@preventive/triage 1.0.0-alpha.36 → 1.0.0-alpha.38

package/risk/files/readability.js

@@ -0,0 +1,164 @@
+// How a file's text reads, for a reviewer: its category (binary, a source
+// map, code with unexpectedly long lines or an inline map, minified, else
+// ASCII or UTF-8), its control and invisible characters, its longest lines,
+// an obfuscator's fingerprint, a large code file, and a file become
+// unreadable between two versions.
+import { CONTROLS, npmTextEncoding } from './characters.js'
+import { MINIFIED_AVERAGE, minifiable, minifiedAverage } from './script.js'
+
+// Lines longer than anyone writes by hand.
+export const NPM_LONG_LINE = 1000
+// Prose, which wraps where it is read: its long lines are paragraphs. By its
+// extension (text, Markdown and MDX, and the markup GitHub renders a README
+// from: `README.org`, `README.rdoc`), or its name alone (`LICENSE-MIT`,
+// `CHANGES`; a dot in it only a version's, `LICENSE-LGPL2.1`,
+// `CHANGES.2.0`; a prose extension after it is one), not code named alike
+// (`lib/history.js`, `dist/notice.min.js`), which can be minified as any.
+export const NPM_PROSE = /(?:\.(?:md|markdown|mdown|mkdn|mdx|txt|rst|adoc|asciidoc|asc|textile|rdoc|org|creole|mediawiki|wiki|pod)|(?:^|\/)(?:licen[cs]e|copying|notice|authors|contributors|readme|changelog|changes|history)(?:-[^/.]*)?(?:\.\d[^/.]*)*)$/iu
+const SOURCE_MAP_COMMENT = /^\s*(?:\/\/|\/\*)[#@] sourceMappingURL=/u
+// A line that is all one, the map in it as a data: URL, base64 or
+// percent-encoded: not code that writes one.
+const INLINE_SOURCE_MAP = /^\s*(?:\/\/|\/\*)[#@] sourceMappingURL=data:[^\s,]*,[\w+/=%.~-]*\s*(?:\*\/)?\s*$/u
+export const SOURCE_MAP = /\.map$/iu
+const MINIFIED_NAME = /\.min\.[^/.]+$/iu
+// What javascript-obfuscator writes, and next to nothing else: its names,
+// `_0x` and four to six hex digits, OBFUSCATED_NAMES of them or more, or the
+// loop it turns its array of strings with, `while(!![])`, spaced or not.
+const OBFUSCATED_NAME = /(?<![\p{ID_Continue}$])_0x[0-9a-f]{4,6}(?![\p{ID_Continue}$])/gu
+export const OBFUSCATED_NAMES = 20
+const OBFUSCATED_LOOP = /while\s*\(\s*!!\[\]\s*\)/u
+// Names counted before a fingerprint's count stops, reading as that many or
+// more: each is kept to tell it from the others, and a file can hold millions.
+export const OBFUSCATED_COUNTED = 1000
+// A text's obfuscator fingerprint, `{ names, loop }`: how many such names it
+// has, up to OBFUSCATED_COUNTED, and whether it has the loop; null where it
+// has neither enough names nor the loop.
+export function npmObfuscation(text) {
+  const names = new Set()
+  for (const [name] of text.matchAll(OBFUSCATED_NAME)) {
+    names.add(name)
+    if (names.size === OBFUSCATED_COUNTED) break
+  }
+  const loop = OBFUSCATED_LOOP.test(text)
+  return names.size >= OBFUSCATED_NAMES || loop ? { names: names.size, loop } : null
+}
+
+// A code file this large is mostly a bundle, worth a look where a version
+// adds it: JavaScript or TypeScript, not a declaration file, which holds no
+// code that runs.
+export const NPM_LARGE_CODE = 256 * 1024
+const CODE = /\.(?:[cm]?[jt]s|[jt]sx)$/iu
+const DECLARATION = /\.d\.[cm]?ts$/iu
+export const npmLargeCode = (path, bytes) => typeof bytes === 'number' && bytes >= NPM_LARGE_CODE && CODE.test(path) && !DECLARATION.test(path)
+
+// A file with a line over UNREADABLE_LINE characters, by how it reads
+// (`now`, npmFileReadability's), `path` its path: an inline source map's line
+// counts for none, and prose and source maps, whose long lines the Long lines
+// tag passes over, never are, nor is a file that isn't text. Then one that
+// had no line over SHORT_LINES characters (`was`) and now has one over
+// UNREADABLE_LINE, by how it reads on each side.
+const SHORT_LINES = 200
+const UNREADABLE_LINE = 2000
+export const npmUnreadable = (path, now) => Boolean(now) && now.category !== 'binary' && !NPM_PROSE.test(path) && !SOURCE_MAP.test(path)
+  && now.longest > UNREADABLE_LINE
+export const npmBecameUnreadable = (path, was, now) => Boolean(was) && was.category !== 'binary' && was.longest <= SHORT_LINES && npmUnreadable(path, now)
+
+// How a file reads, as its `category`, the first that holds (READABILITY):
+// binary (no text), map (a source map), long (code with some lines
+// longer than anyone writes), inline-map (code with its source map in it, minified or
+// not), minified (code mostly on long lines, or named .min., or minified
+// into shorter lines: see MINIFIED_AVERAGE), else utf8 or ascii; and
+// whatever it is, the control, bidirectional or invisible characters a text
+// holds (`controls`), found in one pass, which count as a label of their own
+// beside it each, control and invisible (npmReadabilityLabels). Prose is
+// readable whatever its lines' lengths, and an inline source map's line
+// counts for none, nor for how much of the code is on long lines. With
+// npmTextEncoding's `kind` and `controls`, its `longest` line's length and
+// `longLines`, its code's lines' `average` length where it is minified into
+// short ones (strings and comments aside, see MINIFIED_AVERAGE; 0 otherwise),
+// how long its inline map is (`inlineMap`, 0 for none), and its obfuscator
+// fingerprint (`obfuscation`, npmObfuscation's; null for none, and for prose
+// or a source map).
