weavatrix 0.2.6 → 0.2.8

package/src/security/malware-scoring.js

@@ -26,8 +26,11 @@ function visibleSignals(signals, allow) {
   return hasStrongerUrl ? kept.filter((s) => s.key !== "hardcoded-url") : kept;
 }
 
-function escalatedSeverity(baseSeverity, smoking, multi, nearZeroFp) {
-  if (smoking && nearZeroFp) return "critical";
+// Heuristic source matches can justify urgent review, but they cannot prove that code executed or
+// credentials left the machine. Reserve `critical` for independently confirmed advisories/runtime
+// evidence; this scanner therefore has an explicit HIGH ceiling.
+function heuristicSeverity(baseSeverity, smoking, multi) {
+  if (baseSeverity === "critical") return "high";
   if ((smoking || multi) && (baseSeverity === "medium" || baseSeverity === "low")) return "high";
   return baseSeverity;
 }
@@ -63,20 +66,34 @@ export function buildMalwareFindings({ byPkg, importedPkgs, contentRoots, scanMo
     for (const key of keys) {
       const ofKey = visible.filter((s) => s.key === key);
       const base = ofKey[0];
-      const severity = escalatedSeverity(base.severity, smoking, multi, base.nearZeroFp);
+      const severity = heuristicSeverity(base.severity, smoking, multi);
       findings.push(makeFinding({
         category: "malware",
         rule: key,
         severity,
         confidence: base.nearZeroFp ? "high" : multi ? "medium" : "low",
+        assessment: "SUSPICIOUS_STATIC_EVIDENCE",
+        confirmedExecution: false,
+        requiresRuntimeConfirmation: true,
+        severityCeiling: "high",
         title: `${base.what}: ${pkg}`,
-        detail: `${base.what} in installed package "${pkg}"${multi ? ` - co-occurs with ${[...keys].filter((k) => k !== key).join(", ")} (escalated)` : ""}${importedPkgs.has(pkg) ? ". This package IS imported by the repo's own code." : ". Transitive install (still runs its install scripts)."} Heuristic pattern match - inspect the cited file before acting.`,
+        detail: `${base.what} in installed package "${pkg}"${multi ? ` - co-occurs with ${[...keys].filter((k) => k !== key).join(", ")} (escalated)` : ""}${importedPkgs.has(pkg) ? ". This package IS imported by the repo's own code." : ". Transitive install (its install scripts may have run)."} Static heuristic evidence only: execution, package compromise, and credential exposure are NOT confirmed. Inspect the cited file and verify origin/lockfile/runtime evidence before acting.`,
         package: pkg,
         file: base.file ? String(base.file).replace(/\\/g, "/") : "",
         line: base.line || 0,
         evidence: evidenceRows(ofKey),
         source: "heuristic",
-        fixHint: smoking ? `treat as compromised: remove ${pkg}, reinstall from a clean lockfile, rotate reachable secrets` : `review the cited code in ${pkg}`,
+        verification: {
+          staticPattern: "MATCHED",
+          runtimeExecution: "NOT_VERIFIED",
+          packageOrigin: "NOT_VERIFIED",
+          lockfileIntegrity: "NOT_VERIFIED",
+          credentialExposure: "NOT_VERIFIED",
+          decision: "MANUAL_CONFIRMATION_REQUIRED",
+        },
+        fixHint: smoking
+          ? `quarantine and inspect ${pkg}; verify package origin and lockfile integrity before removal; rotate secrets only if execution or credential exposure is confirmed`
+          : `review the cited code in ${pkg}`,
       }));
     }
   }