@preventive/triage 1.0.0-alpha.41 → 1.0.0-alpha.43

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@preventive/triage",
-  "version": "1.0.0-alpha.41",
+  "version": "1.0.0-alpha.43",
   "description": "Client & relay server for triaging of automated reports",
   "license": "MIT OR Apache-2.0",
   "author": {
@@ -152,6 +152,7 @@
     "server-managed/rename-diff.ts",
     "server-managed/rename-diff-worker.js",
     "server-managed/public-workspace.ts",
+    "server-managed/queue.ts",
     "server-managed/repo-path.ts",
     "server-managed/report-migration.ts",
     "server-managed/report-query.ts",
@@ -164,6 +165,9 @@
     "server-managed/repository-discovery.ts",
     "server-managed/repository-policy.ts",
     "server-managed/repository-risk.ts",
+    "server-managed/repository-risk-assess.ts",
+    "server-managed/repository-risk-audit.ts",
+    "server-managed/scan-downloads.ts",
     "server-managed/session.ts",
     "server-managed/slugs.ts",
     "server-managed/solidity-entry-points.ts",
@@ -255,6 +259,8 @@
     "common/revalidation-input-groups.js",
     "common/server-info.ts",
     "common/scan-server.ts",
+    "common/security-links.d.ts",
+    "common/security-links.js",
     "common/utf8.d.ts",
     "common/utf8.js",
     "common/workspace-app.js",
@@ -346,9 +352,9 @@
   "dependencies": {
     "@exodus/stasis": "1.0.0-beta.9",
     "@exodus/stasis-core": "1.0.0-beta.9",
-    "@preventive/compare": "^1.2.0",
+    "@preventive/compare": "^1.2.8",
     "@preventive/diff": "^1.0.2",
-    "@preventive/lockfile": "1.0.0",
+    "@preventive/lockfile": "1.1.0",
     "@preventive/publishers": "^1.1.0",
     "@preventive/report": "1.0.0-alpha.9",
     "@preventive/sourcemap": "1.0.0-alpha.1",

package/risk/files/runs-code.js

@@ -581,12 +581,20 @@ export function npmFoundAdded(found, was) {
 // a tag kinds share once: `eval, child_process`.
 export const npmRunsCodeKinds = founds => [...new Set([...RUNS_CODE].filter(([kind]) => founds.some(found => found.has(kind))).map(([, { tag }]) => tag))].join(', ')
 
-// What `found` holds (npmRunsCode's) but the kinds whose tags `tags` names,
-// each with its lines; null for none.
-export function npmRunsCodeWithout(found, tags) {
-  const kept = new Map([...found ?? []].filter(([kind]) => !tags.has(RUNS_CODE.get(kind).tag)))
-  return kept.size > 0 ? kept : null
+// What `found` holds (npmRunsCode's) but the kinds whose tags `tags` names
+// (npmRunsCodeWithout), or of those kinds alone (npmRunsCodeTagged), each
+// with its lines; null for none.
+function npmRunsCodeOf(found, kept) {
+  const of = new Map([...found ?? []].filter(([kind]) => kept(RUNS_CODE.get(kind).tag)))
+  return of.size > 0 ? of : null
 }
+export const npmRunsCodeWithout = (found, tags) => npmRunsCodeOf(found, tag => !tags.has(tag))
+export const npmRunsCodeTagged = (found, tags) => npmRunsCodeOf(found, tag => tags.has(tag))
+
+// The kinds that reach for credentials, by their tag: a version's finding of
+// their own (risk/npm/held.js `held-credentials`), apart from the code its
+// files run beyond themselves.
+export const CREDENTIAL_TAGS = new Set([CREDENTIALS.tag])
 
 // Its tags as a file's flags (file-flags.js), in their order, each once: a
 // warning's (`high`), or for one marked worse, `critical`; none for none.

package/risk/index.d.ts

@@ -114,6 +114,13 @@ export interface DependencyRisk {
   uncounted?: true
   created?: string
   gap?: number
+  // For one nothing imports, the version its spec installs (registry.js
+  // npmPublicFacts): its package's latest beside it, when it was published,
+  // whether it has install scripts, and whether that was since the version
+  // compared with (`new`).
+  installs?: { version: string; latest: string | null; published: string | null; scripts: boolean; new: boolean }
+  // Where its package was looked up and npm has none of it for anyone.
+  missing?: true
 }
 