+export function npmFileReadability(path, text) {
+  const encoding = npmTextEncoding(text)
+  if (encoding.kind === 'binary') return { ...encoding, category: 'binary', longest: 0, longLines: 0, average: 0, inlineMap: 0, obfuscation: null }
+  let inlineMap = 0, longChars = 0, longLines = 0, longest = 0
+  for (let at = 0; at <= text.length;) {
+    const next = text.indexOf('\n', at)
+    const end = next === -1 ? text.length : next
+    const length = end - at - (text[end - 1] === '\r' ? 1 : 0)
+    if (SOURCE_MAP_COMMENT.test(text.slice(at, at + 64)) && INLINE_SOURCE_MAP.test(text.slice(at, end))) inlineMap += length
+    else {
+      if (length > NPM_LONG_LINE) {
+        longLines++
+        longChars += length
+      }
+      longest = Math.max(longest, length)
+    }
+    at = end + 1
+  }
+  // A source map holds the names and sources of the code it maps, and prose
+  // its examples: neither runs.
+  const obfuscation = NPM_PROSE.test(path) || SOURCE_MAP.test(path) ? null : npmObfuscation(text)
+  const read = { ...encoding, longest, longLines, average: 0, inlineMap, obfuscation }
+  if (SOURCE_MAP.test(path)) return { ...read, category: 'map' }
+  if (NPM_PROSE.test(path)) return { ...read, category: inlineMap > 0 ? 'inline-map' : encoding.kind }
+  if (longLines === 0) {
+    // None of its lines longer than MINIFIED_AVERAGE, none of its code's can
+    // average more: told without reading its code.
+    const language = minifiable(path)
+    const average = language !== null && longest > MINIFIED_AVERAGE ? minifiedAverage(text, language) : 0
+    return { ...read, average, category: inlineMap > 0 ? 'inline-map' : average > 0 ? 'minified' : encoding.kind }
+  }
+  if (longChars / (text.length - inlineMap) < .5 && !MINIFIED_NAME.test(path)) return { ...read, category: 'long' }
+  return { ...read, category: inlineMap > 0 ? 'inline-map' : 'minified' }
+}
+
+// The category a file's tag shows: for one with long lines, how its text is
+// encoded.
+export const npmTaggedCategory = readability => readability.category === 'long' ? readability.kind : readability.category
+
+// What a file is labelled, in its tags and in the Overview's warning and
+// chips, each finding it: its control characters, its invisible ones
+// (characterLabels) and its long lines, where it holds them, beside its category (how its text is encoded, for one whose long
+// lines are unexpected), but for ASCII or UTF-8, which a file that can't be
+// read as it is counts under as none of them. A minified file's long lines
+// are labelled too, as its inline map's are; prose's and a source map's
+// never are.
+export function npmReadabilityLabels(readability) {
+  const flags = [...characterLabels(readability.controls),
+    ...readability.longLines > 0 && ['long', 'minified', 'inline-map'].includes(readability.category) ? ['long'] : []]
+  const category = npmTaggedCategory(readability)
+  return READABILITY.get(category).mark || flags.length === 0 ? [...flags, category] : flags
+}
+
+// How a label is marked on a file: long lines as a warning where it is
+// otherwise readable, as they are unexpected there, and as a notice in
+// minified code, as minified code is; any other as its category is.
+export const npmLabelMark = (readability, label) => label === 'long' && readability.category !== 'long' ? 'notice' : READABILITY.get(label).mark
+
+// Each category: its name, its tag in a list of files or a file's head (and,
+// `short`, in a file tree, where that is too long), and how it is marked,
+// `warn` for what to look into, `notice` for what can be hard to review by
+// reading it either way.
+export const READABILITY = new Map([
+  ['binary', { name: 'Binary', tag: 'Binary', mark: 'warn' }],
+  ['controls', { name: 'Control chars', tag: 'Controls', mark: 'warn' }],
+  ['invisible', { name: 'Invisible chars', tag: 'Invisible', mark: 'warn' }],
+  ['long', { name: 'Long lines', tag: 'Long lines', mark: 'warn' }],
+  ['minified', { name: 'Minified', tag: 'Minified', short: 'Min', mark: 'notice' }],
+  ['map', { name: 'Source maps', tag: 'Map', mark: 'notice' }],
+  ['inline-map', { name: 'Inline source maps', tag: 'Inline map', mark: 'notice' }],
+  ['utf8', { name: 'UTF-8', tag: 'UTF-8', mark: null }],
+  ['ascii', { name: 'ASCII', tag: 'ASCII', mark: null }],
+])
+
+// The characters a text holds of a label's kind, `controls` (C0, DEL, C1
+// and bidirectional controls) or `invisible`, `[point, times]`, the most
+// found first: those npmTextEncoding found in one pass, told apart by code
+// point. The labels a text's characters take, of those two.
