@preventive/triage 1.0.0-alpha.37 → 1.0.0-alpha.38

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@preventive/triage",
-  "version": "1.0.0-alpha.37",
+  "version": "1.0.0-alpha.38",
   "description": "Client & relay server for triaging of automated reports",
   "license": "MIT OR Apache-2.0",
   "author": {
@@ -101,6 +101,7 @@
     "server-managed/bundle-build-diagnostics.js",
     "server-managed/bundle-build-diagnostics.d.ts",
     "server-managed/bundle-catalog.ts",
+    "server-managed/bundle-commits.ts",
     "server-managed/bundle-store.ts",
     "server-managed/bundle-summary-cache.ts",
     "server-managed/bundle.ts",
@@ -116,6 +117,7 @@
     "server-managed/db-schema.ts",
     "server-managed/db-table-names.ts",
     "server-managed/db.ts",
+    "server-managed/dependency-reviews.ts",
     "server-managed/github-app.ts",
     "server-managed/github-errors.ts",
     "server-managed/github-metadata.ts",
@@ -127,6 +129,8 @@
     "server-managed/http-response.ts",
     "server-managed/http.ts",
     "server-managed/link-reports.ts",
+    "server-managed/locked-packages.ts",
+    "server-managed/lru.ts",
     "server-managed/import-triage.ts",
     "server-managed/managed-issues.ts",
     "server-managed/management.ts",
@@ -135,7 +139,18 @@
     "server-managed/object-storage-disk.ts",
     "server-managed/object-storage-vercel.ts",
     "server-managed/index.ts",
+    "server-managed/npm-insights.ts",
+    "server-managed/npm-risk.ts",
+    "server-managed/npm-provenance.ts",
+    "server-managed/kept.ts",
+    "server-managed/npm-kept.ts",
+    "server-managed/npm-loads.ts",
+    "server-managed/npm-manifest.ts",
+    "server-managed/npm-packages.ts",
     "server-managed/package-entry-points.ts",
+    "server-managed/pretty-print.ts",
+    "server-managed/rename-diff.ts",
+    "server-managed/rename-diff-worker.js",
     "server-managed/public-workspace.ts",
     "server-managed/repo-path.ts",
     "server-managed/report-migration.ts",
@@ -148,6 +163,7 @@
     "server-managed/repository-aliases.ts",
     "server-managed/repository-discovery.ts",
     "server-managed/repository-policy.ts",
+    "server-managed/repository-risk.ts",
     "server-managed/session.ts",
     "server-managed/slugs.ts",
     "server-managed/solidity-entry-points.ts",
@@ -163,9 +179,14 @@
     "server-managed/storage-stores.ts",
     "server-managed/team-catalog.ts",
     "server-managed/team-feed.ts",
+    "server-managed/team-npm-scopes.ts",
+    "server-managed/team-app.ts",
     "server-managed/team-reports.ts",
     "server-managed/triage-response.ts",
+    "server-managed/type-only.ts",
+    "server-managed/type-only-worker.js",
     "server-managed/uploads.ts",
+    "server-managed/view-as.ts",
     "server-managed/upstream-cache.ts",
     "server-managed/workspace-shares.ts",
     "server-common/database-config.ts",
@@ -180,7 +201,13 @@
     "server-common/scan-config.ts",
     "common/bundle-commit.d.ts",
     "common/bundle-commit.js",
+    "common/bundle-compare-diff.js",
+    "common/bundle-compare-diff.d.ts",
+    "common/bundle-compare-inputs.d.ts",
+    "common/bundle-compare-inputs.js",
     "common/bundle-metadata.d.ts",
+    "common/bundle-pkg-of.d.ts",
+    "common/bundle-pkg-of.js",
     "common/bundle-metadata.js",
     "common/bundle-reasons.d.ts",
     "common/bundle-reasons.js",
@@ -188,15 +215,29 @@
     "common/bundle-sources.js",
     "common/bundle-source-links.d.ts",
     "common/bundle-source-links.js",
+    "common/bundle-sourcemap.d.ts",
+    "common/bundle-sourcemap.js",
     "common/bundle-stats.js",
     "common/bundle-tabs.js",
     "common/code-language.js",
     "common/default-scan-models.ts",
+    "common/dependency-reviews.js",
+    "common/dependency-reviews.d.ts",
     "common/finding-id.js",
+    "common/finding-duplicates.js",
+    "common/finding-filters.js",
     "common/github-pr.ts",
     "common/github-issue-labels.js",
     "common/github-issue-labels.d.ts",
+    "common/gzip.js",
+    "common/pretty-print.d.ts",
+    "common/pretty-print.js",
+    "common/line-diff.d.ts",
+    "common/line-diff.js",
+    "common/linked-workspace-groups.js",
     "common/managed/comments.ts",
+    "common/managed/npm-packages.d.ts",
+    "common/managed/npm-packages.js",
     "common/managed/permissions.ts",
     "common/managed/report-content.ts",
     "common/managed/repository-alias.ts",
@@ -205,18 +246,51 @@
     "common/managed/routes.d.ts",
     "common/managed/routes.js",
     "common/managed/scan-models.ts",
+    "common/managed/team-app.js",
+    "common/managed/team-app.d.ts",
     "common/managed/triage.ts",
+    "common/managed/upload-seal.ts",
     "common/save-error-reason.ts",
+    "common/revalidation-conflicts.js",
