mirror of https://github.com/garrytan/gstack.git
ceb1d25fc9
Keep all four campaign rules but rework R2/R3 to match only on deterministic, primary-source indicators. R1 and R4 unchanged. - R2 (auto-run reference): drop the undecidable "not present in npm tarball / locked-package artifacts" negative-proof clause; keep the deterministic "listed in package.json files array" exemption as an FP guard. - R3 (packed-dropper): drop the _0x obfuscation pattern, the ">=3 occurrences" count threshold, and the subjective "ordinary minified bundle" exclusion. Fire only when an R2 auto-run file also contains a literal createDecipheriv/gunzip/inflate call. - Restore the GHSA-g7cv-rxg3-hmpx / CVE-2026-45321 primary-source anchor. |
||
|---|---|---|
| .. | ||
| audit-phases.md | ||
| audit-phases.md.tmpl | ||
| manifest.json | ||