    # this version's tag, for the tarball on disk. Any failure stops the Action
+    # before the scan step; nothing is added to PATH.
     - name: Install supply-chain-guard
       shell: bash
-      run: npm install -g supply-chain-guard@6.3.0 --ignore-scripts --no-audit --no-fund
+      env:
+        SCG_VERSION: "6.3.2"
+        SCG_EXPECTED_REPOSITORY: "homeofe/supply-chain-guard"
+        SCG_EXPECTED_REPOSITORY_ID: "1185867580"
+        SCG_EXPECTED_WORKFLOW: ".github/workflows/ci.yml"
+      run: |
+        set -euo pipefail
+        SCG_INSTALL_DIR=$(mktemp -d "$RUNNER_TEMP/scg-install.XXXXXX")
+        export SCG_INSTALL_DIR
+        printf '{"name":"scg-action-install","version":"0.0.0","private":true}\n' > "$SCG_INSTALL_DIR/package.json"
+        # The public registry explicitly: provenance and registry keys are
+        # verified against it, and a runner-level .npmrc must not redirect this.
+        npm install --prefix "$SCG_INSTALL_DIR" --save-exact --ignore-scripts --no-audit --no-fund \
+          --registry=https://registry.npmjs.org/ "supply-chain-guard@$SCG_VERSION"
+        SCG_NPM_VERSION=$(npm --version)
+        export SCG_NPM_VERSION
+        export SCG_AUDIT_JSON="$SCG_INSTALL_DIR/audit-signatures.json"
+        if ! (cd "$SCG_INSTALL_DIR" && npm audit signatures --json --include-attestations \
+          --registry=https://registry.npmjs.org/ > "$SCG_AUDIT_JSON"); then
+          echo "::error title=supply-chain-guard install verification failed::npm audit signatures rejected the installed scanner; it will not be run." >&2
+          cat "$SCG_AUDIT_JSON" >&2 || true
+          exit 1
+        fi
+        node "$GITHUB_ACTION_PATH/scripts/verify-action-install.mjs"
+        echo "$SCG_INSTALL_DIR/node_modules/.bin" >> "$GITHUB_PATH"
 
     - name: Run scan
       id: scan

package/dist/catalog-digest.d.ts

@@ -1,8 +1,8 @@
 export declare const CATALOG_DIGEST: {
-    readonly version: "6.3.0";
-    readonly sha256: "c2deb3b1c0ad6bb22dc7045850a246f8f5baaa59ef7f40d3a3bc24eb814eb0aa";
-    readonly entriesSha256: "6a2ca03c25cf7259672f2d82bd49bad9205e6400ed32e7ce995d0bc15e91ea16";
-    readonly entryCount: 86829;
+    readonly version: "6.3.2";
+    readonly sha256: "2b986e3d5e07d16bad13558323ffc5ad1f0463a3ca5a028dbf4bbeb3b4dfd7ac";
+    readonly entriesSha256: "e36ca343f6097a0a970d232244046bf90f2472a38ef90f8dc6afb469fed1b30f";
+    readonly entryCount: 87915;
     readonly shardCount: 2;
 };
 //# sourceMappingURL=catalog-digest.d.ts.map

package/dist/catalog-digest.js

@@ -14,10 +14,10 @@ exports.CATALOG_DIGEST = void 0;
 // read off loadThreatIntel()'s hot path, is typechecked, and supplies the
 // version refreshFeed() needs to build the catalog URL.
 exports.CATALOG_DIGEST = {
-    version: "6.3.0",
-    sha256: "c2deb3b1c0ad6bb22dc7045850a246f8f5baaa59ef7f40d3a3bc24eb814eb0aa",
-    entriesSha256: "6a2ca03c25cf7259672f2d82bd49bad9205e6400ed32e7ce995d0bc15e91ea16",
-    entryCount: 86829,
+    version: "6.3.2",
+    sha256: "2b986e3d5e07d16bad13558323ffc5ad1f0463a3ca5a028dbf4bbeb3b4dfd7ac",
+    entriesSha256: "e36ca343f6097a0a970d232244046bf90f2472a38ef90f8dc6afb469fed1b30f",
+    entryCount: 87915,
     shardCount: 2,
 };
 //# sourceMappingURL=catalog-digest.js.map

