@preventive/triage 1.0.0-alpha.40 → 1.0.0-alpha.41

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@preventive/triage",
-  "version": "1.0.0-alpha.40",
+  "version": "1.0.0-alpha.41",
   "description": "Client & relay server for triaging of automated reports",
   "license": "MIT OR Apache-2.0",
   "author": {
@@ -282,6 +282,7 @@
     "risk/npm/old-version.js",
     "risk/npm/registry.js",
     "risk/npm/release.js",
+    "risk/npm/score.js",
     "risk/npm/specs.js",
     "risk/npm/tarball.js",
     "client/dependency-paths.d.ts",

package/risk/files/runs-code.js

@@ -1,9 +1,17 @@
 // What a file's code can do beyond itself, for a reviewer: run a string as
 // code (eval, Function with new or without, node:vm, Module's _compile) or
 // other programs (child_process), reach for credentials (a credential file's
-// path, a token's name) or the whole environment, and publish to npm (`npm
-// publish`, `/-/whoami`, a registry PUT), as a file's stamps say
-// (stamps.js) and a version's findings name what is new to a file.
+// path, a token's name, `gh auth token`, the cloud's instance metadata, the
+// GitHub Actions runner's process or another process's memory, trufflehog)
+// or the whole environment, publish to npm (`npm publish`, `/-/whoami`, a
+// registry PUT), run a shell command fetching or handing off code (`curl …
+// https://…`, `| sh`, `powershell -…`, rundll32, osascript, `/dev/tcp/`),
+// and name a place code runs from again later (a shell's rc file,
+// LaunchAgents, systemd's user units, `.claude/settings.json`,
+// `.vscode/tasks.json`), as a file's stamps say (stamps.js) and a version's
+// findings name what is new to a file. A shell script (`.sh`, `.bat`, `.ps1`
+// …, or a shell's hashbang) is read whole for the last two and the
+// credentials a command reaches for, its text its commands.
 // A quick read, not a parse: a script's code with its strings, regular
 // expressions and comments set aside as script.js tells them, its
 // strings read for the paths, names and commands they hold, a module by the
@@ -52,8 +60,31 @@ const PICKED = String.raw`${GAP}\)${GAP}\??\.${GAP}(?:filter|find|findLast|some|
 const COPY = String.raw`(?:\{${GAP}\.\.\.${GAP})?`
 const ENV_WHOLE = String.raw`(?=JSON|Object|URLSearchParams)(?<![\p{ID_Continue}$.])(?:JSON${GAP}\.${GAP}stringify|URLSearchParams)${GAP}\(${GAP}${COPY}${ENV}`
   + String.raw`|(?=Object)(?<![\p{ID_Continue}$.])Object${GAP}\.${GAP}(?:values|entries)${GAP}\(${GAP}${COPY}${ENV}(?!${PICKED})`
-// Any of RUNS_CODE, as a text may say it.
-const SAYS_ANY = new RegExp(String.raw`eval|Function${FUNCTION_CALLED}|vm["'\x60]|_compile|child_process|\.(?:npmrc|ssh|aws)|_TOKEN|(?:stringify|values|entries|URLSearchParams)${GAP}\(${GAP}(?:\{${GAP}\.\.\.${GAP})?process${GAP}\.${GAP}env|publish|whoami|registry\.(?:npmjs\.org|yarnpkg\.com)`, 'u')
+// What a shell command, and a place code runs from again later, may say
+// (SHELL, PERSISTENCE), and what of the credentials is told in any case:
+// trufflehog (TRUFFLEHOG), GCP's metadata host, and a string naming gh
+// (`'gh'`, `'/usr/bin/gh'`, `'GH.EXE'`) as a program run with its arguments
+// apart is, whatever is between them (`'gh', ['auth', /* … */ 'token']`).
+// A shell, as a hashbang or a pipe names it (`#!/bin/ksh`, `| fish`,
+// BusyBox's `ash`, `| powershell`); after a pipe, by its path or env's too (`| /bin/sh`,
+// `| /usr/bin/env bash`), env's options, their values, and settings before
+// it on its line (`env -S`, `env -u NAME`, `env MODE=x`).
+const SHELLS = String.raw`(?:(?:ba|z|da|k|mk|c|tc|fi|a)?sh|pwsh|powershell)`
+const SHELL_PATH = String.raw`(?:(?:\/[\w.-]{1,40}){0,8}\/)?(?:env(?:[^\S\n]+(?:-[\w-]{1,20}(?:=\S{0,100}|[^\S\n]+(?!-)[^\s=]{1,100})?|\w{1,40}=\S{0,100})){0,6}[^\S\n]+)?`
+const SHELL_OR_PLACE = String.raw`curl|wget|\|\s*(?:sudo|${SHELL_PATH}${SHELLS})|powershell|pwsh|rundll32|osascript|mshta|certutil|bitsadmin|\/dev\/(?:tcp|udp)|iex|invoke-expression`
+  + String.raw`|\$profile|profile\.ps1|config\.fish|conf\.d|bashrc|zshrc|zshenv|zlogin|bash_profile|bash_login|zprofile|\.profile|Launch(?:Agents|Daemons)|systemd|systemctl|\.claude|\.vscode|trufflehog|metadata\.google\.internal|["'\x60\/\\]gh(?:\.exe)?["'\x60]`
+// What says one of the credentials a command, an endpoint or a process holds
+// (HOLDS' gh-token, cloud-metadata, runner-worker and process-memory), as
+// code and its strings may say it, in the case it is written: `gh auth
+// token`'s command, lowercase as gh reads it, the metadata endpoint's
+// address, `Runner.Worker` and `/proc/`; what is told in any case is
+// SHELL_OR_PLACE's.
+const SAYS_CREDENTIALS = String.raw`auth(?:[^\S\n]|[\\^\x60]\r?\n)+token|169\.254\.169\.254|Runner\.Worker|\/proc\/`
+// Any of RUNS_CODE, as a text may say it: a shell command or a place in any
+// case, as Windows' are written (`PowerShell`, `RUNDLL32`).
+const SAYS_SHELL_OR_PLACE = new RegExp(SHELL_OR_PLACE, 'iu')
+const SAYS_CODE = new RegExp(String.raw`eval|Function${FUNCTION_CALLED}|vm["'\x60]|_compile|child_process|\.(?:npmrc|ssh|aws)|_TOKEN|${SAYS_CREDENTIALS}|(?:stringify|values|entries|URLSearchParams)${GAP}\(${GAP}(?:\{${GAP}\.\.\.${GAP})?process${GAP}\.${GAP}env|publish|whoami|registry\.(?:npmjs\.org|yarnpkg\.com)`, 'u')
+const SAYS_ANY = { test: text => SAYS_CODE.test(text) || SAYS_SHELL_OR_PLACE.test(text) }
 
