Detect dependency source redirection

[rng1995]

Summary

Add deterministic HIGH SC10 findings when package-manager configuration adds or replaces a dependency source, or when a dynamic destination cannot be resolved safely from simple local assignments.

The analyzer covers npm, Yarn, pip, Poetry, Maven, and Cargo across direct config files, commands/environment variables, generated heredoc configs, and actionable shell fences. It never executes configuration or contacts a registry.

Root cause

Existing generic patterns could notice credential/configuration-adjacent text but did not model package-source changes as dependency trust-boundary changes. A non-default registry or index could therefore affect dependency resolution without a dedicated rule, operation, scope, destination status, or package-manager evidence.

BEFORE behavior

For a published regression case that generates npm and Yarn configuration through a shell script:

• no dependency-source-specific finding was emitted;
• the destination and add/replace operation were absent from evidence;
• only generic findings contributed to the result;
• result: 46 / MEDIUM / CAUTION.

AFTER behavior

The same case now emits two deterministic SC10 HIGH findings:

Ecosystem	Line	Operation	Surface	Destination status
npm	51	replace	.npmrc	resolved
Yarn	58	replace	.yarnrc	resolved

The destination is resolved through a same-file literal assignment and carried as structured, credential-safe evidence. The resulting combined assessment is 95 / CRITICAL / DO_NOT_INSTALL.

Supported surfaces

Ecosystem	Direct configuration	Commands/environment	Generated configuration
npm	.npmrc, including scoped registries	npm config set, NPM_CONFIG_REGISTRY	.npmrc heredoc
Yarn	.yarnrc, .yarnrc.yml	yarn config set	Yarn config heredoc
pip	pip.conf, pip.ini	index flags, pip config set, index environment variables	pip config heredoc
Poetry	pyproject.toml sources	source/repository commands	pyproject.toml heredoc
Maven	repositories and mirrors in XML config	Maven CLI repository override	Maven XML heredoc
Cargo	source replacement and registry indexes	registry-index environment variables	Cargo config heredoc

Commands in executable scripts and shell-language Markdown fences are actionable. Explanatory prose, comments, unrelated uses of the word “registry,” and non-shell fences do not create SC10 findings.

Deterministic decision model

• Built-in canonical public defaults do not produce SC10 when left unchanged.
• A noncanonical replacement is HIGH.
• An additional source is HIGH.
• A destination that remains dynamic after simple same-file literal resolution is HIGH with status unresolved.
• Every other resolved destination is treated uniformly; there are no organization allowlists, DNS checks, network calls, or reputation judgments.
• SC10 survives optional LLM meta-analysis. Existing explicit, user-selected baseline behavior is unchanged.

Evidence and credential safety

Each finding includes:

• ecosystem;
• add/replace operation;
• configuration surface;
• global or scoped reach;
• redacted destination;
• resolved/unresolved status.

URL userinfo and sensitive query values are removed from SC10 findings. Report-level defense in depth applies the same redaction to every finding field and evidence string in terminal, JSON, Markdown, and SARIF output.

Validation

• Dependency-source and report-redaction suite: 24 passed.
• Supply-chain, meta-analysis, and reporting regression suites: 231 passed.
• Full suite on the combined stack: 2,226 passed, 13 skipped, 38 deselected, 4 xfailed.
• Source distribution and wheel build passed; both new analyzer modules are present in the wheel.
• Focused mypy, changed-file Ruff formatting/lint, and git diff --check passed.

Review order

This PR is intentionally stacked on the nested-artifact PR so each change remains reviewable. After the first PR merges, this PR can be retargeted to main; its own commit contains only SC10, credential redaction, tests, and documentation.

Out of scope

• Registry reputation, ownership, reachability, or vulnerability lookup.
• Executing package-manager commands or configuration.
• User-managed trusted-host allowlists.

[rng1995]

Review comments taken up offline with Nir Paz and addressed in the PR.

[rng1995]

Implemented the remaining findings from Nir's review

1. Issue: executable dependency-source commands were missed in shell context. Commands behind temporary assignment prefixes, inline then/do/else, brace groups, and package-manager surfaces could escape detection.
   Solution: normalize executable command segments and control wrappers before matching, and strip valid temporary assignment words consistently across npm, Yarn, pip, Poetry, and Maven detection.

2. Issue: shell-state tracking mishandled compact/invalid assignments. One-line case assignments or function calls could be ignored, whitespace-separated NAME = value could be treated as an assignment, and export NAME=value OTHER_NAME could lose the valid assignment.
   Solution: recognize only valid shell assignment-word syntax, conservatively mark one-line case results as unresolved, retain valid exported assignments with trailing names, and allow a later definite canonical assignment to clear earlier ambiguity.

3. Issue: word-level heredoc quoting was incomplete. Mixed quoted or partially escaped delimiters could hide generated configuration or cause unrelated body text to be analyzed.
   Solution: add bounded static quote removal for mixed quoted, escaped, and unquoted delimiter segments, while ensuring malformed/unsupported delimiter words do not consume later executable commands.

Validation: 85 dependency-source tests, 224 focused dependency/report/meta tests, 8 terminal/JSON/Markdown/SARIF end-to-end cases, and 2,316 repository tests passed; Ruff, focused mypy, and git diff --check also passed.