From b3cec90a47d872a08fea1aa8f1ce777e585a02c2 Mon Sep 17 00:00:00 2001 From: galuis116 Date: Fri, 17 Jul 2026 14:58:25 -0400 Subject: [PATCH] docs(review): correct lockfile-tamper.ts's module header to state its npm-only scope The module header claimed the check scans "package-lock.json (or another *.lock file)", but isNpmLockfilePath only ever matches package-lock.json -- yarn.lock and pnpm-lock.yaml are never scanned, exactly as isNpmLockfilePath's own doc comment already states. Aligns the module header with that. --- src/review/lockfile-tamper.ts | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/src/review/lockfile-tamper.ts b/src/review/lockfile-tamper.ts index 50d3f6d718..c7b90a284d 100644 --- a/src/review/lockfile-tamper.ts +++ b/src/review/lockfile-tamper.ts @@ -1,5 +1,6 @@ -// Lockfile-tamper-risk gate check (#2563). Deterministic scan of a changed `package-lock.json` (or another -// `*.lock` file) diff for the classic supply-chain tell: a `resolved`/`integrity` value changed WITHOUT that +// Lockfile-tamper-risk gate check (#2563). Deterministic scan of a changed `package-lock.json` diff (npm +// only — see isNpmLockfilePath below; yarn.lock/pnpm-lock.yaml are not parsed) for the classic supply-chain +// tell: a `resolved`/`integrity` value changed WITHOUT that // SAME package-lock entry's own `"version"` field genuinely changing, or a `resolved` URL that points outside // the public npm registry. Distinct from the OSV.dev CVE analyzer (review-enrichment/src/analyzers/lockfile-drift.ts) // — that flags KNOWN-CVE versions; this flags tamper/integrity-substitution regardless of whether the substituted