 // A name read as one, not as a property's (`vm.eval`, `vm . eval`, a spread's
 // `...eval` aside) or part of another's (`evaluate`), or as the global
@@ -103,12 +134,16 @@ const READS = new RegExp(String.raw`${JS_STRING_OR_COMMENT.source}|(?<eval>${nam
 // `.sshd`); a token's name where it is read, the string the name alone (a
 // key, `process.env['GITHUB_TOKEN']`) or the name expanded (a shell's or
 // .npmrc's `$GITHUB_TOKEN`, `${NPM_TOKEN}`, cmd's `%NPM_TOKEN%`), not where
-// text names it (`requires a token in GITHUB_TOKEN`); a command publishing (`npm publish`, `pnpm
+// text names it (`requires a token in GITHUB_TOKEN`); a credential a
+// command, an endpoint or a process holds (`gh auth token`, the cloud's
+// metadata endpoint, `Runner.Worker`, `/proc/<pid>/mem`, trufflehog, as
+// HOLDS tells them); a command publishing (`npm publish`, `pnpm
 // publish …`, options before it as npm takes them, `npm --tag next publish`)
 // or the registry's who-am-I, a publisher's first step with a token. And the
 // registry, where a PUT request is one publishing (REGISTRY_URL).
 // Told first of a string by what any of them says.
-const HOLDS_ANY = /\.(?:npmrc|ssh|aws)|_TOKEN|publish|whoami|registry\./u
+const HOLDS_CODE = new RegExp(String.raw`\.(?:npmrc|ssh|aws)|_TOKEN|${SAYS_CREDENTIALS}|publish|whoami|registry\.`, 'u')
+const HOLDS_ANY = { test: text => HOLDS_CODE.test(text) || SAYS_SHELL_OR_PLACE.test(text) }
 // Before a token's name as a key, its absence told or the token dropped, as
 // TOKEN_NAME tells of one as a name (`!process.env['GITHUB_TOKEN']`,
 // `delete process.env['NPM_TOKEN']`): a few names and dots at most, and
@@ -147,11 +182,151 @@ const unescaped = text => text.replace(ESCAPE, (escape, hex, unit, point, octal,
 const REGISTRY_HOST = String.raw`registry\.(?:npmjs\.org|yarnpkg\.com)`
 const REGISTRY_URL = new RegExp(String.raw`(?:[/\\]{2}|\bhttps?:[/\\]?)(?:[^/\\?#]{0,256}@)?${REGISTRY_HOST}|^(["'\u0060])${REGISTRY_HOST}(?=\1$|[/:?#])`, 'iu')
 const URL_STRIPPED = /[\t\n\r]/gu
+// A shell command fetching or handing off code: curl or wget given a URL
+// (`curl -fsSL https://…`, `ftp://`, `https:\/\/` as a string may escape
+// it), long options before it too (`-H "Authorization: …"`), a quoted
+// argument's `;`, `|` and `&` no command's end (`-d "a=1&b=2"`), its line
+// continued too (`curl -fsSL \⏎ https://…`, `curl\⏎`, cmd's `^`,
+// PowerShell's backtick), not the next line's, the next command's (`curl
+// --version; echo https://…`) nor the next curl's, a download piped to a
+// shell (`… | sh`, `payload|sudo -E -- bash`, `| ksh`, `| /bin/sh`, `cat
+// hash | sh`, not a list of shells, `bash|zsh|sh`, a regular expression's
+// alternatives, `(x|ss|sh)$`, nor `|| sh`, nor an escaped pipe, grep's
+// `'bash\|zsh'`), PowerShell given options (`powershell -nop -enc …`),
+// rundll32, osascript and mshta, certutil fetching (`certutil -urlcache -f
+// http://…`) and bitsadmin's `/transfer`, and bash's network redirection
+// (`/dev/tcp/host/port`), and PowerShell running what it fetches (`iex (iwr
+// https://…).Content`, `irm https://… | iex`, long options before the pipe
+// too, `iwr … -Headers @{…} | iex`, `IEX (New-Object
+// Net.WebClient).DownloadString(…)`), its line continued by a backtick too,
+// not the next pipeline's, `iex $x && iwr …`); in any case, as Windows' are
+// written, and by its path (`/usr/bin/curl`).
+const CONTINUED = String.raw`[\\^\u0060]\r?\n`
+const ON_ITS_LINE = String.raw`(?:[^\n;|&]|${CONTINUED})`
+// PowerShell's own, its backtick alone (not `\⏎`, a new statement there).
+const POWERSHELL_CONTINUED = String.raw`\u0060\r?\n`
+// A command's text up to its end, its arguments' quotes kept, a quote left
+// open (`it's`) as any other character.
+const ARGUMENTS = String.raw`(?:[^\n;|&"']|${CONTINUED}|"[^"\n]*"|'[^'\n]*'|"(?![^"\n]*")|'(?![^'\n]*'))`
+const APART = String.raw`(?:[^\S\n]|${CONTINUED})`
+// A command's options, a few, and their values (`-E`, `-u root`, `--now`),
+// on its line or one continued.
+const OPTIONS = String.raw`(?:${APART}+--?\w[\w-]*(?:=\S*|${APART}+(?!-)\S+)?){0,6}?`
+const SHELL = String.raw`(?<![\w.-])(?:curl|wget)(?:\.exe)?${APART}(?:(?!(?:curl|wget)(?![\w-]))${ARGUMENTS}){0,2000}?["']?(?:https?|s?ftps?|scp):\\?\/\\?\/|(?<![|\\]|(?<![\w.\/-])${SHELLS}\s*)\|\s*(?:sudo${OPTIONS}(?:${APART}+--)?${APART}+)?${SHELL_PATH}${SHELLS}(?![\w)|$-])`
+  + String.raw`|(?<![\w.-])(?:powershell|pwsh)(?:\.exe)?[^\S\n]+-\w|(?<![\w.-])(?:rundll32|osascript|mshta)(?:\.exe)?(?![\w-])`
+  + String.raw`|(?<![\w.-])certutil(?:\.exe)?${APART}${ON_ITS_LINE}{0,100}?-urlcache|(?<![\w.-])bitsadmin(?:\.exe)?${APART}${ON_ITS_LINE}{0,100}?\/transfer|\/dev\/(?:tcp|udp)\/`
+  + String.raw`|(?<![\w$.-])(?:iex|invoke-expression)(?![\w-])(?:[^\n;|&]|${POWERSHELL_CONTINUED}){0,200}?(?:(?<![\w$.-])(?:iwr|irm|invoke-webrequest|invoke-restmethod)(?![\w-])|\.downloadstring\s*\()`
+  + String.raw`|(?<![\w$.-])(?:iwr|irm|invoke-webrequest|invoke-restmethod)(?![\w-])(?:(?!(?:iwr|irm|invoke-webrequest|invoke-restmethod)(?![\w-]))(?:[^\n;|&]|${POWERSHELL_CONTINUED})){0,2000}\|\s*(?:iex|invoke-expression)(?![\w-])`
+// A place code runs from again later: a shell's rc file (`~/.bashrc`,
