@preventive/triage 1.0.0-alpha.4 → 1.0.0-alpha.40

package/risk/files/runs-code.js

@@ -0,0 +1,358 @@
+// What a file's code can do beyond itself, for a reviewer: run a string as
+// code (eval, Function with new or without, node:vm, Module's _compile) or
+// other programs (child_process), reach for credentials (a credential file's
+// path, a token's name) or the whole environment, and publish to npm (`npm
+// publish`, `/-/whoami`, a registry PUT), as a file's stamps say
+// (stamps.js) and a version's findings name what is new to a file.
+// A quick read, not a parse: a script's code with its strings, regular
+// expressions and comments set aside as script.js tells them, its
+// strings read for the paths, names and commands they hold, a module by the
+// string naming it where it is loaded (`require('child_process')`,
+// `import … from 'node:child_process'`); a declaration file (.d.ts) read as
+// TypeScript, as node runs it (stripping its types, `declare function
+// eval(…)` among them, a function named, not called). A call written not to
+// read as one (`window['ev' + 'al']`) goes unseen, as does one in a template
+// literal in another's substitution (`${`${eval(x)}`}`), whose backtick ends
+// the outer one as the regular expression telling strings reads it.
+//
+// Labels to assist a reviewer, making the plain cases less likely to be
+// missed, not a check to rely on: code can come to eval, Function,
+// child_process, credentials or the registry in more ways than any reading of
+// its text tells (a name built as it runs, `(…).constructor('…')`, a module
+// required by a name computed, a path or URL put together, the
+// registry's host read from config), so a file without a label is not one
+// without them.
+import { JS_STRING_OR_COMMENT, NPM_MAX_FOUND, lineOf, npmIsScript } from './script.js'
+
+// What may come between a call's parts: blanks and comments
+// (`Function/* note */(…)`), each comment ending at its first `*/`.
+const COMMENT = String.raw`/\*(?:[^*]|\*(?!/)){0,100}\*/|//[^\n]{0,100}\n`
+const GAP = String.raw`(?:\s|${COMMENT})*`
+// Function called: as it is, optionally (`Function?.(…)`), or by its call or
+// apply (`Function.call(null, …)`), each making a function of its last
+// argument.
+const FUNCTION_CALLED = String.raw`(?:${GAP}\??\.${GAP}(?:call|apply))?${GAP}(?:\?\.${GAP})?\(`
+// But not where the function made returns `this` alone
+// (`Function('return this')()`, `new Function("return this;")`): the global
+// object, as older code finds it where `globalThis` may not be, lodash's and
+// core-js's among them, running nothing of its own.
+const GLOBAL_FOUND = String.raw`(?!${GAP}(?<quote>["'\u0060])\s*return\s+this\s*;?\s*\k<quote>${GAP}\))`
+// The environment, whole: not one variable of it (`process.env.HOME`,
+// `process.env[name]`).
+const ENV = String.raw`process${GAP}\.${GAP}env(?![\p{ID_Continue}$])(?!${GAP}(?:\??\.|\[))`
+// Its values read out whole (`JSON.stringify(process.env)`,
+// `Object.entries(process.env)`, `new URLSearchParams(process.env)`), or a
+// copy of them (`JSON.stringify({ ...process.env })`), not as a program is
+// handed it (`{ env: process.env }`, `{ ...process.env }`), nor its
+// names listed (`Object.keys(process.env)`, as debug picks its DEBUG_ ones),
+// nor one variable asked for (`'HOME' in process.env`), nor its entries or
+// values picked among as they are read (`Object.entries(process.env)
+// .reduce(…)`, as npm's agent finds its proxy's, `.filter(…)`, `.find(…)`).
+const PICKED = String.raw`${GAP}\)${GAP}\??\.${GAP}(?:filter|find|findLast|some|every|reduce)(?![\p{ID_Continue}$])`
+const COPY = String.raw`(?:\{${GAP}\.\.\.${GAP})?`
+const ENV_WHOLE = String.raw`(?=JSON|Object|URLSearchParams)(?<![\p{ID_Continue}$.])(?:JSON${GAP}\.${GAP}stringify|URLSearchParams)${GAP}\(${GAP}${COPY}${ENV}`
+  + String.raw`|(?=Object)(?<![\p{ID_Continue}$.])Object${GAP}\.${GAP}(?:values|entries)${GAP}\(${GAP}${COPY}${ENV}(?!${PICKED})`
+// Any of RUNS_CODE, as a text may say it.
