fix: repair npm install (workspace: protocol) and the SQL verb false positive (v0.7.2)

[ralyodio]

Release 0.7.2. Two fixes: a critical install regression, and the SQL false-positive class.

---

1. npm install of the CLI is broken (critical)

Every install of 0.7.0 and 0.7.1 fails:

npm error code EUNSUPPORTEDPROTOCOL
npm error Unsupported URL Type "workspace:": workspace:*

Extracting the scan engine (#94) added @threatcrush/scan: workspace:* to the CLI's dependencies. pnpm understands workspace:*; the release runs npm publish, which does not rewrite it — so the published package.json ships workspace:* verbatim, and npm chokes on a protocol it doesn't know. This took down every npm install -g @profullstack/threatcrush, including the malware-test-prs scan workflow that installs @latest (the failure that surfaced it).

Fix: the package is bundled into the CLI by tsup (noExternal), so it's a build-time dependency, not a runtime one — nothing requires it from the published artifact. Moving it to devDependencies is both the correct classification and the fix: npm never installs a package's devDependencies, so workspace:* is never resolved by consumers, while pnpm still links it for the build.

Verified end to end:

• packed the 0.7.2 tarball → published dependencies carries no workspace: spec
• npm install of that tarball into a clean project → 209 packages, no protocol error
• @threatcrush/scan is not installed separately (it's in the bundle)
• the installed CLI scans and detects correctly from the bundle alone
• pnpm install --frozen-lockfile passes with the updated lockfile

---

2. A verb-shaped English word read as SQL injection

SQL_KEYWORDS matched bare verbs, each with a trailing \b. A word boundary sits at the hyphen in a React key and after an English "Update", so both of these read as critical SQL injection:

key={`insert-${insertIndex}`}          // ralyodio/ShortsStudio — the only finding
log.info(`Update finished in ${ms}ms`) // ionic-team/capacitor — 3 of 13 findings

Fix: real SQL pairs the verb with the clause that makes it a statement. Each alternative now requires it — SELECT … FROM, INSERT INTO, UPDATE … SET, DELETE FROM, DROP TABLE|…, TRUNCATE TABLE, UNION SELECT — with the SELECT/UPDATE look-aheads bounded to a single string literal. Every injection shape the corpus and unit tests exercise is SELECT … FROM or DELETE FROM, so all still match; a verb standing alone as prose no longer does.

target	before	after
ralyodio/ShortsStudio	1 (false)	0 — clean
ionic-team/capacitor	13	10 (−3, all sql-template-interpolation)
testbed coverage	TPR 65.9% / FPR 0%	unchanged

---

125 tests (up from 123). The new false-positive test was confirmed to fail against the old pattern; the install fix was confirmed by an actual npm install of the packed tarball. tsc --noEmit clean.

This is what makes it safe to point the scanner at a third-party JavaScript repo — both that their PR can install the CLI at all, and that it won't greet them with a bogus SQL-injection alert.

[github-actions]

ThreatCrush Security Scan

NOT RUN — the scan did not complete, so this diff was not examined.
This is not a clean result. See the job log.