+// `.zshrc`, `.zshenv`, `.zlogin`, `.bash_profile`, `.bash_login`,
+// `.zprofile`, and `.profile` in a path, `~/.profile`, not a selector's
+// class, nor one after another, `.nav`), PowerShell's profile (`$PROFILE`,
+// `Microsoft.PowerShell_profile.ps1`, all hosts' `PowerShell\Profile.ps1`,
+// `$PSHOME\Profile.ps1`, not another folder's), macOS's LaunchAgents and
+// LaunchDaemons, fish's (`~/.config/fish/config.fish`, `conf.d`), systemd's
+// user units (`~/.config/systemd/user`, `systemctl --user enable`, other
+// options before it, `--now`, or `--user` after it in its command,
+// `systemctl enable --user`; not `start`, which runs a unit once), and the
+// settings an AI agent or an editor runs commands from on its own
+// (`.claude/settings.json`, `.vscode/tasks.json`); in any case, as Windows'
+// and macOS's paths are, a path's separator a slash or a backslash, escaped
+// in a string as code writes it (`"\\.claude\\settings.json"`, `\/`).
+const SEPARATOR = String.raw`(?:\\?\/|\\{1,2})`
+const PERSISTENCE = String.raw`(?<![\w.-])\.(?:bashrc|zshrc|zshenv|zlogin|bash_profile|bash_login|zprofile)(?![\w-])|(?<=[\/\\])(?<!\.[\w-]*[\/\\])\.profile(?![\w-])|(?<![\w-])Launch(?:Agents|Daemons)(?![\w-])|systemd${SEPARATOR}user(?![\w-])|fish${SEPARATOR}(?:config\.fish|conf\.d)(?![\w-])`
+  + String.raw`|(?<![\w$])\$profile(?![\w-])|(?<![\w.-])Microsoft\.\w+_profile\.ps1(?![\w-])|(?:PowerShell|\$pshome)${SEPARATOR}profile\.ps1(?![\w-])|systemctl${OPTIONS}${APART}+--user${OPTIONS}${APART}+enable(?![\w-])|systemctl${OPTIONS}${APART}+enable(?:${APART}+[^\s;|&]+){0,6}?${APART}+--user(?![\w-])|(?<![\w.-])\.claude${SEPARATOR}settings(?:\.local)?\.json|(?<![\w.-])\.vscode${SEPARATOR}tasks\.json`
+// Credentials a command, an endpoint or a process holds, as recent npm
+// malware reached for them: the GitHub CLI printing its token (`gh auth
+// token`, by its path too, `gh.exe`, its name in any case as Windows runs
+// it, `GH.EXE`, its line continued as a shell command's, `gh auth \⏎
+// token`), not its other commands (`gh auth status`); the cloud's
+// instance metadata endpoint, AWS's, Azure's and GCP's
+// (`http://169.254.169.254/latest/meta-data/…`, `metadata.google.internal`,
+// in any case as DNS reads it), as a host whole (HOST_START, HOST_END): not
+// an address or a host either starts or ends (`169.254.169.2540`,
+// `foo-169.254.169.254`, `169.254.169.254.example.com`,
+// `metadata.google.internal.example.com`; a trailing dot,
+// `metadata.google.internal.`, its host still), nor in a URL's path or
+// userinfo (`https://example.com/169.254.169.254`,
+// `https://169.254.169.254@example.com`; WHATWG's `\@` a path's, its host
+// the address still), nor Azure's instance metadata
+// (`169.254.169.254/metadata/instance/compute`, after a port too, `:80`, its
+// slashes escaped too, `\/`), a machine's region and size, not its
+// identity's token, as msal asks it; the GitHub Actions runner's process
+// (`Runner.Worker`, `Runner.Worker.exe`, `GitHub.Runner.Worker`), whose
+// memory holds a job's secrets, not in another name (`MyRunner.Worker`,
+// `Runner.Workers`) nor case (`runner.worker`); another process's memory, by
+// its pid's digits or a glob (`/proc/1234/mem`, `/proc/*/mem`,
+// `/proc/[0-9]*/mem`) or a substitution (`/proc/${pid}/mem`, a shell's
+// `$pid`, `$(pgrep …)` and backticks, Python's `{pid}`, a format's `%d`),
+// not a process's own (`/proc/self/mem`) nor what else /proc tells of one
+// (`/proc/1234/status`); and trufflehog, a scanner for secrets, in any case
+// (`TruffleHog`), not in another name (`trufflehogs`, `TRUFFLEHOG_VERSION`).
+const GH_TOKEN = String.raw`(?<![\w.-])[gG][hH](?:\.[eE][xX][eE])?${APART}+auth${APART}+token(?![\w-])`
+const PID = String.raw`[\d*?[\]-]{1,20}|\$\{[^}\n]{0,100}\}|\$\([^)\n]{0,200}\)|\u0060[^\u0060\n]{0,200}\u0060|\$\w{1,64}|\{\w{0,64}\}|%d`
+// A host whole, a URL's or alone: not after a word, a dot or a hyphen, nor a
+// path's slash (`https://example.com/169.254.169.254`), a URL's two
+// (`//`, `\/\/`) its start after a scheme's colon or alone
+// (`//169.254.169.254`), not after a path's character
+// (`https://example.com//169.254.169.254`); nor before more of a name or
+// userinfo's `@` (`https://169.254.169.254@example.com`, `…:password@`).
+const HOST_START = String.raw`(?<![\w.-]|(?<![\/\\])\/|[\w.~%-](?:\\?\/){2})`
+const HOST_END = String.raw`(?![\w-]|\.[\w-]|(?::[^\s\/@'"\x60]{0,64})?@)`
+const TRUFFLEHOG = String.raw`(?<![\p{ID_Continue}$-])trufflehog(?![\p{ID_Continue}$-])`
 const HOLDS = [
   ['credential-files', /(?<![\w$.-])\.(?:npmrc|ssh|aws)(?![\w-])/gu],
   ['tokens', new RegExp(String.raw`^["'\u0060]${TOKEN_VAR}["'\u0060]$|(?:\$\{?|%)${TOKEN_VAR}(?![\p{ID_Continue}$])`, 'gu')],
+  ['gh-token', new RegExp(GH_TOKEN, 'gu')],
+  ['cloud-metadata', new RegExp(String.raw`${HOST_START}169\.254\.169\.254${HOST_END}(?!(?::\d{1,5})?\\?\/metadata\\?\/instance(?![\w-]))|${HOST_START}metadata\.google\.internal${HOST_END}`, 'giu')],
+  ['runner-worker', /(?<![\w$-])Runner\.Worker(?![\w$-])/gu],
+  ['process-memory', new RegExp(String.raw`\/proc\/(?:${PID})\/mem(?![\w-])`, 'gu')],
+  ['trufflehog', new RegExp(TRUFFLEHOG, 'giu')],
