Signals
Defined in: types.ts:232
Properties
Section titled “Properties”| Property | Type | Description | Defined in |
|---|---|---|---|
advisories |
MaliciousRecord[] |
- | types.ts:247 |
ageInDays? |
number |
- | types.ts:264 |
analysisDegraded? |
string[] |
Reasons static/network analysis could not complete within its safety budgets. Presence is always rendered as UNKNOWN and requires approval. | types.ts:275 |
artifact |
ArtifactSignal |
Cryptographic identity of the exact tarball inspected by targate. | types.ts:236 |
content |
ContentFindings |
- | types.ts:244 |
dependencyCount |
number |
- | types.ts:266 |
directDependencies |
string[] |
Direct dependency names (transitive deps are NOT analyzed — see README). | types.ts:268 |
hasLifecycleScripts |
boolean |
- | types.ts:238 |
hasNativeCode |
boolean |
- | types.ts:241 |
internalScope? |
boolean |
The package belongs to a policy-declared internal scope: lookups that would leak the package name to third parties (OSV, npm downloads, maintainer search, GitHub) were deliberately SKIPPED, and typosquat similarity does not apply. Distinct from osvUnavailable — this is a choice, not a failure — but equally “not externally checked”. | types.ts:261 |
knownMalicious |
boolean |
- | types.ts:245 |
lifecycleScripts |
Record<string, string> |
- | types.ts:237 |
maliciousRecords |
MaliciousRecord[] |
- | types.ts:246 |
nameSimilarity |
NameSimilarity | null |
- | types.ts:265 |
nativeSurface |
NativeSurface |
- | types.ts:242 |
osvUnavailable |
boolean |
True when the OSV lookup could not be completed (network error, offline). A malicious-package record cannot be ruled out — treat as “unknown”, not “clean”. See the OSV failure handling in the README. | types.ts:253 |
package |
string |
- | types.ts:233 |
recentPublish |
boolean |
- | types.ts:263 |
repositoryMissing |
boolean |
- | types.ts:262 |
reputation |
ReputationSignals |
Reputational & temporal signals (registry-derived + optional external lookups). Informational: consumed by the score and the AI, never by evaluateRules. | types.ts:272 |
rnHardening |
RnHardeningSignals |
- | types.ts:243 |
scriptCommandFindings |
string[] |
Deterministic findings from inspecting the lifecycle command strings. | types.ts:240 |
version |
string |
- | types.ts:234 |