+const CONTROL = new RegExp(CONTROLS.source, 'u')
+export const charactersOf = (controls, label) => [...controls ?? []]
+  .filter(([point]) => CONTROL.test(String.fromCodePoint(point)) === (label === 'controls')).toSorted((a, b) => b[1] - a[1] || a[0] - b[0])
+const characterLabels = controls => controls ? ['controls', 'invisible'].filter(label => charactersOf(controls, label).length > 0) : []
+

package/risk/files/runs-code.js

@@ -0,0 +1,329 @@
+// What a file's code can do beyond itself, for a reviewer: run a string as
+// code (eval, Function with new or without, node:vm, Module's _compile) or
+// other programs (child_process), reach for credentials (a credential file's
+// path, a token's name) or the whole environment, and publish to npm (`npm
+// publish`, `/-/whoami`, a registry PUT), as a file's stamps say
+// (stamps.js) and a version's findings name what is new to a file.
+// A quick read, not a parse: a script's code with its strings, regular
+// expressions and comments set aside as script.js tells them, its
+// strings read for the paths, names and commands they hold, a module by the
+// string naming it where it is loaded (`require('child_process')`,
+// `import … from 'node:child_process'`); a declaration file (.d.ts) read as
+// TypeScript, as node runs it (stripping its types, `declare function
+// eval(…)` among them, a function named, not called). A call written not to
+// read as one (`window['ev' + 'al']`) goes unseen, as does one in a template
+// literal in another's substitution (`${`${eval(x)}`}`), whose backtick ends
+// the outer one as the regular expression telling strings reads it.
+//
+// Labels to assist a reviewer, making the plain cases less likely to be
+// missed, not a check to rely on: code can come to eval, Function,
+// child_process, credentials or the registry in more ways than any reading of
+// its text tells (a name built as it runs, `(…).constructor('…')`, a module
+// required by a name computed, a path or URL put together, the
+// registry's host read from config), so a file without a label is not one
+// without them.
+import { JS_STRING_OR_COMMENT, NPM_MAX_FOUND, lineOf, npmIsScript } from './script.js'
+
+// What may come between a call's parts: blanks and comments
+// (`Function/* note */(…)`), each comment ending at its first `*/`.
+const COMMENT = String.raw`/\*(?:[^*]|\*(?!/)){0,100}\*/|//[^\n]{0,100}\n`
+const GAP = String.raw`(?:\s|${COMMENT})*`
+// Function called: as it is, optionally (`Function?.(…)`), or by its call or
+// apply (`Function.call(null, …)`), each making a function of its last
+// argument.
+const FUNCTION_CALLED = String.raw`(?:${GAP}\??\.${GAP}(?:call|apply))?${GAP}(?:\?\.${GAP})?\(`
+// But not where the function made returns `this` alone
+// (`Function('return this')()`, `new Function("return this;")`): the global
+// object, as older code finds it where `globalThis` may not be, lodash's and
+// core-js's among them, running nothing of its own.
+const GLOBAL_FOUND = String.raw`(?!${GAP}(?<quote>["'\u0060])\s*return\s+this\s*;?\s*\k<quote>${GAP}\))`
+// The environment, whole: not one variable of it (`process.env.HOME`,
+// `process.env[name]`).
+const ENV = String.raw`process${GAP}\.${GAP}env(?![\p{ID_Continue}$])(?!${GAP}(?:\??\.|\[))`
+// Its values read out whole (`JSON.stringify(process.env)`,
+// `Object.entries(process.env)`, `new URLSearchParams(process.env)`), or a
+// copy of them (`JSON.stringify({ ...process.env })`), not as a program is
+// handed it (`{ env: process.env }`, `{ ...process.env }`), nor its
+// names listed (`Object.keys(process.env)`, as debug picks its DEBUG_ ones),
+// nor one variable asked for (`'HOME' in process.env`), nor its entries or
+// values picked among as they are read (`Object.entries(process.env)
+// .reduce(…)`, as npm's agent finds its proxy's, `.filter(…)`, `.find(…)`).
+const PICKED = String.raw`${GAP}\)${GAP}\??\.${GAP}(?:filter|find|findLast|some|every|reduce)(?![\p{ID_Continue}$])`
+const COPY = String.raw`(?:\{${GAP}\.\.\.${GAP})?`
+const ENV_WHOLE = String.raw`(?=JSON|Object|URLSearchParams)(?<![\p{ID_Continue}$.])(?:JSON${GAP}\.${GAP}stringify|URLSearchParams)${GAP}\(${GAP}${COPY}${ENV}`
+  + String.raw`|(?=Object)(?<![\p{ID_Continue}$.])Object${GAP}\.${GAP}(?:values|entries)${GAP}\(${GAP}${COPY}${ENV}(?!${PICKED})`
+// Any of RUNS_CODE, as a text may say it.
+const SAYS_ANY = new RegExp(String.raw`eval|Function${FUNCTION_CALLED}|vm["'\x60]|_compile|child_process|\.(?:npmrc|ssh|aws)|_TOKEN|(?:stringify|values|entries|URLSearchParams)${GAP}\(${GAP}(?:\{${GAP}\.\.\.${GAP})?process${GAP}\.${GAP}env|publish|whoami|registry\.(?:npmjs\.org|yarnpkg\.com)`, 'u')
+
+// A name read as one, not as a property's (`vm.eval`, `vm . eval`, a spread's
+// `...eval` aside) or part of another's (`evaluate`), or as the global
+// object's (`window.eval`, `globalThis?.eval`); looked back on only where the
+// name or the global object's starts, so a long run of blanks reads in one go.