   ['publish', /(?<![\w-])(?:npm|pnpm|yarn)(?:\s+-{1,2}\w[\w-]*(?:=\S*|\s+(?!-)\S+)?){0,8}?\s+publish(?![\w-])|\/-\/whoami(?![\w-])/gu],
+  ['shell', new RegExp(SHELL, 'giu')],
+  ['persistence', new RegExp(PERSISTENCE, 'giu')],
 ]
+// What a shell script holds, read whole: its commands, the places they write
+// to, and the credentials a command, a process or its memory holds (`gh auth
+// token`, `Runner.Worker`, `/proc/<pid>/mem`, trufflehog); not the cloud's
+// metadata endpoint, whose fetching is a shell command already (`curl
+// http://169.254.169.254/…`) and which a script provisioning a machine asks
+// its region and id, nor a credential file or a token, which a script
+// publishing a package names.
+const SHELL_KINDS = new Set(['gh-token', 'runner-worker', 'process-memory', 'trufflehog', 'shell', 'persistence'])
+const SHELL_HOLDS = HOLDS.filter(([kind]) => SHELL_KINDS.has(kind))
+// A shell script, by its extension, its name a shell's startup file's
+// (`.bashrc`, `.profile`), or its hashbang: a shell's, by its path or env's,
+// env's options and settings before it (`#!/bin/ksh`, `#!/usr/bin/env -S
+// bash -e`, `#!/usr/bin/env -S MODE=x bash`, `#!/usr/bin/env pwsh`), past a
+// byte order mark.
+const SHELL_SCRIPT = /(?:\.(?:sh|bash|zsh|ksh|mksh|dash|ash|csh|tcsh|fish|command|bat|cmd|ps1|psm1)|(?:^|[\\/])\.(?:bashrc|zshrc|zshenv|zlogin|bash_profile|bash_login|zprofile|profile))$/iu
+// A shell script's comment, a line's whole (`# curl … | sh`) or its end
+// after a command (`echo ok # don't curl …`, `echo ok;# …`) where the quotes
+// before it are closed, escapes read (`"a \" b"`, PowerShell's by a
+// backtick), not in one (`"a # b"`), and no other `#` (`$#`, `<#`) is;
+// PowerShell's, by its extension or hashbang, its blocks too (`<# … #>`,
+// opened where a command or value may start, `$x=<# … #>1`, not in a
+// string, `"<#"`, `"a <#"`, to the end where none closes); a batch file's, cmd's `::`
+// and `REM` (`@REM`, and `REM` after `&` or `||`, `echo ok & REM …`); as
+// none of its commands.
+const SHELL_COMMENT = /^[ \t]*#.*$|^((?:[^'"\n#\\]|\\.|'[^'\n]*'|"(?:[^"\n\\]|\\.)*")*?[ \t;&|])#.*$/gmu
+const POWERSHELL = /\.psm?1$/iu
+const POWERSHELL_HASHBANG = /^\uFEFF?#!\s*\S*\/(?:env\s+(?:(?:-\S+|\w+=\S*)\s+)*)?pwsh(?![\w-])/u
+const POWERSHELL_COMMENT = /^((?:[^'"\n#\u0060]|\u0060.|'[^'\n]*'|"(?:[^"\n\u0060]|\u0060.)*")*?)(?:(?<=^|[\s;({=,])<#[\s\S]*?(?:#>|(?![\s\S]))|(?<=^|[ \t;&|])#.*$)/gmu
+const BATCH = /\.(?:bat|cmd)$/iu
+const BATCH_COMMENT = /^[ \t]*@?(?:::|rem(?![\w-])).*$|(?<=&|\|\|)[ \t]*@?rem(?![\w-]).*$/gimu
+const SHELL_HASHBANG = new RegExp(String.raw`^\uFEFF?#!\s*\S*\/(?:env\s+(?:(?:-\S+|\w+=\S*)\s+)*)?${SHELLS}(?![\w-])`, 'u')
+// A directory and a file in it named apart, as path.join takes them
+// (`join(home, '.claude', 'settings.json')`): a place code runs from again
+// later where a file names both.
+const PARTS = [
+  ['claude', /^(["'\u0060])\.claude\1$/iu, /^(["'\u0060])settings(?:\.local)?\.json\1$/iu],
+  ['vscode', /^(["'\u0060])\.vscode\1$/iu, /^(["'\u0060])tasks\.json\1$/iu],
+]
+// `.profile` named apart where the home directory is the part before it
+// (`join(os.homedir(), '.profile')`, `resolve(process.env.HOME, …)`, `'~'`),
+// not a selector's class alone.
+const PROFILE = /^(["'\u0060])\.profile\1$/iu
+const HOME_BEFORE = /(?:homedir\s*\(\s*\)|\b(?:HOME|USERPROFILE)|(["'\u0060])~\1)\s*,\s*$/u
 // A module a kind loads: vm, child_process, and libnpmpublish, npm's own
 // publishing.
 const MODULES = [
@@ -169,6 +344,22 @@ const OPTION = /^(["'\u0060])-/u
 const ARGUMENTS_BETWEEN = new RegExp(String.raw`^(?:[\s,[]|${COMMENT})*$`, 'u')
 const PUT = /^(["'\u0060])put\1$/iu
 const METHOD = new RegExp(String.raw`\bmethod["']?${GAP}[:=]${GAP}$`, 'u')
+// A program run with its arguments apart, by its path too, a Windows one's
+// from its drive with spaces in it (`spawn('curl', ['-fsSL', 'https://…'])`,
+// `execFile('powershell.exe', ['-NoP', '-enc', …])`, `spawn('systemctl',
+// ['--user', 'enable', …])`, `spawnSync('gh', ['auth', 'token'])`,
+// `execFileSync('C:\\Program Files\\GitHub CLI\\gh.exe', …)`): its command
+// line, its arguments' strings after its name, read as a shell command is, a
+// variable's or a property's value between (`['-o', output, 'https://…']`,
+// `outputs[i]`, `options?.out`), its first 20 arguments, however long.
+const COMMAND = /^(["'\u0060])(?:\S*[\\/]|[a-z]:[\\/][^\n]*[\\/])?(?:curl|wget|certutil|bitsadmin|powershell|pwsh|systemctl|gh)(?:\.exe)?\1$/iu
+// An argument a shell would need quoted, its separators no command's end
+// (`'Cookie: a=b; c=d'`), its own double quotes single then.
+const SEPARATES = /[;|&]/u
+const VALUES_BETWEEN = new RegExp(String.raw`^(?:[\s,[\]\w$.?]|${COMMENT})*$`, 'u')
+// A place named by its parts one after the other, as path.join takes them
+// (`join(home, '.config', 'systemd', 'user')`), read as a path is.
+const PLACE = new RegExp(PERSISTENCE, 'iu')
 // What comes before a module's name where code loads it: `require(` (or
 // `require?.(`), a bundler's `__require(` or `__non_webpack_require__(`,
 // `import(`, `import` and `from`, comments allowed between
@@ -182,9 +373,10 @@ const TYPE_ONLY = new RegExp(String.raw`\b(?:import|export)${GAP}type\b(?!${GAP}
 