+    "common/revalidation-input-groups.js",
     "common/server-info.ts",
     "common/scan-server.ts",
     "common/utf8.d.ts",
     "common/utf8.js",
+    "common/workspace-app.js",
+    "common/workspace-groups.js",
+    "risk/index.js",
+    "risk/index.d.ts",
+    "risk/files/characters.js",
+    "risk/files/hosts.js",
+    "risk/files/readability.js",
+    "risk/files/runs-code.js",
+    "risk/files/script.js",
+    "risk/files/stamps.js",
+    "risk/npm/assess.js",
+    "risk/npm/combined.js",
+    "risk/npm/compare.js",
+    "risk/npm/dependencies.js",
+    "risk/npm/diff.js",
+    "risk/npm/held.js",
+    "risk/npm/files.js",
+    "risk/npm/downloads.js",
+    "risk/npm/install-scripts.js",
+    "risk/npm/malware.js",
+    "risk/npm/manifest.js",
+    "risk/npm/new-dependency.js",
+    "risk/npm/old-version.js",
+    "risk/npm/registry.js",
+    "risk/npm/release.js",
+    "risk/npm/specs.js",
+    "risk/npm/tarball.js",
     "client/dependency-paths.d.ts",
     "client/dependency-paths.js",
     "client/finding-link.js",
     "client/linked-findings.d.ts",
     "client/linked-findings.js",
     "out/brotli-fallback.js",
+    "out/chunk-*.js",
     "out/client-managed.js",
     "out/client-managed-import.js",
     "out/client-sync.js",
@@ -237,7 +311,7 @@
   ],
   "scripts": {
     "lint": "node --run lint:js && node --run lint:css && node --run lint:ts",
-    "lint:js": "oxlint -c .oxlintrc.json --ignore-pattern=ui/logs.js ./cli.js ./server.ts ./tests/ ./common/ ./server-common/ ./server-e2e/ ./server-managed/ ./client/ ./ui/ ./api/",
+    "lint:js": "oxlint -c .oxlintrc.json --ignore-pattern=ui/logs.js ./cli.js ./server.ts ./tests/ ./common/ ./server-common/ ./server-e2e/ ./server-managed/ ./client/ ./ui/ ./risk/ ./api/",
     "lint:css": "stylelint 'ui/**/*.css'",
     "lint:ts": "tsc --noEmit",
     "prepack": "node --run build",
@@ -247,14 +321,12 @@
     "server-e2e": "node server-e2e/index.ts",
     "server-managed": "node server-managed/index.ts",
     "server-managed-test": "node server-managed/test-server.ts",
-    "test": "node --js-base-64 --require=./tests/_resource-loader.js --experimental-test-module-mocks --test-timeout=120000 --test ./tests/*.test.js"
+    "test": "node --js-base-64 --require=./tests/_resource-loader.js --experimental-test-module-mocks --test-timeout=120000 --test-concurrency=$(node -p 'Math.ceil(os.availableParallelism() * 1.5)') --test ./tests/*.test.js"
   },
   "devDependencies": {
     "@electric-sql/pglite": "^0.5.8",
     "@noble/ciphers": "^2.4.0",
-    "@preventive/diff": "^1.0.1",
-    "@preventive/lockfile": "1.0.0-alpha.7",
-    "@preventive/terminal": "2.0.0-beta.2",
+    "@preventive/terminal": "2.0.0-beta.3",
     "@rray/frontend": "^1.0.0",
     "@stylistic/stylelint-plugin": "^5.3.1",
     "@types/node": "^26.6.4",
@@ -273,8 +345,17 @@
   "dependencies": {
     "@exodus/stasis": "1.0.0-beta.9",
     "@exodus/stasis-core": "1.0.0-beta.9",
+    "@preventive/compare": "^1.2.0",
+    "@preventive/diff": "^1.0.2",
+    "@preventive/lockfile": "1.0.0",
+    "@preventive/publishers": "^1.1.0",
     "@preventive/report": "1.0.0-alpha.9",
-    "@preventive/upstream": "1.0.0-alpha.12",
+    "@preventive/sourcemap": "1.0.0-alpha.1",
+    "@preventive/upstream": "1.1.0",
+    "css-tree": "^3.2.1",
+    "oxc-minify": "^0.152.0",
+    "oxc-parser": "^0.152.0",
+    "oxfmt": "^0.72.0",
     "ws": "^8.22.0"
   },
   "peerDependencies": {

package/risk/files/characters.js

@@ -0,0 +1,196 @@
+// The characters a text holds that can make it read other than it runs, or
+// hide text in it: control and bidirectional characters, and the invisible
+// characters a payload or a name no one sees can be spelled in (variation
+// selectors, Hangul fillers, tags). Shared with a code viewer that shows each
+// as a labelled box (ui/view/control-chars.js), which leaves what spells an
+// emoji, a recommended flag or a line's end as it is (passed).
+
+// What a text holds beyond printing characters and its line breaks: the C0
+// controls other than tab, line feed and carriage return, DEL, the C1
+// controls, and the bidirectional controls that can make code read other than
+// it runs ("Trojan Source"); and the invisible characters that can hide text
+// in it (invisibleCharacters), as a payload hidden in
+// variation selectors or a variable named by a Hangul filler.
+export const CONTROLS = /(?![\t\n\r])\p{Cc}|[\u202A-\u202E\u2066-\u2069]/gu
+const NON_ASCII = /\P{ASCII}/u
+
+// A file's text: `kind` 'ascii' or 'utf8', by whether it holds anything past
+// ASCII, else 'binary' (which the server tells by its bytes, sending no
+// text); `controls` the control and invisible characters a text holds, how
+// often by code point, or null for none.