package/dist/cli.js

@@ -198,7 +198,7 @@ function assertDistinctOutputPaths(options) {
 program
     .name("supply-chain-guard")
     .description("Open-source supply-chain security scanner. Detects GlassWorm and similar malware campaigns in npm packages, PyPI packages, code repos, VS Code extensions, and project dependencies.")
-    .version("6.3.0");
+    .version("6.3.2");
 // ── scan command ────────────────────────────────────────────────────
 program
     .command("scan")

package/dist/dependency-confusion.js

@@ -53,7 +53,7 @@ const types_js_1 = require("./types.js");
 const pattern_scanner_js_1 = require("./pattern-scanner.js");
 const json_utils_js_1 = require("./json-utils.js");
 const publishing_anomaly_detector_js_1 = require("./publishing-anomaly-detector.js");
-const TOOL_VERSION = "6.3.0";
+const TOOL_VERSION = "6.3.2";
 const NPM_REGISTRY = "https://registry.npmjs.org";
 const NPM_DOWNLOADS_API = "https://api.npmjs.org/downloads/point/last-week";
 const PYPI_REGISTRY = "https://pypi.org/pypi";

package/dist/internal-disclosure.d.ts

@@ -455,8 +455,14 @@ export declare function candidateTokens(line: string, meta?: {
  *
  * `runtime` carries the configured deny-list; pass
  * `emptyInternalDisclosureRuntime()` to run the built-in shape rules alone.
+ *
+ * `languageExtension` is the language a file is read as when its path does not
+ * say (an extensionless `#!/usr/bin/env node` hook reads as `.js`; see
+ * script-language.ts). It decides only the lexical questions: comment syntax,
+ * string interpolation and `onlyExtensions`. Test-file and surface
+ * classification keep reading the real path.
  */
-export declare function scanInternalDisclosure(content: string, relativePath: string, runtime?: InternalDisclosureRuntime): Finding[];
+export declare function scanInternalDisclosure(content: string, relativePath: string, runtime?: InternalDisclosureRuntime, languageExtension?: string): Finding[];
 /** Remediation text per rule id. */
 export declare function getInternalDisclosureRecommendation(rule: string): string;
 export {};

