@preventive/triage 1.0.0-alpha.40 → 1.0.0-alpha.42

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@preventive/triage",
-  "version": "1.0.0-alpha.40",
+  "version": "1.0.0-alpha.42",
   "description": "Client & relay server for triaging of automated reports",
   "license": "MIT OR Apache-2.0",
   "author": {
@@ -282,6 +282,7 @@
     "risk/npm/old-version.js",
     "risk/npm/registry.js",
     "risk/npm/release.js",
+    "risk/npm/score.js",
     "risk/npm/specs.js",
     "risk/npm/tarball.js",
     "client/dependency-paths.d.ts",
@@ -345,7 +346,7 @@
   "dependencies": {
     "@exodus/stasis": "1.0.0-beta.9",
     "@exodus/stasis-core": "1.0.0-beta.9",
-    "@preventive/compare": "^1.2.0",
+    "@preventive/compare": "^1.2.3",
     "@preventive/diff": "^1.0.2",
     "@preventive/lockfile": "1.0.0",
     "@preventive/publishers": "^1.1.0",

package/risk/files/runs-code.js

@@ -1,9 +1,17 @@
 // What a file's code can do beyond itself, for a reviewer: run a string as
 // code (eval, Function with new or without, node:vm, Module's _compile) or
 // other programs (child_process), reach for credentials (a credential file's
-// path, a token's name) or the whole environment, and publish to npm (`npm
-// publish`, `/-/whoami`, a registry PUT), as a file's stamps say
-// (stamps.js) and a version's findings name what is new to a file.
+// path, a token's name, `gh auth token`, the cloud's instance metadata, the
+// GitHub Actions runner's process or another process's memory, trufflehog)
+// or the whole environment, publish to npm (`npm publish`, `/-/whoami`, a
+// registry PUT), run a shell command fetching or handing off code (`curl …
+// https://…`, `| sh`, `powershell -…`, rundll32, osascript, `/dev/tcp/`),
+// and name a place code runs from again later (a shell's rc file,
+// LaunchAgents, systemd's user units, `.claude/settings.json`,
+// `.vscode/tasks.json`), as a file's stamps say (stamps.js) and a version's
+// findings name what is new to a file. A shell script (`.sh`, `.bat`, `.ps1`
+// …, or a shell's hashbang) is read whole for the last two and the
+// credentials a command reaches for, its text its commands.
 // A quick read, not a parse: a script's code with its strings, regular
 // expressions and comments set aside as script.js tells them, its
 // strings read for the paths, names and commands they hold, a module by the
@@ -52,8 +60,31 @@ const PICKED = String.raw`${GAP}\)${GAP}\??\.${GAP}(?:filter|find|findLast|some|
 const COPY = String.raw`(?:\{${GAP}\.\.\.${GAP})?`
 const ENV_WHOLE = String.raw`(?=JSON|Object|URLSearchParams)(?<![\p{ID_Continue}$.])(?:JSON${GAP}\.${GAP}stringify|URLSearchParams)${GAP}\(${GAP}${COPY}${ENV}`
   + String.raw`|(?=Object)(?<![\p{ID_Continue}$.])Object${GAP}\.${GAP}(?:values|entries)${GAP}\(${GAP}${COPY}${ENV}(?!${PICKED})`
-// Any of RUNS_CODE, as a text may say it.
-const SAYS_ANY = new RegExp(String.raw`eval|Function${FUNCTION_CALLED}|vm["'\x60]|_compile|child_process|\.(?:npmrc|ssh|aws)|_TOKEN|(?:stringify|values|entries|URLSearchParams)${GAP}\(${GAP}(?:\{${GAP}\.\.\.${GAP})?process${GAP}\.${GAP}env|publish|whoami|registry\.(?:npmjs\.org|yarnpkg\.com)`, 'u')
+// What a shell command, and a place code runs from again later, may say
+// (SHELL, PERSISTENCE), and what of the credentials is told in any case:
+// trufflehog (TRUFFLEHOG), GCP's metadata host, and a string naming gh
+// (`'gh'`, `'/usr/bin/gh'`, `'GH.EXE'`) as a program run with its arguments
+// apart is, whatever is between them (`'gh', ['auth', /* … */ 'token']`).
+// A shell, as a hashbang or a pipe names it (`#!/bin/ksh`, `| fish`,
+// BusyBox's `ash`, `| powershell`); after a pipe, by its path or env's too (`| /bin/sh`,
+// `| /usr/bin/env bash`), env's options, their values, and settings before
+// it on its line (`env -S`, `env -u NAME`, `env MODE=x`).
+const SHELLS = String.raw`(?:(?:ba|z|da|k|mk|c|tc|fi|a)?sh|pwsh|powershell)`
+const SHELL_PATH = String.raw`(?:(?:\/[\w.-]{1,40}){0,8}\/)?(?:env(?:[^\S\n]+(?:-[\w-]{1,20}(?:=\S{0,100}|[^\S\n]+(?!-)[^\s=]{1,100})?|\w{1,40}=\S{0,100})){0,6}[^\S\n]+)?`
+const SHELL_OR_PLACE = String.raw`curl|wget|\|\s*(?:sudo|${SHELL_PATH}${SHELLS})|powershell|pwsh|rundll32|osascript|mshta|certutil|bitsadmin|\/dev\/(?:tcp|udp)|iex|invoke-expression`
+  + String.raw`|\$profile|profile\.ps1|config\.fish|conf\.d|bashrc|zshrc|zshenv|zlogin|bash_profile|bash_login|zprofile|\.profile|Launch(?:Agents|Daemons)|systemd|systemctl|\.claude|\.vscode|trufflehog|metadata\.google\.internal|["'\x60\/\\]gh(?:\.exe)?["'\x60]`
+// What says one of the credentials a command, an endpoint or a process holds
+// (HOLDS' gh-token, cloud-metadata, runner-worker and process-memory), as
+// code and its strings may say it, in the case it is written: `gh auth
+// token`'s command, lowercase as gh reads it, the metadata endpoint's
+// address, `Runner.Worker` and `/proc/`; what is told in any case is
+// SHELL_OR_PLACE's.
+const SAYS_CREDENTIALS = String.raw`auth(?:[^\S\n]|[\\^\x60]\r?\n)+token|169\.254\.169\.254|Runner\.Worker|\/proc\/`
+// Any of RUNS_CODE, as a text may say it: a shell command or a place in any
+// case, as Windows' are written (`PowerShell`, `RUNDLL32`).
+const SAYS_SHELL_OR_PLACE = new RegExp(SHELL_OR_PLACE, 'iu')
+const SAYS_CODE = new RegExp(String.raw`eval|Function${FUNCTION_CALLED}|vm["'\x60]|_compile|child_process|\.(?:npmrc|ssh|aws)|_TOKEN|${SAYS_CREDENTIALS}|(?:stringify|values|entries|URLSearchParams)${GAP}\(${GAP}(?:\{${GAP}\.\.\.${GAP})?process${GAP}\.${GAP}env|publish|whoami|registry\.(?:npmjs\.org|yarnpkg\.com)`, 'u')
+const SAYS_ANY = { test: text => SAYS_CODE.test(text) || SAYS_SHELL_OR_PLACE.test(text) }
 