+const SAYS_ANY = new RegExp(String.raw`eval|Function${FUNCTION_CALLED}|vm["'\x60]|_compile|child_process|\.(?:npmrc|ssh|aws)|_TOKEN|(?:stringify|values|entries|URLSearchParams)${GAP}\(${GAP}(?:\{${GAP}\.\.\.${GAP})?process${GAP}\.${GAP}env|publish|whoami|registry\.(?:npmjs\.org|yarnpkg\.com)`, 'u')
+
+// A name read as one, not as a property's (`vm.eval`, `vm . eval`, a spread's
+// `...eval` aside) or part of another's (`evaluate`), or as the global
+// object's (`window.eval`, `globalThis?.eval`); looked back on only where the
+// name or the global object's starts, so a long run of blanks reads in one go.
+const GLOBAL = 'globalThis|window|global|self'
+const named = name => String.raw`(?=${GLOBAL}|${name})(?<![\p{ID_Continue}$#])(?<!(?<!\.)\.${GAP})(?<!\bfunction${GAP})(?:(?:${GLOBAL})${GAP}\??\.${GAP})?${name}`
+// A token's name, as its value is read (`process.env.GITHUB_TOKEN || null`,
+// `env.NPM_TOKEN`, `||=`), not where its absence is told
+// (`!process.env.GITHUB_TOKEN`, `!(process.env.GITHUB_TOKEN)`) or it is
+// dropped (`delete process.env.NPM_TOKEN`), the token the whole of what is
+// negated or deleted (ABSENT_ENDS: not `!process.env.GITHUB_TOKEN.trim()`,
+// `!(process.env.GITHUB_TOKEN === x)`), nor where it is only set
+// (`process.env.NPM_TOKEN = token`), but for a default as it is destructured
+// (`{ NPM_TOKEN = '' } = process.env`, a line of its own too), nor declared
+// (`const NPM_TOKEN = …`, TypeScript's `let GITHUB_TOKEN: string`), nor typed
+// (a member, `GITHUB_TOKEN?: string`, `NPM_TOKEN: string | undefined`, or a
+// parameter): looked back on, a few names and dots at most, only where the
+// name starts.
+const TOKEN_VAR = '(?:NPM|GITHUB)_TOKEN'
+const SET = String.raw`\s{0,4}=(?![=>])`
+// A name typed, not read: optional (`?:`), or a primitive's type after it,
+// as no destructuring names what it reads (`{ NPM_TOKEN: token }`); not
+// `undefined`, a ternary's choice (`x ? env.NPM_TOKEN : undefined`).
+const TYPED = String.raw`\s{0,4}(?:\?:|:\s{0,4}(?:string|number|boolean|unknown|any)(?![\p{ID_Continue}$]))`
+// What may follow a token negated or deleted whole: the parentheses around
+// it closed, nothing read of what they hold (`!(token).trim()`, `!(token)()`), or else what
+// ends an operand (`&&`, `||`, `??`, a ternary's `?`, `;`, `,`, `:`, `}`, `]`,
+// the line's end).
+const ABSENT_ENDS = String.raw`\s{0,4}(?:(?:\)\s{0,4}){1,4}(?![\s)]{0,8}(?:[.[(]|\?\.))|&&|\|\||\?\?|\?(?!\.)|[;,:}\]]|$)`
+const TOKEN_NAME = String.raw`(?=NPM|GITHUB)(?<![\p{ID_Continue}$])(?<!\b(?:const|let|var)\s{1,4})`
+  + String.raw`(?:(?<!(?:!|\bdelete\s)[\s(]{0,4}(?:[\p{ID_Continue}$]{1,64}\s{0,4}\??\.\s{0,4}){0,4})|(?!${TOKEN_VAR}${ABSENT_ENDS}))`
+  + String.raw`${TOKEN_VAR}(?![\p{ID_Continue}$])(?!${TYPED})(?:(?!${SET})|(?<=[{,]\s{0,64}${TOKEN_VAR}))`
+// A script's strings, regular expressions and comments, as script.js
+// tells them, each taking its own text, and its code in none of them: eval,
+// not a property TypeScript types as optional (`eval?: T`, JavaScript's `?:`
+// none of its own), and Function called, but to find the global object;
+// Module's _compile, called
+// (`module._compile(source, filename)`) or hooked (`Module.prototype._compile
+// = …`), not named in a type (`typeof Module.prototype._compile`); a token's
+// name, its value read; the environment read out whole; and a PUT request's
+// call (`axios.put(…)`).
+const READS = new RegExp(String.raw`${JS_STRING_OR_COMMENT.source}|(?<eval>${named('eval')}(?![\p{ID_Continue}$])(?!\s*\?:))|(?<function>${named('Function')}${FUNCTION_CALLED}${GLOBAL_FOUND})`
+  + String.raw`|(?<compile>\.${GAP}_compile(?:${FUNCTION_CALLED}|${GAP}=(?![=>])))|(?<tokens>${TOKEN_NAME})|(?<env>${ENV_WHOLE})|(?<put>\.${GAP}put${GAP}\()`, 'gmu')
+// What a string holds that a kind is: a credential file's path, npm's, SSH's
+// or AWS's (`~/.npmrc`, `.ssh/id_rsa`, `.aws/credentials`, not `x.npmrc` or
+// `.sshd`); a token's name where it is read, the string the name alone (a
+// key, `process.env['GITHUB_TOKEN']`) or the name expanded (a shell's or
+// .npmrc's `$GITHUB_TOKEN`, `${NPM_TOKEN}`, cmd's `%NPM_TOKEN%`), not where
+// text names it (`requires a token in GITHUB_TOKEN`); a command publishing (`npm publish`, `pnpm
+// publish …`, options before it as npm takes them, `npm --tag next publish`)
+// or the registry's who-am-I, a publisher's first step with a token. And the
+// registry, where a PUT request is one publishing (REGISTRY_URL).
