@preventive/triage 1.0.0-alpha.37 → 1.0.0-alpha.38

package/risk/npm/malware.js

@@ -0,0 +1,36 @@
+// What tells of malware in a version: npm's security team taking its package
+// down, whatever version is asked, as it does for malicious code; and an
+// advisory of malware naming the version, npm's or OSV's (registry.js
+// npmVersionAdvisories).
+
+// Whether an advisory is of malware rather than a vulnerability: OSV's of the
+// malicious packages OpenSSF lists, each `MAL-…`, or one such a record names
+// (its `aliases`, as upstream's `osv` gives npm's advisory it names); GitHub
+// files its malware advisories as CWE-506, embedded malicious code, whatever
+// their title ("Critical severity vulnerability that affects event-stream
+// and flatmap-stream"); and its title may say so where its CWE doesn't
+// (@solana/web3.js's GHSA-jcxm-7wvp-g6p5, CWE-200 alone).
+export const npmMalwareAdvisory = ({ id, aliases, cwe, title }) => [id, ...aliases ?? []].some(name => (name ?? '').startsWith('MAL-'))
+  || (cwe ?? []).includes('CWE-506') || /\bmalware\b/iu.test(title ?? '')
+
+// Whether `json`, a version's document, is the placeholder npm publishes in
+// place of a package its security team took down: a "security holding
+// package" from npm/security-holder, published by npm, the account npm's
+// registry names as its publisher, which no package's author can. Not one
+// by another account, such as the `0.0.1-security` versions 2017's hacktask
+// typosquats are listed as theirs, each npm's own `0.0.2-security` after it.
+export function npmPlaceholder(json) {
+  const repository = typeof json?.repository === 'string' ? json.repository : json?.repository?.url
+  const npms = json?.description === 'security holding package' || /(?:^|[/:])npm\/security-holder(?:\.git)?\/?$/iu.test(typeof repository === 'string' ? repository : '')
+  return npms && json?._npmUser?.name === 'npm'
+}
+
+// The `malware` finding of a version, critical: its package taken down by npm
+// (`takenDown`, its latest version npm's placeholder), and the advisories of
+// malware among `advisories` (`{ id, url?, title?, cwe }`), each `{ id, url?,
+// title? }` once; null for neither.
+export function npmMalwareFinding({ takenDown, advisories }) {
+  const named = new Map(advisories.filter(npmMalwareAdvisory).map(({ id, url, title }) => [id, { id, ...url ? { url } : {}, ...title ? { title } : {} }]))
+  if (!takenDown && named.size === 0) return null
+  return { id: 'malware', severity: 'critical', ...takenDown ? { takenDown: true } : {}, ...named.size > 0 ? { advisories: [...named.values()] } : {} }
+}

package/risk/npm/manifest.js

@@ -0,0 +1,65 @@
+// What risk reads of a version from npm's version document, as the npm viewer
+// is served it (server-managed/npm-packages.ts npmManifest): the npm account
+// that published it, or the CI that did by npm's trusted publishing, which of
+// its accounts are known to publish (@preventive/publishers), whether npm
+// keeps a provenance statement for it, the scripts npm runs installing it,
+// its dependencies, and its deprecation; and whether a package's scope is one
+// of npm's most downloaded packages'.
+import publishers from '@preventive/publishers/npm.js'
+import scopes from '@preventive/publishers/npm-scopes.js'
+import { INSTALL_SCRIPTS } from './install-scripts.js'
+
+const NPM_ACCOUNT = /^[\w.-]{1,214}$/u
+// The npm accounts known to publish: those with standing on one of npm's
+// most downloaded packages.
+const KNOWN_PUBLISHERS = new Set(publishers.map(name => name.toLowerCase()))
+// The scopes of npm's most downloaded packages, which only their owners, an
+// npm organization or account, publish in; and those accounts' own, by
+// scope: npm's accounts and organizations share one namespace, so `@name` is
+// the account `name`'s.
+const KNOWN_SCOPES = new Set(scopes)
+const PUBLISHER_SCOPES = new Map(publishers.map(name => [`@${name.toLowerCase()}`, name]))
+
+// A package's scope where it is known: one of npm's most downloaded
+// packages' (`{ scope }`, `@babel` of `@babel/core`), or else a known
+// publisher's own (`{ scope, account }`, `@sindresorhus` of
+// `@sindresorhus/is`); else null.
+export function npmKnownScope(name) {
+  const scope = name.startsWith('@') ? name.slice(0, name.indexOf('/')) : null
+  if (!scope) return null
+  if (KNOWN_SCOPES.has(scope)) return { scope }
+  const account = PUBLISHER_SCOPES.get(scope)
+  return account ? { scope, account } : null
+}
+const plainObject = value => Boolean(value) && typeof value === 'object' && !Array.isArray(value)
+const stringRecord = value => plainObject(value) ? Object.fromEntries(Object.entries(value).filter(([, item]) => typeof item === 'string')) : undefined
+
+// One of package.json's people's name: `{ name }`, or `Name <email> (url)` in
+// one string.