 // A name read as one, not as a property's (`vm.eval`, `vm . eval`, a spread's
 // `...eval` aside) or part of another's (`evaluate`), or as the global
@@ -103,12 +134,16 @@ const READS = new RegExp(String.raw`${JS_STRING_OR_COMMENT.source}|(?<eval>${nam
 // `.sshd`); a token's name where it is read, the string the name alone (a
 // key, `process.env['GITHUB_TOKEN']`) or the name expanded (a shell's or
 // .npmrc's `$GITHUB_TOKEN`, `${NPM_TOKEN}`, cmd's `%NPM_TOKEN%`), not where
-// text names it (`requires a token in GITHUB_TOKEN`); a command publishing (`npm publish`, `pnpm
+// text names it (`requires a token in GITHUB_TOKEN`); a credential a
+// command, an endpoint or a process holds (`gh auth token`, the cloud's
+// metadata endpoint, `Runner.Worker`, `/proc/<pid>/mem`, trufflehog, as
+// HOLDS tells them); a command publishing (`npm publish`, `pnpm
 // publish …`, options before it as npm takes them, `npm --tag next publish`)
 // or the registry's who-am-I, a publisher's first step with a token. And the
 // registry, where a PUT request is one publishing (REGISTRY_URL).
 // Told first of a string by what any of them says.
-const HOLDS_ANY = /\.(?:npmrc|ssh|aws)|_TOKEN|publish|whoami|registry\./u
+const HOLDS_CODE = new RegExp(String.raw`\.(?:npmrc|ssh|aws)|_TOKEN|${SAYS_CREDENTIALS}|publish|whoami|registry\.`, 'u')
+const HOLDS_ANY = { test: text => HOLDS_CODE.test(text) || SAYS_SHELL_OR_PLACE.test(text) }
 // Before a token's name as a key, its absence told or the token dropped, as
 // TOKEN_NAME tells of one as a name (`!process.env['GITHUB_TOKEN']`,
 // `delete process.env['NPM_TOKEN']`): a few names and dots at most, and
@@ -147,11 +182,151 @@ const unescaped = text => text.replace(ESCAPE, (escape, hex, unit, point, octal,
 const REGISTRY_HOST = String.raw`registry\.(?:npmjs\.org|yarnpkg\.com)`
 const REGISTRY_URL = new RegExp(String.raw`(?:[/\\]{2}|\bhttps?:[/\\]?)(?:[^/\\?#]{0,256}@)?${REGISTRY_HOST}|^(["'\u0060])${REGISTRY_HOST}(?=\1$|[/:?#])`, 'iu')
 const URL_STRIPPED = /[\t\n\r]/gu
+// A shell command fetching or handing off code: curl or wget given a URL
+// (`curl -fsSL https://…`, `ftp://`, `https:\/\/` as a string may escape
+// it), long options before it too (`-H "Authorization: …"`), a quoted
+// argument's `;`, `|` and `&` no command's end (`-d "a=1&b=2"`), its line
+// continued too (`curl -fsSL \⏎ https://…`, `curl\⏎`, cmd's `^`,
+// PowerShell's backtick), not the next line's, the next command's (`curl
+// --version; echo https://…`) nor the next curl's, a download piped to a
+// shell (`… | sh`, `payload|sudo -E -- bash`, `| ksh`, `| /bin/sh`, `cat
+// hash | sh`, not a list of shells, `bash|zsh|sh`, a regular expression's
+// alternatives, `(x|ss|sh)$`, nor `|| sh`, nor an escaped pipe, grep's
+// `'bash\|zsh'`), PowerShell given options (`powershell -nop -enc …`),
+// rundll32, osascript and mshta, certutil fetching (`certutil -urlcache -f
+// http://…`) and bitsadmin's `/transfer`, and bash's network redirection
+// (`/dev/tcp/host/port`), and PowerShell running what it fetches (`iex (iwr
+// https://…).Content`, `irm https://… | iex`, long options before the pipe
+// too, `iwr … -Headers @{…} | iex`, `IEX (New-Object
+// Net.WebClient).DownloadString(…)`), its line continued by a backtick too,
+// not the next pipeline's, `iex $x && iwr …`); in any case, as Windows' are
+// written, and by its path (`/usr/bin/curl`).
+const CONTINUED = String.raw`[\\^\u0060]\r?\n`
+const ON_ITS_LINE = String.raw`(?:[^\n;|&]|${CONTINUED})`
+// PowerShell's own, its backtick alone (not `\⏎`, a new statement there).
+const POWERSHELL_CONTINUED = String.raw`\u0060\r?\n`
+// A command's text up to its end, its arguments' quotes kept, a quote left
+// open (`it's`) as any other character.
+const ARGUMENTS = String.raw`(?:[^\n;|&"']|${CONTINUED}|"[^"\n]*"|'[^'\n]*'|"(?![^"\n]*")|'(?![^'\n]*'))`
+const APART = String.raw`(?:[^\S\n]|${CONTINUED})`
+// A command's options, a few, and their values (`-E`, `-u root`, `--now`),
+// on its line or one continued.
+const OPTIONS = String.raw`(?:${APART}+--?\w[\w-]*(?:=\S*|${APART}+(?!-)\S+)?){0,6}?`
+const SHELL = String.raw`(?<![\w.-])(?:curl|wget)(?:\.exe)?${APART}(?:(?!(?:curl|wget)(?![\w-]))${ARGUMENTS}){0,2000}?["']?(?:https?|s?ftps?|scp):\\?\/\\?\/|(?<![|\\]|(?<![\w.\/-])${SHELLS}\s*)\|\s*(?:sudo${OPTIONS}(?:${APART}+--)?${APART}+)?${SHELL_PATH}${SHELLS}(?![\w)|$-])`
+  + String.raw`|(?<![\w.-])(?:powershell|pwsh)(?:\.exe)?[^\S\n]+-\w|(?<![\w.-])(?:rundll32|osascript|mshta)(?:\.exe)?(?![\w-])`
+  + String.raw`|(?<![\w.-])certutil(?:\.exe)?${APART}${ON_ITS_LINE}{0,100}?-urlcache|(?<![\w.-])bitsadmin(?:\.exe)?${APART}${ON_ITS_LINE}{0,100}?\/transfer|\/dev\/(?:tcp|udp)\/`
+  + String.raw`|(?<![\w$.-])(?:iex|invoke-expression)(?![\w-])(?:[^\n;|&]|${POWERSHELL_CONTINUED}){0,200}?(?:(?<![\w$.-])(?:iwr|irm|invoke-webrequest|invoke-restmethod)(?![\w-])|\.downloadstring\s*\()`
+  + String.raw`|(?<![\w$.-])(?:iwr|irm|invoke-webrequest|invoke-restmethod)(?![\w-])(?:(?!(?:iwr|irm|invoke-webrequest|invoke-restmethod)(?![\w-]))(?:[^\n;|&]|${POWERSHELL_CONTINUED})){0,2000}\|\s*(?:iex|invoke-expression)(?![\w-])`
+// A place code runs from again later: a shell's rc file (`~/.bashrc`,
+// `.zshrc`, `.zshenv`, `.zlogin`, `.bash_profile`, `.bash_login`,
+// `.zprofile`, and `.profile` in a path, `~/.profile`, not a selector's
+// class, nor one after another, `.nav`), PowerShell's profile (`$PROFILE`,
+// `Microsoft.PowerShell_profile.ps1`, all hosts' `PowerShell\Profile.ps1`,
+// `$PSHOME\Profile.ps1`, not another folder's), macOS's LaunchAgents and
+// LaunchDaemons, fish's (`~/.config/fish/config.fish`, `conf.d`), systemd's
+// user units (`~/.config/systemd/user`, `systemctl --user enable`, other
+// options before it, `--now`, or `--user` after it in its command,
+// `systemctl enable --user`; not `start`, which runs a unit once), and the
+// settings an AI agent or an editor runs commands from on its own
+// (`.claude/settings.json`, `.vscode/tasks.json`); in any case, as Windows'
+// and macOS's paths are, a path's separator a slash or a backslash, escaped
+// in a string as code writes it (`"\\.claude\\settings.json"`, `\/`).
+const SEPARATOR = String.raw`(?:\\?\/|\\{1,2})`
+const PERSISTENCE = String.raw`(?<![\w.-])\.(?:bashrc|zshrc|zshenv|zlogin|bash_profile|bash_login|zprofile)(?![\w-])|(?<=[\/\\])(?<!\.[\w-]*[\/\\])\.profile(?![\w-])|(?<![\w-])Launch(?:Agents|Daemons)(?![\w-])|systemd${SEPARATOR}user(?![\w-])|fish${SEPARATOR}(?:config\.fish|conf\.d)(?![\w-])`
+  + String.raw`|(?<![\w$])\$profile(?![\w-])|(?<![\w.-])Microsoft\.\w+_profile\.ps1(?![\w-])|(?:PowerShell|\$pshome)${SEPARATOR}profile\.ps1(?![\w-])|systemctl${OPTIONS}${APART}+--user${OPTIONS}${APART}+enable(?![\w-])|systemctl${OPTIONS}${APART}+enable(?:${APART}+[^\s;|&]+){0,6}?${APART}+--user(?![\w-])|(?<![\w.-])\.claude${SEPARATOR}settings(?:\.local)?\.json|(?<![\w.-])\.vscode${SEPARATOR}tasks\.json`
+// Credentials a command, an endpoint or a process holds, as recent npm
+// malware reached for them: the GitHub CLI printing its token (`gh auth
+// token`, by its path too, `gh.exe`, its name in any case as Windows runs
+// it, `GH.EXE`, its line continued as a shell command's, `gh auth \⏎
+// token`), not its other commands (`gh auth status`); the cloud's
+// instance metadata endpoint, AWS's, Azure's and GCP's
+// (`http://169.254.169.254/latest/meta-data/…`, `metadata.google.internal`,
+// in any case as DNS reads it), as a host whole (HOST_START, HOST_END): not
+// an address or a host either starts or ends (`169.254.169.2540`,
+// `foo-169.254.169.254`, `169.254.169.254.example.com`,
+// `metadata.google.internal.example.com`; a trailing dot,
+// `metadata.google.internal.`, its host still), nor in a URL's path or
+// userinfo (`https://example.com/169.254.169.254`,