+// Told first of a string by what any of them says.
+const HOLDS_ANY = /\.(?:npmrc|ssh|aws)|_TOKEN|publish|whoami|registry\./u
+// Before a token's name as a key, its absence told or the token dropped, as
+// TOKEN_NAME tells of one as a name (`!process.env['GITHUB_TOKEN']`,
+// `delete process.env['NPM_TOKEN']`): a few names and dots at most, and
+// after it, its key's bracket closed, what may follow it whole (ABSENT_ENDS,
+// not `!process.env['NPM_TOKEN'].length`). After it, the token set
+// (`process.env['NPM_TOKEN'] = token`).
+const KEY_SET = new RegExp(String.raw`^\s{0,4}\]${SET}`, 'u')
+const KEY_ENDS = new RegExp(String.raw`^\s{0,4}\]${ABSENT_ENDS}`, 'mu')
+const KEY_ABSENT = /(?:!|\bdelete\s)[\s(]{0,4}(?:[\p{ID_Continue}$]{1,64}\s{0,4}\??\.\s{0,4}){0,4}[\p{ID_Continue}$]{1,64}\s{0,4}(?:\?\.\s{0,4})?\[\s{0,4}$/u
+// A string's text as JavaScript reads it, its escapes decoded (`\x2f`,
+// `\u002f`, `\u{2f}`, sloppy mode's octal `\057`, `\/`, `\\`, `\n`, `\t`), a
+// line continued (a backslash before a line's end) joined: what a URL in it
+// spells, however its separators are escaped or its lines broken.
+const ESCAPE = /\\(?:x([\da-f]{2})|u([\da-f]{4})|u\{([\da-f]{1,6})\}|([0-3][0-7]{0,2}|[4-7][0-7]?)|(\r\n|[^]))/giu
+const CONTROLS = new Map([['n', '\n'], ['r', '\r'], ['t', '\t'], ['b', '\b'], ['f', '\f'], ['v', '\v']])
+const LINE_ENDS = new Set(['\n', '\r', '\r\n', '\u2028', '\u2029'])
+const unescaped = text => text.replace(ESCAPE, (escape, hex, unit, point, octal, char) => {
+  if (char !== undefined) return LINE_ENDS.has(char) ? '' : CONTROLS.get(char) ?? char
+  const code = octal === undefined ? Number.parseInt(hex ?? unit ?? point, 16) : Number.parseInt(octal, 8)
+  return code <= 0x10_FFFF ? String.fromCodePoint(code) : escape
+})
+// The registry's host in a string, as JavaScript reads it (unescaped) and a
+// URL's parsing does, its tabs and line breaks gone, as a URL's authority: after two slashes, backslashes URLs take for them too, or
+// after an http(s) scheme's colon (its slashes optional there, as URLs take
+// them), its userinfo between, to its last `@` before the URL's path, query or
+// fragment, quotes and all, 256
+// characters at most, as credentials are, so a URL's every start is read
+// in bounded time (`https://registry.npmjs.org/`, `.npmrc`'s
+// `//registry.npmjs.org/`, `https://${token}@registry.npmjs.org/`,
+// `https:\\\\registry.npmjs.org`, `https:\x2f\x2fregistry.npmjs.org`,
+// `https:registry.npmjs.org`); or starting the string, its whole or before its
+// path, port, query or fragment (npm-profile's `'registry.npmjs.org'`, a URL joined,
+// `'https://' + 'registry.npmjs.org/'`). Not in prose, as anywhere else
+// (`registry.npmjs.org</span>`, `asks registry.npmjs.org`, `[registry.npmjs.org]`,
+// `note:registry.npmjs.org`, `user@registry.npmjs.org`, `docs/registry.npmjs.org`).