+export function npmTextEncoding(text) {
+  if (typeof text !== 'string') return { kind: 'binary', controls: null }
+  const controls = new Map()
+  for (const [char] of text.matchAll(CONTROLS)) controls.set(char.codePointAt(0), (controls.get(char.codePointAt(0)) ?? 0) + 1)
+  // The invisible characters are all past ASCII: looked for in a text that
+  // has any, from its first.
+  const past = text.search(NON_ASCII)
+  if (past !== -1) for (const [code, times] of invisibleCharacters(text, past) ?? []) controls.set(code, times)
+  return { kind: past === -1 ? 'ascii' : 'utf8', controls: controls.size > 0 ? controls : null }
+}
+
+// A pictograph is an assigned one (Emoji): Extended_Pictographic also takes
+// in code points reserved for emoji to come, unassigned, each boxed itself,
+// and a joiner or selector beside one would go unseen.
+const EMOJI_BEFORE = /(?=\p{Emoji})\p{Extended_Pictographic}(?:\u{FE0F}|[\u{1F3FB}-\u{1F3FF}])?$/u
+const EMOJI_AFTER = /^(?=\p{Emoji})\p{Extended_Pictographic}/u
+const PICTOGRAPH_BEFORE = /(?=\p{Emoji})\p{Extended_Pictographic}$/u
+const KEYCAP_BASE = /^[\d#*]$/u
+const isTag = code => code >= 0xe0020 && code <= 0xe007f
+// The subdivision flags Unicode recommends (RGI), their tags spelling the
+// subdivision after a black flag: England's, Scotland's and Wales's. Others
+// show as a black flag and their tags as nothing, as a payload in them would.
+const FLAGS = new Set(['gbeng', 'gbsct', 'gbwls'])
+const tagged = (text, from, to) => to - from === 10 ? String.fromCodePoint(...Array.from({ length: 5 }, (_, i) => text.codePointAt(from + 2 * i) - 0xe0000)) : ''
+
+// Where to go on from where `code` at `at` in `text` stays text, else -1 for
+// one to show. A CR before a newline is part of the line end, as is one that
+// ends `text` where `lineEnd` says a newline follows it. A joiner between two
+// emoji joins them into one, a recommended subdivision flag's tags, up to the
+// cancel tag, name its region (FLAGS), and the text or emoji presentation
+// selector after a pictograph, or the emoji one between a keycap's digit, #
+// or * and its mark, draws it; after a letter or a digit alone it is another
+// name.
+export function passed(text, at, code, lineEnd) {
+  if (code === 0x0d && (text[at + 1] === '\n' || lineEnd && at + 1 === text.length)) return at + 1
+  if (code === 0x200d && EMOJI_BEFORE.test(text.slice(Math.max(0, at - 4), at)) && EMOJI_AFTER.test(text.slice(at + 1, at + 3))) return at + 1
+  if ((code === 0xfe0e || code === 0xfe0f) && PICTOGRAPH_BEFORE.test(text.slice(Math.max(0, at - 2), at))) return at + 1
+  if (code === 0xfe0f && KEYCAP_BASE.test(text[at - 1] ?? '') && text[at + 1] === '\u20E3') return at + 1
+  if (isTag(code) && !isTag(text.codePointAt(at - 2))) {
+    let end = at
+    while (isTag(text.codePointAt(end))) end += 2
+    if (text.codePointAt(at - 2) === 0x1f3f4 && text.codePointAt(end - 2) === 0xe007f && FLAGS.has(tagged(text, at, end - 2))) return end
+  }
+  return -1
+}
+
+// Those text is hidden in, as a file's Invisible chars label counts them
+// (readability.js), where they show: variation selectors (a payload, a
+// byte a selector), Hangul fillers (a name no one sees) and tags (ASCII no one
+// sees). Not the format characters, a BOM or a zero-width space, which text
+// has its uses for, nor the other marks that show as nothing (the combining
+// grapheme joiner, the Khmer inherent vowels and the Mongolian free variation
+// selectors), which tables of the characters a name may hold, as JavaScript
+// parsers have, hold too; nor what of these hides nothing (benign).
+const INVISIBLE = /[\u115F\u1160\u3164\uFFA0\u{E0001}\u{E0020}-\u{E007F}]|[\uFE00-\uFE0F]|[\u{E0100}-\u{E01EF}]/u
+// The code units they are in, to look for them by, faster than by code point:
+// the high surrogate starting those past the Basic Multilingual Plane (tags,
+// the selectors' supplement) too, told apart from its others once found. No
+// `u`, which would read a pair as the one code point it spells.
+// eslint-disable-next-line require-unicode-regexp
+const INVISIBLE_UNITS = /[\uFE00-\uFE0F\u115F\u1160\u3164\uFFA0\uDB40]/g
+// A table's code points, from its ranges in hex (`30 2018-2019`).
+const codePoints = ranges => new Set(ranges.split(' ').flatMap(range => {
+  const [from, to = from] = range.split('-').map(digits => Number.parseInt(digits, 16))
+  return Array.from({ length: to - from + 1 }, (_, i) => from + i)
+}))
+// The variation sequences Unicode registers, which hide nothing, though Code
+// shows their selectors after a letter or a digit, another name there: VS1 to
+// VS14's on other than an ideograph (StandardizedVariants.txt, Unicode
+// 18.0.0), each selector's bases, as an HTML entity table's math symbols, and
+// the emoji with a text and an emoji presentation, VS15 and VS16 after each
+// (emoji-variation-sequences.txt), as a heading's anchor keeps one (`#`).
