@preventive/triage 1.0.0-alpha.40 → 1.0.0-alpha.42

package/risk/npm/diff.js

@@ -1,8 +1,9 @@
 // How two versions' files differ, as Compare's diff has them
 // (ui/view/bundle-compare-diff.js computeBundleDiff), for risk's findings
-// (compare.js): the files the open version adds, and those it changes, a file
-// moved to another path paired with its old one by content, as git diff -M
-// pairs them (@preventive/compare compareTrees).
+// (compare.js): the files the open version adds, and those it changes, a
+// build's content-hashed file paired with the one it replaces by its name
+// (hashedKey), and a file moved to another path with its old one by content,
+// as git diff -M pairs them (@preventive/compare compareTrees).
 import { compareTrees } from '@preventive/compare'
 import { bundleFilesAsMap } from '../../common/bundle-sources.js'
 
@@ -21,6 +22,25 @@ const same = (a, b) => a === b || (a?.format === 'digest' && b?.format === 'dige
 const treeData = (content, at) => typeof content === 'string' ? `\0text\0${content.toWellFormed()}`
   : content?.format === 'digest' ? `\0digest\0${content.digest}` : `\0none\0${at}`
 
+// A build's content-hashed file (`assets/index-CyWAfh-p.js`, Vite's and
+// Rollup's `[name]-[hash]`, webpack's `[name].[contenthash].js`) by its name
+// but its hash, `assets/index\0.js`: a release renames it as its content
+// changes, the same file. Null for a name whose last part before its
+// extension is no hash: 8 to 32 of base64url's characters with a letter, and
+// a digit or a capital, as neither a lowercase word (`index-client.js`,
+// `lodash.debounce.js`) nor a number (a date, `migration-20240101.js`) is. Its hash its last 8 or more such characters, so that chunks named
+// after a module (`vendor-react-DQ4mN2sx.js`) pair each with its own; a
+// longer hash holding a `-` (Rollup's `[hash:16]`) is cut there, so that a
+// rebuild pairs by its content alone, as its parts aren't told from a
+// chunk's name's (`vendor-ui-…`) without it.
+const HASHED_NAME = /^(.+)[-.]([\w-]{8,32})((?:\.[A-Za-z\d]+)+)$/u
+function hashedKey(path) {
+  const at = path.lastIndexOf('/') + 1
+  const [, stem, hash, extension] = HASHED_NAME.exec(path.slice(at)) ?? []
+  if (!hash || !/[A-Za-z]/u.test(hash) || !/[\dA-Z]/u.test(hash)) return null
+  return `${path.slice(0, at)}${stem}\0${extension}`
+}
+
 // `onlyOther`, the files the open version (`other`) adds, `{ path }` each, and
 // `changed`, those it changes, `{ path, modified }`, or moves, `{ path,
 // renamedFrom, modified }`, `modified` whether its content changed too; each
@@ -34,10 +54,26 @@ export function npmFilesDiff(base, other) {
     else if (!same(before.get(path), text)) changed.push({ path, modified: true })
   }
   for (const path of before.keys()) if (!after.has(path)) onlyBase.push(path)
+  // A content-hashed file added where one by the same name but its hash
+  // (hashedKey) is removed, one each, is that file changed, as a build
+  // renames it: what it runs, how it reads and how large it is told against
+  // it, not all of it new.
+  const hashed = paths => Map.groupBy(paths.filter(hashedKey), hashedKey)
+  const moved = new Set(), removed = hashed(onlyBase)
+  for (const [key, paths] of hashed(onlyOther)) {
+    const was = removed.get(key)
+    if (paths.length !== 1 || was?.length !== 1) continue
+    changed.push({ path: paths[0], renamedFrom: was[0], modified: !same(before.get(was[0]), after.get(paths[0])) })
+    moved.add(paths[0])
+  }
+  // The rest by content, against every file removed: one paired by its name
+  // may be another's too, a build's copy of it elsewhere.
   const entries = (paths, files, side) => paths.filter(path => path.isWellFormed()).map((path, at) => ({ name: path, data: treeData(files.get(path), `${side}${at}`) }))
-  const renames = compareTrees(entries(onlyBase, before, 'a'), entries(onlyOther, after, 'b'), { paths: 'keys', renameLimit: RENAME_LIMIT, lines: false })
+  const renames = compareTrees(entries(onlyBase, before, 'a'), entries(onlyOther.filter(path => !moved.has(path)), after, 'b'), { paths: 'keys', renameLimit: RENAME_LIMIT, lines: false })
     .filter(change => change.status === 'renamed')
-  const moved = new Set(renames.map(change => change.new.path))
-  for (const change of renames) changed.push({ path: change.new.path, renamedFrom: change.old.path, modified: change.similarity !== 100 })
+  for (const change of renames) {
+    changed.push({ path: change.new.path, renamedFrom: change.old.path, modified: change.similarity !== 100 })
+    moved.add(change.new.path)
+  }
   return { onlyOther: onlyOther.filter(path => !moved.has(path)).map(path => ({ path })), changed }
 }