+// `https://169.254.169.254@example.com`; WHATWG's `\@` a path's, its host
+// the address still), nor Azure's instance metadata
+// (`169.254.169.254/metadata/instance/compute`, after a port too, `:80`, its
+// slashes escaped too, `\/`), a machine's region and size, not its
+// identity's token, as msal asks it; the GitHub Actions runner's process
+// (`Runner.Worker`, `Runner.Worker.exe`, `GitHub.Runner.Worker`), whose
+// memory holds a job's secrets, not in another name (`MyRunner.Worker`,
+// `Runner.Workers`) nor case (`runner.worker`); another process's memory, by
+// its pid's digits or a glob (`/proc/1234/mem`, `/proc/*/mem`,
+// `/proc/[0-9]*/mem`) or a substitution (`/proc/${pid}/mem`, a shell's
+// `$pid`, `$(pgrep …)` and backticks, Python's `{pid}`, a format's `%d`),
+// not a process's own (`/proc/self/mem`) nor what else /proc tells of one
+// (`/proc/1234/status`); and trufflehog, a scanner for secrets, in any case
+// (`TruffleHog`), not in another name (`trufflehogs`, `TRUFFLEHOG_VERSION`).
+const GH_TOKEN = String.raw`(?<![\w.-])[gG][hH](?:\.[eE][xX][eE])?${APART}+auth${APART}+token(?![\w-])`
+const PID = String.raw`[\d*?[\]-]{1,20}|\$\{[^}\n]{0,100}\}|\$\([^)\n]{0,200}\)|\u0060[^\u0060\n]{0,200}\u0060|\$\w{1,64}|\{\w{0,64}\}|%d`
+// A host whole, a URL's or alone: not after a word, a dot or a hyphen, nor a
+// path's slash (`https://example.com/169.254.169.254`), a URL's two
+// (`//`, `\/\/`) its start after a scheme's colon or alone
+// (`//169.254.169.254`), not after a path's character
+// (`https://example.com//169.254.169.254`); nor before more of a name or
+// userinfo's `@` (`https://169.254.169.254@example.com`, `…:password@`).
+const HOST_START = String.raw`(?<![\w.-]|(?<![\/\\])\/|[\w.~%-](?:\\?\/){2})`
+const HOST_END = String.raw`(?![\w-]|\.[\w-]|(?::[^\s\/@'"\x60]{0,64})?@)`
+const TRUFFLEHOG = String.raw`(?<![\p{ID_Continue}$-])trufflehog(?![\p{ID_Continue}$-])`
 const HOLDS = [
   ['credential-files', /(?<![\w$.-])\.(?:npmrc|ssh|aws)(?![\w-])/gu],
   ['tokens', new RegExp(String.raw`^["'\u0060]${TOKEN_VAR}["'\u0060]$|(?:\$\{?|%)${TOKEN_VAR}(?![\p{ID_Continue}$])`, 'gu')],
+  ['gh-token', new RegExp(GH_TOKEN, 'gu')],
+  ['cloud-metadata', new RegExp(String.raw`${HOST_START}169\.254\.169\.254${HOST_END}(?!(?::\d{1,5})?\\?\/metadata\\?\/instance(?![\w-]))|${HOST_START}metadata\.google\.internal${HOST_END}`, 'giu')],
+  ['runner-worker', /(?<![\w$-])Runner\.Worker(?![\w$-])/gu],
+  ['process-memory', new RegExp(String.raw`\/proc\/(?:${PID})\/mem(?![\w-])`, 'gu')],
+  ['trufflehog', new RegExp(TRUFFLEHOG, 'giu')],
   ['publish', /(?<![\w-])(?:npm|pnpm|yarn)(?:\s+-{1,2}\w[\w-]*(?:=\S*|\s+(?!-)\S+)?){0,8}?\s+publish(?![\w-])|\/-\/whoami(?![\w-])/gu],
+  ['shell', new RegExp(SHELL, 'giu')],
+  ['persistence', new RegExp(PERSISTENCE, 'giu')],
 ]
+// What a shell script holds, read whole: its commands, the places they write
+// to, and the credentials a command, a process or its memory holds (`gh auth
+// token`, `Runner.Worker`, `/proc/<pid>/mem`, trufflehog); not the cloud's
+// metadata endpoint, whose fetching is a shell command already (`curl
+// http://169.254.169.254/…`) and which a script provisioning a machine asks
+// its region and id, nor a credential file or a token, which a script
+// publishing a package names.
+const SHELL_KINDS = new Set(['gh-token', 'runner-worker', 'process-memory', 'trufflehog', 'shell', 'persistence'])
+const SHELL_HOLDS = HOLDS.filter(([kind]) => SHELL_KINDS.has(kind))
+// A shell script, by its extension, its name a shell's startup file's
+// (`.bashrc`, `.profile`), or its hashbang: a shell's, by its path or env's,
+// env's options and settings before it (`#!/bin/ksh`, `#!/usr/bin/env -S
+// bash -e`, `#!/usr/bin/env -S MODE=x bash`, `#!/usr/bin/env pwsh`), past a
+// byte order mark.
+const SHELL_SCRIPT = /(?:\.(?:sh|bash|zsh|ksh|mksh|dash|ash|csh|tcsh|fish|command|bat|cmd|ps1|psm1)|(?:^|[\\/])\.(?:bashrc|zshrc|zshenv|zlogin|bash_profile|bash_login|zprofile|profile))$/iu
+// A shell script's comment, a line's whole (`# curl … | sh`) or its end
+// after a command (`echo ok # don't curl …`, `echo ok;# …`) where the quotes
+// before it are closed, escapes read (`"a \" b"`, PowerShell's by a
+// backtick), not in one (`"a # b"`), and no other `#` (`$#`, `<#`) is;
+// PowerShell's, by its extension or hashbang, its blocks too (`<# … #>`,
+// opened where a command or value may start, `$x=<# … #>1`, not in a
+// string, `"<#"`, `"a <#"`, to the end where none closes); a batch file's, cmd's `::`
+// and `REM` (`@REM`, and `REM` after `&` or `||`, `echo ok & REM …`); as
+// none of its commands.
+const SHELL_COMMENT = /^[ \t]*#.*$|^((?:[^'"\n#\\]|\\.|'[^'\n]*'|"(?:[^"\n\\]|\\.)*")*?[ \t;&|])#.*$/gmu
+const POWERSHELL = /\.psm?1$/iu
+const POWERSHELL_HASHBANG = /^\uFEFF?#!\s*\S*\/(?:env\s+(?:(?:-\S+|\w+=\S*)\s+)*)?pwsh(?![\w-])/u
+const POWERSHELL_COMMENT = /^((?:[^'"\n#\u0060]|\u0060.|'[^'\n]*'|"(?:[^"\n\u0060]|\u0060.)*")*?)(?:(?<=^|[\s;({=,])<#[\s\S]*?(?:#>|(?![\s\S]))|(?<=^|[ \t;&|])#.*$)/gmu
+const BATCH = /\.(?:bat|cmd)$/iu
+const BATCH_COMMENT = /^[ \t]*@?(?:::|rem(?![\w-])).*$|(?<=&|\|\|)[ \t]*@?rem(?![\w-]).*$/gimu
+const SHELL_HASHBANG = new RegExp(String.raw`^\uFEFF?#!\s*\S*\/(?:env\s+(?:(?:-\S+|\w+=\S*)\s+)*)?${SHELLS}(?![\w-])`, 'u')
+// A directory and a file in it named apart, as path.join takes them
+// (`join(home, '.claude', 'settings.json')`): a place code runs from again
+// later where a file names both.
+const PARTS = [
+  ['claude', /^(["'\u0060])\.claude\1$/iu, /^(["'\u0060])settings(?:\.local)?\.json\1$/iu],
+  ['vscode', /^(["'\u0060])\.vscode\1$/iu, /^(["'\u0060])tasks\.json\1$/iu],
+]
+// `.profile` named apart where the home directory is the part before it
+// (`join(os.homedir(), '.profile')`, `resolve(process.env.HOME, …)`, `'~'`),
+// not a selector's class alone.
+const PROFILE = /^(["'\u0060])\.profile\1$/iu
+const HOME_BEFORE = /(?:homedir\s*\(\s*\)|\b(?:HOME|USERPROFILE)|(["'\u0060])~\1)\s*,\s*$/u
 // A module a kind loads: vm, child_process, and libnpmpublish, npm's own
 // publishing.
 const MODULES = [
@@ -169,6 +344,22 @@ const OPTION = /^(["'\u0060])-/u
 const ARGUMENTS_BETWEEN = new RegExp(String.raw`^(?:[\s,[]|${COMMENT})*$`, 'u')
 const PUT = /^(["'\u0060])put\1$/iu
 const METHOD = new RegExp(String.raw`\bmethod["']?${GAP}[:=]${GAP}$`, 'u')
+// A program run with its arguments apart, by its path too, a Windows one's
+// from its drive with spaces in it (`spawn('curl', ['-fsSL', 'https://…'])`,
+// `execFile('powershell.exe', ['-NoP', '-enc', …])`, `spawn('systemctl',
+// ['--user', 'enable', …])`, `spawnSync('gh', ['auth', 'token'])`,
+// `execFileSync('C:\\Program Files\\GitHub CLI\\gh.exe', …)`): its command
+// line, its arguments' strings after its name, read as a shell command is, a
+// variable's or a property's value between (`['-o', output, 'https://…']`,
+// `outputs[i]`, `options?.out`), its first 20 arguments, however long.
+const COMMAND = /^(["'\u0060])(?:\S*[\\/]|[a-z]:[\\/][^\n]*[\\/])?(?:curl|wget|certutil|bitsadmin|powershell|pwsh|systemctl|gh)(?:\.exe)?\1$/iu
+// An argument a shell would need quoted, its separators no command's end
+// (`'Cookie: a=b; c=d'`), its own double quotes single then.
+const SEPARATES = /[;|&]/u
+const VALUES_BETWEEN = new RegExp(String.raw`^(?:[\s,[\]\w$.?]|${COMMENT})*$`, 'u')
+// A place named by its parts one after the other, as path.join takes them
+// (`join(home, '.config', 'systemd', 'user')`), read as a path is.
+const PLACE = new RegExp(PERSISTENCE, 'iu')
 // What comes before a module's name where code loads it: `require(` (or
 // `require?.(`), a bundler's `__require(` or `__non_webpack_require__(`,
 // `import(`, `import` and `from`, comments allowed between
@@ -182,9 +373,10 @@ const TYPE_ONLY = new RegExp(String.raw`\b(?:import|export)${GAP}type\b(?!${GAP}
 