+function personName(value) {
+  const text = part => typeof part === 'string' && part.trim() !== '' ? part.trim() : null
+  if (plainObject(value)) return text(value.name)
+  return typeof value === 'string' ? text(/^([^<(]*)/u.exec(value)?.[1]) : null
+}
+
+// A version document's manifest, as risk reads it: `publisher` (or
+// `trustedPublisher`), `knownAccounts`, `provenance`, `installScripts`,
+// `dependencies`, `peerDependencies` and `optionalDependencies`, and
+// `deprecated`, each where it has one.
+export function npmVersionManifest(json) {
+  const pick = {}
+  if (typeof json?.deprecated === 'string') pick.deprecated = json.deprecated
+  const publisher = personName(json?._npmUser)
+  if (publisher && NPM_ACCOUNT.test(publisher)) pick.publisher = publisher
+  else if (publisher && publisher.length <= 64 && plainObject(json._npmUser.trustedPublisher)) pick.trustedPublisher = publisher
+  if (pick.publisher && KNOWN_PUBLISHERS.has(pick.publisher.toLowerCase())) pick.knownAccounts = [pick.publisher]
+  for (const key of ['dependencies', 'peerDependencies', 'optionalDependencies']) {
+    const record = stringRecord(json?.[key])
+    if (record && Object.keys(record).length > 0) pick[key] = record
+  }
+  if (plainObject(json?.dist) && plainObject(json.dist.attestations) && plainObject(json.dist.attestations.provenance)) pick.provenance = true
+  const scripts = stringRecord(json?.scripts)
+  const install = scripts ? INSTALL_SCRIPTS.filter(script => script in scripts) : []
+  if (install.length > 0) pick.installScripts = Object.fromEntries(install.map(script => [script, scripts[script]]))
+  return pick
+}

package/risk/npm/new-dependency.js

@@ -0,0 +1,30 @@
+// What risk tells of a dependency a version adds, by its package: its tier by
+// its downloads, its latest two weeks' left out (downloads.js
+// npmSettledDownloads), as a package a release just pulled in, as a
+// compromised one depending on it would, could owe those to that release
+// alone; and below the top 20,000, how old the package was where it didn't
+// exist when the version compared with was published, as plain-crypto-js
+// was eighteen hours old when axios 1.14.1 was published depending on it.
+import { npmDownloadTier, npmSettledDownloads, npmTierLow } from './downloads.js'
+
+// A dependency added, from its package's facts so far: `downloads`, npm's
+// count of them (null where npm counts none, as it counts none of a package's
+// until the day after it was first published, nor any of a private one's);
+// `listed`, once its version list is read, `{ created, private }`, when its
+// first version was published and whether only a token reads it; and
+// `published`, when the version compared with and the open one were. Its
+// `tier` (Infinity, unpopular, where npm counts none of a public package's;
+// null where it can't yet be told), whether its version list is `wanted` to
+// tell more (below the top 20,000, or none counted), and `created`, `gap`
+// where its package is new since the version compared with: when its first
+// version was published, and how long before the open version that was
+// (negative for after, as a name someone took once a release named it).
+export function npmAddedDependency({ downloads, listed = null, published = [] }, now = Date.now()) {
+  const settled = npmSettledDownloads(downloads, now)
+  const counted = settled ? npmDownloadTier(settled) : null
+  const wanted = !settled || (counted !== null && npmTierLow(counted))
+  const tier = settled ? counted : listed && !listed.private ? Infinity : null
+  const [was, open] = published
+  const created = wanted && tier !== null && listed?.created && was && open && Date.parse(listed.created) > Date.parse(was) ? listed.created : null
+  return { tier, wanted, created, gap: created ? Date.parse(open) - Date.parse(created) : null }
+}

package/risk/npm/old-version.js

@@ -0,0 +1,108 @@
+// The version an open version is compared with where the caller leaves it to
+// risk (assess.js `oldVersion: true`): of the package's others, the one most
+// likely free of what an attack injects, as a pair's findings flag only what
+// is new against it, so an attack's own earlier version, or one published
+// with it, would hide what it injected. Told by what npm's document says of
+// each version alone (registry.js npmPackageFacts): when it was published,
+// its publisher and whether that account is known (manifest.js), its
+// deprecation, and those since removed from npm, whose times it keeps; no
+// tarball is read for it.
+import { DAY_MS } from './downloads.js'
+import { npmAccountStanding } from './release.js'
+
+// How long a version is on npm before it is taken as looked at: a month, as
+// an attack's versions are mostly found and pulled within days.
+const SETTLED_MS = 30 * DAY_MS
+// How near the open version's publish, either side, a version comes with it:
+// a week, as an attack publishes its versions within days of each other.