 // Each kind, in the order its tags show: its tag, what it does, its name in
 // the tag's tooltip, a row of its own where kinds share the tag (a string run
-// as code by any way, `eval`'s; a credential file or token, `credentials`'),
-// and for one marked as worse than the others' warning, `critical`: the whole
-// environment read out, and publishing.
+// as code by any way, `eval`'s; a credential file, a token, a command, an
+// endpoint or a process, `credentials`'), and for one marked as worse than
+// the others' warning, `critical`: the whole environment read out,
+// publishing, and a place code runs from again later.
 const AS_CODE = { tag: 'eval', note: 'Runs a string as code' }
 const CREDENTIALS = { tag: 'credentials', note: 'Reaches for credentials' }
 export const RUNS_CODE = new Map([
@@ -195,24 +387,44 @@ export const RUNS_CODE = new Map([
   ['child-process', { tag: 'child_process', note: 'Runs other programs', name: 'child_process' }],
   ['credential-files', { ...CREDENTIALS, name: '.npmrc, .ssh or .aws' }],
   ['tokens', { ...CREDENTIALS, name: 'NPM_TOKEN or GITHUB_TOKEN' }],
+  ['gh-token', { ...CREDENTIALS, name: 'gh auth token' }],
+  ['cloud-metadata', { ...CREDENTIALS, name: '169.254.169.254 or metadata.google.internal' }],
+  ['runner-worker', { ...CREDENTIALS, name: 'Runner.Worker' }],
+  ['process-memory', { ...CREDENTIALS, name: '/proc/<pid>/mem' }],
+  ['trufflehog', { ...CREDENTIALS, name: 'trufflehog' }],
   ['env', { tag: 'whole env', note: 'Reads out the whole environment', name: 'process.env, by JSON.stringify, Object.entries or values, URLSearchParams', mark: 'critical' }],
   ['publish', { tag: 'publish', note: 'Publishes to npm', name: 'npm publish, /-/whoami or a registry PUT', mark: 'critical' }],
+  ['shell', { tag: 'shell', note: 'Runs shell commands fetching or handing off code', name: 'curl or wget a URL, | sh, powershell -…, iex, rundll32, osascript, /dev/tcp' }],
+  ['persistence', { tag: 'persistence', note: 'Names a place code runs from again later', name: '.bashrc, .zshrc, $PROFILE, LaunchAgents, systemd user units, .claude/settings.json, .vscode/tasks.json', mark: 'critical' }],
 ])
 
