How a package becomes a firewall verdict.

OSV/GHSA advisories are the hard-authority side. When a package version is known malicious, LPM Firewall records the advisory context, prepares public-safe evidence, and publishes a block verdict.

• Package-version and artifact identifiers are tied to the advisory.
• The client-facing action is a highest-confidence block.
• Public reports point back to the advisory evidence where appropriate.

The static side runs continuously over the npm registry stream: fetch, scan, classify, then either finalize or request deeper review. More than 120 static checks inspect each package's source behavior, manifest and lifecycle scripts, shipped artifacts, supply-chain and release changes, embedded secrets, package identity, social-engineering signals, and scan coverage.

For each package version it processes, LPM downloads and integrity-checks the published tarball, then inspects it without installing or running package code. The scanner examines install hooks, entrypoints, dependency declarations, JavaScript and TypeScript source, and shipped artifacts for connected behaviors such as sensitive-data access followed by outbound transmission, remote download followed by execution, concealed payload loading, or persistence.

The result is enriched with registry-to-tarball consistency checks, source similarity, package reputation, and changes from the previous release. Ordinary capabilities are evaluated in context, not treated as malicious on their own. Clear deterministic evidence can produce a verdict; ambiguous, similarity-only, or incomplete results are routed for deeper source-aware review.

• Package integrity. Verifies the registry integrity hash before extracting the tarball. Package code is not installed or executed.
• Manifest and install surface.Examines install hooks, entrypoints, executable commands, dependency specifications, and differences between the registry manifest and the tarball's package.json.
• Source behavior. Looks for connected patterns involving credential or environment access, outbound communication, code or shell execution, downloads, persistence, remote control, data exfiltration, and configuration tampering.
• Obfuscation and payloads. Detects dynamic evaluation, encoded or encrypted payload loaders, high-entropy content, concealed destinations, and Trojan Source characters.
• Shipped artifacts. Inventories native binaries, WebAssembly, Node bytecode, archives, build helpers, hidden payloads, oversized entrypoints, and case-colliding paths.
• Supply-chain changes. Checks suspicious package names, source clones and fingerprints, repository-identity mismatches, dangerous changes from the previous version, and newly introduced known-malicious runtime dependencies.
• Package context. Uses package age, maintainers, repository presence, provenance, attestations, release history, and download activity as routing context—not proof of maliciousness.
• Scan confidence. Records evidence paths, confidence, structural risk, and analysis coverage. Incomplete or ambiguous scans are escalated instead of being treated as clean.

1. Read registry changes and fetch package metadata.
2. Queue package versions for scanner processing.
3. Download and scan with the scanner engine: findings, verdict, confidence, source fingerprints, artifact inventory, lifecycle, network, and obfuscation signals.
4. Add context such as manifest confusion, source similarity, reputation signals, and version changes.
5. Routing decides whether AI review is needed; otherwise the result is finalized.
6. Public-safe report data is prepared for the website.

• Clean verdicts clear stale warn or block decisions.
• Warn, suspicious, and block verdicts publish package-version decisions.
• If AI review is needed, static analysis does not publish a final block by itself.

Static analysis requests source-aware review when a deterministic answer isn't safe:

• Strong static malicious / suspicious signals.
• Source-similarity to known-malicious signatures.
• Identity-clone mismatch.
• High-risk lifecycle / network / execution combinations.
• Structural or metadata risk not safe to resolve deterministically.

Source similarity is routing intelligence, not automatic block authority. It creates friction and sends the package to source-aware AI review.