+const CLOSE_MS = 7 * DAY_MS
+// How near a version since removed from npm, either side, a version comes
+// with it: a day, as an attack's versions come within hours of each other,
+// and npm removes those it finds.
+const REMOVED_MS = DAY_MS
+
+// A version as npm publishes one, `{ core, pre }`: its MAJOR.MINOR.PATCH, each
+// to 16 digits and a safe integer as semver takes them, and its prerelease's
+// identifiers, build metadata aside; null for any other.
+const VERSION = /^(0|[1-9]\d{0,15})\.(0|[1-9]\d{0,15})\.(0|[1-9]\d{0,15})(?:-([\da-z-]+(?:\.[\da-z-]+)*))?(?:\+[\da-z-]+(?:\.[\da-z-]+)*)?$/iu
+function parsed(version) {
+  const match = VERSION.exec(version)
+  const core = match?.slice(1, 4).map(Number)
+  return core?.every(Number.isSafeInteger) ? { core, pre: match[4]?.split('.') ?? [] } : null
+}
+
+// Which of two versions is higher, by semver's precedence: their cores, a
+// release above its prereleases, and prereleases by their identifiers, a
+// number below a word.
+function compared(a, b) {
+  const core = a.core.findIndex((part, at) => part !== b.core[at])
+  if (core !== -1) return a.core[core] - b.core[core]
+  if (a.pre.length === 0 || b.pre.length === 0) return b.pre.length - a.pre.length
+  for (let at = 0; at < Math.max(a.pre.length, b.pre.length); at++) {
+    const x = a.pre[at], y = b.pre[at]
+    if (x === undefined || y === undefined) return x === undefined ? -1 : 1
+    if (x === y) continue
+    const xNumber = /^\d+$/u.test(x), yNumber = /^\d+$/u.test(y)
+    if (xNumber !== yNumber) return xNumber ? -1 : 1
+    if (xNumber && x.length !== y.length) return x.length - y.length
+    return x < y ? -1 : 1
+  }
+  return 0
+}
+
+// Of a package's versions (`releases`, `{ version, published, publisher,
+// known, deprecated, removed }` each, `removed` one since removed from npm,
+// its time alone kept), the one `version` is compared with at `now`, or null
+// where none is below it. Each account by its standing on the package when
+// the open version was published (release.js npmAccountStanding), the most
+// first: known, one that publishes one of npm's most downloaded packages;
+// one of its maintainers, on it three months or more, or first to publish
+// it; and new to it. Of those below it, a release where it is one, the
+// highest that is preferred, each preference kept only where some version
+// holds it, in turn:
+//
+// - Where an account new to it published it, one another published, as an
+//   attack may have published more than one.
+// - One published before it, not after, as one published since (a
+//   backport) is no version it came from.
+// - Where the highest of those an account of a higher standing than its own
+//   published, as when a package is taken from its maintainers, one an
+//   account of that standing or higher published.
+// - One published a day or more apart from any version since removed from
+//   npm, as not one of the attack npm removed those of.
+// - One published a week or more apart from it, as not one of an attack's,
+//   and on npm a month or more, as looked at; but for one a known account
+//   other than its own published, trusted however new, and one a maintainer
+//   other than its own published, held to the week alone, as an account taken
+//   leaves another's versions alone, and a maintainer few know of is taken
+//   with its peers as often. Its own account's are held to both, as it may be
+//   the one taken.
+// - One npm doesn't say is deprecated, as one a maintainer took back.
+//
+// The highest is in its branch (`1.x.y`, `0.2.y`, `0.0.y`) where one is
+// there, else in the closest branch below.
+const RANKS = { new: 0, maintainer: 1, known: 2 }
+export function npmOldVersion(version, releases, now) {
+  const open = releases.find(row => row.version === version && !row.removed)
+  const at = open && parsed(version)
+  if (!at) return null
+  const prefer = (rows, wanted) => { const kept = rows.filter(wanted); return kept.length > 0 ? kept : rows }
+  const time = row => row.published === null ? Number.NaN : Date.parse(row.published)
+  const opened = time(open)
+  const versions = releases.flatMap(row => { const of = parsed(row.version); return of ? [{ ...row, of }] : [] })
+  const removed = versions.filter(row => row.removed).map(time).filter(Number.isFinite)
+  const standing = npmAccountStanding(releases, open.published)
+  const rank = row => row?.publisher ? RANKS[standing(row.publisher, row.known)] : RANKS.new
+  const own = rank(open)
+  let rows = prefer(versions.filter(row => !row.removed && compared(row.of, at) < 0).toSorted((a, b) => compared(b.of, a.of)),
+    row => row.of.pre.length === 0 || at.pre.length > 0)
+  if (open.publisher && own === RANKS.new) rows = prefer(rows, row => row.publisher !== open.publisher)
+  rows = prefer(rows, row => time(row) < opened)
+  const top = rank(rows[0])
+  if (open.publisher && top > own) rows = rows.filter(row => rank(row) >= top)
+  rows = prefer(rows, row => removed.every(gone => Math.abs(time(row) - gone) >= REMOVED_MS))
+  const vouched = row => row.publisher === open.publisher ? RANKS.new : rank(row)
+  rows = prefer(prefer(rows, row => vouched(row) === RANKS.known || Math.abs(time(row) - opened) >= CLOSE_MS),
+    row => vouched(row) >= RANKS.maintainer || now - time(row) >= SETTLED_MS)
+  return prefer(rows, row => !row.deprecated)[0]?.version ?? null
+}

package/risk/npm/registry.js

@@ -0,0 +1,282 @@
+// What risk asks npm for, each kept in the caller's cache where it gives one
+// (`cache`, as @preventive/upstream's CacheStore: `read(type, key)` and
+// `write(type, key, value)`, each type its caller's to keep where it will):
+//
+// - `npm/tarballs`, `<name>@<version>`: a version's tarball, its bytes, as
+//   upstream's getTarball keeps one, checked against its integrity.