+const STANDARDIZED = new Map([
+  [0xfe00, '30 1000 1002 1004 1010-1011 1015 1019-101a 101c-101d 1022 1031 1075'
+    + ' 1078 107a 1080 2018-2019 201c-201d 210b 2110 2112 211b 212c 2130-2131'
+    + ' 2133 2205 2229-222a 223d 2242-2243 2248 2268-2269 2272-2273 228a-228b'
+    + ' 2293-2295 2297 229c 22cd 22da-22dd 29b7 2a3c-2a3d 2a6c 2a9d-2a9e'
+    + ' 2aac-2aad 2acb-2acc 3001-3002 31c0 31c6 31c9 31cf-31d2 31d4-31d5 31d7'
+    + ' 31db-31dd 31e5 a856 a85c a85e-a860 a868 aa60-aa66 aa6b-aa6c aa6f aa7a'
+    + ' ff01 ff0c ff0e ff10 ff1a-ff1b ff1f 10ac5-10ac6 10ad6-10ad7 10ae1 13091'
+    + ' 1310f 1311c 13121 13127 13139 131a0 131b1 131b8-131b9 131cb 131e0'
+    + ' 131f9-131fa 1327b 1327f 13285 1328c 132aa 132cb 132dc 132e7 13307'
+    + ' 1331b 13322 1333c 13377-13378 13399-1339a 133d3 133e4-133e5 133e7'
+    + ' 133ee 133f2 133f5-133f6 13416 13419-1341a 13423 13443-13446'
+    + ' 13be8-13bea 13f72 1d49c 1d49e-1d49f 1d4a2 1d4a5-1d4a6 1d4a9-1d4ac'
+    + ' 1d4ae-1d4b5 1db10'],
+  [0xfe01, '2018-2019 201c-201d 210b 2110 2112 211b 212c 2130-2131 2133 3001-3002'
+    + ' 31c6 31cf 31dd ff01 ff0c ff0e ff1a-ff1b ff1f 13093 13132 13139 13187'
+    + ' 131b1 131ee 131f8-131fa 13257 1327f 1328b 132a4 13308 13312-13314'
+    + ' 1331b 13321-13322 13331 133e8 13419 13f1f 14274 1d49c 1d49e-1d49f'
+    + ' 1d4a2 1d4a5-1d4a6 1d4a9-1d4ac 1d4ae-1d4b5'],
+  [0xfe02, '2018-2019 201c-201d 13117 13139 13183 131a0 131ba 131ee 13216 1327b'
+    + ' 132a4 132e7 132e9 132f8 132fd 13302-13303 13310-13314 1331c 13321'
+    + ' 13331 1334a 13361 13373 1337d 13385 133af-133b0 133bf 133db 133dd'
+    + ' 13419 1342c 1342e 14274 1d4cf'],
+  [0xfe03, '13012 130b8 130ba 1310f 1312f 13139 13184 1319c-1319d 1319f 131b1'
+    + ' 131db 13205 13296 13338 13419'],
+  [0xfe04, '13139 1340d'],
+  [0xfe05, '13139 14274'],
+  [0xfe06, '1312f 13139 13184 131db 131ee 13205 132a4 132e9 1332b 13338'
+    + ' 13370-13371 13419 14274'],
+].map(([selector, bases]) => [selector, codePoints(bases)]))
+const EMOJI = codePoints('23 2a 30-39 a9 ae 203c 2049 2122 2139 2194-2199 21a9-21aa 231a-231b 2328'
+  + ' 23cf 23e9-23f3 23f8-23fa 24c2 25aa-25ab 25b6 25c0 25fb-25fe 2600-2604 260e'
+  + ' 2611 2614-2615 2618 261d 2620 2622-2623 2626 262a 262e-262f 2638-263a 2640'
+  + ' 2642 2648-2653 265f-2660 2663 2665-2666 2668 267b 267e-267f 2692-2697 2699'
+  + ' 269b-269c 26a0-26a1 26a7 26aa-26ab 26b0-26b1 26bd-26be 26c4-26c5 26c8'
+  + ' 26ce-26cf 26d1 26d3-26d4 26e9-26ea 26f0-26f5 26f7-26fa 26fd 2702 2705'
+  + ' 2708-270d 270f 2712 2714 2716 271d 2721 2728 2733-2734 2744 2747 274c 274e'
+  + ' 2753-2755 2757 2763-2764 2795-2797 27a1 27b0 27bf 2934-2935 2b05-2b07'
+  + ' 2b1b-2b1c 2b50 2b55 3030 303d 3297 3299 1f004 1f170-1f171 1f17e-1f17f'
+  + ' 1f202 1f21a 1f22f 1f237 1f30d-1f30f 1f315 1f31c 1f321 1f324-1f32c 1f336'
+  + ' 1f378 1f37d 1f393 1f396-1f397 1f399-1f39b 1f39e-1f39f 1f3a7 1f3ac-1f3ae'
+  + ' 1f3c2 1f3c4 1f3c6 1f3ca-1f3ce 1f3d4-1f3e0 1f3ed 1f3f3 1f3f5 1f3f7 1f408'
+  + ' 1f415 1f41f 1f426 1f43f 1f441-1f442 1f446-1f449 1f44d-1f44e 1f453 1f46a'
+  + ' 1f47d 1f4a3 1f4b0 1f4b3 1f4bb 1f4bf 1f4cb 1f4da 1f4df 1f4e4-1f4e6'
+  + ' 1f4ea-1f4ed 1f4f7 1f4f9-1f4fb 1f4fd 1f508 1f50d 1f512-1f513 1f549-1f54a'
+  + ' 1f550-1f567 1f56f-1f570 1f573-1f579 1f587 1f58a-1f58d 1f590 1f5a5 1f5a8'
+  + ' 1f5b1-1f5b2 1f5bc 1f5c2-1f5c4 1f5d1-1f5d3 1f5dc-1f5de 1f5e1 1f5e3 1f5e8'
+  + ' 1f5ef 1f5f3 1f5fa 1f610 1f687 1f68d 1f691 1f694 1f698 1f6ad 1f6b2'
+  + ' 1f6b9-1f6ba 1f6bc 1f6cb 1f6cd-1f6cf 1f6e0-1f6e5 1f6e9 1f6f0 1f6f3')
+// The blocks of variation selectors, as those tables write them out as ranges.
