@lateos/npm-scan 1.0.0 → 1.1.0

package/backend/detectors/index.js

@@ -29,9 +29,15 @@ import { scan as tier1MultistagePostinstallScan } from './tier1-multistage-posti
 import { scan as tier1VersionAnomalyScan } from './tier1-version-anomaly.js';
 import { scan as tier1ObfuscationHeuristicsScan } from './tier1-obfuscation-heuristics.js';
 import { scan as tier1SlsaAttestationScan } from './tier1-slsa-attestation.js';
+import { scan as tier1SelfPropagationScan } from './tier1-self-propagation.js';
+import { scan as tier1EncryptedC2Scan } from './tier1-encrypted-c2.js';
+import { scan as tier1TransitiveDepsScan } from './tier1-transitive-deps.js';
+import { scan as tier1MaintainerCompromiseScan } from './tier1-maintainer-compromise.js';
 
 function timeout(ms) {
-  return new Promise((_, reject) => setTimeout(() => reject(new Error(`timeout after ${ms}ms`)), ms));
+  return new Promise((_, reject) =>
+    setTimeout(() => reject(new Error(`timeout after ${ms}ms`)), ms)
+  );
 }
 
 async function runTier1(name, scanFn, pkgJson, files, registryMeta, allFiles) {
@@ -43,7 +49,9 @@ async function runTier1(name, scanFn, pkgJson, files, registryMeta, allFiles) {
     const fileCount = allFiles && allFiles.length > 0 ? allFiles.length : files.length;
     if (fileCount >= 10 && result.length > 0) {
       const hitRate = result.length / fileCount;
-      if (hitRate > 0.8) return [];
+      if (hitRate > 0.8) {
+        return [];
+      }
     }
     return result;
   } catch {
@@ -53,36 +61,175 @@ async function runTier1(name, scanFn, pkgJson, files, registryMeta, allFiles) {
 