+// - `risk/npm/versions`, `<name>@<version>`: what a version's document says,
+//   which npm never changes once published: its manifest (manifest.js, its
+//   deprecation aside), when it was published, and its dist.
+// - `risk/npm/packages`, `<name>`: the versions npm says are deprecated, those
+//   it removed (each one's when), and whether it took the package down, as
+//   `at` a time, asked again after an hour, as npm deprecates and removes a
+//   version any time.
+// - `risk/npm/old-versions`, `<name>@<version>`: the version it is compared
+//   with where risk picks it (old-version.js npmOldVersion), or none, as `at`
+//   a time, picked again after an hour, as npm publishes and deprecates
+//   versions any time and those it has grow older.
+// - `risk/npm/public`, `<name>`: when a package anyone can read was first
+//   published, or `{ missing: true }`, as `at` a time, asked again after an
+//   hour.
+// - `risk/npm/downloads`, `<name>@<from>:<to>`: its downloads a day over those
+//   days, `{ start, end, days }`, or `{ none: true }` where npm counts none.
+//
+// The package assessed is asked for as upstream asks, with the npm token the
+// environment has for a scoped one (PREVENTIVE_MEASURES_NPM_TOKEN,
+// STASIS_NPM_TOKEN or NPM_TOKEN), so a private one can be read; its
+// dependencies' public facts and downloads with none. A caller may ask for
+// packages' documents (`packument`) and versions' tarballs (`tarball`)
+// itself, as the managed server does, within the bounds it holds every read
+// of npm to; else a tarball is upstream's getTarball's, bounded as upstream
+// bounds it. What risk asks npm itself is given up on after 30 seconds, and
+// read no further than its bounds, `upstream-too-large` past them, as is a
+// tarball unpacking past tarball.js's, `package-too-large`.
+import { advisories } from '@preventive/upstream/advisories.js'
+import { getTarball } from '@preventive/upstream/npm.js'
+import { npmVersionManifest } from './manifest.js'
+import { npmPlaceholder } from './malware.js'
+import { npmOldVersion } from './old-version.js'
+import { npmTarballVersion } from './tarball.js'
+import { DAY_MS } from './downloads.js'
+
+const REGISTRY = 'https://registry.npmjs.org'
+const DOWNLOADS = 'https://api.npmjs.org/downloads/range'
+const PACKAGE_MS = 60 * 60_000
+// How long a version's advisories are kept, as the managed server keeps a
+// package's and a lockfile's: an hour, as a new one may come at any time.
+const ADVISORIES_MS = 60 * 60_000
+// How much of npm's answers is read: a whole document, as the managed server
+// reads one (server-managed/npm-packages.ts PACKUMENT_BYTES), and a few
+// months' downloads a day.
+const PACKUMENT_BYTES = 64 * 1024 * 1024
+const DOWNLOADS_BYTES = 1024 * 1024
+// How long npm is waited on for an answer, as the managed server waits on its
+// upstreams (server-managed/npm-packages.ts askUpstream).
+const REQUEST_MS = 30_000
+
+export class NpmRiskError extends Error {
+  constructor(code, message = code) { super(message); this.code = code }
+}
+
+const isTime = value => typeof value === 'string' && value.length <= 40 && !Number.isNaN(Date.parse(value))
+// A scoped name in a downloads API path, its slash escaped.
+const encoded = name => name.replace('/', '%2f')
+const token = () => typeof process === 'undefined' ? null
+  : ['PREVENTIVE_MEASURES_NPM_TOKEN', 'STASIS_NPM_TOKEN', 'NPM_TOKEN'].map(key => process.env[key]).find(Boolean) ?? null
+
+// A value kept under `type` and `key`, else `ask`ed and kept; one `fresh`
+// says is stale asked again.