+const BLOCKS = [[0xfe00, 0xfe0f], [0xe0100, 0xe01ef]]
+// The compatibility jamo but their filler.
+const JAMO = [[0x3131, 0x3163], [0x3165, 0x318e]]
+
+// The code point before `at` in `text`, a pair of surrogates read as one.
+function codePointBefore(text, at) {
+  if (at === 0) return undefined
+  const pair = at >= 2 ? text.codePointAt(at - 2) : 0
+  return pair > 0xffff ? pair : text.codePointAt(at - 1)
+}
+const within = (code, ...ranges) => code !== undefined && ranges.some(([from, to]) => code >= from && code <= to)
+
+// Whether the one shown as `code` at `at` hides nothing: a Hangul filler
+// composing Hangul (the initial consonant's before a vowel, a syllable with
+// none, or the vowel's after an initial consonant, one with none), or a
+// compatibility or halfwidth jamo's among those jamo, as a codepage's table
+// lists them, though not one after a syllable, a name that reads as it; a
+// variation sequence Unicode registers; a block of selectors written out as a
+// range in a table (`VS1-VS16`); or an emoji's presentation selector doubled,
+// as copying text leaves it.
+function benign(text, at, code) {
+  const end = at + (code > 0xffff ? 2 : 1)
+  const after = text.codePointAt(end), before = codePointBefore(text, at)
+  switch (code) {
+    case 0x115f: return within(after, [0x1161, 0x11a7], [0xd7b0, 0xd7c6])
+    case 0x1160: return within(before, [0x1100, 0x115e], [0xa960, 0xa97c])
+    case 0x3164: return within(before, ...JAMO) || within(after, ...JAMO)
+    case 0xffa0: return within(before, [0xffa1, 0xffdc]) || within(after, [0xffa1, 0xffdc])
+    default: return (code === 0xfe0e || code === 0xfe0f ? EMOJI.has(before) : STANDARDIZED.get(code)?.has(before))
+      || BLOCKS.some(([from, to]) => code === from && text[end] === '-' && text.codePointAt(end + 1) === to
+        || code === to && text[at - 1] === '-' && codePointBefore(text, at - 1) === from)
+      || (code === 0xfe0e || code === 0xfe0f) && before === code && PICTOGRAPH_BEFORE.test(text.slice(Math.max(0, at - 3), at - 1))
+  }
+}
+
+// How many of each a text holds, by code point, or null for none: each one
+// a code viewer shows (passed), visited alone, not each character it shows. `from`:
+// where to look from, as the first character past ASCII, since all of them are.
+export function invisibleCharacters(text, from = 0) {
+  let found = null
+  INVISIBLE_UNITS.lastIndex = from
+  for (let match = INVISIBLE_UNITS.exec(text); match; match = INVISIBLE_UNITS.exec(text)) {
+    const at = match.index, code = text.codePointAt(at)
+    if (!INVISIBLE.test(String.fromCodePoint(code))) continue
+    const next = passed(text, at, code, false)
+    if (next !== -1) INVISIBLE_UNITS.lastIndex = next
+    else if (!benign(text, at, code)) {
+      found ??= new Map()
+      found.set(code, (found.get(code) ?? 0) + 1)
+    }
+  }
+  return found
+}
+

package/risk/files/hosts.js

@@ -0,0 +1,205 @@
+// The hosts a version's code names, and the services malicious packages send
+// what they take to, fetch what they run from or look the machine up with,
+// for a reviewer: the hosts a version's scripts name that the version
+// compared with's named in none of theirs, and the services a file names,
+// under a tag for how much they call for (HOST_TAGS: Exfiltration, Remote,
+// IP lookup), as a file's stamps say (stamps.js).
+//
+// A quick read, not a parse, as runs-code.js reads: a host is a URL's in a
+// script's strings, regular expressions and template literals
+// (JS_STRING_OR_COMMENT), its comments aside, where a link to docs is no host
+// the code calls; an exfiltration host is told in any text but prose and a
+// source map, wherever it is written. A host built as the code runs
+// (`'https://' + name`, `${host}`) goes unseen, so a version without these
+// labels is not one that sends nothing.
+import { NPM_PROSE, SOURCE_MAP } from './readability.js'
+import { JS_STRING_OR_COMMENT, NPM_MAX_FOUND, lineOf, npmIsScript } from './script.js'
+
+// How many hosts a file is told naming at most, the first it names.
