Supply-chain tamper detection

These checks look for signs that a package or deployment bundle carries something a reviewer did not read.

vulkro-sf scan ./force-app

Checks

Rule ID	What it finds	Fix
SF-TAMPER-001	A static resource over 5 MB (sf-tamper-oversized-resource), or an Apex class that embeds a large base64 string (sf-tamper-base64-blob-apex). Either can carry a hidden payload.	Open or decode it and confirm the contents. If unexplained, do not install the package.
SF-TAMPER-002	A component whose apiVersion is at least four major versions below the most common apiVersion in the package, so it runs under older, weaker platform defaults.	Raise it to match the package, or reject the package if the gap is unexplained.
npm-install-lifecycle-script	A preinstall, install or postinstall script in package.json (CWE-1357). npm runs it on every install with the developer's privileges.	Remove the hook, or move the step to a named script, and use npm ci --ignore-scripts in untrusted contexts.

See also: Dependencies and SCA, Metadata governance