+async function kept({ cache }, type, key, ask, fresh = () => true) {
+  const hit = cache ? await cache.read(type, key) : null
+  if (hit != null && fresh(hit)) return hit
+  const value = await ask()
+  if (cache && value != null) await cache.write(type, key, value)
+  return value
+}
+
+// An answer's body as JSON, read no further than `limit` bytes.
+async function jsonOf(res, limit, what) {
+  const tooLarge = () => new NpmRiskError('upstream-too-large', `npm's answer for ${what} is over ${limit} bytes`)
+  if (Number(res.headers.get('content-length')) > limit) { await res.body?.cancel(); throw tooLarge() }
+  const chunks = []
+  let size = 0
+  for await (const chunk of res.body ?? []) {
+    size += chunk.byteLength
+    if (size > limit) throw tooLarge()
+    chunks.push(chunk)
+  }
+  try { return JSON.parse(await new Blob(chunks).text()) } catch { throw new NpmRiskError('upstream-invalid', `npm's answer for ${what} isn't JSON`) }
+}
+
+// What npm answers `url` as JSON (jsonOf), null where it answers 404; given up
+// on after REQUEST_MS, or once the caller's `signal` aborts, its abort
+// rethrown as it is. `upstream-busy` where npm asks to be asked later (429),
+// as its downloads API does past a burst of requests;
+// `upstream-unavailable` where it can't be asked or answers otherwise.
+async function askNpm(url, headers, limit, what, { signal }) {
+  try {
+    const res = await fetch(url, { headers: { accept: 'application/json', ...headers }, redirect: 'error', signal: AbortSignal.any([AbortSignal.timeout(REQUEST_MS), ...signal ? [signal] : []]) })
+    if (res.status === 404) { await res.body?.cancel(); return null }
+    if (!res.ok) { await res.body?.cancel(); throw new NpmRiskError(res.status === 429 ? 'upstream-busy' : 'upstream-unavailable', `npm answered ${res.status} for ${what}`) }
+    return await jsonOf(res, limit, what)
+  } catch (error) {
+    if (error instanceof NpmRiskError || signal?.aborted) throw error
+    throw new NpmRiskError('upstream-unavailable', `npm couldn't be asked for ${what}: ${error.message}`)
+  }
+}
+
+// A package's whole document, null where npm has none for this asker: the
+// caller's (`packument`) where it gives one, else risk's own.
+function packageDocument(name, context, authorized) {
+  if (context.packument) return context.packument(name, { authorized, signal: context.signal })
+  const secret = authorized && name.startsWith('@') ? token() : null
+  return askNpm(`${REGISTRY}/${name}`, secret ? { authorization: `Bearer ${secret}` } : {}, PACKUMENT_BYTES, name, context)
+}
+
+// When a document says its package's first version was published, one since
+// unpublished among them: the earliest time it lists.
+const firstPublished = doc => Object.entries(doc?.time ?? {}).filter(([key, at]) => key !== 'modified' && isTime(at)).map(([, at]) => at)
+  .reduce((first, at) => first === null || Date.parse(at) < Date.parse(first) ? at : first, null)
+
+// Each version a package's document lists, as old-version.js npmOldVersion
+// picks among them: `{ version, published, publisher, known, deprecated,
+// removed }`, its publisher's account as manifest.js reads it, and whether
+// that is known; and each it lists a time of and no document, as one since
+// removed from npm, `removed`, its time alone, as npmPackageFacts reads none
+// of it. Its times' other keys (`created`, `modified`) are no versions, as
+// none of a version starts with a letter.
+const versionsOf = doc => [...new Set([...Object.keys(doc.versions ?? {}), ...Object.keys(doc.time ?? {}).filter(key => /^\d/u.test(key))])]
+const releasesOf = (doc, deprecated = {}) => versionsOf(doc).map(version => {
+  const json = doc.versions?.[version]
+  const { publisher = null, knownAccounts } = json ? npmVersionManifest(json) : {}
+  return { version, published: isTime(doc.time?.[version]) ? doc.time[version] : null, publisher, known: Boolean(knownAccounts),
+    deprecated: Object.hasOwn(deprecated, version), removed: !json }
+})
+
+// What risk reads of `version` of a package, of the one it is compared with
+// (`oldVersion`: one, null for none, or true for the one old-version.js
+// npmOldVersion picks of its versions, by its document), and of the package:
+// `versions`, each one's `{ manifest, published, dist }`, those of them npm
+// removed since they were published (`removed`, each one's when), none
+// picked to compare a removed one with, `deprecated`, by version, whether
+// npm's security team took the package down (`takenDown`, its latest version
+// npm's placeholder, malware.js npmPlaceholder), `removals`, how many
+// versions of it npm removed, `oldVersion`, the one compared with or null,
+// and where its document was read and either the pick
+// or another account publishing each wants them, `releases`, each version it
+// lists (releasesOf), so that no more of the document is held. Its document
+// is read once at most, and not at all where all of it is kept and fresh. A
+// version's facts are kept for good, as npm never changes a version, but npm
+// may remove it: the package's, kept an hour, has which it removed, and they
+// go by that.