 // The kinds a file's code holds, each with the lines it is on, of the first
 // NPM_MAX_FOUND places it does each, in RUNS_CODE's order; null for none, or
-// for a file that is no script.
+// for a file that is no script. A shell script's, read whole, are its shell
+// commands and the places it names; one with a shell's hashbang is one
+// whatever its extension, and read as JavaScript too where it is that, as
+// a launcher (`#!/bin/sh` then `exec node "$0"`) is both.
 export function npmRunsCode(path, text) {
-  if (!npmIsScript(path, text)) return null
+  const script = npmIsScript(path, text)
+  const shell = typeof text === 'string' && (SHELL_SCRIPT.test(path) || SHELL_HASHBANG.test(text))
+  if (!script && !shell) return null
   const found = new Map()
   const at = (kind, offset) => {
     const offsets = found.get(kind)
     if (!offsets) found.set(kind, [offset])
     else if (offsets.length < NPM_MAX_FOUND) offsets.push(offset)
   }
-  read(text, 0, at)
-  // A PUT request publishing where the file names the registry.
+  if (script) read(text, 0, at)
+  if (shell && SAYS_ANY.test(text)) {
+    // Its comments blanked, its lines where they were.
+    const comments = BATCH.test(path) ? BATCH_COMMENT : POWERSHELL.test(path) || POWERSHELL_HASHBANG.test(text) ? POWERSHELL_COMMENT : SHELL_COMMENT
+    const commands = text.replace(comments, (comment, command = '') => command + comment.slice(command.length).replaceAll(/[^\n]/gu, ' '))
+    for (const [kind, holds] of SHELL_HOLDS) for (const { index } of commands.matchAll(holds)) at(kind, index)
+  }
+  // A PUT request publishing where the file names the registry; a place
+  // named by its directory and its file apart.
   if (found.has('registry')) for (const offset of found.get('put') ?? []) at('publish', offset)
+  for (const [part] of PARTS) if (found.has(`${part}-file`)) for (const offset of found.get(`${part}-dir`) ?? []) at('persistence', offset)
   if (![...RUNS_CODE.keys()].some(kind => found.has(kind))) return null
   const line = lineOf(text)
   return new Map([...RUNS_CODE.keys()].filter(kind => found.has(kind)).map(kind => [kind, [...new Set(found.get(kind).map(line))].toSorted((a, b) => a - b)]))
@@ -227,10 +439,11 @@ export function npmRunsCode(path, text) {
 // anything is read.
 function read(code, base, at) {
   if (!SAYS_ANY.test(code)) return
-  // Where the string before ends; whether the strings since a program's name
-  // are its arguments, an option or its value each, and whether the last is
-  // an option.
-  let end = 0, option = false, program = false
+  // The string before, and where, a place's part maybe; the command line
+  // since a program's name, and where it is named; where the string before
+  // ends; whether the strings since a program's name are its arguments, an
+  // option or its value each, and whether the last is an option.
+  let before = null, command = null, end = 0, option = false, program = false
   for (const { 0: token, 1: string, groups, index } of code.matchAll(READS)) {
     if (string === undefined) {
       for (const kind of CODE_KINDS) if (groups[kind]) at(kind, base + index)
@@ -248,16 +461,40 @@ function read(code, base, at) {
       const after = code.slice(index + token.length, index + token.length + 20)
       return !KEY_SET.test(after) && (!KEY_ENDS.test(after) || !KEY_ABSENT.test(code.slice(Math.max(0, index - 300), index)))
     }
-    const held = HOLDS_ANY.test(text) ? HOLDS.flatMap(([kind, holds]) => [...text.matchAll(holds)].map(({ index: within }) => [kind, within])) : []
+    // Each kind searched for before its places are listed, as matchAll copies
+    // its regular expression each time.
+    const held = HOLDS_ANY.test(text) ? HOLDS.flatMap(([kind, holds]) => text.search(holds) === -1 ? [] : [...text.matchAll(holds)].map(({ index: within }) => [kind, within])) : []
     for (const [kind, within] of held) if (kind !== 'tokens' || within > 0 || keyed()) at(kind, base + index + within)
     if (text.includes('registry.') && REGISTRY_URL.test(unescaped(text).replace(URL_STRIPPED, ''))) at('registry', base + index)
     for (const [kind, name] of MODULES) if (name.test(string) && loaded(code, index)) at(kind, base + index)
+    if (PROFILE.test(string) && HOME_BEFORE.test(code.slice(Math.max(0, index - 100), index))) at('persistence', base + index)
+    for (const [part, dir, file] of PARTS) {
+      if (dir.test(string)) at(`${part}-dir`, base + index)
+      if (file.test(string)) at(`${part}-file`, base + index)
+    }
     if (program && ARGUMENTS_BETWEEN.test(code.slice(end, index))) {
       if (PUBLISH.test(string)) at('publish', base + index)
       program = OPTION.test(string) || option
       option = OPTION.test(string)
     } else program = false
     if (PROGRAM.test(string)) [program, option] = [true, false]
+    if (command && command.arguments < 20 && VALUES_BETWEEN.test(code.slice(end, index))) {
+      const argument = text.slice(1, -1)
+      command.line += ` ${SEPARATES.test(argument) ? `"${argument.replaceAll('"', "'")}"` : argument}`
+      command.arguments++
+      const { line } = command
+      const hit = SHELL_HOLDS.find(([, holds]) => line.search(holds) !== -1)
+      if (hit) {
+        at(hit[0], command.at)
+        command = null
+      }
+    } else command = null
+    if (COMMAND.test(string)) command = { arguments: 0, at: base + index, line: string.slice(1, -1) }
+    if (before && before.text.length + text.length < 200 && ARGUMENTS_BETWEEN.test(code.slice(end, index))) {
+      const [first, second] = [before.text.slice(1, -1), text.slice(1, -1)]
+      if (!PLACE.test(first) && !PLACE.test(second) && PLACE.test(`${first}/${second}`)) at('persistence', before.at)
+    }
+    before = { text, at: base + index }
     if (PUT.test(string) && METHOD.test(code.slice(Math.max(0, index - 300), index))) at('put', base + index)
     end = index + token.length
   }