 export async function runAll(pkgJson, files = [], registryMeta = null, allFiles = null) {
   const findings = [];
-  findings.push(...await atk001.scan(pkgJson, files));
-  findings.push(...await atk002.scan(pkgJson, files));
-  findings.push(...await atk003.scan(pkgJson, files));
-  findings.push(...await atk004.scan(pkgJson, files));
-  findings.push(...await atk005.scan(pkgJson, files));
-  findings.push(...await atk006.scan(pkgJson, files));
-  findings.push(...await atk007.scan(pkgJson, files));
-  findings.push(...await atk008.scan(pkgJson, files));
-  findings.push(...await atk009.scan(pkgJson, files));
-  findings.push(...await atk010.scan(pkgJson, files));
-  findings.push(...await atk011.scan(pkgJson, files));
-  findings.push(...await megalodonScan(pkgJson, allFiles || files, registryMeta));
-  findings.push(...await hfScan(pkgJson, files, registryMeta, allFiles || files));
-  findings.push(...await miniShaiHuludScan(pkgJson, files, registryMeta, allFiles || files));
-  findings.push(...await badhostScan(pkgJson, files, registryMeta, allFiles || files));
-  findings.push(...await trapdoorScan(pkgJson, files, registryMeta, allFiles || files));
-  findings.push(...await nodeIpcScan(pkgJson, files, registryMeta, allFiles || files));
-  findings.push(...await mshSupplementScan(pkgJson, files, registryMeta, allFiles || files));
-  findings.push(...await typosquatScan(pkgJson, files, registryMeta, allFiles || files));
-  findings.push(...await axiosPoisoningScan(pkgJson, files, registryMeta, allFiles || files));
-  findings.push(...await runTier1('tier1-typosquat', tier1TyposquatScan, pkgJson, files, registryMeta, allFiles || files));
-  findings.push(...await runTier1('tier1-infostealer', tier1InfostealerScan, pkgJson, files, registryMeta, allFiles || files));
-  findings.push(...await runTier1('tier1-lifecycle-hook', tier1LifecycleHookScan, pkgJson, files, registryMeta, allFiles || files));
-  findings.push(...await runTier1('tier1-binary-embed', tier1BinaryEmbedScan, pkgJson, files, registryMeta, allFiles || files));
-  findings.push(...await runTier1('tier1-metadata-spoof', tier1MetadataSpoofScan, pkgJson, files, registryMeta, allFiles || files));
-  findings.push(...await runTier1('tier1-version-confusion', tier1VersionConfusionScan, pkgJson, files, registryMeta, allFiles || files));
-  findings.push(...await runTier1('tier1-cloud-imds', tier1CloudImdsScan, pkgJson, files, registryMeta, allFiles || files));
-  findings.push(...await runTier1('tier1-multistage-postinstall', tier1MultistagePostinstallScan, pkgJson, files, registryMeta, allFiles || files));
-  findings.push(...await runTier1('tier1-version-anomaly', tier1VersionAnomalyScan, pkgJson, files, registryMeta, allFiles || files));
-  findings.push(...await runTier1('tier1-obfuscation-heuristics', tier1ObfuscationHeuristicsScan, pkgJson, files, registryMeta, allFiles || files));
-  findings.push(...await runTier1('tier1-slsa-attestation', tier1SlsaAttestationScan, pkgJson, files, registryMeta, allFiles || files));
+  findings.push(...(await atk001.scan(pkgJson, files)));
+  findings.push(...(await atk002.scan(pkgJson, files)));
+  findings.push(...(await atk003.scan(pkgJson, files)));
+  findings.push(...(await atk004.scan(pkgJson, files)));
+  findings.push(...(await atk005.scan(pkgJson, files)));
+  findings.push(...(await atk006.scan(pkgJson, files)));
+  findings.push(...(await atk007.scan(pkgJson, files)));
+  findings.push(...(await atk008.scan(pkgJson, files)));
+  findings.push(...(await atk009.scan(pkgJson, files)));
+  findings.push(...(await atk010.scan(pkgJson, files)));
+  findings.push(...(await atk011.scan(pkgJson, files)));
+  findings.push(...(await megalodonScan(pkgJson, allFiles || files, registryMeta)));
+  findings.push(...(await hfScan(pkgJson, files, registryMeta, allFiles || files)));
+  findings.push(...(await miniShaiHuludScan(pkgJson, files, registryMeta, allFiles || files)));
+  findings.push(...(await badhostScan(pkgJson, files, registryMeta, allFiles || files)));
+  findings.push(...(await trapdoorScan(pkgJson, files, registryMeta, allFiles || files)));
+  findings.push(...(await nodeIpcScan(pkgJson, files, registryMeta, allFiles || files)));
+  findings.push(...(await mshSupplementScan(pkgJson, files, registryMeta, allFiles || files)));
+  findings.push(...(await typosquatScan(pkgJson, files, registryMeta, allFiles || files)));
+  findings.push(...(await axiosPoisoningScan(pkgJson, files, registryMeta, allFiles || files)));
+  findings.push(
+    ...(await runTier1(
+      'tier1-typosquat',
+      tier1TyposquatScan,
+      pkgJson,
+      files,
+      registryMeta,
+      allFiles || files
+    ))
+  );
+  findings.push(
+    ...(await runTier1(
+      'tier1-infostealer',
+      tier1InfostealerScan,
+      pkgJson,
+      files,
+      registryMeta,
+      allFiles || files
+    ))
+  );
+  findings.push(
+    ...(await runTier1(
+      'tier1-lifecycle-hook',
+      tier1LifecycleHookScan,
+      pkgJson,
+      files,
+      registryMeta,
+      allFiles || files
+    ))
+  );
+  findings.push(
+    ...(await runTier1(
+      'tier1-binary-embed',
+      tier1BinaryEmbedScan,
+      pkgJson,
+      files,
+      registryMeta,
+      allFiles || files
+    ))
+  );
+  findings.push(
+    ...(await runTier1(
+      'tier1-metadata-spoof',
+      tier1MetadataSpoofScan,
+      pkgJson,
+      files,
+      registryMeta,
+      allFiles || files
+    ))
+  );
+  findings.push(
+    ...(await runTier1(
+      'tier1-version-confusion',
+      tier1VersionConfusionScan,
+      pkgJson,
+      files,
+      registryMeta,
+      allFiles || files
+    ))
+  );
+  findings.push(
+    ...(await runTier1(
+      'tier1-cloud-imds',
+      tier1CloudImdsScan,
+      pkgJson,
+      files,
+      registryMeta,
+      allFiles || files
+    ))
+  );
+  findings.push(
+    ...(await runTier1(
+      'tier1-multistage-postinstall',
+      tier1MultistagePostinstallScan,
+      pkgJson,
+      files,
+      registryMeta,
+      allFiles || files
+    ))
+  );
+  findings.push(
+    ...(await runTier1(
+      'tier1-version-anomaly',
+      tier1VersionAnomalyScan,
+      pkgJson,
+      files,
+      registryMeta,
+      allFiles || files
+    ))
+  );
+  findings.push(
+    ...(await runTier1(
+      'tier1-obfuscation-heuristics',
+      tier1ObfuscationHeuristicsScan,
+      pkgJson,
+      files,
+      registryMeta,
+      allFiles || files
+    ))
+  );
+  findings.push(
+    ...(await runTier1(
+      'tier1-slsa-attestation',
+      tier1SlsaAttestationScan,
+      pkgJson,
+      files,
+      registryMeta,
+      allFiles || files
+    ))
+  );
+  findings.push(
+    ...(await runTier1(
+      'tier1-self-propagation',
+      tier1SelfPropagationScan,
+      pkgJson,
+      files,
+      registryMeta,
+      allFiles || files
+    ))
+  );
+  findings.push(
+    ...(await runTier1(
+      'tier1-encrypted-c2',
+      tier1EncryptedC2Scan,
+      pkgJson,
+      files,
+      registryMeta,
+      allFiles || files
+    ))
+  );
+  findings.push(
+    ...(await runTier1(
+      'tier1-transitive-deps',
+      tier1TransitiveDepsScan,
+      pkgJson,
+      files,
+      registryMeta,
+      allFiles || files
+    ))
+  );
+  findings.push(
+    ...(await runTier1(
+      'tier1-maintainer-compromise',
+      tier1MaintainerCompromiseScan,
+      pkgJson,
+      files,
+      registryMeta,
+      allFiles || files
+    ))
+  );
   return findings.sort((a, b) => b.severity.localeCompare(a.severity));
-}
+}