+export async function npmPackageFacts(name, version, oldVersion, context) {
+  const { cache, now } = context
+  const fresh = hit => hit != null && now - hit.at < PACKAGE_MS
+  const picked = cache && oldVersion === true ? await cache.read('risk/npm/old-versions', `${name}@${version}`) : null
+  const given = oldVersion === true ? fresh(picked) ? picked.oldVersion : undefined : oldVersion
+  if (cache && given !== undefined) {
+    const wanted = given === null ? [version] : [version, given]
+    const [facts, pkg] = await Promise.all([Promise.all(wanted.map(at => cache.read('risk/npm/versions', `${name}@${at}`))), cache.read('risk/npm/packages', name)])
+    const gone = at => Object.hasOwn(pkg.removed, at)
+    if (fresh(pkg) && 'removed' in pkg && wanted.every((at, i) => facts[i] || gone(at))) {
+      return { versions: new Map(wanted.flatMap((at, i) => gone(at) ? [] : [[at, facts[i]]])), removed: new Map(wanted.filter(gone).map(at => [at, pkg.removed[at]])),
+        removals: Object.keys(pkg.removed).length, deprecated: pkg.deprecated, takenDown: pkg.takenDown, oldVersion: given }
+    }
+  }
+  const doc = await packageDocument(name, context, true)
+  if (!doc) throw new NpmRiskError('package-not-found', `npm has no package ${name}`)
+  const removed = new Map()
+  const factsOf = at => {
+    const json = doc.versions?.[at]
+    if (!json && isTime(doc.time?.[at])) { removed.set(at, doc.time[at]); return null }
+    if (!json) throw new NpmRiskError('version-not-found', `npm has no ${name}@${at}`)
+    const { deprecated: _, ...manifest } = npmVersionManifest(json)
+    return { manifest, published: isTime(doc.time?.[at]) ? doc.time[at] : null, dist: { tarball: json.dist?.tarball, integrity: json.dist?.integrity } }
+  }
+  const opened = factsOf(version)
+  const deprecated = Object.fromEntries(Object.entries(doc.versions ?? {}).filter(([, json]) => typeof json?.deprecated === 'string' && json.deprecated !== '').map(([at, json]) => [at, json.deprecated]))
+  let releases = oldVersion === true && opened ? releasesOf(doc, deprecated) : null
+  const old = oldVersion === true ? opened && npmOldVersion(version, releases, now) : oldVersion
+  const read = new Map([...opened ? [[version, opened]] : [], ...old === null ? [] : [[old, factsOf(old)]]].filter(([, fact]) => fact))
+  const takenDown = npmPlaceholder(doc.versions?.[doc['dist-tags']?.latest])
+  const publishers = [version, old].map(at => read.get(at)?.manifest.publisher)
+  if (publishers.every(Boolean) && publishers[0] !== publishers[1]) releases ??= releasesOf(doc, deprecated)
+  const gone = Object.fromEntries(Object.entries(doc.time ?? {}).filter(([at, when]) => at !== 'created' && at !== 'modified' && isTime(when) && !doc.versions?.[at]))
+  if (cache) {
+    await Promise.all([...read].map(([at, fact]) => cache.write('risk/npm/versions', `${name}@${at}`, fact)))
+    await cache.write('risk/npm/packages', name, { at: now, deprecated, takenDown, removed: gone })
+    if (oldVersion === true) await cache.write('risk/npm/old-versions', `${name}@${version}`, { at: now, oldVersion: old })
+  }
+  return { versions: read, removed, removals: Object.keys(gone).length, deprecated, takenDown, oldVersion: old, ...releases ? { releases } : {} }
+}
+
+// npm's advisories of `version` of a package, as `npm audit` asks them, and
+// where `osv`, OSV's records npm's registry hasn't, as the malicious
+// packages' of nx's versions are (MAL-2025-41443, of GHSA-cxm3-wv7p-598c,
+// which npm's registry hasn't): upstream's `advisories` and its `osv`, an
+// advisory of npm's an OSV record names taking the record's ids among its
+// `aliases`. Each `{ id, url?, title?, cwe, aliases }`, kept ADVISORIES_MS,
+// and given up on once `signal` aborts.