+const REGISTRY_HOST = String.raw`registry\.(?:npmjs\.org|yarnpkg\.com)`
+const REGISTRY_URL = new RegExp(String.raw`(?:[/\\]{2}|\bhttps?:[/\\]?)(?:[^/\\?#]{0,256}@)?${REGISTRY_HOST}|^(["'\u0060])${REGISTRY_HOST}(?=\1$|[/:?#])`, 'iu')
+const URL_STRIPPED = /[\t\n\r]/gu
+const HOLDS = [
+  ['credential-files', /(?<![\w$.-])\.(?:npmrc|ssh|aws)(?![\w-])/gu],
+  ['tokens', new RegExp(String.raw`^["'\u0060]${TOKEN_VAR}["'\u0060]$|(?:\$\{?|%)${TOKEN_VAR}(?![\p{ID_Continue}$])`, 'gu')],
+  ['publish', /(?<![\w-])(?:npm|pnpm|yarn)(?:\s+-{1,2}\w[\w-]*(?:=\S*|\s+(?!-)\S+)?){0,8}?\s+publish(?![\w-])|\/-\/whoami(?![\w-])/gu],
+]
+// A module a kind loads: vm, child_process, and libnpmpublish, npm's own
+// publishing.
+const MODULES = [
+  ['vm', /^(["'\u0060])(?:node:)?vm\1$/u],
+  ['child-process', /^(["'\u0060])(?:node:)?child_process\1$/u],
+  ['publish', /^(["'\u0060])libnpmpublish\1$/u],
+]
+// A string a program is run with publishing (`spawn('npm', ['publish'])`),
+// after the one naming it, its options and their values between
+// (`['--tag', 'next', 'publish']`), and a request's method set to PUT
+// (`{ method: 'PUT' }`, `options.method = 'put'`).
+const PROGRAM = /^(["'\u0060])(?:npm|pnpm|yarn)\1$/u
+const PUBLISH = /^(["'\u0060])publish\1$/u
+const OPTION = /^(["'\u0060])-/u
+const ARGUMENTS_BETWEEN = new RegExp(String.raw`^(?:[\s,[]|${COMMENT})*$`, 'u')
+const PUT = /^(["'\u0060])put\1$/iu
+const METHOD = new RegExp(String.raw`\bmethod["']?${GAP}[:=]${GAP}$`, 'u')
+// What comes before a module's name where code loads it: `require(` (or
+// `require?.(`), a bundler's `__require(` or `__non_webpack_require__(`,
+// `import(`, `import` and `from`, comments allowed between
+// (`import(/* webpackIgnore: true */ …)`); a name not loaded, as in a list of
+// node's modules, is none, nor one a type-only import or export names
+// (`import type { … } from`, `import type cp = require(`, comments allowed as
+// in a load), which TypeScript erases (`import type from` imports a default
+// named type, `import type = require(` one named so).
+const LOADS = new RegExp(String.raw`(?:(?:require[\w$]*${GAP}(?:\?\.${GAP})?|\bimport${GAP})\(|\b(?:from|import))${GAP}$`, 'u')
+const TYPE_ONLY = new RegExp(String.raw`\b(?:import|export)${GAP}type\b(?!${GAP}(?:from\b|=))[^;'"\x60]*(?:\bfrom|=${GAP}require${GAP}\()${GAP}$`, 'u')
+
+// Each kind, in the order its tags show: its tag, what it does, its name in
+// the tag's tooltip, a row of its own where kinds share the tag (a string run
+// as code by any way, `eval`'s; a credential file or token, `credentials`'),
+// and for one marked as worse than the others' warning, `critical`: the whole
+// environment read out, and publishing.
+const AS_CODE = { tag: 'eval', note: 'Runs a string as code' }
+const CREDENTIALS = { tag: 'credentials', note: 'Reaches for credentials' }
+export const RUNS_CODE = new Map([
+  ['eval', { ...AS_CODE, name: 'eval' }],
+  ['function', { ...AS_CODE, name: 'Function' }],
+  ['vm', { ...AS_CODE, name: 'vm' }],
+  ['compile', { ...AS_CODE, name: 'Module._compile' }],
+  ['child-process', { tag: 'child_process', note: 'Runs other programs', name: 'child_process' }],
+  ['credential-files', { ...CREDENTIALS, name: '.npmrc, .ssh or .aws' }],
+  ['tokens', { ...CREDENTIALS, name: 'NPM_TOKEN or GITHUB_TOKEN' }],
+  ['env', { tag: 'whole env', note: 'Reads out the whole environment', name: 'process.env, by JSON.stringify, Object.entries or values, URLSearchParams', mark: 'critical' }],
+  ['publish', { tag: 'publish', note: 'Publishes to npm', name: 'npm publish, /-/whoami or a registry PUT', mark: 'critical' }],
+])
+
+// The kinds a file's code holds, each with the lines it is on, of the first
+// NPM_MAX_FOUND places it does each, in RUNS_CODE's order; null for none, or
+// for a file that is no script.
+export function npmRunsCode(path, text) {
+  if (!npmIsScript(path, text)) return null
+  const found = new Map()
+  const at = (kind, offset) => {
+    const offsets = found.get(kind)
+    if (!offsets) found.set(kind, [offset])
+    else if (offsets.length < NPM_MAX_FOUND) offsets.push(offset)
+  }
+  read(text, 0, at)
+  // A PUT request publishing where the file names the registry.