 // Each kind, in the order its tags show: its tag, what it does, its name in
 // the tag's tooltip, a row of its own where kinds share the tag (a string run
-// as code by any way, `eval`'s; a credential file or token, `credentials`'),
-// and for one marked as worse than the others' warning, `critical`: the whole
-// environment read out, and publishing.
+// as code by any way, `eval`'s; a credential file, a token, a command, an
+// endpoint or a process, `credentials`'), and for one marked as worse than
+// the others' warning, `critical`: the whole environment read out,
+// publishing, and a place code runs from again later.
 const AS_CODE = { tag: 'eval', note: 'Runs a string as code' }
 const CREDENTIALS = { tag: 'credentials', note: 'Reaches for credentials' }
 export const RUNS_CODE = new Map([
@@ -195,24 +387,44 @@ export const RUNS_CODE = new Map([
   ['child-process', { tag: 'child_process', note: 'Runs other programs', name: 'child_process' }],
   ['credential-files', { ...CREDENTIALS, name: '.npmrc, .ssh or .aws' }],
   ['tokens', { ...CREDENTIALS, name: 'NPM_TOKEN or GITHUB_TOKEN' }],
+  ['gh-token', { ...CREDENTIALS, name: 'gh auth token' }],
+  ['cloud-metadata', { ...CREDENTIALS, name: '169.254.169.254 or metadata.google.internal' }],
+  ['runner-worker', { ...CREDENTIALS, name: 'Runner.Worker' }],
+  ['process-memory', { ...CREDENTIALS, name: '/proc/<pid>/mem' }],
+  ['trufflehog', { ...CREDENTIALS, name: 'trufflehog' }],
   ['env', { tag: 'whole env', note: 'Reads out the whole environment', name: 'process.env, by JSON.stringify, Object.entries or values, URLSearchParams', mark: 'critical' }],
   ['publish', { tag: 'publish', note: 'Publishes to npm', name: 'npm publish, /-/whoami or a registry PUT', mark: 'critical' }],
+  ['shell', { tag: 'shell', note: 'Runs shell commands fetching or handing off code', name: 'curl or wget a URL, | sh, powershell -…, iex, rundll32, osascript, /dev/tcp' }],
+  ['persistence', { tag: 'persistence', note: 'Names a place code runs from again later', name: '.bashrc, .zshrc, $PROFILE, LaunchAgents, systemd user units, .claude/settings.json, .vscode/tasks.json', mark: 'critical' }],
 ])
 
