chore(security): query OSV for malicious packages in supply chain check

SECURITY.md

@@ -10,7 +10,7 @@ This repository uses defenses against npm supply-chain worms such as **Mini Shai
 - **Frozen lockfile** — `pnpm-lock.yaml` is committed; CI uses `pnpm install --frozen-lockfile`.
 - **pnpm workspace config** — supply-chain settings live in `pnpm-workspace.yaml` (pnpm 10+ ignores `package.json` → `pnpm`).
 - **Blocked install scripts** — only packages in `pnpm-workspace.yaml` → `onlyBuiltDependencies` may run lifecycle scripts (currently `isolated-vm` for dev tooling). Other packages with scripts are listed in `ignoredBuiltDependencies` (e.g. `unrs-resolver`, `eslint-plugin-n8n-nodes-base`). `strictDepBuilds: true` fails on unreviewed scripts.
-- **Blocklist scan** — `pnpm run audit:supply-chain` checks the lockfile against `security/compromised-packages.json` and validates pnpm config.
+- **Blocklist scan** — `pnpm run audit:supply-chain` checks the lockfile against `security/compromised-packages.json`, queries [OSV](https://osv.dev) for malicious-package (`MAL-`) records on every locked package, and validates pnpm config. The OSV query needs network access and fails closed; set `SUPPLY_CHAIN_OFFLINE=1` to run with the static blocklist only.
 - **Delayed updates** — `minimumReleaseAge` (24h, strict) reduces exposure to freshly published malicious versions.
 - **No exotic transitive deps** — `blockExoticSubdeps` blocks git/tarball transitive resolutions.
 - **Version overrides** — CVE mitigations use **exact pins** in `pnpm-workspace.yaml` (e.g. `lodash`, `uuid`, `minimatch`). Do not use `>=`/`^`/`~` ranges in overrides; bump versions deliberately with an updated lockfile and passing audit.
@@ -56,14 +56,15 @@ Check for persistence artifacts: `.claude/router_runtime.js`, malicious `.vscode
 
 ### Blocklist maintenance
 
-- Full Mini Shai-Hulud package list: `security/compromised-packages-blocklist.json` (172 packages).
+- Malicious versions from new campaigns (e.g. the August 2026 keyv/cacheable "ChainDrop" worm) are picked up automatically through the OSV query; no list update is needed for those.
+- Offline fallback list (May 2026 Mini Shai-Hulud only): `security/compromised-packages-blocklist.json` (172 packages).
 - IOC strings and metadata: `security/compromised-packages.json`.
-- After new advisories, update the blocklist JSON and run `pnpm run audit:supply-chain`.
+- Add lockfile IOC strings for new campaigns to `lockfileIndicators`, then run `pnpm run audit:supply-chain`.
 
 ### Reporting vulnerabilities
 
 Email **red@4c.gg** or open a private security advisory on GitHub. Do not file public issues for unfixed credential or supply-chain incidents.
 
 ### Updating the blocklist
 
-After new campaign advisories, extend `security/compromised-packages.json` and re-run `pnpm run audit:supply-chain`.
+Compromised versions are covered by the OSV query. After new campaign advisories, add any lockfile IOC strings to `security/compromised-packages.json` and re-run `pnpm run audit:supply-chain`.

osv-scanner.toml

@@ -15,3 +15,14 @@ own build glob patterns. Not overridable: no patched braces release exists.
 Also ignored for pnpm audit via auditConfig.ignoreGhsas in pnpm-workspace.yaml.
 Drop both entries once braces publishes a fix.
 """
+
+[[IgnoredVulns]]
+id = "GHSA-mrhx-c7xc-m3w5"
+ignoreUntil = 2027-01-24
+reason = """
+zod <4.6.6 (memory exhaustion on oversized constrained collections). zod 3.x is a
+dev-only peer of n8n-workflow, never shipped (package.json "files" excludes it), and
+n8n-workflow still requires zod 3, for which no patched release exists.
+Also ignored for pnpm audit via auditConfig.ignoreGhsas in pnpm-workspace.yaml.
+Drop both entries once n8n-workflow moves to zod >=4.6.6.
+"""