package/risk/index.d.ts

@@ -116,6 +116,19 @@ export interface DependencyRisk {
   gap?: number
 }
 
+// A version's risk as one number (risk/npm/score.js): what its findings call
+// for (`raised`, each it counts), each by its severity, malware all of it,
+// lowered by its exposure (`lowered`): how long it has been out (`days`)
+// among how many download its package (`tier`, its rank, null past the last
+// or where unknown), `by` the share taken off. Its `level` is named as the
+// findings' severities are: from 75 critical, 50 high, 25 moderate, else low.
+export interface RiskScore {
+  score: number
+  level: 'critical' | 'high' | 'moderate' | 'low'
+  raised: { id: string; severity: Severity }[]
+  lowered?: { days: number; tier: number | null; by: number }
+}
+
 export interface NpmAssessment {
   name: string
   version: string
@@ -129,6 +142,7 @@ export interface NpmAssessment {
   files: Record<string, FileRisk>
   // Against `oldVersion`, each it holds too, flagged against none (`held`).
   dependencies: { added: DependencyRisk[]; changed: DependencyRisk[]; held?: DependencyRisk[] }
+  score: RiskScore
 }
 
 export function assessNpm(name: string, version: string, options?: AssessNpmOptions): Promise<NpmAssessment>

package/risk/npm/assess.js

@@ -7,17 +7,18 @@ import { npmCombinedFindings, npmHeldDependencyFindings } from './combined.js'
 import { npmHeldFindings, npmVersionFindings } from './held.js'
 import { npmVersionFileRisk } from './files.js'
 import { npmDependencyChanges, npmFlagDependencyChanges } from './dependencies.js'
-import { npmDownloadMonths, npmSettledDownloads, npmTierLevel } from './downloads.js'
+import { npmDownloadMonths, npmDownloadTier, npmSettledDownloads, npmTierLevel } from './downloads.js'
 import { NpmRiskError, npmDownloads, npmPackageFacts, npmPackageReleases, npmPublicFacts, npmVersionAdvisories, npmVersionFiles } from './registry.js'
 import { npmMalwareFinding } from './malware.js'
 import { npmKnownScope } from './manifest.js'
 import { DEFAULT_MINIMUM_RELEASE_AGE, npmAccountStanding } from './release.js'
 import { npmAddedDependency } from './new-dependency.js'
+import { npmRiskScore } from './score.js'
 
 // Which reading of a version an assessment kept (`risk/npm/assessments`) is:
 // one more whenever a heuristic changes what it finds, so one kept by an
 // older reading is read anew.
-const RISK_VERSION = 12
+const RISK_VERSION = 14
 
 // How long an assessment kept may be as JSON, and what risk reads of either
 // version's files: a package past it, whose files name thousands of hosts or
@@ -191,15 +192,18 @@ export async function assessNpm(name, version, { oldVersion = null, fromEmpty =
   const malware = npmMalwareFinding({ takenDown: facts.takenDown, advisories: advisories ? await npmVersionAdvisories(name, version, osv, context) : [] })
   if (!facts.versions.has(version)) {
     if (!malware) throw new NpmRiskError('version-not-found', `npm has no ${name}@${version}`)
-    return { name, version, oldVersion: null, published: facts.removed.get(version), removed: true, findings: [malware], files: {}, dependencies: { added: [], changed: [] } }
+    return { name, version, oldVersion: null, published: facts.removed.get(version), removed: true, findings: [malware], files: {}, dependencies: { added: [], changed: [] },
+      score: npmRiskScore([malware]) }
   }
   const { published, manifest } = facts.versions.get(version)
   const kept = await lasting(name, version, old, facts, context, fromEmpty)
+  const counted = downloads && popularity ? await npmDownloads(name, context) : null
   const own = npmVersionFindings({ deprecated: facts.deprecated[version], published, minimumReleaseAge, now, known: Boolean(manifest.knownAccounts), scope: npmKnownScope(name),
-    provenance: Boolean(manifest.provenance), downloads: downloads && popularity ? await npmDownloads(name, context) : null })
+    provenance: Boolean(manifest.provenance), downloads: counted })
   const was = old === null ? null : facts.versions.get(old).published
   const added = downloads && dependencies ? await addedDependencies(kept.dependencies.added, [was, published], context, owned) : kept.dependencies.added
-  return { name, version, oldVersion: old, published, ...npmAssessmentOf(kept, malware ? [malware, ...own] : own, added) }
+  const assessment = npmAssessmentOf(kept, malware ? [malware, ...own] : own, added)
+  return { name, version, oldVersion: old, published, ...assessment, score: npmRiskScore(assessment.findings, { published, now, tier: counted ? npmDownloadTier(counted) : null }) }
 }
 