package/backend/detectors/lib/ast-patterns.js

@@ -1,7 +1,10 @@
 const PATTERNS = [
   { id: 'EVAL_USAGE', re: /\beval\s*\(/ },
   { id: 'FUNCTION_CONSTRUCTOR', re: /Function\s*\(/ },
-  { id: 'STRING_REVERSAL_CHAIN', re: /\.split\s*\(\s*['"]\s*['"]\s*\)\s*\.reverse\s*\(\s*\)\s*\.join\s*\(/ },
+  {
+    id: 'STRING_REVERSAL_CHAIN',
+    re: /\.split\s*\(\s*['"]\s*['"]\s*\)\s*\.reverse\s*\(\s*\)\s*\.join\s*\(/,
+  },
   { id: 'XOR_CIPHER', re: /charCodeAt\s*\([^)]*\)\s*\^\s*\w+/ },
   { id: 'BITWISE_LOOP', re: /for\s*\([^;]+;[^;]+\)\s*\{[^}]{20,}\^[^}]*\}/ },
   { id: 'DYNAMIC_REQUIRE', re: /require\s*\(\s*(?:Buffer\.from|atob|decodeURIComponent)/ },

package/backend/detectors/lib/entropy-analyzer.js

@@ -1,6 +1,8 @@
 export function shannonEntropy(str) {
   const len = str.length;
-  if (len === 0) return 0;
+  if (len === 0) {
+    return 0;
+  }
   const freq = {};
   for (const ch of str) {
     freq[ch] = (freq[ch] || 0) + 1;
@@ -14,11 +16,17 @@ export function shannonEntropy(str) {
 }
 
 export function isMinified(code) {
-  if (code.length < 100) return false;
+  if (code.length < 100) {
+    return false;
+  }
   const lines = code.split('\n');
-  if (lines.length <= 3 && code.length > 1000) return true;
+  if (lines.length <= 3 && code.length > 1000) {
+    return true;
+  }
   const tokens = code.match(/\b[a-zA-Z_$][\w$]*\b/g) || [];
-  if (tokens.length < 10) return false;
+  if (tokens.length < 10) {
+    return false;
+  }
   const avgLen = tokens.reduce((s, t) => s + t.length, 0) / tokens.length;
   return avgLen < 3;
 }

package/backend/detectors/megalodon/d1-workflow-scan.js

@@ -1,7 +1,8 @@
 import { MegalodonSignal } from './types.js';
 import yaml from 'js-yaml';
 