+  if (found.has('registry')) for (const offset of found.get('put') ?? []) at('publish', offset)
+  if (![...RUNS_CODE.keys()].some(kind => found.has(kind))) return null
+  const line = lineOf(text)
+  return new Map([...RUNS_CODE.keys()].filter(kind => found.has(kind)).map(kind => [kind, [...new Set(found.get(kind).map(line))].toSorted((a, b) => a - b)]))
+}
+
+// Where code (a file's, or a template literal's substitution's, at `base` in
+// the file) does a kind, as at(kind, offset), in order: its code's, what its
+// strings hold, a string naming a module where it is loaded, and what a
+// template literal's substitutions (`${eval(x)}`) do, code again, read as its
+// own; a PUT request (`put`) and the registry's host (`registry`) as their
+// own, for the file to pair. Most code says none of it at all, told before
+// anything is read.
+function read(code, base, at) {
+  if (!SAYS_ANY.test(code)) return
+  // Where the string before ends; whether the strings since a program's name
+  // are its arguments, an option or its value each, and whether the last is
+  // an option.
+  let end = 0, option = false, program = false
+  for (const { 0: token, 1: string, groups, index } of code.matchAll(READS)) {
+    if (string === undefined) {
+      for (const kind of CODE_KINDS) if (groups[kind]) at(kind, base + index)
+      continue
+    }
+    if (string[0] === '/') continue
+    const inner = string[0] === '`' && SAYS_ANY.test(string) ? substitutions(string) : []
+    for (const [from, to] of inner) read(string.slice(from, to), base + index + from, at)
+    // What a string holds, a template's text alone, its substitutions' code
+    // read as code, its comments and regular expressions aside.
+    const text = inner.length === 0 ? string : textOf(string, inner)
+    // A token's name as the string's whole (`within` 0, its quote) is a key,
+    // not one where its absence is told, it is dropped or only set.
+    const keyed = () => {
+      const after = code.slice(index + token.length, index + token.length + 20)
+      return !KEY_SET.test(after) && (!KEY_ENDS.test(after) || !KEY_ABSENT.test(code.slice(Math.max(0, index - 300), index)))
+    }
+    const held = HOLDS_ANY.test(text) ? HOLDS.flatMap(([kind, holds]) => [...text.matchAll(holds)].map(({ index: within }) => [kind, within])) : []
+    for (const [kind, within] of held) if (kind !== 'tokens' || within > 0 || keyed()) at(kind, base + index + within)
+    if (text.includes('registry.') && REGISTRY_URL.test(unescaped(text).replace(URL_STRIPPED, ''))) at('registry', base + index)
+    for (const [kind, name] of MODULES) if (name.test(string) && loaded(code, index)) at(kind, base + index)
+    if (program && ARGUMENTS_BETWEEN.test(code.slice(end, index))) {
+      if (PUBLISH.test(string)) at('publish', base + index)
+      program = OPTION.test(string) || option
+      option = OPTION.test(string)
+    } else program = false
+    if (PROGRAM.test(string)) [program, option] = [true, false]
+    if (PUT.test(string) && METHOD.test(code.slice(Math.max(0, index - 300), index))) at('put', base + index)
+    end = index + token.length
+  }
+}
+
+// The kinds code itself does, by READS' groups.
+const CODE_KINDS = ['eval', 'function', 'compile', 'tokens', 'env', 'put']
+
+// Whether the string at `index` in code names a module where it is loaded.
+function loaded(code, index) {
+  const before = code.slice(Math.max(0, index - 300), index)
+  return LOADS.test(before) && !TYPE_ONLY.test(before)
+}
+
+// A template literal with its substitutions' code blanked, its text in place.
+function textOf(template, inner) {
+  const parts = []
+  let from = 0
+  for (const [start, end] of inner) {
+    parts.push(template.slice(from, start), ' '.repeat(end - start))
+    from = end
+  }
+  parts.push(template.slice(from))
+  return parts.join('')
+}
+
+// Where each of a template literal's substitutions' code starts and ends, in
+// it: from its `${` to the `}` that closes it.
+function substitutions(template) {
+  const found = []
+  for (let i = template.indexOf('${'); i !== -1; i = template.indexOf('${', i)) {
+    // Escaped by an odd run of backslashes before it (`\${`, not `\\${`).
+    let run = 0
+    while (template[i - 1 - run] === '\\') run++
+    if (run % 2 === 1) {
+      i += 2
+      continue
+    }
+    const end = closing(template, i + 2)
+    found.push([i + 2, end])
+    i = end
+  }
+  return found
+}
+
+// A string, regular expression or comment where it starts, told as
+// JS_STRING_OR_COMMENT tells them in a whole text.