package/risk/npm/held.js

@@ -7,6 +7,7 @@ import { npmDownloadTier, npmTierLevel, npmTierLow } from './downloads.js'
 import { npmInstallScripts } from './install-scripts.js'
 import { npmTooNew } from './release.js'
 import { HOST_TAGS, npmHostsTagged } from '../files/hosts.js'
+import { CREDENTIAL_TAGS, npmRunsCodeTagged, npmRunsCodeWithout } from '../files/runs-code.js'
 import { npmVersionFileRisk } from './files.js'
 
 // What npm says of a version and of its package, told fresh as it changes in
@@ -39,7 +40,8 @@ export function npmVersionFindings({ deprecated, published, minimumReleaseAge, n
 // orange, as its files' tags are: the scripts npm runs installing it
 // (install-scripts.js, `held-install-scripts`, `[script, command]` each); and
 // its files, each with what it holds, that run code beyond themselves
-// (`held-runs-code`), name a service under one of the hosts' tags, at the
+// (`held-runs-code`), reach for credentials (runs-code.js CREDENTIAL_TAGS,
+// `held-credentials`), name a service under one of the hosts' tags, at the
 // tag's severity (hosts.js HOST_TAGS: `held-exfiltration` red, `held-remote`
 // orange, `held-ip-lookup` yellow), or bear an obfuscator's fingerprint
 // (`held-obfuscated`).
@@ -49,7 +51,8 @@ export function npmHeldFindings(version) {
   const holding = of => reads.map(({ path, read }) => ({ path, found: of(read) })).filter(row => row.found)
   return [
     ...scripts.length > 0 ? [{ id: 'held-install-scripts', severity: 'high', scripts }] : [],
-    { id: 'held-runs-code', severity: 'high', files: holding(read => read.runsCode) },
+    { id: 'held-runs-code', severity: 'high', files: holding(read => npmRunsCodeWithout(read.runsCode, CREDENTIAL_TAGS)) },
+    { id: 'held-credentials', severity: 'high', files: holding(read => npmRunsCodeTagged(read.runsCode, CREDENTIAL_TAGS)) },
     ...[...HOST_TAGS].map(([tag, severity]) => ({ id: `held-${npmHostFinding(tag)}`, severity, files: holding(read => npmHostsTagged(read.exfiltration, tag)) })),
     { id: 'held-obfuscated', severity: 'high', files: holding(read => read.readability.obfuscation) },
   ].filter(finding => !finding.files || finding.files.length > 0)