+const NPM_MAX_HOSTS = 1000
+
+// A URL's host: a name whose last label is letters (an internationalized
+// one's too, as written or as punycode), or an IPv4 address, after its
+// scheme, as a regular expression may leave its `s` optional (`https?://`),
+// and any user, its case aside; whole, not the start of one built as the code
+// runs (`api.service.com.${tld}`).
+const LABEL = String.raw`[\p{L}\p{N}](?:[\p{L}\p{N}-]*[\p{L}\p{N}])?`
+const URL_HOST = new RegExp(String.raw`\b(?:https?|wss?|ftp)\??:\/\/(?:[^\s/@'"\x60]*@)?(${LABEL}(?:\.${LABEL})+)(?![\p{L}\p{N}-]|\.[\p{L}\p{N}_$-])`, 'giu')
+const NAMED = /\.(?:\p{L}{2,}|xn--[a-z0-9-]+)$/u
+const IPV4 = /^(?:(?:25[0-5]|2[0-4]\d|1?\d?\d)\.){3}(?:25[0-5]|2[0-4]\d|1?\d?\d)$/u
+// Hosts no code calls out to: this machine, the names kept for examples and
+// tests (RFC 2606, RFC 6761) and local networks, and W3C's, whose URLs name
+// XML namespaces.
+const LOCAL = /^(?:localhost|.+\.(?:localhost|local|test|invalid|example|internal)|(?:.+\.)?example\.(?:com|net|org)|127(?:\.\d+){3}|0\.0\.0\.0|(?:.+\.)?w3\.org)$/u
+
+// What a regular expression escapes in a URL, its slashes and dots
+// (`/https:\/\/api\.example\.com/`), as a string may its slashes
+// (`"https:\/\/api.example.com"`, as JSON can be written), read unescaped.
+const ESCAPED = /\\([/.])/gu
+
+// The pages github.com shows of a repository that a person reads, past its
+// owner and name, as links and error messages name them: not its Actions,
+// whose runs' artifacts and logs are downloads of what its workflows made.
+const GITHUB_PAGES = new Set(['issues', 'pull', 'pulls', 'blob', 'tree', 'wiki', 'discussions', 'commit', 'commits', 'compare', 'blame',
+  'security', 'projects', 'labels', 'milestone', 'milestones', 'releases', 'tags', 'graphs', 'network', 'stargazers'])
+// The paths past github.com that name no repository but a page of GitHub's
+// own (`github.com/sponsors/someone`, `github.com/orgs/someone/people`).
+const GITHUB_OWN = new Set(['sponsors', 'orgs', 'apps', 'marketplace', 'features', 'topics', 'collections', 'settings', 'login', 'search', 'explore', 'about'])
+// How a github.com URL (`url`, as written from its scheme on, the punctuation
+// a sentence ends it with aside) is named among a file's hosts, read as fetch
+// reads it (WHATWG URL: a port, a trailing dot, backslashes as slashes, `..`
+// resolved): `github.com` for its home or a person's, a page of GitHub's own
+// (GITHUB_OWN), a page of a repository a person reads (GITHUB_PAGES), a
+// release's page (`releases/tag/v1`, `releases/latest`) but not its assets'
+// (`releases/latest/download/…`), a file's page but not the file raw
+// (`blob/…?raw=true`, any `raw` asked), and a page but not its content in another format, as
+// GitHub serves one by a suffix to its path past a file's (`pull/1.patch`,
+// `commit/….diff`, `commits/main.atom`). Any other (a repository's own URL,
+// which git clones, `raw/…`, `archive/…`, `tarball`, `repo.git`, a path GitHub
+// may add, one read otherwise) leads to whatever a repository holds: named by
+// it (`github.com/owner/repo`, in lower case, as GitHub's names are any), so
+// that it is never taken for one of github.com's links to code and docs
+// (compare.js ALLOWED_HOSTS).
+const FILE_PATHS = new Set(['blob', 'tree', 'blame', 'wiki'])
+const FORMAT = /\.(?:patch|diff|atom)$/iu
+const GIT = /\.git$/iu
+const decoded = part => { try { return decodeURIComponent(part) } catch { return part } }
+function githubNamed(url) {
+  let parsed = null
+  try { parsed = new URL(url.replace(/^(\w+)\?:/u, '$1:').replace(/[)\]}>.,;:!]+$/u, '')) } catch {}
+  if (!parsed) return 'github.com/'
+  // Its path and query decoded, as GitHub routes them (`pull/1%2Epatch`,
+  // `?raw=%31`).
+  const segments = parsed.pathname.split('/').slice(1).map(decoded)
+  if (segments.length > 1 && segments.at(-1) === '') segments.pop()
+  const [owner, repo = '', section, ...rest] = segments
+  const repositoryPage = owner !== '' && repo !== '' && !GIT.test(repo) && GITHUB_PAGES.has(section)
+    && !(section === 'releases' && rest.includes('download')) && !(section === 'blob' && parsed.searchParams.has('raw'))
+    && !(!FILE_PATHS.has(section) && FORMAT.test(segments.at(-1)))
+  const page = parsed.hostname.replace(/\.$/u, '') === 'github.com' && (segments.length === 1 || GITHUB_OWN.has(owner) || repositoryPage)
+  return page ? 'github.com' : `github.com/${owner}/${repo.replace(GIT, '')}`.toLowerCase()
+}
+
+// The hosts a script's strings name, each with the line it is first named on,
+// in the order named, NPM_MAX_HOSTS at most; null for none, or for a file
+// that is no script.