+export async function npmVersionAdvisories(name, version, osv, context) {
+  const what = `${name}@${version}`
+  const { rows } = await kept(context, 'risk/npm/advisories', what, async () => {
+    context.signal?.throwIfAborted()
+    const asked = await untilAborted(advisories([{ ecosystem: 'npm', name, versions: [version] }], { cache: false, osv }), context.signal).catch(error => {
+      throw context.signal?.aborted ? error : new NpmRiskError(error?.status === 429 ? 'upstream-busy' : 'upstream-unavailable', `advisories of ${what} couldn't be had: ${error.message}`)
+    })
+    return { at: context.now, osv, rows: asked.map(({ id, url, title, cwe, aliases }) => ({ id, ...url ? { url } : {}, ...title ? { title } : {}, cwe, aliases })) }
+  }, hit => context.now - hit.at < ADVISORIES_MS && hit.osv === osv)
+  return rows
+}
+
+// Each version a package's document lists (releasesOf), the document read
+// anew, as npmPackageFacts reads it.
+export async function npmPackageReleases(name, context) {
+  const doc = await packageDocument(name, context, true)
+  if (!doc) throw new NpmRiskError('package-not-found', `npm has no package ${name}`)
+  return releasesOf(doc)
+}
+
+// `promise`, given up on once `signal` aborts, its reason thrown: what it
+// waits on, which takes no signal (upstream's getTarball), left to settle
+// unheeded.
+function untilAborted(promise, signal) {
+  if (!signal) return promise
+  if (signal.aborted) return Promise.reject(signal.reason)
+  return new Promise((resolve, reject) => {
+    const onAbort = () => reject(signal.reason)
+    signal.addEventListener('abort', onAbort, { once: true })
+    promise.then(resolve, reject).finally(() => signal.removeEventListener('abort', onAbort))
+  })
+}
+
+// A version's files, as compare.js takes a version, from its tarball
+// (tarball.js): the caller's (`tarball`) where it gives one, its failures
+// thrown as they are, else upstream's, given up on once `signal` aborts; with
+// `npm` its `{ name, version, manifest, published }`.
+export async function npmVersionFiles(name, version, { manifest, published, dist }, { cache, tarball: read, signal }) {
+  const what = `${name}@${version}`
+  signal?.throwIfAborted()
+  const tarball = read ? await read(name, version, { signal }) : await untilAborted(getTarball(name, version, dist, cache === undefined ? {} : { cache }), signal).catch(error => {
+    throw signal?.aborted ? error : new NpmRiskError('upstream-unavailable', `npm's tarball of ${what} couldn't be had: ${error.message}`)
+  })
+  try { return { npm: { name, version, manifest, published }, ...await npmTarballVersion(tarball) } } catch (error) {
+    throw new NpmRiskError(error.message === 'package-too-large' ? 'package-too-large' : 'upstream-invalid', `npm's tarball of ${what}: ${error.message}`)
+  }
+}
+
+// When a package anyone can read was first published, `{ created }`, or null
+// for one npm has none of for anyone.
+export async function npmPublicFacts(name, context) {
+  const facts = await kept(context, 'risk/npm/public', name,
+    async () => { const doc = await packageDocument(name, context, false); return doc ? { at: context.now, created: firstPublished(doc) } : { at: context.now, missing: true } },
+    hit => context.now - hit.at < PACKAGE_MS)
+  return facts.missing ? null : { created: facts.created }
+}
+
+// The days a package's downloads are asked over at `now`: from the first of
+// the month before last to yesterday, as the npm viewer asks them.
+const day = time => new Date(time).toISOString().slice(0, 10)
+function rangeAt(now) {
+  const today = new Date(now)
+  return `${day(Date.UTC(today.getUTCFullYear(), today.getUTCMonth() - 2, 1))}:${day(now - DAY_MS)}`
+}
+
+// A package's downloads a day over rangeAt's days, `{ start, end, days }`,
+// null where npm counts none.
+export async function npmDownloads(name, context) {
+  const range = rangeAt(context.now)
+  const answer = await kept(context, 'risk/npm/downloads', `${name}@${range}`, async () => {
+    const json = await askNpm(`${DOWNLOADS}/${range}/${encoded(name)}`, {}, DOWNLOADS_BYTES, `${name}'s downloads`, context)
+    if (json === null) return { none: true }
+    const start = Date.parse(json.start)
+    const length = Math.round((Date.parse(json.end) - start) / DAY_MS) + 1
+    const days = Array.from({ length: Number.isSafeInteger(length) && length > 0 && length <= 400 ? length : 0 }, () => 0)
+    for (const row of json.downloads ?? []) {
+      const at = Math.round((Date.parse(row.day) - start) / DAY_MS)
+      if (at >= 0 && at < days.length && Number.isSafeInteger(row.downloads)) days[at] = row.downloads
+    }
+    return { start: json.start, end: json.end, days }
+  })
+  return answer.none ? null : answer
+}

package/risk/npm/release.js

@@ -0,0 +1,85 @@
+// What calls for a look at a version beside its files: one too new to
+// trust yet, one npm says is deprecated, a publisher that changed, provenance
+// the version before had and this one lost, and install scripts it adds or
+// changes. Each from what npm's version documents say, as manifest.js reads
+// them (`publisher`, `knownAccounts`, `provenance`, `installScripts`,
+// `deprecated`).
