Jev 분류가 Hemanth.HM의 pkg-gate에서 npm install 스크립트를 게이트합니다

작성자: Hemanth.HM

가드레일

이 사용 사례 분류

이 npm 수명 주기 스크립트의 intent Choice, threat Score, secret Noul, remote-exec Noul을 Jev에 묻습니다.

Name: script_intent
지시: What is the primary intent and runtime behavior of `script_content` executed in lifecycle hook `lifecycle_hook`?
기준: build_tool
Standard compilation or native build (e.g. node-gyp, esbuild, tsc, cargo)
binary_download
Downloads official pre-compiled native binaries or assets from a known repository or CDN
benign_notice
Informational message, donation banner, or benign no-op command
system_recon
Gathers host system details, environment variables, network interfaces, or user directories
credential_access
Reads or extracts secrets, authentication tokens (NPM_TOKEN, AWS, SSH keys), or credential files
obfuscated_exec
Executes obfuscated code, base64 payloads, or pipes curl/wget to bash/sh/node
other
General package maintenance or utility task

Name: threat_severity
지시: How severe is the security risk of executing `script_content` during npm install of `package.name`?
기준: 0
Safe: standard build or benign command with no external network or secret access
1
Low risk: fetches known binary from release domain or routine package setup
2
Suspicious: makes non-standard outbound connections, inspects system environment, or runs encoded commands
3
Critical threat: credential harvesting, token exfiltration, backdoor dropper, or destructive action

Name: accesses_secrets
지시: Does `script_content` attempt to access, extract, or transmit environment variables, private credentials, or authentication tokens?

Name: remote_execution
지시: Does `script_content` download and execute arbitrary unverified external code or pipe remote scripts directly into a shell?