+const TOKEN = new RegExp(JS_STRING_OR_COMMENT.source, 'muy')
+
+// Where the `}` closing code from `from` in a text is, or the text's end for
+// none: the first its braces leave unbalanced, those in its strings, regular
+// expressions and comments aside (`${/* } */ x}`, `${/}/.test(x)}`).
+function closing(text, from) {
+  let depth = 0
+  for (let at = from; at < text.length; at++) {
+    const char = text[at]
+    // Tried where a token can start: a quote, a slash, or a run of blanks, a
+    // comment's leading blanks taken from where they start.
+    if ('"\'`/ \t'.includes(char)) {
+      TOKEN.lastIndex = at
+      const token = TOKEN.exec(text)
+      if (token) {
+        at += token[0].length - 1
+        continue
+      }
+    }
+    if (char === '{') depth++
+    else if (char === '}' && depth-- === 0) return at
+  }
+  return text.length
+}
+
+// What `found` holds (npmRunsCode's kinds, hosts.js's services) that
+// `was` didn't, each with its lines: what is new to a file, as its tags say,
+// `was` null for one the version compared with didn't hold, or held none in.
+// Null for none.
+export function npmFoundAdded(found, was) {
+  if (!found) return null
+  const added = new Map([...found].filter(([kind]) => !was?.has(kind)))
+  return added.size > 0 ? added : null
+}
+
+// The kinds any of `founds` holds, as their tags name them, in their order,
+// a tag kinds share once: `eval, child_process`.
+export const npmRunsCodeKinds = founds => [...new Set([...RUNS_CODE].filter(([kind]) => founds.some(found => found.has(kind))).map(([, { tag }]) => tag))].join(', ')
+
+// What `found` holds (npmRunsCode's) but the kinds whose tags `tags` names,
+// each with its lines; null for none.
+export function npmRunsCodeWithout(found, tags) {
+  const kept = new Map([...found ?? []].filter(([kind]) => !tags.has(RUNS_CODE.get(kind).tag)))
+  return kept.size > 0 ? kept : null
+}
+
+// Its tags as a file's flags (file-flags.js), in their order, each once: a
+// warning's (`high`), or for one marked worse, `critical`; none for none.
+export const npmRunsCodeFlags = found => [...new Map([...found?.keys() ?? []].map(kind => RUNS_CODE.get(kind))
+  .map(({ tag, mark }) => [tag, { name: tag, severity: mark ?? 'high' }])).values()]
+

package/risk/files/script.js

@@ -0,0 +1,114 @@
+// How a script's text is read, for risk's readers of a file
+// (readability.js, runs-code.js, hosts.js): JavaScript's and CSS's strings,
+// regular expressions and comments, set apart from their code, what of their
+// blanks a minifier drops, which files are scripts node runs, and each
+// offset's line.
+
+// Code minified into lines shorter than NPM_LONG_LINE: outside its strings and
+// comments (`/* @__PURE__ */`), its lines average more than anyone writes and
+// next to none of its spaces are ones a minifier drops. Told only in what
+// minifiers write, as GitHub Linguist tells minified files only in JavaScript
+// and CSS, each by its strings and comments (matched in one pass, so that
+// neither starts inside the other, a comment with the spaces around it) and
+// the spaces it can do without.
+export const MINIFIED_AVERAGE = 110
+const MINIFIED_SPACES = .01
+// What a regular expression set aside holds.
+const REGEX = '\uE000'
+const JS = {
+  // A hashbang, the file's first line (`#!/usr/bin/env node`), a comment,
+  // after a byte order mark too, which node's ES module loader drops first.
+  // A string's or template's escape may be a line continuation (`\` before a
+  // line break, CRLF's whole).
+  // Linear on any text: a regular expression's context looked back on only
+  // before a `/`, a comment's leading blanks taken only from where they
+  // start, and what is left open read to where it would end, a string or a
+  // regular expression its line's end, a template or a comment the text's,
+  // rather than tried again from each later quote or slash.
+  // A regular expression first where a value starts (after `=>`, `...`, an operator or a keyword, not a property: `x.default/2`, `this.#in/2`), so a quote in it (`/["']/`) starts no string.