+const GLOBAL = 'globalThis|window|global|self'
+const named = name => String.raw`(?=${GLOBAL}|${name})(?<![\p{ID_Continue}$#])(?<!(?<!\.)\.${GAP})(?<!\bfunction${GAP})(?:(?:${GLOBAL})${GAP}\??\.${GAP})?${name}`
+// A token's name, as its value is read (`process.env.GITHUB_TOKEN || null`,
+// `env.NPM_TOKEN`, `||=`), not where its absence is told
+// (`!process.env.GITHUB_TOKEN`, `!(process.env.GITHUB_TOKEN)`) or it is
+// dropped (`delete process.env.NPM_TOKEN`), the token the whole of what is
+// negated or deleted (ABSENT_ENDS: not `!process.env.GITHUB_TOKEN.trim()`,
+// `!(process.env.GITHUB_TOKEN === x)`), nor where it is only set
+// (`process.env.NPM_TOKEN = token`), but for a default as it is destructured
+// (`{ NPM_TOKEN = '' } = process.env`, a line of its own too), nor declared
+// (`const NPM_TOKEN = …`, TypeScript's `let GITHUB_TOKEN: string`), nor typed
+// (a member, `GITHUB_TOKEN?: string`, `NPM_TOKEN: string | undefined`, or a
+// parameter): looked back on, a few names and dots at most, only where the
+// name starts.
+const TOKEN_VAR = '(?:NPM|GITHUB)_TOKEN'
+const SET = String.raw`\s{0,4}=(?![=>])`
+// A name typed, not read: optional (`?:`), or a primitive's type after it,
+// as no destructuring names what it reads (`{ NPM_TOKEN: token }`); not
+// `undefined`, a ternary's choice (`x ? env.NPM_TOKEN : undefined`).
+const TYPED = String.raw`\s{0,4}(?:\?:|:\s{0,4}(?:string|number|boolean|unknown|any)(?![\p{ID_Continue}$]))`
+// What may follow a token negated or deleted whole: the parentheses around
+// it closed, nothing read of what they hold (`!(token).trim()`, `!(token)()`), or else what
+// ends an operand (`&&`, `||`, `??`, a ternary's `?`, `;`, `,`, `:`, `}`, `]`,
+// the line's end).
+const ABSENT_ENDS = String.raw`\s{0,4}(?:(?:\)\s{0,4}){1,4}(?![\s)]{0,8}(?:[.[(]|\?\.))|&&|\|\||\?\?|\?(?!\.)|[;,:}\]]|$)`
+const TOKEN_NAME = String.raw`(?=NPM|GITHUB)(?<![\p{ID_Continue}$])(?<!\b(?:const|let|var)\s{1,4})`
+  + String.raw`(?:(?<!(?:!|\bdelete\s)[\s(]{0,4}(?:[\p{ID_Continue}$]{1,64}\s{0,4}\??\.\s{0,4}){0,4})|(?!${TOKEN_VAR}${ABSENT_ENDS}))`
+  + String.raw`${TOKEN_VAR}(?![\p{ID_Continue}$])(?!${TYPED})(?:(?!${SET})|(?<=[{,]\s{0,64}${TOKEN_VAR}))`
+// A script's strings, regular expressions and comments, as script.js
+// tells them, each taking its own text, and its code in none of them: eval,
+// not a property TypeScript types as optional (`eval?: T`, JavaScript's `?:`
+// none of its own), and Function called, but to find the global object;
+// Module's _compile, called
+// (`module._compile(source, filename)`) or hooked (`Module.prototype._compile
+// = …`), not named in a type (`typeof Module.prototype._compile`); a token's
+// name, its value read; the environment read out whole; and a PUT request's
+// call (`axios.put(…)`).
+const READS = new RegExp(String.raw`${JS_STRING_OR_COMMENT.source}|(?<eval>${named('eval')}(?![\p{ID_Continue}$])(?!\s*\?:))|(?<function>${named('Function')}${FUNCTION_CALLED}${GLOBAL_FOUND})`
+  + String.raw`|(?<compile>\.${GAP}_compile(?:${FUNCTION_CALLED}|${GAP}=(?![=>])))|(?<tokens>${TOKEN_NAME})|(?<env>${ENV_WHOLE})|(?<put>\.${GAP}put${GAP}\()`, 'gmu')
+// What a string holds that a kind is: a credential file's path, npm's, SSH's
+// or AWS's (`~/.npmrc`, `.ssh/id_rsa`, `.aws/credentials`, not `x.npmrc` or
+// `.sshd`); a token's name where it is read, the string the name alone (a
+// key, `process.env['GITHUB_TOKEN']`) or the name expanded (a shell's or
+// .npmrc's `$GITHUB_TOKEN`, `${NPM_TOKEN}`, cmd's `%NPM_TOKEN%`), not where
+// text names it (`requires a token in GITHUB_TOKEN`); a command publishing (`npm publish`, `pnpm
+// publish …`, options before it as npm takes them, `npm --tag next publish`)
+// or the registry's who-am-I, a publisher's first step with a token. And the
+// registry's host, where a PUT request is one publishing.
+// Told first of a string by what any of them says.