-const C2_EXFIL_RE = /curl\s+.*?https?:\/\/(?!github\.com|githubusercontent\.com|raw\.githubusercontent\.com)[^\s'"]+/i;
+const C2_EXFIL_RE =
+  /curl\s+.*?https?:\/\/(?!github\.com|githubusercontent\.com|raw\.githubusercontent\.com)[^\s'"]+/i;
 const SECRETS_REF_RE = /\$\{\{?\s*secrets\.\w+/;
 const B64_DECODE_CHAIN_RE = /base64\s+-d\s*[|>]\s*(ba)?sh/;
 
@@ -11,16 +12,23 @@ function isWorkflowFile(f) {
 }
 
 function countExecutableLines(text) {
-  return text.split('\n').filter(l => l.trim() && !l.trim().startsWith('#')).length;
+  return text.split('\n').filter((l) => l.trim() && !l.trim().startsWith('#')).length;
 }
 
 function extractRunBlocks(parsed) {
   const runs = [];
-  if (!parsed || typeof parsed !== 'object') return runs;
+  if (!parsed || typeof parsed !== 'object') {
+    return runs;
+  }
 
   const walk = (obj) => {
-    if (!obj || typeof obj !== 'object') return;
-    if (Array.isArray(obj)) { obj.forEach(walk); return; }
+    if (!obj || typeof obj !== 'object') {
+      return;
+    }
+    if (Array.isArray(obj)) {
+      obj.forEach(walk);
+      return;
+    }
     for (const [k, v] of Object.entries(obj)) {
       if (k === 'run' && typeof v === 'string') {
         runs.push(v);
@@ -38,21 +46,31 @@ function extractRunBlocks(parsed) {
 function extractRunBlocksRaw(text) {
   const runs = [];
   const runMatch = text.match(/run:\s*[|>]\s*\n(\s{2,}.*(?:\n\s{2,}.*)*)/g);
-  if (runMatch) runs.push(...runMatch.map(m => m.replace(/^run:\s*[|>]\s*\n/, '')));
+  if (runMatch) {
+    runs.push(...runMatch.map((m) => m.replace(/^run:\s*[|>]\s*\n/, '')));
+  }
 
   const inlineRe = /run:\s*['"](.+?)['"]\s*$/gm;
   let m;
-  while ((m = inlineRe.exec(text)) !== null) runs.push(m[1]);
+  while ((m = inlineRe.exec(text)) !== null) {
+    runs.push(m[1]);
+  }
 
   const envRe = /env:\s*\n((?:\s{2,}\w+:\s*.+\n?)*)/g;
   let em;
-  while ((em = envRe.exec(text)) !== null) runs.push({ _env: em[1] });
+  while ((em = envRe.exec(text)) !== null) {
+    runs.push({ _env: em[1] });
+  }
   return runs;
 }
 
 function runInStepHasBoth(step, signal) {
   const runVal = step.run;
-  const envVals = step.env ? Object.values(step.env).filter(v => typeof v === 'string').join(' ') : '';
+  const envVals = step.env
+    ? Object.values(step.env)
+        .filter((v) => typeof v === 'string')
+        .join(' ')
+    : '';
   const combined = typeof runVal === 'string' ? `${runVal} ${envVals}` : '';
 
   if (signal === 'exfil') {
@@ -69,19 +87,21 @@ export async function scan(allFiles) {
   const workflowFiles = allFiles.filter(isWorkflowFile);
 
   for (const f of workflowFiles) {
-    if (f.content.length > 512 * 1024) continue;
+    if (f.content.length > 512 * 1024) {
+      continue;
+    }
 
     let parsed = null;
-    let parseError = null;
+    let _parseError = null;
     try {
       parsed = yaml.load(f.content);
     } catch (e) {
-      parseError = e;
+      _parseError = e;
     }
 
     const rawRunBlocks = parsed ? extractRunBlocks(parsed) : extractRunBlocksRaw(f.content);
-    const runStrings = rawRunBlocks.filter(r => typeof r === 'string');
-    const envBlocks = rawRunBlocks.filter(r => typeof r === 'object' && r._env);
+    const runStrings = rawRunBlocks.filter((r) => typeof r === 'string');
+    const _envBlocks = rawRunBlocks.filter((r) => typeof r === 'object' && r._env);
 