 // The kinds a file's code holds, each with the lines it is on, of the first
 // NPM_MAX_FOUND places it does each, in RUNS_CODE's order; null for none, or
-// for a file that is no script.
+// for a file that is no script. A shell script's, read whole, are its shell
+// commands and the places it names; one with a shell's hashbang is one
+// whatever its extension, and read as JavaScript too where it is that, as
+// a launcher (`#!/bin/sh` then `exec node "$0"`) is both.
 export function npmRunsCode(path, text) {
-  if (!npmIsScript(path, text)) return null
+  const script = npmIsScript(path, text)
+  const shell = typeof text === 'string' && (SHELL_SCRIPT.test(path) || SHELL_HASHBANG.test(text))
+  if (!script && !shell) return null
   const found = new Map()
   const at = (kind, offset) => {
     const offsets = found.get(kind)
     if (!offsets) found.set(kind, [offset])
     else if (offsets.length < NPM_MAX_FOUND) offsets.push(offset)
   }
-  read(text, 0, at)
-  // A PUT request publishing where the file names the registry.
+  if (script) read(text, 0, at)
+  if (shell && SAYS_ANY.test(text)) {
+    // Its comments blanked, its lines where they were.
+    const comments = BATCH.test(path) ? BATCH_COMMENT : POWERSHELL.test(path) || POWERSHELL_HASHBANG.test(text) ? POWERSHELL_COMMENT : SHELL_COMMENT
+    const commands = text.replace(comments, (comment, command = '') => command + comment.slice(command.length).replaceAll(/[^\n]/gu, ' '))
+    for (const [kind, holds] of SHELL_HOLDS) for (const { index } of commands.matchAll(holds)) at(kind, index)
+  }
+  // A PUT request publishing where the file names the registry; a place
+  // named by its directory and its file apart.
   if (found.has('registry')) for (const offset of found.get('put') ?? []) at('publish', offset)
+  for (const [part] of PARTS) if (found.has(`${part}-file`)) for (const offset of found.get(`${part}-dir`) ?? []) at('persistence', offset)
   if (![...RUNS_CODE.keys()].some(kind => found.has(kind))) return null
   const line = lineOf(text)
   return new Map([...RUNS_CODE.keys()].filter(kind => found.has(kind)).map(kind => [kind, [...new Set(found.get(kind).map(line))].toSorted((a, b) => a - b)]))
@@ -227,10 +439,11 @@ export function npmRunsCode(path, text) {
 // anything is read.
 function read(code, base, at) {
   if (!SAYS_ANY.test(code)) return
-  // Where the string before ends; whether the strings since a program's name
-  // are its arguments, an option or its value each, and whether the last is
-  // an option.
-  let end = 0, option = false, program = false
+  // The string before, and where, a place's part maybe; the command line
+  // since a program's name, and where it is named; where the string before
+  // ends; whether the strings since a program's name are its arguments, an
+  // option or its value each, and whether the last is an option.
+  let before = null, command = null, end = 0, option = false, program = false
   for (const { 0: token, 1: string, groups, index } of code.matchAll(READS)) {
     if (string === undefined) {
       for (const kind of CODE_KINDS) if (groups[kind]) at(kind, base + index)
@@ -248,16 +461,40 @@ function read(code, base, at) {
       const after = code.slice(index + token.length, index + token.length + 20)
       return !KEY_SET.test(after) && (!KEY_ENDS.test(after) || !KEY_ABSENT.test(code.slice(Math.max(0, index - 300), index)))
     }
-    const held = HOLDS_ANY.test(text) ? HOLDS.flatMap(([kind, holds]) => [...text.matchAll(holds)].map(({ index: within }) => [kind, within])) : []
+    // Each kind searched for before its places are listed, as matchAll copies
+    // its regular expression each time.
+    const held = HOLDS_ANY.test(text) ? HOLDS.flatMap(([kind, holds]) => text.search(holds) === -1 ? [] : [...text.matchAll(holds)].map(({ index: within }) => [kind, within])) : []
     for (const [kind, within] of held) if (kind !== 'tokens' || within > 0 || keyed()) at(kind, base + index + within)
     if (text.includes('registry.') && REGISTRY_URL.test(unescaped(text).replace(URL_STRIPPED, ''))) at('registry', base + index)
     for (const [kind, name] of MODULES) if (name.test(string) && loaded(code, index)) at(kind, base + index)
+    if (PROFILE.test(string) && HOME_BEFORE.test(code.slice(Math.max(0, index - 100), index))) at('persistence', base + index)
+    for (const [part, dir, file] of PARTS) {
+      if (dir.test(string)) at(`${part}-dir`, base + index)
+      if (file.test(string)) at(`${part}-file`, base + index)
+    }
     if (program && ARGUMENTS_BETWEEN.test(code.slice(end, index))) {
       if (PUBLISH.test(string)) at('publish', base + index)
       program = OPTION.test(string) || option
       option = OPTION.test(string)
     } else program = false
     if (PROGRAM.test(string)) [program, option] = [true, false]
+    if (command && command.arguments < 20 && VALUES_BETWEEN.test(code.slice(end, index))) {
+      const argument = text.slice(1, -1)
+      command.line += ` ${SEPARATES.test(argument) ? `"${argument.replaceAll('"', "'")}"` : argument}`
+      command.arguments++
+      const { line } = command
+      const hit = SHELL_HOLDS.find(([, holds]) => line.search(holds) !== -1)
+      if (hit) {
+        at(hit[0], command.at)
+        command = null
+      }
+    } else command = null
+    if (COMMAND.test(string)) command = { arguments: 0, at: base + index, line: string.slice(1, -1) }
+    if (before && before.text.length + text.length < 200 && ARGUMENTS_BETWEEN.test(code.slice(end, index))) {
+      const [first, second] = [before.text.slice(1, -1), text.slice(1, -1)]
+      if (!PLACE.test(first) && !PLACE.test(second) && PLACE.test(`${first}/${second}`)) at('persistence', before.at)
+    }
+    before = { text, at: base + index }
     if (PUT.test(string) && METHOD.test(code.slice(Math.max(0, index - 300), index))) at('put', base + index)
     end = index + token.length
   }
@@ -344,12 +581,20 @@ export function npmFoundAdded(found, was) {
 // a tag kinds share once: `eval, child_process`.
 export const npmRunsCodeKinds = founds => [...new Set([...RUNS_CODE].filter(([kind]) => founds.some(found => found.has(kind))).map(([, { tag }]) => tag))].join(', ')
 