+const HOLDS_ANY = /\.(?:npmrc|ssh|aws)|_TOKEN|publish|whoami|registry\./u
+// Before a token's name as a key, its absence told or the token dropped, as
+// TOKEN_NAME tells of one as a name (`!process.env['GITHUB_TOKEN']`,
+// `delete process.env['NPM_TOKEN']`): a few names and dots at most, and
+// after it, its key's bracket closed, what may follow it whole (ABSENT_ENDS,
+// not `!process.env['NPM_TOKEN'].length`). After it, the token set
+// (`process.env['NPM_TOKEN'] = token`).
+const KEY_SET = new RegExp(String.raw`^\s{0,4}\]${SET}`, 'u')
+const KEY_ENDS = new RegExp(String.raw`^\s{0,4}\]${ABSENT_ENDS}`, 'mu')
+const KEY_ABSENT = /(?:!|\bdelete\s)[\s(]{0,4}(?:[\p{ID_Continue}$]{1,64}\s{0,4}\??\.\s{0,4}){0,4}[\p{ID_Continue}$]{1,64}\s{0,4}(?:\?\.\s{0,4})?\[\s{0,4}$/u
+const HOLDS = [
+  ['credential-files', /(?<![\w$.-])\.(?:npmrc|ssh|aws)(?![\w-])/gu],
+  ['tokens', new RegExp(String.raw`^["'\u0060]${TOKEN_VAR}["'\u0060]$|(?:\$\{?|%)${TOKEN_VAR}(?![\p{ID_Continue}$])`, 'gu')],
+  ['publish', /(?<![\w-])(?:npm|pnpm|yarn)(?:\s+-{1,2}\w[\w-]*(?:=\S*|\s+(?!-)\S+)?){0,8}?\s+publish(?![\w-])|\/-\/whoami(?![\w-])/gu],
+  ['registry', /registry\.(?:npmjs\.org|yarnpkg\.com)/gu],
+]
+// A module a kind loads: vm, child_process, and libnpmpublish, npm's own
+// publishing.
+const MODULES = [
+  ['vm', /^(["'\u0060])(?:node:)?vm\1$/u],
+  ['child-process', /^(["'\u0060])(?:node:)?child_process\1$/u],
+  ['publish', /^(["'\u0060])libnpmpublish\1$/u],
+]
+// A string a program is run with publishing (`spawn('npm', ['publish'])`),
+// after the one naming it, its options and their values between
+// (`['--tag', 'next', 'publish']`), and a request's method set to PUT
+// (`{ method: 'PUT' }`, `options.method = 'put'`).
+const PROGRAM = /^(["'\u0060])(?:npm|pnpm|yarn)\1$/u
+const PUBLISH = /^(["'\u0060])publish\1$/u
+const OPTION = /^(["'\u0060])-/u
+const ARGUMENTS_BETWEEN = new RegExp(String.raw`^(?:[\s,[]|${COMMENT})*$`, 'u')
+const PUT = /^(["'\u0060])put\1$/iu
+const METHOD = new RegExp(String.raw`\bmethod["']?${GAP}[:=]${GAP}$`, 'u')
+// What comes before a module's name where code loads it: `require(` (or
+// `require?.(`), a bundler's `__require(` or `__non_webpack_require__(`,
+// `import(`, `import` and `from`, comments allowed between
+// (`import(/* webpackIgnore: true */ …)`); a name not loaded, as in a list of
+// node's modules, is none, nor one a type-only import or export names
+// (`import type { … } from`, `import type cp = require(`, comments allowed as
+// in a load), which TypeScript erases (`import type from` imports a default
+// named type, `import type = require(` one named so).
+const LOADS = new RegExp(String.raw`(?:(?:require[\w$]*${GAP}(?:\?\.${GAP})?|\bimport${GAP})\(|\b(?:from|import))${GAP}$`, 'u')
+const TYPE_ONLY = new RegExp(String.raw`\b(?:import|export)${GAP}type\b(?!${GAP}(?:from\b|=))[^;'"\x60]*(?:\bfrom|=${GAP}require${GAP}\()${GAP}$`, 'u')
+
+// Each kind, in the order its tags show: its tag, what it does, its name in
+// the tag's tooltip, a row of its own where kinds share the tag (a string run
+// as code by any way, `eval`'s; a credential file or token, `credentials`'),
+// and for one marked as worse than the others' warning, `critical`: the whole
+// environment read out, and publishing.
+const AS_CODE = { tag: 'eval', note: 'Runs a string as code' }
+const CREDENTIALS = { tag: 'credentials', note: 'Reaches for credentials' }
+export const RUNS_CODE = new Map([
+  ['eval', { ...AS_CODE, name: 'eval' }],
+  ['function', { ...AS_CODE, name: 'Function' }],
+  ['vm', { ...AS_CODE, name: 'vm' }],
+  ['compile', { ...AS_CODE, name: 'Module._compile' }],
+  ['child-process', { tag: 'child_process', note: 'Runs other programs', name: 'child_process' }],
+  ['credential-files', { ...CREDENTIALS, name: '.npmrc, .ssh or .aws' }],
+  ['tokens', { ...CREDENTIALS, name: 'NPM_TOKEN or GITHUB_TOKEN' }],
+  ['env', { tag: 'whole env', note: 'Reads out the whole environment', name: 'process.env, by JSON.stringify, Object.entries or values, URLSearchParams', mark: 'critical' }],
+  ['publish', { tag: 'publish', note: 'Publishes to npm', name: 'npm publish, /-/whoami or a registry PUT', mark: 'critical' }],
+])
+
+// The kinds a file's code holds, each with the lines it is on, of the first
+// NPM_MAX_FOUND places it does each, in RUNS_CODE's order; null for none, or
+// for a file that is no script.