package/dist/internal-disclosure.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"internal-disclosure.d.ts","sourceRoot":"","sources":["../src/internal-disclosure.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiEG;AAKH,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AA8GhF,qEAAqE;AACrE,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAIvD;AAED,+DAA+D;AAC/D,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAKpD;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAS5D;AAMD;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI,CAYxD;AAED,MAAM,MAAM,SAAS,GAAG,SAAS,GAAG,UAAU,GAAG,eAAe,GAAG,QAAQ,GAAG,SAAS,CAAC;AAExF;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAoBrD;AA0ED;;;;GAIG;AACH,cAAM,cAAc;IAaN,OAAO,CAAC,QAAQ,CAAC,OAAO;IAZpC,OAAO,CAAC,MAAM,CAAK;IACnB,OAAO,CAAC,SAAS,CAAK;IACtB,OAAO,CAAC,MAAM,CAAK;IACnB,OAAO,CAAC,KAAK,CAA0B;IACvC,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,WAAW,CAAM;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAsB;IAC7C,OAAO,CAAC,UAAU,CAAK;IACvB,OAAO,CAAC,UAAU,CAAK;IACvB,OAAO,CAAC,iBAAiB,CAAC,CAAU;IACpC,OAAO,CAAC,KAAK,CAAC,CAAiB;IAE/B,YAA6B,OAAO,EAAE,MAAM,EAAI;IAEhD,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CA+ClC;IAED,OAAO,CAAC,SAAS;IAqIjB,OAAO,CAAC,aAAa;IASrB,OAAO,CAAC,UAAU;CAyBnB;AAED,2EAA2E;AAC3E,UAAU,6BAA6B;IACrC,EAAE,EAAE,cAAc,CAAC;CACpB;AAkDD,wBAAgB,gCAAgC,CAC9C,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,MAAM,GACZ,OAAO,CAOT;AACD;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAU3D;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CASxD;AAkED,gFAAgF;AAChF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGvD;AAED,4EAA4E;AAC5E,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAKpD;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAUpD;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAIvD;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,GAAG,QAAQ,CAE7E;AAED,yCAAyC;AACzC,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAOzD;AAED,qEAAqE;AACrE,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAMhE;AAED,qEAAqE;AACrE,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE7D;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAQ3D;AAED,qEAAqE;AACrE,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAW5D;AAaD;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAI7E;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAQT;AAaD;;;GAGG;AACH,MAAM,WAAW,oBAAqB,SAAQ,YAAY;IACxD,mGAAmG;IACnG,cAAc,CAAC,EAAE,KAAK,CAAC;IACvB,UAAU,CAAC,EAAE,KAAK,CAAC;IACnB,iBAAiB,CAAC,EAAE,KAAK,CAAC;IAC1B;;;OAGG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,qEAAqE;IACrE,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,QAAQ,CAAC;IACnD,gEAAgE;IAChE,aAAa,CAAC,EAAE,CACd,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,eAAe,EACtB,OAAO,EAAE,6BAA6B,KACnC,OAAO,CAAC;CACd;AAiDD;;;GAGG;AACH,eAAO,MAAM,4BAA4B,EAAE,oBAAoB,EA2I9D,CAAC;AA6EF,4EAA4E;AAC5E,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,OAAO,GAAG,SAAS,CAAC;AAoDzD,kEAAkE;AAClE,wBAAgB,mBAAmB,CAAC,YAAY,EAAE,MAAM,GAAG,WAAW,CAOrE;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAEjE;AAED,0DAA0D;AAC1D,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAIhF;AAMD;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,OAAO,CAAC;AAEpC,yDAAyD;AACzD,eAAO,MAAM,qBAAqB,KAAK,CAAC;AAExC,iEAAiE;AACjE,eAAO,MAAM,qBAAqB,MAAM,CAAC;AAEzC;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,QAAQ,CAAC;AAEjD;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,MAAM,CAAC;AAEjD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,8BAA8B,QAAS,CAAC;AAiBrD;;;;GAIG;AACH,UAAU,SAAS;IACjB,oCAAoC;IACpC,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,2DAA2D;IAC3D,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,gEAAgE;AAChE,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CASzD;AAED,2EAA2E;AAC3E,wBAAgB,YAAY,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAUrE;AA+ID;