-// What `found` holds (npmRunsCode's) but the kinds whose tags `tags` names,
-// each with its lines; null for none.
-export function npmRunsCodeWithout(found, tags) {
-  const kept = new Map([...found ?? []].filter(([kind]) => !tags.has(RUNS_CODE.get(kind).tag)))
-  return kept.size > 0 ? kept : null
+// What `found` holds (npmRunsCode's) but the kinds whose tags `tags` names
+// (npmRunsCodeWithout), or of those kinds alone (npmRunsCodeTagged), each
+// with its lines; null for none.
+function npmRunsCodeOf(found, kept) {
+  const of = new Map([...found ?? []].filter(([kind]) => kept(RUNS_CODE.get(kind).tag)))
+  return of.size > 0 ? of : null
 }
+export const npmRunsCodeWithout = (found, tags) => npmRunsCodeOf(found, tag => !tags.has(tag))
+export const npmRunsCodeTagged = (found, tags) => npmRunsCodeOf(found, tag => tags.has(tag))
+
+// The kinds that reach for credentials, by their tag: a version's finding of
+// their own (risk/npm/held.js `held-credentials`), apart from the code its
+// files run beyond themselves.
+export const CREDENTIAL_TAGS = new Set([CREDENTIALS.tag])
 
 // Its tags as a file's flags (file-flags.js), in their order, each once: a
 // warning's (`high`), or for one marked worse, `critical`; none for none.