+export function npmRunsCode(path, text) {
+  if (!npmIsScript(path, text)) return null
+  const found = new Map()
+  const at = (kind, offset) => {
+    const offsets = found.get(kind)
+    if (!offsets) found.set(kind, [offset])
+    else if (offsets.length < NPM_MAX_FOUND) offsets.push(offset)
+  }
+  read(text, 0, at)
+  // A PUT request publishing where the file names the registry.
+  if (found.has('registry')) for (const offset of found.get('put') ?? []) at('publish', offset)
+  if (![...RUNS_CODE.keys()].some(kind => found.has(kind))) return null
+  const line = lineOf(text)
+  return new Map([...RUNS_CODE.keys()].filter(kind => found.has(kind)).map(kind => [kind, [...new Set(found.get(kind).map(line))].toSorted((a, b) => a - b)]))
+}
+
+// Where code (a file's, or a template literal's substitution's, at `base` in
+// the file) does a kind, as at(kind, offset), in order: its code's, what its
+// strings hold, a string naming a module where it is loaded, and what a
+// template literal's substitutions (`${eval(x)}`) do, code again, read as its
+// own; a PUT request (`put`) and the registry's host (`registry`) as their
+// own, for the file to pair. Most code says none of it at all, told before
+// anything is read.
+function read(code, base, at) {
+  if (!SAYS_ANY.test(code)) return
+  // Where the string before ends; whether the strings since a program's name
+  // are its arguments, an option or its value each, and whether the last is
+  // an option.
+  let end = 0, option = false, program = false
+  for (const { 0: token, 1: string, groups, index } of code.matchAll(READS)) {
+    if (string === undefined) {
+      for (const kind of CODE_KINDS) if (groups[kind]) at(kind, base + index)
+      continue
+    }
+    if (string[0] === '/') continue
+    const inner = string[0] === '`' && SAYS_ANY.test(string) ? substitutions(string) : []
+    for (const [from, to] of inner) read(string.slice(from, to), base + index + from, at)
+    // What a string holds, a template's text alone, its substitutions' code
+    // read as code, its comments and regular expressions aside.
+    const text = inner.length === 0 ? string : textOf(string, inner)
+    // A token's name as the string's whole (`within` 0, its quote) is a key,
+    // not one where its absence is told, it is dropped or only set.
+    const keyed = () => {
+      const after = code.slice(index + token.length, index + token.length + 20)
+      return !KEY_SET.test(after) && (!KEY_ENDS.test(after) || !KEY_ABSENT.test(code.slice(Math.max(0, index - 300), index)))
+    }
+    const held = HOLDS_ANY.test(text) ? HOLDS.flatMap(([kind, holds]) => [...text.matchAll(holds)].map(({ index: within }) => [kind, within])) : []
+    for (const [kind, within] of held) if (kind !== 'tokens' || within > 0 || keyed()) at(kind, base + index + within)
+    for (const [kind, name] of MODULES) if (name.test(string) && loaded(code, index)) at(kind, base + index)
+    if (program && ARGUMENTS_BETWEEN.test(code.slice(end, index))) {
+      if (PUBLISH.test(string)) at('publish', base + index)
+      program = OPTION.test(string) || option
+      option = OPTION.test(string)
+    } else program = false
+    if (PROGRAM.test(string)) [program, option] = [true, false]
+    if (PUT.test(string) && METHOD.test(code.slice(Math.max(0, index - 300), index))) at('put', base + index)
+    end = index + token.length
+  }
+}
+
+// The kinds code itself does, by READS' groups.
+const CODE_KINDS = ['eval', 'function', 'compile', 'tokens', 'env', 'put']
+
+// Whether the string at `index` in code names a module where it is loaded.
+function loaded(code, index) {
+  const before = code.slice(Math.max(0, index - 300), index)
+  return LOADS.test(before) && !TYPE_ONLY.test(before)
+}
+
+// A template literal with its substitutions' code blanked, its text in place.
+function textOf(template, inner) {
+  const parts = []
+  let from = 0
+  for (const [start, end] of inner) {
+    parts.push(template.slice(from, start), ' '.repeat(end - start))
+    from = end
+  }
+  parts.push(template.slice(from))
+  return parts.join('')
+}
+
+// Where each of a template literal's substitutions' code starts and ends, in
+// it: from its `${` to the `}` that closes it.
+function substitutions(template) {
+  const found = []
+  for (let i = template.indexOf('${'); i !== -1; i = template.indexOf('${', i)) {
+    // Escaped by an odd run of backslashes before it (`\${`, not `\\${`).
+    let run = 0
+    while (template[i - 1 - run] === '\\') run++
+    if (run % 2 === 1) {
+      i += 2
+      continue
+    }
+    const end = closing(template, i + 2)
+    found.push([i + 2, end])
+    i = end
+  }
+  return found
+}
+
+// A string, regular expression or comment where it starts, told as
+// JS_STRING_OR_COMMENT tells them in a whole text.
+const TOKEN = new RegExp(JS_STRING_OR_COMMENT.source, 'muy')
+
+// Where the `}` closing code from `from` in a text is, or the text's end for
+// none: the first its braces leave unbalanced, those in its strings, regular
+// expressions and comments aside (`${/* } */ x}`, `${/}/.test(x)}`).