package/risk/npm/score.js

@@ -0,0 +1,59 @@
+// A version's risk as one number, out of 100: what its findings call for,
+// lowered by how long it has been out among how many who would have noticed.
+// Its findings stay what a reviewer reads; the score orders what to read
+// first.
+import { DAY_MS } from './downloads.js'
+
+// How much each finding raises the score, by its severity: a version's
+// findings combined as independent chances are (1 − Π(1 − weight)), so that
+// each adds less the more there are, none past 100. One red finding alone is
+// 50; two, or one with two orange, past 75, as attacks show.
+const WEIGHTS = { critical: 0.5, high: 0.2, moderate: 0.08, low: 0.03, notice: 0 }
+// What the version's age tells instead (`too-new`), as exposure does below.
+const TOLD_BY_AGE = new Set(['too-new'])
+
+// How much a version's exposure lowers the score, at most: a version out for
+// years among millions keeps a tenth of what its findings call for, as an
+// attack that long among that many would have been found and pulled.
+const MOST_LOWERED = 0.9
+// From how old a version is lowered at all, and how old fully: two weeks, as
+// risk's minimum release age (release.js), and two years, on a log scale.
+const EXPOSED_FROM_DAYS = 14
+const EXPOSED_DAYS = 730
+// How much who downloads a package lowers it, by its tier (downloads.js): its
+// rank by downloads. The top 200 fully; one few download hardly, as few would
+// notice; one whose downloads aren't known (null, a caller's own package, or
+// one npm counts none of) a little.
+const TIER_EXPOSURE = [[200, 1], [1000, 0.95], [5000, 0.85], [20_000, 0.65], [100_000, 0.35], [Infinity, 0.1]]
+const UNKNOWN_TIER_EXPOSURE = 0.25
+
+// The score's levels, as the findings' severities name theirs.
+const LEVELS = [[75, 'critical'], [50, 'high'], [25, 'moderate'], [0, 'low']]
+export const npmRiskLevel = score => LEVELS.find(([from]) => score >= from)[1]
+
+// How exposed a version has been, from 0 to 1: how long it has been out
+// (`published` an ISO time, at `now`) times how widely its package is
+// downloaded (`tier`, null where unknown).
+export function npmExposure(published, now, tier) {
+  const days = typeof published === 'string' ? (now - Date.parse(published)) / DAY_MS : NaN
+  if (!(days > EXPOSED_FROM_DAYS)) return 0
+  const age = Math.min(1, Math.log(days / EXPOSED_FROM_DAYS) / Math.log(EXPOSED_DAYS / EXPOSED_FROM_DAYS))
+  const wide = tier === null ? UNKNOWN_TIER_EXPOSURE : TIER_EXPOSURE.find(([upTo]) => tier <= upTo)[1]
+  return age * wide
+}
+
+// A version's risk score (`score`, 0 to 100) and its `level`, from its
+// assessment's `findings` and its exposure (npmExposure): 100 where malware
+// is told of it, however old; else what its findings call for (`raised`, each
+// `{ id, severity }` it counts), lowered by its exposure (`lowered`: its
+// `days` out, its `tier`, and by how much, a share), none lowered under two
+// weeks.
+export function npmRiskScore(findings, { published = null, now = Date.now(), tier = null } = {}) {
+  if (findings.some(({ id }) => id === 'malware')) return { score: 100, level: 'critical', raised: [{ id: 'malware', severity: 'critical' }] }
+  const raised = findings.filter(({ id, severity }) => !TOLD_BY_AGE.has(id) && WEIGHTS[severity] > 0).map(({ id, severity }) => ({ id, severity }))
+  const called = 1 - raised.reduce((left, { severity }) => left * (1 - WEIGHTS[severity]), 1)
+  const exposure = npmExposure(published, now, tier)
+  const score = Math.round(100 * called * (1 - MOST_LOWERED * exposure))
+  return { score, level: npmRiskLevel(score), raised,
+    ...exposure > 0 ? { lowered: { days: Math.floor((now - Date.parse(published)) / DAY_MS), tier: Number.isFinite(tier) ? tier : null, by: Math.round(100 * MOST_LOWERED * exposure) / 100 } } : {} }
+}

package/server-managed/pretty-print.ts

@@ -28,7 +28,7 @@ import { type NpmVersionDocument, npmFileText } from './npm-packages.ts'
 // Part of every kept copy's name; bumped when what the formatter writes for
 // the same file changes, or what its check lets through, so copies written
 // before are no longer read.
-const PRETTY_VERSION = 3
+const PRETTY_VERSION = 4
 // Formats running at once per process, each holding its file's syntax tree,
 // and those waiting their turn past them (a version's files are formatted one
 // after another, beside other readers'), any more refused.

package/server-managed/repository-risk.ts

@@ -72,7 +72,7 @@ export interface OpenedRepository {
   recheck(): Promise<void>
 }
 
-type Assessment = { published: string | null; findings: { id: string; severity: Severity; takenDown?: unknown }[] }
+type Assessment = { published: string | null; findings: { id: string; severity: Severity; takenDown?: unknown }[]; score: { score: number } }
 
 export interface RepositoryRiskSource<R extends RepositoryRiskRepo> {
   repos(): Promise<R[]>
@@ -100,13 +100,14 @@ type AdvisoryRow = Advisory & { malware: boolean }
 type RiskFailure = { error: string; detail?: string }
 
