feat: Supply chain attack prevention — version quarantine, new package & low download checks

src/decision.ts

@@ -1,3 +1,4 @@
+import type { SupplyChainSignal } from './registry.js';
 
 export interface Vulnerability {
   name: string;
@@ -54,3 +55,45 @@ export function makeDecision(vulnerabilities: Vulnerability[]): DecisionResult {
 
   return { decision, reason };
 }
+
+export function makeFullDecision(
+  vulnerabilities: Vulnerability[],
+  signals: SupplyChainSignal[]
+): DecisionResult {
+  // CVE-based decision first (always takes priority)
+  const cveResult = makeDecision(vulnerabilities);
+
+  // If CVE already denies, keep it — supply chain signals don't override
+  if (cveResult.decision === 'deny') {
+    // Append supply chain context if present
+    if (signals.length > 0) {
+      const scWarnings = signals.map(s => s.detail).join(' ');
+      return { decision: 'deny', reason: `${cveResult.reason} Additionally: ${scWarnings}` };
+    }
+    return cveResult;
+  }
+
+  // Build supply chain reason parts
+  if (signals.length === 0) {
+    return cveResult;
+  }
+
+  const parts: string[] = [];
+  for (const signal of signals) {
+    let line = `⚠️ ${signal.detail}`;
+    if (signal.suggestion) {
+      line += ` ${signal.suggestion}`;
+    }
+    parts.push(line);
+  }
+
+  const scReason = parts.join(' ');
+
+  // Escalate allow → ask if any supply chain signal fires
+  if (cveResult.decision === 'allow') {
+    return { decision: 'ask', reason: scReason };
+  }
+
+  // CVE was already 'ask' — combine reasons
+  return { decision: 'ask', reason: `${cveResult.reason} ${scReason}` };
+}

src/index.ts

@@ -20,9 +20,10 @@
  * }
  */
 
-import { makeDecision, type Vulnerability } from './decision.js';
+import { makeDecision, makeFullDecision, type Vulnerability } from './decision.js';
 import { parseInstallCommand } from './parser.js';
 import { checkPackageVulnerabilities, type Vulnerability as OSVVulnerability, type CheckResult } from './osv.js';
+import { checkRegistryMetadata, type SupplyChainSignal } from './registry.js';
 
 // Map OSV severity to decision engine severity
 function mapSeverity(osvSeverity: OSVVulnerability['severity']): Vulnerability['severity'] {
@@ -149,15 +150,25 @@ async function main() {
       return;
     }
 
-    // PARALLEL: Check all packages for vulnerabilities concurrently
-    const checkResults = await Promise.all(
-      checkablePackages.map(pkg =>
-        checkPackageVulnerabilities(pkg.name, pkg.version, pkg.ecosystem)
-          .then(result => ({ pkg, result }))
-      )
-    );
-
-    // FAIL CLOSED: If any check failed, deny the install
+    // PARALLEL: Run OSV and registry checks concurrently
+    const [checkResults, registryResults] = await Promise.all([
+      // OSV vulnerability checks (fail-closed)
+      Promise.all(
+        checkablePackages.map(pkg =>
+          checkPackageVulnerabilities(pkg.name, pkg.version, pkg.ecosystem)
+            .then(result => ({ pkg, result }))
+        )
+      ),
+      // Registry metadata checks (fail-open)
+      Promise.all(
+        checkablePackages.map(pkg =>
+          checkRegistryMetadata(pkg.name, pkg.version, pkg.ecosystem)
+            .then(result => ({ pkg, result }))
+        )
+      ),
+    ]);
+
+    // FAIL CLOSED: If any OSV check failed, deny the install
     const errors: string[] = [];
     const allVulnerabilities: Vulnerability[] = [];
 
@@ -188,8 +199,16 @@ async function main() {
       return;
     }
 
-    // Make decision based on vulnerabilities
-    let { decision, reason } = makeDecision(allVulnerabilities);
+    // Collect supply chain signals (fail-open: errors silently ignored)
+    const allSignals: SupplyChainSignal[] = [];
+    for (const { result } of registryResults) {
+      if (result.status === 'success') {
+        allSignals.push(...result.signals);
+      }
+    }
+
+    // Make decision based on CVE vulnerabilities + supply chain signals
+    let { decision, reason } = makeFullDecision(allVulnerabilities, allSignals);
 
     // Add note about unchecked homebrew packages if any
     if (homebrewPackages.length > 0) {