diff --git a/packages/safe-chain/src/registryProxy/certBundle.js b/packages/safe-chain/src/registryProxy/certBundle.js
index 60e7d23..956279d 100644
--- a/packages/safe-chain/src/registryProxy/certBundle.js
+++ b/packages/safe-chain/src/registryProxy/certBundle.js
@@ -49,6 +49,7 @@ let cachedPath = null;
  * - Includes Safe Chain CA (for MITM of known registries)
  * - Includes Mozilla roots via npm `certifi` (public HTTPS)
  * - Includes Node's built-in root certificates as a portable fallback
+ * @returns {string} Path to the combined CA bundle PEM file
  */
 export function getCombinedCaBundlePath() {
   if (cachedPath && fs.existsSync(cachedPath)) return cachedPath;
diff --git a/packages/safe-chain/src/registryProxy/parsePackageFromUrl.js b/packages/safe-chain/src/registryProxy/parsePackageFromUrl.js
index 64ce99a..1fda121 100644
--- a/packages/safe-chain/src/registryProxy/parsePackageFromUrl.js
+++ b/packages/safe-chain/src/registryProxy/parsePackageFromUrl.js
@@ -35,6 +35,7 @@ export function parsePackageFromUrl(url) {
 /**
  * @param {string} url
  * @param {string} registry
+ * @returns {{packageName: string | undefined, version: string | undefined}}
  */
 function parseJsPackageFromUrl(url, registry) {
   let packageName, version;
@@ -78,6 +79,7 @@ function parseJsPackageFromUrl(url, registry) {
 /**
  * @param {string} url
  * @param {string} registry
+ * @returns {{packageName: string | undefined, version: string | undefined}}
  */
 function parsePipPackageFromUrl(url, registry) {
   let packageName, version
diff --git a/packages/safe-chain/src/scanning/malwareDatabase.js b/packages/safe-chain/src/scanning/malwareDatabase.js
index a2e2fb7..b11f8d8 100644
--- a/packages/safe-chain/src/scanning/malwareDatabase.js
+++ b/packages/safe-chain/src/scanning/malwareDatabase.js
@@ -23,6 +23,7 @@ let cachedMalwareDatabase = null;
  * For Python packages (PEP-503): lowercase and replace _, -, . with -
  * For js packages: keep as-is (case-sensitive)
  * @param {string} name
+ * @returns {string}
  */
 function normalizePackageName(name) {
   const ecosystem = getEcoSystem();