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAelE;AAED,iFAAiF;AACjF,wBAAgB,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAUtF;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,GAAG,MAAM,CAc7E;AAWD;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,OAAO,EACnB,aAAa,UAAO,GACnB,OAAO,CAGT;AAyCD,+EAA+E;AAC/E,UAAU,eAAe;IACvB,gEAAgE;IAChE,MAAM,EAAE,OAAO,EAAE,CAAC;IAClB,kFAAkF;IAClF,YAAY,EAAE,OAAO,EAAE,CAAC;IACxB,qEAAqE;IACrE,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;CACxC;AAED,0EAA0E;AAC1E,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,eAAe,CAiCrE;AAMD;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED,8EAA8E;AAC9E,eAAO,MAAM,sBAAsB,2BAA2B,CAAC;AAE/D;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAI3E;AAED;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,iBAAiB,GAAG,UAAU,GAAG,cAAc,CAAC;AAE5D,kCAAkC;AAClC,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,MAAM,EAAE,OAAO,CAAC;IAChB,wEAAwE;IACxE,KAAK,EAAE,MAAM,CAAC;IACd,wDAAwD;IACxD,MAAM,EAAE,iBAAiB,CAAC;CAC3B;AAED,sEAAsE;AACtE,MAAM,WAAW,yBAAyB;IACxC,gDAAgD;IAChD,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACpB,yFAAyF;IACzF,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,iFAAiF;IACjF,YAAY,EAAE,OAAO,EAAE,CAAC;IACxB,yEAAyE;IACzE,OAAO,EAAE,OAAO,CAAC;IACjB,2EAA2E;IAC3E,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB;;;;OAIG;IACH,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAED,+EAA+E;AAC/E,eAAO,MAAM,uBAAuB,iCAAiC,CAAC;AAEtE,uEAAuE;AACvE,wBAAgB,8BAA8B,IAAI,yBAAyB,CAS1E;AA+LD;;;;;;;;;;GAUG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,YAAY,GAAG,IAAI,EAC3B,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,yBAAyB,CA4H3B;AAMD;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;IAAE,SAAS,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,EAAE,CAwCrF;AAwFD;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE,yBAA4D,GACpE,OAAO,EAAE,CAwNX;AAuGD,oCAAoC;AACpC,wBAAgB,mCAAmC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CA4BxE"}
+{"version":3,"file":"internal-disclosure.d.ts","sourceRoot":"","sources":["../src/internal-disclosure.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiEG;AAKH,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AA8GhF,qEAAqE;AACrE,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAIvD;AAED,+DAA+D;AAC/D,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAKpD;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAS5D;AAMD;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI,CAYxD;AAED,MAAM,MAAM,SAAS,GAAG,SAAS,GAAG,UAAU,GAAG,eAAe,GAAG,QAAQ,GAAG,SAAS,CAAC;AAExF;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAoBrD;AA0ED;;;;GAIG;AACH,cAAM,cAAc;IAaN,OAAO,CAAC,QAAQ,CAAC,OAAO;IAZpC,OAAO,CAAC,MAAM,CAAK;IACnB,OAAO,CAAC,SAAS,CAAK;IACtB,OAAO,CAAC,MAAM,CAAK;IACnB,OAAO,CAAC,KAAK,CAA0B;IACvC,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,WAAW,CAAM;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAsB;IAC7C,OAAO,CAAC,UAAU,CAAK;IACvB,OAAO,CAAC,UAAU,CAAK;IACvB,OAAO,CAAC,iBAAiB,CAAC,CAAU;IACpC,OAAO,CAAC,KAAK,CAAC,CAAiB;IAE/B,YAA6B,OAAO,EAAE,MAAM,EAAI;IAEhD,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CA+ClC;IAED,OAAO,CAAC,SAAS;IAqIjB,OAAO,CAAC,aAAa;IASrB,OAAO,CAAC,UAAU;CAyBnB;AAED,2EAA2E;AAC3E,UAAU,6BAA6B;IACrC,EAAE,EAAE,cAAc,CAAC;CACpB;AAuFD,wBAAgB,gCAAgC,CAC9C,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,MAAM,GACZ,OAAO,CAOT;AACD;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAU3D;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CASxD;AAkED,gFAAgF;AAChF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGvD;AAED,4EAA4E;AAC5E,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAKpD;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAUpD;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAIvD;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,GAAG,QAAQ,CAE7E;AAED,yCAAyC;AACzC,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAOzD;AAED,qEAAqE;AACrE,