package/risk/index.d.ts

@@ -116,6 +116,19 @@ export interface DependencyRisk {
   gap?: number
 }
 
+// A version's risk as one number (risk/npm/score.js): what its findings call
+// for (`raised`, each it counts), each by its severity, malware all of it,
+// lowered by its exposure (`lowered`): how long it has been out (`days`)
+// among how many download its package (`tier`, its rank, null past the last
+// or where unknown), `by` the share taken off. Its `level` is named as the
+// findings' severities are: from 75 critical, 50 high, 25 moderate, else low.
+export interface RiskScore {
+  score: number
+  level: 'critical' | 'high' | 'moderate' | 'low'
+  raised: { id: string; severity: Severity }[]
+  lowered?: { days: number; tier: number | null; by: number }
+}
+
 export interface NpmAssessment {
   name: string
   version: string
@@ -129,6 +142,7 @@ export interface NpmAssessment {
   files: Record<string, FileRisk>
   // Against `oldVersion`, each it holds too, flagged against none (`held`).
   dependencies: { added: DependencyRisk[]; changed: DependencyRisk[]; held?: DependencyRisk[] }
+  score: RiskScore
 }
 
 export function assessNpm(name: string, version: string, options?: AssessNpmOptions): Promise<NpmAssessment>

package/risk/npm/assess.js

@@ -7,17 +7,18 @@ import { npmCombinedFindings, npmHeldDependencyFindings } from './combined.js'
 import { npmHeldFindings, npmVersionFindings } from './held.js'
 import { npmVersionFileRisk } from './files.js'
 import { npmDependencyChanges, npmFlagDependencyChanges } from './dependencies.js'
-import { npmDownloadMonths, npmSettledDownloads, npmTierLevel } from './downloads.js'
+import { npmDownloadMonths, npmDownloadTier, npmSettledDownloads, npmTierLevel } from './downloads.js'
 import { NpmRiskError, npmDownloads, npmPackageFacts, npmPackageReleases, npmPublicFacts, npmVersionAdvisories, npmVersionFiles } from './registry.js'
 import { npmMalwareFinding } from './malware.js'
 import { npmKnownScope } from './manifest.js'
 import { DEFAULT_MINIMUM_RELEASE_AGE, npmAccountStanding } from './release.js'
 import { npmAddedDependency } from './new-dependency.js'
+import { npmRiskScore } from './score.js'
 
 // Which reading of a version an assessment kept (`risk/npm/assessments`) is:
 // one more whenever a heuristic changes what it finds, so one kept by an
 // older reading is read anew.
-const RISK_VERSION = 12
+const RISK_VERSION = 16
 
 // How long an assessment kept may be as JSON, and what risk reads of either
 // version's files: a package past it, whose files name thousands of hosts or
@@ -191,15 +192,18 @@ export async function assessNpm(name, version, { oldVersion = null, fromEmpty =
   const malware = npmMalwareFinding({ takenDown: facts.takenDown, advisories: advisories ? await npmVersionAdvisories(name, version, osv, context) : [] })
   if (!facts.versions.has(version)) {
     if (!malware) throw new NpmRiskError('version-not-found', `npm has no ${name}@${version}`)
-    return { name, version, oldVersion: null, published: facts.removed.get(version), removed: true, findings: [malware], files: {}, dependencies: { added: [], changed: [] } }
+    return { name, version, oldVersion: null, published: facts.removed.get(version), removed: true, findings: [malware], files: {}, dependencies: { added: [], changed: [] },
+      score: npmRiskScore([malware]) }
   }
   const { published, manifest } = facts.versions.get(version)
   const kept = await lasting(name, version, old, facts, context, fromEmpty)
+  const counted = downloads && popularity ? await npmDownloads(name, context) : null
   const own = npmVersionFindings({ deprecated: facts.deprecated[version], published, minimumReleaseAge, now, known: Boolean(manifest.knownAccounts), scope: npmKnownScope(name),
-    provenance: Boolean(manifest.provenance), downloads: downloads && popularity ? await npmDownloads(name, context) : null })
+    provenance: Boolean(manifest.provenance), downloads: counted })
   const was = old === null ? null : facts.versions.get(old).published
   const added = downloads && dependencies ? await addedDependencies(kept.dependencies.added, [was, published], context, owned) : kept.dependencies.added
-  return { name, version, oldVersion: old, published, ...npmAssessmentOf(kept, malware ? [malware, ...own] : own, added) }
+  const assessment = npmAssessmentOf(kept, malware ? [malware, ...own] : own, added)
+  return { name, version, oldVersion: old, published, ...assessment, score: npmRiskScore(assessment.findings, { published, now, tier: counted ? npmDownloadTier(counted) : null }) }
 }
 