+  stringOrComment: /((?=\/)(?<=(?:^|\.\.\.|[(,=:[!&|?{};>+\-*/%^<~]|(?<![\p{ID_Continue}$.#])(?:await|case|default|delete|do|else|extends|in|instanceof|new|of|return|throw|typeof|void|yield))[ \t]*)\/(?![/*])(?:[^/\\[\n]|\\.|\[(?:[^\]\\\n]|\\.)*(?:\]|(?=\\?$)))+(?:\/[a-z]*|(?=\\?$))|"(?:[^"\\\n]|\\(?:\r\n|[\s\S]))*(?:"|$)|'(?:[^'\\\n]|\\(?:\r\n|[\s\S]))*(?:'|$)|`(?:[^`\\]|\\(?:\r\n|[\s\S]))*(?:`|(?![\s\S])))|(?<![ \t])[ \t]*(?:\/\*[\s\S]*?(?:\*\/|(?![\s\S]))|\/\/.*|(?<![\s\S])\uFEFF?#!.*)[ \t]*/gmu,
+  // Beside punctuation (`a, b`, `x = 1`), not between two words, as
+  // JavaScript tells a word's characters (`return a`, `var π`, `var \u03c0`),
+  droppable: /(?<![\p{ID_Continue}$\\\u200C\u200D])[ \t]+|[ \t]+(?![\p{ID_Continue}$\\\u200C\u200D])/gu,
+  // nor between two `+`, two `-` or two `/` (`a+ +b` is no `a++b`, `a/ /b/`
+  // no comment), nor after a regular expression before a word (`/a/ in b`).
+  needed: (code, index, run) => ('+-/'.includes(code[index - 1]) && code[index + run.length] === code[index - 1])
+    || (code[index - 2] === REGEX && /[\p{ID_Continue}$\\\u200C\u200D]/u.test(code[index + run.length])),
+}
+const CSS = {
+  // No `//` comments, so `url(https://…)` is code.
+  stringOrComment: /("(?:[^"\\\n]|\\.)*"|'(?:[^'\\\n]|\\.)*')|[ \t]*\/\*[\s\S]*?\*\/[ \t]*/gu,
+  // Beside braces, `;`, `,`, `>`, parentheses, after `:` (`a { color: red }`)
+  // and beside a selector's `+` or `~` (`.a + .b`), not those a selector or a
+  // value needs (`.a .b`, `1px solid #fff`, `a :hover`),
+  droppable: /(?<=[{};,:>(])[ \t]+|[ \t]+(?=[{};,>)!])|(?<=[+~])[ \t]+|[ \t]+(?=[+~])/gu,
+  // nor beside `+` or `~` in parentheses (`calc(1px + var(--x))`) or in a
+  // custom property's value, kept for a `calc()` to come (`--gap:1px + 2px`).
+  needed: (code, index, run, depth) => /[+~]/u.test(code[index - 1] + code[index + run.length])
+    && (depth > 0 || /^\s*--[^:]*:/u.test(code.slice(Math.max(...['{', ';', '}'].map(end => code.lastIndexOf(end, index))) + 1, index))),
+}
+// JavaScript's strings and regular expressions (the first group) and its
+// comments, for a reader that sets them aside (runs-code.js, hosts.js).
+export const JS_STRING_OR_COMMENT = JS.stringOrComment
+export const minifiable = path => /\.[cm]?js$/iu.test(path) ? JS : /\.css$/iu.test(path) ? CSS : null
+// How much of a text is read for how its lines are minified: their average
+// is told by as much of them, and a text of millions of lines is read no
+// further.
+const MINIFIED_READ = 4 * 1024 * 1024
+// Its code's lines' average length where they are minified into short ones,
+// else 0, told by its first MINIFIED_READ characters.
+export function minifiedAverage(whole, { stringOrComment, droppable, needed }) {
+  const text = whole.length > MINIFIED_READ ? whole.slice(0, whole.lastIndexOf('\n', MINIFIED_READ) + 1 || MINIFIED_READ) : whole
+  // Its lines of code alone, as long as what is on them: a comment set aside
+  // leaves nothing but its line breaks, a string or template `""` and its, a
+  // regular expression `/REGEX/`, so the code either side stays apart.
+  const lines = text.replaceAll(stringOrComment, (match, string) => (string === undefined ? '' : string[0] === '/' ? `/${REGEX}/` : '""') + match.replaceAll(/[^\n]/gu, ''))
+    .replaceAll(/^[ \t]+/gmu, '')
+    .split('\n').filter(line => line.trim() !== '')
+  const code = lines.join('\n'), length = code.length - (lines.length - 1)
+  // Counted by character: a run aligning `=` is as many spaces as it is wide.
+  let depth = 0, dropped = 0, scanned = 0
+  for (const { 0: run, index } of code.matchAll(droppable)) {
+    for (; scanned < index; scanned++) depth = Math.max(0, depth + (code[scanned] === '(' ? 1 : code[scanned] === ')' ? -1 : 0))
+    if (!needed(code, index, run, depth)) dropped += run.length
+  }
+  return lines.length > 0 && length > MINIFIED_AVERAGE * lines.length && dropped < MINIFIED_SPACES * length ? Math.round(length / lines.length) : 0
+}
+
+// JavaScript or TypeScript (a declaration file too, which node runs as any
+// other), or a script run by node by its hashbang (`bin/cli`, with no
+// extension), a byte order mark before it or not, as node runs one after it
+// as an ES module (in a `"type": "module"` package).