     let exfilTriggered = false;
     let decodeTriggered = false;
@@ -109,7 +129,7 @@ export async function scan(allFiles) {
     }
 
     if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
-      const steps = parsed.jobs ? Object.values(parsed.jobs).flatMap(j => j.steps || []) : [];
+      const steps = parsed.jobs ? Object.values(parsed.jobs).flatMap((j) => j.steps || []) : [];
       for (const step of steps) {
         if (!exfilTriggered && runInStepHasBoth(step, 'exfil')) {
           exfilTriggered = true;
@@ -136,7 +156,11 @@ export async function scan(allFiles) {
 
     const lineCount = countExecutableLines(f.content);
     if ((exfilTriggered || decodeTriggered) && lineCount >= 100 && lineCount <= 120) {
-      const found = evidence.find(e => e.signal === MegalodonSignal.WORKFLOW_C2_EXFIL || e.signal === MegalodonSignal.WORKFLOW_DECODE_CHAIN);
+      const found = evidence.find(
+        (e) =>
+          e.signal === MegalodonSignal.WORKFLOW_C2_EXFIL ||
+          e.signal === MegalodonSignal.WORKFLOW_DECODE_CHAIN
+      );
       if (found) {
         found.detail += ` | Matches ${lineCount}-line Megalodon payload footprint`;
       }

package/backend/detectors/megalodon/d2-credential-harvest.js

@@ -3,7 +3,10 @@ import { MegalodonSignal } from './types.js';
 const CRED_PATTERNS = [
   { pattern: /\bAWS_(SECRET_ACCESS_KEY|ACCESS_KEY_ID|SESSION_TOKEN)\b/, label: 'AWS credential' },
   { pattern: /\bGOOGLE_APPLICATION_CREDENTIALS\b/, label: 'GCP credential' },
-  { pattern: /\bAZURE_(CLIENT_SECRET|TENANT_ID|CLIENT_ID|SUBSCRIPTION_ID)\b/, label: 'Azure credential' },
+  {
+    pattern: /\bAZURE_(CLIENT_SECRET|TENANT_ID|CLIENT_ID|SUBSCRIPTION_ID)\b/,
+    label: 'Azure credential',
+  },
   { pattern: /\bGH_(TOKEN|PAT)\b/, label: 'GitHub PAT' },
   { pattern: /\bGITHUB_TOKEN\b/, label: 'GitHub token' },
   { pattern: /\bNPM_TOKEN\b/, label: 'npm token' },
@@ -15,7 +18,8 @@ const CRED_PATTERNS = [
   { pattern: /\bMONGO_(URI|URL|CONNECTION)\b/, label: 'MongoDB connection' },
 ];
 
-const OUTBOUND_NET_RE = /curl\s+|wget\s+|fetch\s*\(|https?\.request\s*\(|http\.request\s*\(|got\s*\(|axios\s*\.|request\s*\(|node-fetch|\.post\s*\(|\.get\s*\(/i;
+const OUTBOUND_NET_RE =
+  /curl\s+|wget\s+|fetch\s*\(|https?\.request\s*\(|http\.request\s*\(|got\s*\(|axios\s*\.|request\s*\(|node-fetch|\.post\s*\(|\.get\s*\(/i;
 
 const TARGET_EXTENSIONS = ['.sh', '.bash', '.yml', '.yaml', '.js'];
 
@@ -37,7 +41,7 @@ export async function scan(allFiles) {
       const re = new RegExp(cp.pattern.source, 'gi');
       let m;
       while ((m = re.exec(content)) !== null) {
-        if (!matched.some(ex => ex.label === cp.label)) {
+        if (!matched.some((ex) => ex.label === cp.label)) {
           matched.push({ label: cp.label, match: m[0] });
         }
         score += 3;
@@ -50,8 +54,11 @@ export async function scan(allFiles) {
         evidence.push({
           signal: MegalodonSignal.CREDENTIAL_HARVEST,
           file: f.path,
-          excerpt: matched.map(m => m.label).join(', ').slice(0, 120),
-          detail: `Credential env vars (${matched.map(m => m.label).join(', ')}) co-occur with outbound network call (score: ${score})`,
+          excerpt: matched
+            .map((m) => m.label)
+            .join(', ')
+            .slice(0, 120),
+          detail: `Credential env vars (${matched.map((m) => m.label).join(', ')}) co-occur with outbound network call (score: ${score})`,
         });
       }
     }