 // An assessment of what of it holds whatever the time (`kept`,

package/risk/npm/score.js

@@ -0,0 +1,59 @@
+// A version's risk as one number, out of 100: what its findings call for,
+// lowered by how long it has been out among how many who would have noticed.
+// Its findings stay what a reviewer reads; the score orders what to read
+// first.
+import { DAY_MS } from './downloads.js'
+
+// How much each finding raises the score, by its severity: a version's
+// findings combined as independent chances are (1 − Π(1 − weight)), so that
+// each adds less the more there are, none past 100. One red finding alone is
+// 50; two, or one with two orange, past 75, as attacks show.
+const WEIGHTS = { critical: 0.5, high: 0.2, moderate: 0.08, low: 0.03, notice: 0 }
+// What the version's age tells instead (`too-new`), as exposure does below.
+const TOLD_BY_AGE = new Set(['too-new'])
+
+// How much a version's exposure lowers the score, at most: a version out for
+// years among millions keeps a tenth of what its findings call for, as an
+// attack that long among that many would have been found and pulled.
+const MOST_LOWERED = 0.9
+// From how old a version is lowered at all, and how old fully: two weeks, as
+// risk's minimum release age (release.js), and two years, on a log scale.
+const EXPOSED_FROM_DAYS = 14
+const EXPOSED_DAYS = 730
+// How much who downloads a package lowers it, by its tier (downloads.js): its
+// rank by downloads. The top 200 fully; one few download hardly, as few would
+// notice; one whose downloads aren't known (null, a caller's own package, or
+// one npm counts none of) a little.
+const TIER_EXPOSURE = [[200, 1], [1000, 0.95], [5000, 0.85], [20_000, 0.65], [100_000, 0.35], [Infinity, 0.1]]
+const UNKNOWN_TIER_EXPOSURE = 0.25
+
+// The score's levels, as the findings' severities name theirs.
+const LEVELS = [[75, 'critical'], [50, 'high'], [25, 'moderate'], [0, 'low']]
+export const npmRiskLevel = score => LEVELS.find(([from]) => score >= from)[1]
+
+// How exposed a version has been, from 0 to 1: how long it has been out
+// (`published` an ISO time, at `now`) times how widely its package is
+// downloaded (`tier`, null where unknown).
+export function npmExposure(published, now, tier) {
+  const days = typeof published === 'string' ? (now - Date.parse(published)) / DAY_MS : NaN
+  if (!(days > EXPOSED_FROM_DAYS)) return 0
+  const age = Math.min(1, Math.log(days / EXPOSED_FROM_DAYS) / Math.log(EXPOSED_DAYS / EXPOSED_FROM_DAYS))
+  const wide = tier === null ? UNKNOWN_TIER_EXPOSURE : TIER_EXPOSURE.find(([upTo]) => tier <= upTo)[1]
+  return age * wide
+}
+
+// A version's risk score (`score`, 0 to 100) and its `level`, from its
+// assessment's `findings` and its exposure (npmExposure): 100 where malware
+// is told of it, however old; else what its findings call for (`raised`, each
+// `{ id, severity }` it counts), lowered by its exposure (`lowered`: its
+// `days` out, its `tier`, and by how much, a share), none lowered under two
+// weeks.
+export function npmRiskScore(findings, { published = null, now = Date.now(), tier = null } = {}) {
+  if (findings.some(({ id }) => id === 'malware')) return { score: 100, level: 'critical', raised: [{ id: 'malware', severity: 'critical' }] }
+  const raised = findings.filter(({ id, severity }) => !TOLD_BY_AGE.has(id) && WEIGHTS[severity] > 0).map(({ id, severity }) => ({ id, severity }))
+  const called = 1 - raised.reduce((left, { severity }) => left * (1 - WEIGHTS[severity]), 1)
+  const exposure = npmExposure(published, now, tier)
+  const score = Math.round(100 * called * (1 - MOST_LOWERED * exposure))
+  return { score, level: npmRiskLevel(score), raised,
+    ...exposure > 0 ? { lowered: { days: Math.floor((now - Date.parse(published)) / DAY_MS), tier: Number.isFinite(tier) ? tier : null, by: Math.round(100 * MOST_LOWERED * exposure) / 100 } } : {} }
+}

package/server-managed/repository-risk.ts

@@ -72,7 +72,7 @@ export interface OpenedRepository {
   recheck(): Promise<void>
 }
 
-type Assessment = { published: string | null; findings: { id: string; severity: Severity; takenDown?: unknown }[] }
+type Assessment = { published: string | null; findings: { id: string; severity: Severity; takenDown?: unknown }[]; score: { score: number } }
 
 export interface RepositoryRiskSource<R extends RepositoryRiskRepo> {
   repos(): Promise<R[]>
@@ -100,13 +100,14 @@ type AdvisoryRow = Advisory & { malware: boolean }
 type RiskFailure = { error: string; detail?: string }
 
 // A risk line is of npm's package of its name and version, or, with an
-// `integrity`, of a mirror's that its lockfiles hold to it.
+// `integrity`, of a mirror's that its lockfiles hold to it; its `score` risk's
+// of it, out of 100 (assessNpm `score`, risk/npm/score.js).
 export type RepositoryRiskLine =
   | { type: 'repos'; repos: { id: number; fullName: string }[] }
   | ({ type: 'repo'; id: number } & ({ commit: string; lockfiles: { path: string; format: LockfileFormat }[] } | RiskFailure))
   | ({ type: 'lockfile'; repo: number; path: string; format: LockfileFormat } & ({ packages: LockedPackage[] } | RiskFailure))
   | ({ type: 'risk'; name: string; version: string; integrity?: string }
-    & ({ published: string | null; severity: Severity | null; findings: { id: string; severity: Severity; takenDown?: true }[] } | RiskFailure))
+    & ({ published: string | null; severity: Severity | null; score: number; findings: { id: string; severity: Severity; takenDown?: true }[] } | RiskFailure))
   | ({ type: 'advisories'; repo: number; path: string } & ({ advisories: AdvisoryRow[] } | RiskFailure))
   | { type: 'done' }
 
@@ -198,9 +199,9 @@ async function assess({ source, signal }: Scan, pkg: AssessedPackage, teamScoped
     try {
       const read = doc ??= await documentOf(source, pkg, signal)
       if (!(read instanceof NpmPackageError) && pkg.integrity !== undefined && !pkg.integrity.split(/\s+/u).includes(read.dist.integrity)) return { ...at, error: 'integrity-mismatch' }
-      const { published, findings } = read instanceof NpmPackageError ? await removedOf(source, pkg, teamScoped, signal, read) : await assessedOf(source, pkg, teamScoped, signal, read)
+      const { published, findings, score } = read instanceof NpmPackageError ? await removedOf(source, pkg, teamScoped, signal, read) : await assessedOf(source, pkg, teamScoped, signal, read)
       const told = findings.map(({ id, severity, takenDown }) => ({ id, severity, ...takenDown === true ? { takenDown: true as const } : {} }))
-      return { ...at, published, severity: highestSeverity(told), findings: told }
+      return { ...at, published, severity: highestSeverity(told), score: score.score, findings: told }
     } catch (error) {
       if (signal.aborted) return null
       if (!isBusy(error) || attempt >= BUSY_RETRIES) return { ...at, ...failureOf(error) }
@@ -243,7 +244,8 @@ async function assessed(scan: Scan, pkg: AssessedPackage): Promise<RiskLine | nu
   try { teamScoped = await scan.source.teamScoped(pkg.name) } catch (error) { return { type: 'risk', ...pkg, ...failureOf(error) } }
   const key = `${pkg.name}@${pkg.version}\0${pkg.integrity ?? ''}\0${teamScoped}`
   const kept = scan.caches.risks.get(key) ?? await keptLine(scan, key)
-  if (kept && Date.now() - kept.at < RISK_KEPT_MS) return kept.line
+  // One kept before risk told a score (assessNpm `score`) is asked again.
+  if (kept && Date.now() - kept.at < RISK_KEPT_MS && ('error' in kept.line || typeof kept.line.score === 'number')) return kept.line
   const line = await assess(scan, pkg, teamScoped)
   if (line && (!('error' in line) || line.error === 'integrity-mismatch')) {
     const at = Date.now()