+const SCRIPT = /\.[cm]?[jt]sx?$/iu
+const NODE_HASHBANG = /^\uFEFF?#!.*\bnode\b/u
+// Whether a file (its path and text) is a script, as SCRIPT and NODE_HASHBANG tell.
+export const npmIsScript = (path, text) => typeof text === 'string' && (SCRIPT.test(path) || NODE_HASHBANG.test(text))
+// How many places a file is told doing a thing, the first ones, at most
+// (runs-code.js, hosts.js): a file doing it on millions of lines is told by
+// its first, and what it holds of them kept to a bound however many there
+// are.
+export const NPM_MAX_FOUND = 100
+// Every how many line breaks one is kept where lineOf counts from.
+const LINE_MARK = 1024
+// Each offset in a text as its line: one more than the line breaks before it,
+// counted on from the nearest of every LINE_MARKth, which alone are kept.
+export function lineOf(text) {
+  let marks = null
+  return offset => {
+    if (!marks) {
+      marks = []
+      for (let at = text.indexOf('\n'), count = 0; at !== -1; at = text.indexOf('\n', at + 1), count++) if (count % LINE_MARK === 0) marks.push(at)
+    }
+    let high = marks.length, low = 0
+    while (low < high) {
+      const middle = (low + high) >> 1
+      if (marks[middle] < offset) low = middle + 1
+      else high = middle
+    }
+    if (low === 0) return 1
+    let breaks = (low - 1) * LINE_MARK + 1
+    for (let at = text.indexOf('\n', marks[low - 1] + 1); at !== -1 && at < offset; at = text.indexOf('\n', at + 1)) breaks++
+    return breaks + 1
+  }
+}
+

package/risk/files/stamps.js

@@ -0,0 +1,46 @@
+// A file's stamps: what risk reads of one file (the readers beside this), and
+// what of it calls for a look, as a list of files tags it and orders it by:
+// each `{ name, severity }`, its tag's text and how severe it is (SEVERITIES).
+import { READABILITY, npmFileReadability, npmLabelMark, npmLargeCode, npmReadabilityLabels, npmTaggedCategory } from './readability.js'
+import { npmExfiltration, npmHostSeverity, npmHostTags, npmHosts } from './hosts.js'
+import { npmRunsCode, npmRunsCodeFlags } from './runs-code.js'
+
+// How severe a stamp or a finding is, the most first: `critical` red,
+// `high` a warning's orange, `moderate` yellow, `low`, and a `notice`, under
+// a low one.
+export const SEVERITIES = ['critical', 'high', 'moderate', 'low', 'notice']
+
+// A label's mark (readability.js READABILITY) as a severity: a warning's
+// orange, or a notice.
+const severityOf = mark => mark === 'warn' ? 'high' : 'notice'
+
+// A file's stamps, from what was read of it: what its code does beyond
+// itself (runs-code.js npmRunsCodeFlags), a warning's or, for the whole
+// environment read out and publishing, critical; the services it names
+// (hosts.js), a stamp a tag, at the tag's severity (Exfiltration critical,
+// Remote high, IP lookup moderate); a large code file, a notice; an
+// obfuscator's fingerprint, a warning's; and its control characters, long
+// lines and category, by their marks, but for what reads as most files do
+// (UTF-8, ASCII) and a source map.
+function npmStampsOf({ path, bytes, readability, runsCode, exfiltration }) {
+  const category = npmTaggedCategory(readability)
+  const listed = category !== 'ascii' && category !== 'map' && READABILITY.get(category).mark
+  return [...npmRunsCodeFlags(runsCode),
+    ...npmHostTags(exfiltration).map(([tag, services]) => ({ name: tag, severity: npmHostSeverity(tag, services) })),
+    ...npmLargeCode(path, bytes) ? [{ name: 'Large', severity: 'notice' }] : [],
+    ...readability.obfuscation ? [{ name: 'Obfuscated', severity: 'high' }] : [],
+    ...npmReadabilityLabels(readability).filter(label => label === 'controls' || label === 'long')
+      .map(label => ({ name: READABILITY.get(label).tag, severity: severityOf(npmLabelMark(readability, label)) })),
+    ...listed ? [{ name: READABILITY.get(category).tag, severity: severityOf(listed) }] : []]
+}
+
+// Everything risk reads of a file (`path`, its `text`, null for one that
+// isn't, and its size in `bytes`): how it reads (npmFileReadability), what
+// its code does beyond itself (npmRunsCode), the services it names under the
+// hosts' tags (npmExfiltration) and the hosts its code names (npmHosts), and its
+// `stamps` (npmStampsOf).
+export function npmFileRisk(path, text, bytes) {
+  const readability = npmFileReadability(path, text)
+  const exfiltration = npmExfiltration(path, text), runsCode = npmRunsCode(path, text)
+  return { readability, runsCode, exfiltration, hosts: npmHosts(path, text), stamps: npmStampsOf({ path, bytes, readability, runsCode, exfiltration }) }
+}