+export function npmHosts(path, text) {
+  if (!npmIsScript(path, text) || !(text.includes('://') || text.includes(':\\/\\/'))) return null
+  const hosts = new Map(), line = lineOf(text)
+  for (const { 1: token, index } of text.matchAll(JS_STRING_OR_COMMENT)) {
+    if (hosts.size >= NPM_MAX_HOSTS) break
+    // Read unescaped, its offsets as near: on the same line but in a template
+    // across lines; a regular expression without its closing slash and flags,
+    // as a string's quote ends its URL (`/https:\/\/github.com\/a\/b\/pull\/1.patch/i`).
+    const body = token?.startsWith('/') ? token.replace(/\/[a-z]*$/u, '') : token
+    const string = body?.includes('\\') ? body.replaceAll(ESCAPED, '$1') : body
+    if (!string?.includes('://')) continue
+    for (const { 1: name, index: at } of string.matchAll(URL_HOST)) {
+      const host = name.toLowerCase()
+      const named = host === 'github.com' ? githubNamed(/^[^\s'"\u0060]*/u.exec(string.slice(at))[0]) : host
+      if (!hosts.has(named) && (NAMED.test(host) || IPV4.test(host)) && !LOCAL.test(host)) hosts.set(named, line(index + at))
+      if (hosts.size >= NPM_MAX_HOSTS) break
+    }
+  }
+  return hosts.size > 0 ? hosts : null
+}
+
+// A host as it is written, under another or not (`m.webhook.site`), then a
+// path on it where only that path is the service (`/api/webhooks`), on its
+// own: not part of a longer name (`notwebhook.site`, `webhook.sites`), a
+// name under another domain (`webhook.site.evil.example`, `webhook.site.рф`),
+// nor another path (`/install.sh`, `/api/webhooks.json`), though a sentence
+// may end after it. Its name first, so a text is searched for that alone.
+const NAME_CHAR = String.raw`[\p{L}\p{N}_-]`
+const host = (name, path = '') => new RegExp(String.raw`(?<!${NAME_CHAR})${name}${path}(?!\.?${NAME_CHAR})`, 'giu')
+// One so like a file's name or code (`transfer.sh`, `file.io`) only as a
+// URL's host: after the `//` that starts its authority (or `\/\/` as JSON can
+// write it), where the URL starts, its scheme as URL_HOST takes one after the
+// text's start, a blank, a quote, `(`, `=`, `,`, `<` or `>`, or without one
+// after a quote, `(`, `=` or `,` (`"//file.io/x"`): not a URL's path, whatever
+// it holds (`https://example.com/a//transfer.sh`, `/http://transfer.sh`); and
+// after any user, not a user itself (`https://transfer.sh@example.com`).
+const inUrl = name => new RegExp(String.raw`(?<=(?:(?:^|[\s'"\x60(=,<>])(?:https?|wss?|ftp)\??:|['"\x60(=,])\\?\/\\?\/(?:[^\s/@'"\x60]*@)?(?:${NAME_CHAR}+\.)*)${name}(?!\.?${NAME_CHAR}|(?::[^\s/@'"\x60]*)?@)`, 'giu')
+// The tags the services go under, each with its severity (stamps.js
+// SEVERITIES), as a change between versions raises it (npmHostSeverity):
+// Exfiltration, `critical` (red), where nothing but catching what is sent
+// has a use for it in a package's code; Remote, `high` (orange), where it
+// could be fine; and IP lookup, `moderate` (yellow), where it usually is.
+export const HOST_TAGS = new Map([['Exfiltration', 'critical'], ['Remote', 'high'], ['IP lookup', 'moderate']])
+const [CATCHER, REMOTE, IP_LOOKUP] = [...HOST_TAGS.keys()].map(tag => ({ tag }))
+// Services malicious packages send what they take to, fetch what they run
+// from, or look the machine up with, each under its tag. Exfiltration's:
+// request catchers, and out-of-band testing hosts (interactsh's, Burp
+// Collaborator's, Canarytokens', DNS logs). Remote's: bot and webhook APIs,
+// paste sites and file drops, tunnels, Pipedream's own API (its endpoints
+// are `pipedream.net`), and the install script of Bun (`bun.sh/install`, now
+// `bun.com/install`), which a worm ran its payload with. And IP lookups.