 // An assessment of what of it holds whatever the time (`kept`,

package/risk/npm/combined.js

@@ -25,12 +25,15 @@ const higher = (a, b) => SEVERITIES[Math.min(SEVERITIES.indexOf(a), SEVERITIES.i
 // scripts added or changed and what each version ran (`flagged`, `was`); a
 // dependency taken from elsewhere than npm's registry anew, its spec before
 // (`was`), or added that nothing imports (`added`). Code kept running beyond
-// itself (`kept-runs-code`) marks nothing, its files held already.
+// itself or reaching for credentials (`kept-runs-code`, `kept-credentials`)
+// marks nothing, its files held already.
 const byPath = (rows, key) => new Map(rows.map(row => [row.path, row[key]]))
 const marked = (held, rows) => ({ ...held, files: held.files.map(row => rows.has(row.path) ? { ...row, added: rows.get(row.path) } : row) })
 const FOLDS = {
   'runs-code': ['held-runs-code', (held, change) => marked(held, byPath(change.files, 'added'))],
   'kept-runs-code': ['held-runs-code', held => held],
+  credentials: ['held-credentials', (held, change) => marked(held, byPath(change.files, 'added'))],
+  'kept-credentials': ['held-credentials', held => held],
   obfuscated: ['held-obfuscated', (held, change) => marked(held, byPath(change.files, 'obfuscation'))],
   'install-scripts': ['held-install-scripts', (held, change) => ({ ...held, flagged: change.flagged, was: [...change.was] })],
   'non-registry-deps': ['held-non-registry-deps', (held, change) => {

package/risk/npm/compare.js

@@ -13,7 +13,7 @@ import { npmHostFinding } from './held.js'
 import { HOST_TAGS, npmHostSeverity, npmHostsTagged } from '../files/hosts.js'
 import { npmBecameUnreadable, npmBinaryCode, npmLargeCode, npmUnreadable } from '../files/readability.js'
 import { SEVERITIES } from '../files/stamps.js'
-import { npmFoundAdded, npmRunsCodeFlags, npmRunsCodeWithout } from '../files/runs-code.js'
+import { CREDENTIAL_TAGS, npmFoundAdded, npmRunsCodeFlags, npmRunsCodeTagged, npmRunsCodeWithout } from '../files/runs-code.js'
 import { npmDependencySpecs } from './dependencies.js'
 import { npmFilesDiff } from './diff.js'
 import { npmInstallScripts } from './install-scripts.js'
@@ -21,7 +21,8 @@ import { npmInstallScriptsChange, npmProvenanceLost, npmPublisherChange } from '
 
 // What the open version does to its files that calls for a look, as red
 // findings: code that runs beyond itself (runs-code.js), new to a file it
-// adds or changes, the kinds with their lines (`runs-code`); a service under
+// adds or changes, the kinds with their lines (`runs-code`), those reaching
+// for credentials apart (CREDENTIAL_TAGS, `credentials`); a service under
 // one of the hosts' tags new to a file it adds or changes (hosts.js
 // npmExfiltration), a finding a tag a level higher than its own
 // (npmHostSeverity: `exfiltration` and `remote` red, `ip-lookup` orange); a
@@ -33,7 +34,7 @@ import { npmInstallScriptsChange, npmProvenanceLost, npmPublisherChange } from '
 // the one compared with's was text, or no code, or none (npmBinaryCode,
 // `binary-code`). Then in orange what any of its files runs beyond itself that
 // `runs-code` doesn't name, kept from the version compared with
-// (`kept-runs-code`). A renamed file by its old path; one renamed alone,
+// (`kept-runs-code`, `kept-credentials`). A renamed file by its old path; one renamed alone,
 // unchanged, holds what it held. A file become unreadable calls for less
 // where its source map was rebuilt with it (`rebuilt`, rebuiltWithMap), as a
 // build minifies a file and writes its map together, and in a `major`
@@ -51,8 +52,11 @@ function npmFileFindings(base, other, files, major) {
   const exfiltration = gained('exfiltration'), runsCode = gained('runsCode')
   const flagged = new Set(runsCode.flatMap(row => npmRunsCodeFlags(row.added).map(({ name }) => name)))
   const kept = [...bundleFilesAsMap(other).keys()].map(path => ({ path, found: npmRunsCodeWithout(npmVersionFileRisk(other, path).runsCode, flagged) })).filter(row => row.found)
+  // Code that runs beyond itself, or of the kinds reaching for credentials.
+  const ofKinds = (rows, key, of) => rows.map(row => ({ ...row, [key]: of(row[key], CREDENTIAL_TAGS) })).filter(row => row[key])
   return [
-    { id: 'runs-code', severity: 'critical', files: runsCode },
+    { id: 'runs-code', severity: 'critical', files: ofKinds(runsCode, 'added', npmRunsCodeWithout) },
+    { id: 'credentials', severity: 'critical', files: ofKinds(runsCode, 'added', npmRunsCodeTagged) },
     ...[...HOST_TAGS.keys()].map(tag => {
       const rows = exfiltration.map(row => ({ path: row.path, added: npmHostsTagged(row.added, tag) })).filter(row => row.added)
       return { id: npmHostFinding(tag), severity: rows.length > 0 ? npmHostSeverity(tag, rows[0].added, null) : HOST_TAGS.get(tag), files: rows }
@@ -65,7 +69,8 @@ function npmFileFindings(base, other, files, major) {
       .map(row => ({ path: row.path, obfuscation: after(row).readability.obfuscation })) },
     { id: 'binary-code', severity: 'critical', files: touched.filter(row => npmBinaryCode(row.path, after(row).readability) && !npmBinaryCode(row.renamedFrom ?? row.path, before(row)?.readability))
       .map(row => ({ path: row.path, bytes: sizes.get(row.path) })) },
-    { id: 'kept-runs-code', severity: 'high', files: kept },
+    { id: 'kept-runs-code', severity: 'high', files: ofKinds(kept, 'found', npmRunsCodeWithout) },
+    { id: 'kept-credentials', severity: 'high', files: ofKinds(kept, 'found', npmRunsCodeTagged) },
   ].filter(finding => finding.files.length > 0)
 }