+import { DAY_MS } from './downloads.js'
+import { npmInstallScripts } from './install-scripts.js'
+
+// How old a version must be to be trusted, by default: two weeks, as a
+// compromised release is mostly found and pulled within days, so one this
+// new hasn't yet had the time to be. A caller's own packages (a team's npm
+// scopes) take 0: trusted however new.
+export const DEFAULT_MINIMUM_RELEASE_AGE = 14 * DAY_MS
+
+// Whether a version published at `published` (an ISO time) is too new to
+// trust at `now`: younger than `minimumReleaseAge`, none at 0.
+export const npmTooNew = (published, { minimumReleaseAge = DEFAULT_MINIMUM_RELEASE_AGE, now = Date.now() } = {}) =>
+  minimumReleaseAge > 0 && typeof published === 'string' && now - Date.parse(published) < minimumReleaseAge
+
+// How long before a version an account has published its package to be one
+// of its maintainers: three months, as an account given a package to take it
+// publishes its attack within weeks.
+const TENURE_MS = 90 * DAY_MS
+
+// Each account's standing on a package when a version of it was published
+// (`at`, an ISO time), by the package's versions as npm's document lists them
+// (`releases`, registry.js, `{ publisher, published }` each), as
+// `(account, known) => standing`: `known` where it publishes one of npm's
+// most downloaded packages (`known`, manifest.js `knownAccounts`), green;
+// `maintainer` where it published the package three months or more before,
+// or first, as its sole maintainer has, yellow; else `new`, as an account
+// taking the package from its maintainers is, orange. An account published it
+// first only where its versions tell so: the earliest npm lists a time of
+// was its, none of another's (or of none npm names, as one since removed) as
+// early, and each npm lists no time of was its too, as any could be earlier.
+export function npmAccountStanding(releases, at) {
+  const since = new Map()
+  let earliest = null
+  for (const { publisher, published } of releases) {
+    const time = Date.parse(published)
+    if (Number.isNaN(time)) continue
+    if (publisher && !(since.get(publisher) <= time)) since.set(publisher, time)
+    if (earliest === null || time < earliest.time) earliest = { publisher, time }
+    else if (time === earliest.time && publisher !== earliest.publisher) earliest.publisher = null
+  }
+  const first = earliest?.publisher && releases.every(({ publisher, published }) => publisher === earliest.publisher || !Number.isNaN(Date.parse(published)))
+    ? earliest.publisher : null
+  return (account, known) => known ? 'known' : account && (account === first || Date.parse(at) - since.get(account) >= TENURE_MS) ? 'maintainer' : 'new'
+}
+
+// The npm account that published each version, where npm says for both and
+// they differ, as when a package changes hands, or is taken over: `{ was,
+// now, wasKnown, nowKnown, severity }`, each account known where it publishes
+// one of npm's most downloaded packages (`knownAccounts`), and with the
+// package's versions told (`standing`, npmAccountStanding's of the open
+// version), each one's standing on it (`wasStanding`, `nowStanding`);
+// `moderate` where the open version's is known, or one of the package's
+// maintainers, `critical` where a known one gave way to one that isn't, else
+// `high`. Null where it didn't change.
+export function npmPublisherChange(from, to, standing = null) {
+  const now = to?.publisher, was = from?.publisher
+  if (!was || !now || was === now) return null
+  const nowKnown = to.knownAccounts?.includes(now) === true, wasKnown = from.knownAccounts?.includes(was) === true
+  const told = standing ? { wasStanding: standing(was, wasKnown), nowStanding: standing(now, nowKnown) } : {}
+  return { was, now, wasKnown, nowKnown, ...told, severity: nowKnown || told.nowStanding === 'maintainer' ? 'moderate' : wasKnown ? 'critical' : 'high' }
+}
+
+// Provenance the one compared with has and the open version hasn't, as a
+// version published by hand, with a token taken from its maintainers,
+// wouldn't.
+export const npmProvenanceLost = (from, to) => Boolean(from?.provenance && !to?.provenance)
+
+// The scripts npm runs installing the open version (`other`, its manifest
+// and `paths`, its files; install-scripts.js npmInstallScripts, node-gyp's
+// for a binding.gyp among them) that the one compared with (`base`) didn't,
+// or ran another command for: `{ was, now, flagged }`, each version's
+// scripts by name and the names flagged; null for none. One dropped isn't
+// flagged.
+export function npmInstallScriptsChange(base, other) {
+  const scripts = ({ manifest, paths }) => new Map(npmInstallScripts(manifest, paths))
+  const now = scripts(other), was = scripts(base)
+  const flagged = [...now].filter(([script, command]) => was.get(script) !== command).map(([script]) => script)
+  return flagged.length === 0 ? null : { was, now, flagged }
+}