fix: address security and documentation issues

- Fix complex TOCTOU race in dlx/binary.ts by re-checking binary existence after metadata read
- Fix incorrect package name in provenance workflow (@socketregistry/lib → @socketsecurity/lib)
- Remove outdated src/index.ts reference from CLAUDE.md (file was removed in previous release)
- Update lint.mjs example to use src/logger.ts instead of non-existent src/index.ts

Author: jdalton

.github/workflows/provenance.yml

@@ -24,6 +24,6 @@ jobs:
     uses: SocketDev/socket-registry/.github/workflows/provenance.yml@4709a2443e5a036bb0cd94e5d1559f138f05994c # main
     with:
       debug: ${{ inputs.debug }}
-      package-name: '@socketregistry/lib'
+      package-name: '@socketsecurity/lib'
       setup-script: 'pnpm run build'
       use-trusted-publishing: true

CLAUDE.md

@@ -357,10 +357,9 @@ Use `pnpm run build:watch` or `pnpm run dev` for development with automatic rebu
 1. Create utility in appropriate `src/` subdirectory
 2. Use path aliases for internal imports
 3. Add type definitions
-4. Add to `src/index.ts` if public API
-5. Update `package.json` exports if direct export needed
-6. Add tests in `test/` matching structure
-7. Update types and build
+4. Update `package.json` exports if direct export needed
+5. Add tests in `test/` matching structure
+6. Update types and build
 
 ### Common Patterns
 

scripts/lint.mjs

@@ -416,7 +416,7 @@ async function main() {
       logger.log('  pnpm lint --fix             # Fix issues in changed files')
       logger.log('  pnpm lint --all             # Lint all files')
       logger.log('  pnpm lint --staged --fix    # Fix issues in staged files')
-      logger.log('  pnpm lint src/index.ts      # Lint specific file(s)')
+      logger.log('  pnpm lint src/logger.ts     # Lint specific file(s)')
       process.exitCode = 0
       return
     }

src/dlx/binary.ts

@@ -302,6 +302,11 @@ export async function dlxBinary(
         computedIntegrity = (metadata as Record<string, unknown>)[
           'integrity'
         ] as string
+        // Re-check binary exists after reading metadata (TOCTOU protection).
+        // Prevents race where binary is deleted between validity check and use.
+        if (!fs.existsSync(binaryPath)) {
+          downloaded = true
+        }
       } else {
         // If metadata is invalid, re-download.
         downloaded = true