feat(scanner): reject plugin postinstall downloads - #1144
Draft
seonghobae wants to merge 2 commits into
Draft
Conversation
RED coverage for package.json postinstall/preinstall/install scripts that curl -o then chmod, pipe to a shell, or install an unpinned URL. echo-only lifecycle scripts plus a lockfile stay package_install inventory. Relates to #1099.
Fail closed when package.json preinstall, install, or postinstall downloads or executes an unsigned payload. Reuse claude-plugin-unsigned-executable-download, pipe-to-shell, and unpinned-package-install rather than a second regex family. Lockfile-only trees without a lifecycle download stay package_install inventory. LICENSE/NOTICE SPDX mismatch is unchanged. Relates to #1099.
|
Important Draft PR not reviewedDraft PRs are not automatically reviewed by default.
To automatically review draft PRs, update your CodeRabbit configuration: reviews:
auto_review:
drafts: trueThanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
4 tasks
seonghobae
added a commit
that referenced
this pull request
Sep 7, 2026
Summary: - Snapshot 13:10 UTC records Draft #1144 `c66dfaf` stacked on #1143. - package.json install lifecycle downloads fail closed. - Lockfile-only trees stay package_install inventory. Rationale: - #999 is the single writer of the product-technical gap baseline. - #1099 remaining surfaces stay on stacked successors, not Close. Tests: - documentation-only; detector evidence lives on #1144 (1359/1359)
This was referenced Sep 7, 2026
seonghobae
added
enhancement
ChatGPT Codex Connector
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
package.jsonpreinstall/install/postinstalldownloads or executes an unsigned payload (curl/wgetto a file then chmod/exec,curl | sh, unpinned URL install).claude-plugin-unsigned-executable-download,claude-plugin-pipe-to-shell, andclaude-plugin-unpinned-package-install(same CWE-494 causal class) instead of a second regex family. Tests provepackage.jsonlifecycle is now a surface.package.jsonplus lockfile with no lifecycle script, or lifecycleecho ok/echo hionly, stayspackage_installinventory andscan_result=pass. Nopackage.jsonis unchanged.Successor of #1143 / #1138 / issue #1099. Stacked on
feat/claude-plugin-license-mismatch-1099(e5051ea). Does not Close #1099, #1143, #1142, #1141, #1140, #1139, #1138, #1137, #1136, #1135, #1134, #1129, #1087, #929, #983, #1106, #1036, #1133, or #998. Does not steal G-06 #1133 or #1142 SARIF. Lockfile-only package trees without a postinstall download stay inventory.Test plan
tests/test_claude_plugin_postinstall_download.py)Relates to #1099. Relates to #1143. Relates to #1138.