Skip to content

docs: fix the npm-script-lens links in the verdict heuristics research #55

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kridaydave merged 1 commit into from
Sep 12, 2026
Merged

docs: fix the npm-script-lens links in the verdict heuristics research #55

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 5 additions & 5 deletions CD_res/research-phase1/verdict-heuristics.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -364,8 +364,8 @@ D5/D6 and the rule set say.
`prisma` / `@prisma/engines` (downloads platform engine binaries), and `core-js` (a
funding banner that only writes a file and reads env vars)
([RFC 0054](https://github.com/npm/rfcs/blob/main/accepted/0054-make-scripts-install-opt-in.md),
[npm-script-lens demo report](https://github.com/Booyak101/npm-script-lens),
[dev.to walkthrough](https://dev.to/booyak101/npm-v12-stopped-running-install-scripts-which-ones-do-you-approve-a-real-audit-walkthrough-b1l)).
[npm-script-lens demo report](https://github.com/Booyaka101/npm-script-lens),
[dev.to walkthrough](https://dev.to/booyaka101/npm-v12-stopped-running-install-scripts-which-ones-do-you-approve-a-real-audit-walkthrough-b1l)).
- A concrete capability classification that separates them (from npm-script-lens, which
statically analyzes scripts and their require-chains):
- HIGH: spawns processes (child_process, execa, node-gyp, unresolved binaries) or runs
Expand All @@ -374,7 +374,7 @@ D5/D6 and the rule set say.
- MEDIUM: network access without exec;
- LOW: filesystem writes or process.env reads only;
- SAFE: none
([npm-script-lens](https://github.com/Booyak101/npm-script-lens)).
([npm-script-lens](https://github.com/Booyaka101/npm-script-lens)).

### What malicious install scripts look like

Expand Down Expand Up @@ -733,8 +733,8 @@ Bands (score only; BLOCK latch wins regardless):
- npm install-scripts command docs (v12): https://docs.npmjs.com/cli/v12/commands/npm-install-scripts/
- pnpm supply chain security: https://pnpm.io/supply-chain-security
- bun lifecycle docs: https://bun.com/docs/pm/lifecycle
- npm-script-lens: https://github.com/Booyak101/npm-script-lens
- npm v12 audit walkthrough (dev.to): https://dev.to/booyak101/npm-v12-stopped-running-install-scripts-which-ones-do-you-approve-a-real-audit-walkthrough-b1l
- npm-script-lens: https://github.com/Booyaka101/npm-script-lens
- npm v12 audit walkthrough (dev.to): https://dev.to/booyaka101/npm-v12-stopped-running-install-scripts-which-ones-do-you-approve-a-real-audit-walkthrough-b1l
- Latch paper: https://ldklab.github.io/assets/papers/asiaccs22-latch.pdf
- Weak Links in the npm Supply Chain (ICSE 2022): https://patricegodefroid.github.io/public_psfiles/icse2022.pdf
- Amalfi (ICSE 2022): https://dl.acm.org/doi/10.1145/3510003.3510104
Expand Down
Loading