package/backend/detectors/megalodon/d3-publish-velocity.js

@@ -3,7 +3,9 @@ import { MegalodonSignal } from './types.js';
 export function detectVelocitySpike(times, windowHours = 6, threshold = 3) {
   const filtered = {};
   for (const [v, t] of Object.entries(times)) {
-    if (v === 'created' || v === 'modified') continue;
+    if (v === 'created' || v === 'modified') {
+      continue;
+    }
     filtered[v] = t;
   }
 
@@ -33,7 +35,7 @@ export function detectVelocitySpike(times, windowHours = 6, threshold = 3) {
     }
 
     if (inWindow.length >= threshold) {
-      let display = inWindow.slice(0, 10);
+      const display = inWindow.slice(0, 10);
       let suffix = '';
       if (inWindow.length > 10) {
         suffix = ` +${inWindow.length - 10} more`;
@@ -54,14 +56,18 @@ export async function scan(registryMeta) {
   const times = registryMeta?.time || {};
   const result = detectVelocitySpike(times);
 
-  if (!result.triggered) return [];
+  if (!result.triggered) {
+    return [];
+  }
 
-  return [{
-    signal: MegalodonSignal.PUBLISH_VELOCITY,
-    file: 'registry.npmjs.org',
-    excerpt: result.versionsInWindow,
-    detail: `Version publish velocity spike: ${result.versionsInWindow} versions in window starting ${result.windowStartISO}`,
-    _windowStartISO: result.windowStartISO,
-    _allVersions: result._allVersions,
-  }];
+  return [
+    {
+      signal: MegalodonSignal.PUBLISH_VELOCITY,
+      file: 'registry.npmjs.org',
+      excerpt: result.versionsInWindow,
+      detail: `Version publish velocity spike: ${result.versionsInWindow} versions in window starting ${result.windowStartISO}`,
+      _windowStartISO: result.windowStartISO,
+      _allVersions: result._allVersions,
+    },
+  ];
 }

package/backend/detectors/megalodon/d4-publisher-drift.js

@@ -7,8 +7,12 @@ export async function scan(registryMeta, velocityResult) {
 
   const filteredTimes = {};
   for (const [v, t] of Object.entries(timeMap)) {
-    if (v === 'created' || v === 'modified') continue;
-    if (t) filteredTimes[v] = t;
+    if (v === 'created' || v === 'modified') {
+      continue;
+    }
+    if (t) {
+      filteredTimes[v] = t;
+    }
   }
 
   const sortedVersions = Object.entries(filteredTimes)
@@ -16,7 +20,9 @@ export async function scan(registryMeta, velocityResult) {
     .sort((a, b) => new Date(a[1]).getTime() - new Date(b[1]).getTime())
     .map(([v]) => v);
 
-  if (sortedVersions.length === 0) return [];
+  if (sortedVersions.length === 0) {
+    return [];
+  }
 
   if (velocityResult?.triggered) {
     const windowStartISO = velocityResult.windowStartISO;
@@ -24,14 +30,20 @@ export async function scan(registryMeta, velocityResult) {
 
     const priorPublishers = new Set();
     for (const v of sortedVersions) {
-      if (new Date(filteredTimes[v]).getTime() >= new Date(windowStartISO).getTime()) break;
+      if (new Date(filteredTimes[v]).getTime() >= new Date(windowStartISO).getTime()) {
+        break;
+      }
       const user = versions[v]?._npmUser?.name;
-      if (user) priorPublishers.add(user);
+      if (user) {
+        priorPublishers.add(user);
+      }
     }
 
     if (priorPublishers.size === 0 && allInWindow.length > 0) {
       const firstUser = versions[allInWindow[0]]?._npmUser?.name;
-      if (firstUser) priorPublishers.add(firstUser);
+      if (firstUser) {
+        priorPublishers.add(firstUser);
+      }
     }
 
