feat(binary-scan): differentiate suspicious string labels with per-label severity

[lachaib]

Summary

The binary scanner previously treated all suspicious string matches as a single binary:new-string label, and any binary finding mapped to HIGH severity. This meant a crypto library upgrade adding 47 new algorithm constants (ML-KEM, ML-DSA OIDs, Camellia key schedules) produced the same HIGH alarm as a package injecting a new C2 URL — a significant source of noise.

This PR splits the detection into distinct labels with calibrated severity levels:

Label	Severity	Rationale
binary:sensitive-path	high	/etc/passwd etc. hardcoded in a compiled lib is almost always malicious
binary:url-other-scheme	high	ws://, dns://, udp://, tcp://, smtp://, irc://, socks5:// etc. have no legitimate reason to be embedded in a library binary
binary:url-http	moderate	HTTP/HTTPS URLs appear in doc strings, SDK headers, and cert authority endpoints
binary:ip-v4	moderate	IPv4 addresses — legitimate in network libs but worth surfacing
binary:ip-v6	moderate	IPv6 addresses — added because IPv6-only C2 servers are a real evasion pattern against IPv4-centric blocklists
binary:tmppath	moderate	/tmp/ paths
binary:base64	low	Long base64-like blobs are expected in crypto/data libs as constants, OIDs, and test vectors
binary:high-entropy	high	Unchanged
native:*	high	Unchanged

binary-scan.ts: patterns are now ordered most-to-least specific (sensitive path first, base64 last); first match wins per string so the highest-signal label is assigned.

severity.ts: replaces the blunt any binary delta → HIGH block with a per-label binaryFindingSeverity() function, matching the approach used for source pattern hits.

Motivation

A cryptography 46.0.7 → 48.0.1 upgrade was flagging HIGH due to 47 new strings in _rust.abi3.so, all of which were legitimate cryptographic constants and algorithm identifiers from ML-KEM and ML-DSA support. With this change those strings match binary:base64 → LOW, and the package correctly resolves below the HIGH threshold.

Test plan

• Run lockscan against a cryptography 46→48 lockfile diff — overall binary severity should no longer be HIGH from string matches alone
• Confirm a package with a new ws:// or dns:// URL in its binary still triggers HIGH
• Confirm a new hardcoded /etc/passwd reference still triggers HIGH
• pnpm tsc --noEmit passes (pre-existing unrelated error in analyzer.ts excluded)

🤖 Generated with Claude Code