+function closing(text, from) {
+  let depth = 0
+  for (let at = from; at < text.length; at++) {
+    const char = text[at]
+    // Tried where a token can start: a quote, a slash, or a run of blanks, a
+    // comment's leading blanks taken from where they start.
+    if ('"\'`/ \t'.includes(char)) {
+      TOKEN.lastIndex = at
+      const token = TOKEN.exec(text)
+      if (token) {
+        at += token[0].length - 1
+        continue
+      }
+    }
+    if (char === '{') depth++
+    else if (char === '}' && depth-- === 0) return at
+  }
+  return text.length
+}
+
+// What `found` holds (npmRunsCode's kinds, hosts.js's services) that
+// `was` didn't, each with its lines: what is new to a file, as its tags say,
+// `was` null for one the version compared with didn't hold, or held none in.
+// Null for none.
+export function npmFoundAdded(found, was) {
+  if (!found) return null
+  const added = new Map([...found].filter(([kind]) => !was?.has(kind)))
+  return added.size > 0 ? added : null
+}
+
+// The kinds any of `founds` holds, as their tags name them, in their order,
+// a tag kinds share once: `eval, child_process`.
+export const npmRunsCodeKinds = founds => [...new Set([...RUNS_CODE].filter(([kind]) => founds.some(found => found.has(kind))).map(([, { tag }]) => tag))].join(', ')
+
+// What `found` holds (npmRunsCode's) but the kinds whose tags `tags` names,
+// each with its lines; null for none.
+export function npmRunsCodeWithout(found, tags) {
+  const kept = new Map([...found ?? []].filter(([kind]) => !tags.has(RUNS_CODE.get(kind).tag)))
+  return kept.size > 0 ? kept : null
+}
+
+// Its tags as a file's flags (file-flags.js), in their order, each once: a
+// warning's (`high`), or for one marked worse, `critical`; none for none.
+export const npmRunsCodeFlags = found => [...new Map([...found?.keys() ?? []].map(kind => RUNS_CODE.get(kind))
+  .map(({ tag, mark }) => [tag, { name: tag, severity: mark ?? 'high' }])).values()]
+

package/risk/files/script.js

@@ -0,0 +1,112 @@
+// How a script's text is read, for risk's readers of a file
+// (readability.js, runs-code.js, hosts.js): JavaScript's and CSS's strings,
+// regular expressions and comments, set apart from their code, what of their
+// blanks a minifier drops, which files are scripts node runs, and each
+// offset's line.
+
+// Code minified into lines shorter than NPM_LONG_LINE: outside its strings and
+// comments (`/* @__PURE__ */`), its lines average more than anyone writes and
+// next to none of its spaces are ones a minifier drops. Told only in what
+// minifiers write, as GitHub Linguist tells minified files only in JavaScript
+// and CSS, each by its strings and comments (matched in one pass, so that
+// neither starts inside the other, a comment with the spaces around it) and
+// the spaces it can do without.
+export const MINIFIED_AVERAGE = 110
+const MINIFIED_SPACES = .01
+// What a regular expression set aside holds.
+const REGEX = '\uE000'
+const JS = {
+  // A hashbang, the file's first line (`#!/usr/bin/env node`), a comment.
+  // A string's or template's escape may be a line continuation (`\` before a
+  // line break, CRLF's whole).
+  // Linear on any text: a regular expression's context looked back on only
+  // before a `/`, a comment's leading blanks taken only from where they
+  // start, and what is left open read to where it would end, a string or a
+  // regular expression its line's end, a template or a comment the text's,
+  // rather than tried again from each later quote or slash.
+  // A regular expression first where a value starts (after `=>`, `...`, an operator or a keyword, not a property: `x.default/2`, `this.#in/2`), so a quote in it (`/["']/`) starts no string.
+  stringOrComment: /((?=\/)(?<=(?:^|\.\.\.|[(,=:[!&|?{};>+\-*/%^<~]|(?<![\p{ID_Continue}$.#])(?:await|case|default|delete|do|else|extends|in|instanceof|new|of|return|throw|typeof|void|yield))[ \t]*)\/(?![/*])(?:[^/\\[\n]|\\.|\[(?:[^\]\\\n]|\\.)*(?:\]|(?=\\?$)))+(?:\/[a-z]*|(?=\\?$))|"(?:[^"\\\n]|\\(?:\r\n|[\s\S]))*(?:"|$)|'(?:[^'\\\n]|\\(?:\r\n|[\s\S]))*(?:'|$)|`(?:[^`\\]|\\(?:\r\n|[\s\S]))*(?:`|(?![\s\S])))|(?<![ \t])[ \t]*(?:\/\*[\s\S]*?(?:\*\/|(?![\s\S]))|\/\/.*|(?<![\s\S])#!.*)[ \t]*/gmu,
+  // Beside punctuation (`a, b`, `x = 1`), not between two words, as
+  // JavaScript tells a word's characters (`return a`, `var π`, `var \u03c0`),
+  droppable: /(?<![\p{ID_Continue}$\\\u200C\u200D])[ \t]+|[ \t]+(?![\p{ID_Continue}$\\\u200C\u200D])/gu,
+  // nor between two `+`, two `-` or two `/` (`a+ +b` is no `a++b`, `a/ /b/`
+  // no comment), nor after a regular expression before a word (`/a/ in b`).