     const suspiciousPublishers = [];
@@ -39,15 +51,19 @@ export async function scan(registryMeta, velocityResult) {
     for (const v of allInWindow) {
       const user = versions[v]?._npmUser?.name;
       if (user && !priorPublishers.has(user)) {
-        if (!suspiciousPublishers.includes(user)) suspiciousPublishers.push(user);
-        if (!affectedVersions.includes(v)) affectedVersions.push(v);
+        if (!suspiciousPublishers.includes(user)) {
+          suspiciousPublishers.push(user);
+        }
+        if (!affectedVersions.includes(v)) {
+          affectedVersions.push(v);
+        }
       }
     }
 
     if (suspiciousPublishers.length > 0) {
       const detail = `Drift detected: known publishers [${[...priorPublishers].join(', ')}], new publisher(s) [${suspiciousPublishers.join(', ')}] in versions [${affectedVersions.join(', ')}]`;
 
-      const firstSuspiciousVer = allInWindow.find(v => affectedVersions.includes(v));
+      const firstSuspiciousVer = allInWindow.find((v) => affectedVersions.includes(v));
       let ageNote = '';
       if (firstSuspiciousVer && suspiciousPublishers[0]) {
         ageNote = await checkAccountAge(suspiciousPublishers[0], filteredTimes[firstSuspiciousVer]);
@@ -62,7 +78,9 @@ export async function scan(registryMeta, velocityResult) {
       });
     }
   } else {
-    if (sortedVersions.length < 4) return [];
+    if (sortedVersions.length < 4) {
+      return [];
+    }
 
     const last3 = sortedVersions.slice(-3);
     const prior = sortedVersions.slice(0, -3);
@@ -70,7 +88,9 @@ export async function scan(registryMeta, velocityResult) {
     const priorPublishers = new Set();
     for (const v of prior) {
       const user = versions[v]?._npmUser?.name;
-      if (user) priorPublishers.add(user);
+      if (user) {
+        priorPublishers.add(user);
+      }
     }
 
     const suspiciousPublishers = [];
@@ -78,8 +98,12 @@ export async function scan(registryMeta, velocityResult) {
     for (const v of last3) {
       const user = versions[v]?._npmUser?.name;
       if (user && !priorPublishers.has(user)) {
-        if (!suspiciousPublishers.includes(user)) suspiciousPublishers.push(user);
-        if (!affectedVersions.includes(v)) affectedVersions.push(v);
+        if (!suspiciousPublishers.includes(user)) {
+          suspiciousPublishers.push(user);
+        }
+        if (!affectedVersions.includes(v)) {
+          affectedVersions.push(v);
+        }
       }
     }
 
@@ -88,7 +112,10 @@ export async function scan(registryMeta, velocityResult) {
 
       let ageNote = '';
       if (suspiciousPublishers[0] && affectedVersions[0]) {
-        ageNote = await checkAccountAge(suspiciousPublishers[0], filteredTimes[affectedVersions[0]]);
+        ageNote = await checkAccountAge(
+          suspiciousPublishers[0],
+          filteredTimes[affectedVersions[0]]
+        );
       }
 
       evidence.push({
@@ -108,10 +135,14 @@ async function checkAccountAge(npmUser, firstSuspiciousTime) {
   try {
     const url = `https://registry.npmjs.org/-/user/org.couchdb.user/${encodeURIComponent(npmUser)}`;
     const res = await fetch(url);
-    if (!res.ok) return '';
+    if (!res.ok) {
+      return '';
+    }
     const data = await res.json();
     const created = data?.date;
-    if (!created) return '';
+    if (!created) {
+      return '';
+    }
     const createdDate = new Date(created).getTime();
     const firstPub = new Date(firstSuspiciousTime).getTime();
     const daysDiff = (firstPub - createdDate) / (1000 * 60 * 60 * 24);
@@ -119,6 +150,7 @@ async function checkAccountAge(npmUser, firstSuspiciousTime) {
       return `Publisher account created ${Math.round(daysDiff)} days before first suspicious publish`;
     }
   } catch {
+    /* ignore fetch errors */
   }
   return '';
 }

package/backend/detectors/megalodon/d5-bot-commit-identity.js

@@ -1,3 +1,3 @@
-export async function scan(registryMeta) {
+export async function scan(_registryMeta) {
   return [];
 }

package/backend/detectors/megalodon/d6-date-anachronism.js

@@ -1,3 +1,3 @@
-export async function scan(pkgJson, registryMeta) {
+export async function scan(_pkgJson, _registryMeta) {
   return [];
 }