 // A risk line is of npm's package of its name and version, or, with an
-// `integrity`, of a mirror's that its lockfiles hold to it.
+// `integrity`, of a mirror's that its lockfiles hold to it; its `score` risk's
+// of it, out of 100 (assessNpm `score`, risk/npm/score.js).
 export type RepositoryRiskLine =
   | { type: 'repos'; repos: { id: number; fullName: string }[] }
   | ({ type: 'repo'; id: number } & ({ commit: string; lockfiles: { path: string; format: LockfileFormat }[] } | RiskFailure))
   | ({ type: 'lockfile'; repo: number; path: string; format: LockfileFormat } & ({ packages: LockedPackage[] } | RiskFailure))
   | ({ type: 'risk'; name: string; version: string; integrity?: string }
-    & ({ published: string | null; severity: Severity | null; findings: { id: string; severity: Severity; takenDown?: true }[] } | RiskFailure))
+    & ({ published: string | null; severity: Severity | null; score: number; findings: { id: string; severity: Severity; takenDown?: true }[] } | RiskFailure))
   | ({ type: 'advisories'; repo: number; path: string } & ({ advisories: AdvisoryRow[] } | RiskFailure))
   | { type: 'done' }
 
@@ -198,9 +199,9 @@ async function assess({ source, signal }: Scan, pkg: AssessedPackage, teamScoped
     try {
       const read = doc ??= await documentOf(source, pkg, signal)
       if (!(read instanceof NpmPackageError) && pkg.integrity !== undefined && !pkg.integrity.split(/\s+/u).includes(read.dist.integrity)) return { ...at, error: 'integrity-mismatch' }
-      const { published, findings } = read instanceof NpmPackageError ? await removedOf(source, pkg, teamScoped, signal, read) : await assessedOf(source, pkg, teamScoped, signal, read)
+      const { published, findings, score } = read instanceof NpmPackageError ? await removedOf(source, pkg, teamScoped, signal, read) : await assessedOf(source, pkg, teamScoped, signal, read)
       const told = findings.map(({ id, severity, takenDown }) => ({ id, severity, ...takenDown === true ? { takenDown: true as const } : {} }))
-      return { ...at, published, severity: highestSeverity(told), findings: told }
+      return { ...at, published, severity: highestSeverity(told), score: score.score, findings: told }
     } catch (error) {
       if (signal.aborted) return null
       if (!isBusy(error) || attempt >= BUSY_RETRIES) return { ...at, ...failureOf(error) }
@@ -243,7 +244,8 @@ async function assessed(scan: Scan, pkg: AssessedPackage): Promise<RiskLine | nu
   try { teamScoped = await scan.source.teamScoped(pkg.name) } catch (error) { return { type: 'risk', ...pkg, ...failureOf(error) } }
   const key = `${pkg.name}@${pkg.version}\0${pkg.integrity ?? ''}\0${teamScoped}`
   const kept = scan.caches.risks.get(key) ?? await keptLine(scan, key)
-  if (kept && Date.now() - kept.at < RISK_KEPT_MS) return kept.line
+  // One kept before risk told a score (assessNpm `score`) is asked again.
+  if (kept && Date.now() - kept.at < RISK_KEPT_MS && ('error' in kept.line || typeof kept.line.score === 'number')) return kept.line
   const line = await assess(scan, pkg, teamScoped)
   if (line && (!('error' in line) || line.error === 'integrity-mismatch')) {
     const at = Date.now()

package/server-managed/type-only-worker.js

@@ -3,9 +3,9 @@
 // server's event loop: each pair a tree of a file a side, a side not there
 // none, its paths as they are, which say what a file is. Two paths pair as one
 // change wherever compareTrees takes them for a rename at all; where it
-// doesn't, the pair is types only where each of its two changes is, as each
-// side holds types alone and neither keeps an `export {}`, which is what it
-// would stamp of them paired. `[true, false, ...]` by pair.
+// doesn't, the pair is types only where each of its two changes is: the file
+// gone erasing whole, and the one come erasing whole or leaving a single bare
+// `export {}`, which nothing loaded before. `[true, false, ...]` by pair.
 import { parentPort, workerData } from 'node:worker_threads'
 import { compareTrees } from '@preventive/compare'
 

package/server-managed/type-only.ts

@@ -4,8 +4,10 @@
 // paired as its viewer pairs them (rename-diff.ts comparedFiles), whose
 // change @preventive/compare's compareTrees stamps
 // `typeOnly` -- each side there a file named as a declaration file and
-// proven to hold types alone, so that it runs nothing (proveTypeOnly) --
-// and nothing else. Proven in a worker, off the event loop, a comparison at a
+// proven to hold types alone but for a runtime, the module loads and
+// `export {}` its stripping leaves, that the change leaves as it was, an
+// added one's empty or a single bare `export {}` (proveTypeOnly) -- and
+// nothing else. Proven in a worker, off the event loop, a comparison at a
 // time per process, for at most a minute; told a line each, `{ path, hash,
 // otherPath, otherHash }`, a side not there null, which the viewer checks
 // name the files it shows. Access is the caller's to check.