+export const EXFILTRATION = new Map([
+  ['webhook-site', { ...CATCHER, name: 'webhook.site', pattern: host(String.raw`webhook\.site`) }],
+  ['pipedream', { ...CATCHER, name: 'Pipedream', pattern: host(String.raw`pipedream\.net`) }],
+  ['requestbin', { ...CATCHER, name: 'RequestBin', pattern: host(String.raw`(?:requestbin\.(?:net|com)|requestb\.in)`) }],
+  ['requestcatcher', { ...CATCHER, name: 'Request Catcher', pattern: host(String.raw`requestcatcher\.com`) }],
+  ['requestrepo', { ...CATCHER, name: 'requestrepo', pattern: host(String.raw`requestrepo\.com`) }],
+  ['beeceptor', { ...CATCHER, name: 'Beeceptor', pattern: host(String.raw`beeceptor\.com`) }],
+  ['oast', { ...CATCHER, name: 'OAST', pattern: host(String.raw`(?:interact\.sh|interactsh\.com|oast\.(?:pro|live|site|online|fun|me)|oastify\.com|burpcollaborator\.net)`) }],
+  ['canarytokens', { ...CATCHER, name: 'Canarytokens', pattern: host(String.raw`canarytokens\.(?:com|org)`) }],
+  ['dnslog', { ...CATCHER, name: 'DNSLog', pattern: host(String.raw`dnslog\.cn`) }],
+  ['ceye', { ...CATCHER, name: 'CEYE', pattern: host(String.raw`ceye\.io`) }],
+  ['telegram', { ...REMOTE, name: 'Telegram', pattern: host(String.raw`api\.telegram\.org`) }],
+  ['discord', { ...REMOTE, name: 'Discord webhook', pattern: host(String.raw`discord(?:app)?\.com`, String.raw`/api(?:/v\d+)?/webhooks`) }],
+  ['slack', { ...REMOTE, name: 'Slack webhook', pattern: host(String.raw`hooks\.slack\.com`, '/(?:services|workflows|triggers)') }],
+  ['pastebin', { ...REMOTE, name: 'Pastebin', pattern: host(String.raw`pastebin\.com`) }],
+  ['paste-ee', { ...REMOTE, name: 'paste.ee', pattern: host(String.raw`paste\.ee`) }],
+  ['transfer-sh', { ...REMOTE, name: 'transfer.sh', pattern: inUrl(String.raw`transfer\.sh`) }],
+  ['file-io', { ...REMOTE, name: 'file.io', pattern: inUrl(String.raw`file\.io`) }],
+  ['0x0', { ...REMOTE, name: '0x0.st', pattern: host(String.raw`0x0\.st`) }],
+  ['ngrok', { ...REMOTE, name: 'ngrok', pattern: host(String.raw`ngrok(?:-free)?\.(?:io|app|dev)`) }],
+  ['localtunnel', { ...REMOTE, name: 'localtunnel', pattern: host(String.raw`loca\.lt`) }],
+  ['cloudflare-tunnel', { ...REMOTE, name: 'Cloudflare Tunnel', pattern: host(String.raw`trycloudflare\.com`) }],
+  ['serveo', { ...REMOTE, name: 'Serveo', pattern: host(String.raw`serveo\.net`) }],
+  ['pipedream-api', { ...REMOTE, name: 'Pipedream API', pattern: host(String.raw`pipedream\.com`) }],
+  ['bun', { ...REMOTE, name: 'Bun install', pattern: host(String.raw`bun\.(?:sh|com)`, '/install') }],
+  ['ipinfo', { ...IP_LOOKUP, name: 'ipinfo', pattern: host(String.raw`ipinfo\.io`) }],
+  ['ipify', { ...IP_LOOKUP, name: 'ipify', pattern: host(String.raw`ipify\.org`) }],
+  ['ifconfig-me', { ...IP_LOOKUP, name: 'ifconfig.me', pattern: host(String.raw`ifconfig\.me`) }],
+  ['icanhazip', { ...IP_LOOKUP, name: 'icanhazip', pattern: host(String.raw`icanhazip\.com`) }],
+  ['ip-api', { ...IP_LOOKUP, name: 'ip-api', pattern: host(String.raw`ip-api\.com`) }],
+  ['ipapi', { ...IP_LOOKUP, name: 'ipapi', pattern: host(String.raw`ipapi\.com?`) }],
+  ['checkip', { ...IP_LOOKUP, name: 'checkip', pattern: host(String.raw`checkip\.amazonaws\.com`) }],
+])
+// Any of them, as a text may say it: most say none, told at once.
+const SAYS_ANY = new RegExp([...EXFILTRATION.values()].map(({ pattern }) => pattern.source).join('|'), 'iu')
+
+// The services a file names, each with the lines it is named on, the first
+// NPM_MAX_FOUND, in EXFILTRATION's order; null for none, or for prose or a
+// source map.
+export function npmExfiltration(path, text) {
+  if (typeof text !== 'string' || NPM_PROSE.test(path) || SOURCE_MAP.test(path) || !SAYS_ANY.test(text)) return null
+  const found = new Map(), line = lineOf(text)
+  for (const [service, { pattern }] of EXFILTRATION) {
+    const lines = new Set()
+    for (const { index } of text.matchAll(pattern)) if (lines.add(line(index)).size >= NPM_MAX_FOUND) break
+    if (lines.size > 0) found.set(service, [...lines])
+  }
+  return found.size > 0 ? found : null
+}
+
+// The services of `found` under `tag` (HOST_TAGS), in their order; null for
+// none.
+export function npmHostsTagged(found, tag) {
+  const tagged = found && new Map([...found].filter(([service]) => EXFILTRATION.get(service).tag === tag))
+  return tagged?.size > 0 ? tagged : null
+}
+
+// The services a file names (`found`) by their tag, in HOST_TAGS' order:
+// `[tag, services]` each.
+export const npmHostTags = found => [...HOST_TAGS.keys()].map(tag => [tag, npmHostsTagged(found, tag)]).filter(([, services]) => services)
+
+// How severe a tag's `services` are: its own severity, or with `was` (null for
+// a file that held none), where one of them the file didn't name, a level
+// higher, never past `critical`, as a change between versions calls for more.
+export function npmHostSeverity(tag, services, was) {
+  const levels = [...HOST_TAGS.values()]
+  const at = levels.indexOf(HOST_TAGS.get(tag))
+  return levels[was !== undefined && [...services.keys()].some(service => !was?.has(service)) ? Math.max(0, at - 1) : at]
+}