multi-tool-finding-triage

The merge key causes all dependency findings without code-location fields to collapse into one entry. Because the first such entry is medium severity, the critical Next.js finding is hidden from the gate and build 4471 incorrectly passes. The proposed package-only addition does not distinguish CVEs; dependency keys need package identity plus CVE, while code findings can retain a location/CWE key. Count consensus by distinct scanner. This is a security-relevant report-integrity defect, not evidence of malware. The provided request asks for repository edits and tests, but no file-editing capability is available in this response.

No malware behavior is evident in the supplied portion. It does show a potentially unsafe dependency-gate configuration: a package-wide Ghostscript waiver suppresses findings including a cataloged sandbox escape, and the critical-only threshold permits high-severity findings to pass. The expired Axios exception warrants checking whether expiration is enforced. These are policy and vulnerability-management risks, not evidence of malicious code.