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAMhE;AAED,qEAAqE;AACrE,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE7D;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAQ3D;AAED,qEAAqE;AACrE,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAW5D;AAaD;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAI7E;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAQT;AAaD;;;GAGG;AACH,MAAM,WAAW,oBAAqB,SAAQ,YAAY;IACxD,mGAAmG;IACnG,cAAc,CAAC,EAAE,KAAK,CAAC;IACvB,UAAU,CAAC,EAAE,KAAK,CAAC;IACnB,iBAAiB,CAAC,EAAE,KAAK,CAAC;IAC1B;;;OAGG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,qEAAqE;IACrE,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,QAAQ,CAAC;IACnD,gEAAgE;IAChE,aAAa,CAAC,EAAE,CACd,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,eAAe,EACtB,OAAO,EAAE,6BAA6B,KACnC,OAAO,CAAC;CACd;AAiDD;;;GAGG;AACH,eAAO,MAAM,4BAA4B,EAAE,oBAAoB,EA2I9D,CAAC;AA6EF,4EAA4E;AAC5E,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,OAAO,GAAG,SAAS,CAAC;AAoDzD,kEAAkE;AAClE,wBAAgB,mBAAmB,CAAC,YAAY,EAAE,MAAM,GAAG,WAAW,CAOrE;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAEjE;AAED,0DAA0D;AAC1D,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAIhF;AAMD;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,OAAO,CAAC;AAEpC,yDAAyD;AACzD,eAAO,MAAM,qBAAqB,KAAK,CAAC;AAExC,iEAAiE;AACjE,eAAO,MAAM,qBAAqB,MAAM,CAAC;AAEzC;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,QAAQ,CAAC;AAEjD;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,MAAM,CAAC;AAEjD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,8BAA8B,QAAS,CAAC;AAiBrD;;;;GAIG;AACH,UAAU,SAAS;IACjB,oCAAoC;IACpC,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,2DAA2D;IAC3D,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,gEAAgE;AAChE,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CASzD;AAED,2EAA2E;AAC3E,wBAAgB,YAAY,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAUrE;AA+ID;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAelE;AAED,iFAAiF;AACjF,wBAAgB,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAUtF;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,GAAG,MAAM,CAc7E;AAWD;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,OAAO,EACnB,aAAa,UAAO,GACnB,OAAO,CAGT;AAyCD,+EAA+E;AAC/E,UAAU,eAAe;IACvB,gEAAgE;IAChE,MAAM,EAAE,OAAO,EAAE,CAAC;IAClB,kFAAkF;IAClF,YAAY,EAAE,OAAO,EAAE,CAAC;IACxB,qEAAqE;IACrE,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;CACxC;AAED,0EAA0E;AAC1E,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,eAAe,CAiCrE;AAMD;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED,8EAA8E;AAC9E,eAAO,MAAM,sBAAsB,2BAA2B,CAAC;AAE/D;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAI3E;AAED;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,iBAAiB,GAAG,UAAU,GAAG,cAAc,CAAC;AAE5D,kCAAkC;AAClC,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,MAAM,EAAE,OAAO,CAAC;IAChB,wEAAwE;IACxE,KAAK,EAAE,MAAM,CAAC;IACd,wDAAwD;IACxD,MAAM,EAAE,iBAAiB,CAAC;CAC3B;AAED,sEAAsE;AACtE,MAAM,WAAW,yBAAyB;IACxC,gDAAgD;IAChD,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACpB,yFAAyF;IACzF,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,iFAAiF;IACjF,YAAY,EAAE,OAAO,EAAE,CAAC;IACxB,yEAAyE;IACzE,OAAO,EAAE,OAAO,CAAC;IACjB,2EAA2E;IAC3E,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB;;;;OAIG;IACH,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAED,+EAA+E;AAC/E,eAAO,MAAM,uBAAuB,iCAAiC,CAAC;AAEtE,uEAAuE;AACvE,wBAAgB,8BAA8B,IAAI,yBAAyB,CAS1E;AA+LD;;;;;;;;;;GAUG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,YAAY,GAAG,IAAI,EAC3B,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,yBAAyB,CA4H3B;AAMD;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;IAAE,SAAS,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,EAAE,CAwCrF;AAwFD;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE,yBAA4D,EACrE,iBAAiB,CAAC,EAAE,MAAM,GACzB,OAAO,EAAE,CA2NX;AAuGD,oCAAoC;AACpC,wBAAgB,mCAAmC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CA4BxE"}

