Signals
Defined in: types.ts:242
Properties
Section titled “Properties”| Property | Type | Description | Defined in |
|---|---|---|---|
advisories |
MaliciousRecord[] |
- | types.ts:257 |
ageInDays? |
number |
- | types.ts:274 |
analysisDegraded? |
string[] |
Reasons static/network analysis could not complete within its safety budgets. Presence is always rendered as UNKNOWN and requires approval. | types.ts:285 |
artifact |
ArtifactSignal |
Cryptographic identity of the exact tarball inspected by targate. | types.ts:246 |
content |
ContentFindings |
- | types.ts:254 |
dependencyCount |
number |
- | types.ts:276 |
directDependencies |
string[] |
Direct dependency names (transitive deps are NOT analyzed — see README). | types.ts:278 |
hasLifecycleScripts |
boolean |
- | types.ts:248 |
hasNativeCode |
boolean |
- | types.ts:251 |
internalScope? |
boolean |
The package belongs to a policy-declared internal scope: lookups that would leak the package name to third parties (OSV, npm downloads, maintainer search, GitHub) were deliberately SKIPPED, and typosquat similarity does not apply. Distinct from osvUnavailable — this is a choice, not a failure — but equally “not externally checked”. | types.ts:271 |
knownMalicious |
boolean |
- | types.ts:255 |
lifecycleScripts |
Record<string, string> |
- | types.ts:247 |
maliciousRecords |
MaliciousRecord[] |
- | types.ts:256 |
nameSimilarity |
NameSimilarity | null |
- | types.ts:275 |
nativeSurface |
NativeSurface |
- | types.ts:252 |
osvUnavailable |
boolean |
True when the OSV lookup could not be completed (network error, offline). A malicious-package record cannot be ruled out — treat as “unknown”, not “clean”. See the OSV failure handling in the README. | types.ts:263 |
package |
string |
- | types.ts:243 |
recentPublish |
boolean |
- | types.ts:273 |
repositoryMissing |
boolean |
- | types.ts:272 |
reputation |
ReputationSignals |
Reputational & temporal signals (registry-derived + optional external lookups). Informational: consumed by the score and the AI, never by evaluateRules. | types.ts:282 |
rnHardening |
RnHardeningSignals |
- | types.ts:253 |
scriptCommandFindings |
string[] |
Deterministic findings from inspecting the lifecycle command strings. | types.ts:250 |
version |
string |
- | types.ts:244 |