+  needed: (code, index, run) => ('+-/'.includes(code[index - 1]) && code[index + run.length] === code[index - 1])
+    || (code[index - 2] === REGEX && /[\p{ID_Continue}$\\\u200C\u200D]/u.test(code[index + run.length])),
+}
+const CSS = {
+  // No `//` comments, so `url(https://…)` is code.
+  stringOrComment: /("(?:[^"\\\n]|\\.)*"|'(?:[^'\\\n]|\\.)*')|[ \t]*\/\*[\s\S]*?\*\/[ \t]*/gu,
+  // Beside braces, `;`, `,`, `>`, parentheses, after `:` (`a { color: red }`)
+  // and beside a selector's `+` or `~` (`.a + .b`), not those a selector or a
+  // value needs (`.a .b`, `1px solid #fff`, `a :hover`),
+  droppable: /(?<=[{};,:>(])[ \t]+|[ \t]+(?=[{};,>)!])|(?<=[+~])[ \t]+|[ \t]+(?=[+~])/gu,
+  // nor beside `+` or `~` in parentheses (`calc(1px + var(--x))`) or in a
+  // custom property's value, kept for a `calc()` to come (`--gap:1px + 2px`).
+  needed: (code, index, run, depth) => /[+~]/u.test(code[index - 1] + code[index + run.length])
+    && (depth > 0 || /^\s*--[^:]*:/u.test(code.slice(Math.max(...['{', ';', '}'].map(end => code.lastIndexOf(end, index))) + 1, index))),
+}
+// JavaScript's strings and regular expressions (the first group) and its
+// comments, for a reader that sets them aside (runs-code.js, hosts.js).
+export const JS_STRING_OR_COMMENT = JS.stringOrComment
+export const minifiable = path => /\.[cm]?js$/iu.test(path) ? JS : /\.css$/iu.test(path) ? CSS : null
+// How much of a text is read for how its lines are minified: their average
+// is told by as much of them, and a text of millions of lines is read no
+// further.
+const MINIFIED_READ = 4 * 1024 * 1024
+// Its code's lines' average length where they are minified into short ones,
+// else 0, told by its first MINIFIED_READ characters.
+export function minifiedAverage(whole, { stringOrComment, droppable, needed }) {
+  const text = whole.length > MINIFIED_READ ? whole.slice(0, whole.lastIndexOf('\n', MINIFIED_READ) + 1 || MINIFIED_READ) : whole
+  // Its lines of code alone, as long as what is on them: a comment set aside
+  // leaves nothing but its line breaks, a string or template `""` and its, a
+  // regular expression `/REGEX/`, so the code either side stays apart.
+  const lines = text.replaceAll(stringOrComment, (match, string) => (string === undefined ? '' : string[0] === '/' ? `/${REGEX}/` : '""') + match.replaceAll(/[^\n]/gu, ''))
+    .replaceAll(/^[ \t]+/gmu, '')
+    .split('\n').filter(line => line.trim() !== '')
+  const code = lines.join('\n'), length = code.length - (lines.length - 1)
+  // Counted by character: a run aligning `=` is as many spaces as it is wide.
+  let depth = 0, dropped = 0, scanned = 0
+  for (const { 0: run, index } of code.matchAll(droppable)) {
+    for (; scanned < index; scanned++) depth = Math.max(0, depth + (code[scanned] === '(' ? 1 : code[scanned] === ')' ? -1 : 0))
+    if (!needed(code, index, run, depth)) dropped += run.length
+  }
+  return lines.length > 0 && length > MINIFIED_AVERAGE * lines.length && dropped < MINIFIED_SPACES * length ? Math.round(length / lines.length) : 0
+}
+
+// JavaScript or TypeScript (a declaration file too, which node runs as any
+// other), or a script run by node by its hashbang (`bin/cli`, with no
+// extension).
+const SCRIPT = /\.[cm]?[jt]sx?$/iu
+const NODE_HASHBANG = /^#!.*\bnode\b/u
+// Whether a file (its path and text) is a script, as SCRIPT and NODE_HASHBANG tell.
+export const npmIsScript = (path, text) => typeof text === 'string' && (SCRIPT.test(path) || NODE_HASHBANG.test(text))
+// How many places a file is told doing a thing, the first ones, at most
+// (runs-code.js, hosts.js): a file doing it on millions of lines is told by
+// its first, and what it holds of them kept to a bound however many there
+// are.
+export const NPM_MAX_FOUND = 100
+// Every how many line breaks one is kept where lineOf counts from.
+const LINE_MARK = 1024
+// Each offset in a text as its line: one more than the line breaks before it,
+// counted on from the nearest of every LINE_MARKth, which alone are kept.
+export function lineOf(text) {
+  let marks = null
+  return offset => {
+    if (!marks) {
+      marks = []
+      for (let at = text.indexOf('\n'), count = 0; at !== -1; at = text.indexOf('\n', at + 1), count++) if (count % LINE_MARK === 0) marks.push(at)
+    }
+    let high = marks.length, low = 0
+    while (low < high) {
+      const middle = (low + high) >> 1
+      if (marks[middle] < offset) low = middle + 1
+      else high = middle
+    }
+    if (low === 0) return 1
+    let breaks = (low - 1) * LINE_MARK + 1
+    for (let at = text.indexOf('\n', marks[low - 1] + 1); at !== -1 && at < offset; at = text.indexOf('\n', at + 1)) breaks++
+    return breaks + 1
+  }
+}
+