package/dist/internal-disclosure.js

@@ -621,8 +621,42 @@ function isPrivateAddressLexicalContextOkIndexed(content, matchStart, value, v8C
         return true;
     if (followsRequirementMarker(content, matchStart))
         return false;
+    if (followsSpecCitation(content, matchStart))
+        return false;
     return v8Context.allows(matchStart);
 }
+/**
+ * A section number cited after the specification it belongs to, on the same
+ * line: `(JSON Schema 2020-12, 10.3.2.3)`, `ECMA-262: 10.4.2.1`,
+ * `RFC 9110, 10.2.1.1`. Standards number their sections in dotted parts, and a
+ * chapter 10 four-part number has the 10/8 shape. Only a named specification
+ * (with an optional version) followed by a comma or colon counts, and only when
+ * adjacent: `JSON Schema server, 10.3.2.3` names a host. The RFCs that DEFINE
+ * private or special-purpose address space are excluded, because a literal after
+ * them is an example address, not a section: `RFC 1918, 10.3.2.3`.
+ */
+const SPEC_CITATION_AT_END = new RegExp(String.raw `(?:^|[^\w-])(?:` +
+    [
+        String.raw `json\s+schema(?:\s+(?:draft[-\s]?\d{1,2}|\d{4}-\d{2}))?`,
+        String.raw `ecma-\d{2,4}(?:\s+\d{1,2}(?:st|nd|rd|th)\s+edition)?`,
+        String.raw `iso(?:\/iec)?\s?\d{3,5}(?:-\d{1,3}){0,3}(?::\d{4})?`,
+        String.raw `rfc\s?(?!(?:1918|3927|4193|5735|6598|6890)\b)\d{3,5}`,
+    ].join("|") +
+    String.raw `)\s*[,:]\s*$`, "i");
+/** Longest citation plus punctuation and a little spacing; bounds the lookback. */
+const SPEC_CITATION_WINDOW = 48;
+function followsSpecCitation(content, matchStart) {
+    const start = Math.max(0, matchStart - SPEC_CITATION_WINDOW);
+    let prefix = content.slice(start, matchStart);
+    const newline = prefix.lastIndexOf("\n");
+    if (newline >= 0)
+        prefix = prefix.slice(newline + 1);
+    // Same sentinel as followsRequirementMarker: a window cut mid-line is not a
+    // word boundary.
+    else if (start > 0)
+        prefix = "x" + prefix;
+    return SPEC_CITATION_AT_END.test(prefix);
+}
 /**
  * A requirement marker written directly in front of the candidate, on the same
  * line: `Req 10.4.1.1`, `Requirement 10.4.1.1`, `§ 10.4.1.1`. PCI DSS v4.0
@@ -2085,19 +2119,26 @@ function truncatedFinding(relativePath, reasons) {
  *
  * `runtime` carries the configured deny-list; pass
  * `emptyInternalDisclosureRuntime()` to run the built-in shape rules alone.
+ *
+ * `languageExtension` is the language a file is read as when its path does not
+ * say (an extensionless `#!/usr/bin/env node` hook reads as `.js`; see
+ * script-language.ts). It decides only the lexical questions: comment syntax,
+ * string interpolation and `onlyExtensions`. Test-file and surface
+ * classification keep reading the real path.
  */
-function scanInternalDisclosure(content, relativePath, runtime = emptyInternalDisclosureRuntime()) {
+function scanInternalDisclosure(content, relativePath, runtime = emptyInternalDisclosureRuntime(), languageExtension) {
     const findings = [];
     const normalizedPath = relativePath.replace(/\\/g, "/");
+    const languagePath = languageExtension ? `${normalizedPath}${languageExtension}` : normalizedPath;
     const isTestFile = TEST_FILE.test(normalizedPath);
     const surface = classifyFileSurface(normalizedPath);
-    const isMarkdown = MARKDOWN_FILE.test(normalizedPath);
-    const isCodeFile = CODE_FILE.test(normalizedPath);
-    const hashIsComment = !C_FAMILY_FILE.test(normalizedPath);
-    const isJsonFile = JSON_FILE.test(normalizedPath);
-    const interpolation = JS_FAMILY_FILE.test(normalizedPath)
+    const isMarkdown = MARKDOWN_FILE.test(languagePath);
+    const isCodeFile = CODE_FILE.test(languagePath);
+    const hashIsComment = !C_FAMILY_FILE.test(languagePath);
+    const isJsonFile = JSON_FILE.test(languagePath);
+    const interpolation = JS_FAMILY_FILE.test(languagePath)
         ? "js"
-        : PYTHON_FILE.test(normalizedPath)
+        : PYTHON_FILE.test(languagePath)
             ? "python"
             : null;
     const index = buildLineIndex(content);
@@ -2162,7 +2203,9 @@ function scanInternalDisclosure(content, relativePath, runtime = emptyInternalDi
     // Dockerfile (lastIndexOf on the whole path would slice from a directory dot).
     const basename = normalizedPath.slice(normalizedPath.lastIndexOf("/") + 1);
     const dotAt = basename.lastIndexOf(".");
-    const fileExt = dotAt > 0 ? basename.slice(dotAt).toLowerCase() : "";
+    const fileExt = languageExtension
+        ? languageExtension.toLowerCase()
+        : dotAt > 0 ? basename.slice(dotAt).toLowerCase() : "";
     for (const pattern of exports.INTERNAL_DISCLOSURE_PATTERNS) {
         // Mirrors checkFilePatterns() in scanner.ts, so a PatternEntry behaves the
         // same way whichever loop consumes it.