 // A version's risk as one number (risk/npm/score.js): what its findings call
@@ -147,6 +154,25 @@ export interface NpmAssessment {
 
 export function assessNpm(name: string, version: string, options?: AssessNpmOptions): Promise<NpmAssessment>
 
+// Readies, at once, the downloads assessNpm asks of each of these packages
+// that can be, kept in `cache` as it keeps them, so that their assessments
+// ask npm none: those kept within a week, and unscoped ones, asked of npm 128
+// at a time. `ready` is told each once its downloads are kept; the rest (scoped
+// ones, which npm answers only one by one) are left for npmReadyDownload.
+// npm asking to be asked later is thrown as an NpmRiskError
+// (`upstream-busy`), those readied by then told.
+// A cache that reads and writes many at once too (`readMany`, `writeMany`)
+// is read once and written once a lookup.
+export function npmReadyDownloads(names: string[], ready: (name: string) => void, options: { cache: CacheStore & {
+  readMany?(type: string, keys: string[]): Promise<Map<string, unknown>>
+  writeMany?(type: string, entries: [key: string, value: unknown][]): Promise<void>
+}; signal?: AbortSignal; now?: number }): Promise<void>
+
+// Readies the downloads assessNpm asks of a package, asked of npm on their
+// own where they aren't kept; npm asking to be asked later thrown as an
+// NpmRiskError (`upstream-busy`).
+export function npmReadyDownload(name: string, options: { cache: CacheStore; signal?: AbortSignal; now?: number }): Promise<void>
+
 // Whether an advisory is of malware rather than a vulnerability: OSV's of a
 // malicious package (`MAL-…`), or one such a record names (its `aliases`),
 // CWE-506, embedded malicious code, whatever its title, or a title naming

package/risk/index.js

@@ -3,5 +3,5 @@
 export { assessNpm } from './npm/assess.js'
 export { npmMalwareAdvisory } from './npm/malware.js'
 export { DEFAULT_MINIMUM_RELEASE_AGE } from './npm/release.js'
-export { NpmRiskError } from './npm/registry.js'
+export { NpmRiskError, npmReadyDownload, npmReadyDownloads } from './npm/registry.js'
 export { SEVERITIES, npmFileRisk } from './files/stamps.js'

package/risk/npm/assess.js

@@ -12,13 +12,14 @@ import { NpmRiskError, npmDownloads, npmPackageFacts, npmPackageReleases, npmPub
 import { npmMalwareFinding } from './malware.js'
 import { npmKnownScope } from './manifest.js'
 import { DEFAULT_MINIMUM_RELEASE_AGE, npmAccountStanding } from './release.js'
-import { npmAddedDependency } from './new-dependency.js'
+import { npmAddedDependency, npmUnusedDependencySeverity } from './new-dependency.js'
+import { SEVERITIES } from '../files/stamps.js'
 import { npmRiskScore } from './score.js'
 
 // Which reading of a version an assessment kept (`risk/npm/assessments`) is:
 // one more whenever a heuristic changes what it finds, so one kept by an
 // older reading is read anew.
-const RISK_VERSION = 14
+const RISK_VERSION = 17
 
 // How long an assessment kept may be as JSON, and what risk reads of either
 // version's files: a package past it, whose files name thousands of hosts or
@@ -123,26 +124,32 @@ const MAX_TOLD_DEPENDENCIES = 100
 // with what risk tells of its package
 // (new-dependency.js npmAddedDependency): its tier, its last whole month's
 // downloads by what its tier goes by where it has one (`month`, `{ total,
-// from }`), `uncounted` where npm counts none of them, and `created` and `gap`
+// from }`), `uncounted` where npm counts none of them, `created` and `gap`
 // where it is new since the version compared with (`published`, when that
-// and the open version were); four asked at a time, whether each is the
+// and the open version were), and for one nothing imports (flagged so, or
+// among `unusedKeys`), the version its spec installs (`installs`,
+// registry.js npmPublicFacts); `missing` where
+// its package was looked up and npm has none of it for anyone, as once
+// unpublished or taken down; four asked at a time, whether each is the
 // caller's own among them, none more once one fails or MAX_TOLD_DEPENDENCIES
 // not the caller's own were taken, however many a version adds.
-async function addedDependencies(added, published, context, owned) {
+async function addedDependencies(added, published, context, owned, unusedKeys = new Set()) {
   const told = [...added]
   const asked = told.flatMap((row, at) => row.opens ? [at] : [])
   let next = 0, taken = 0
   const tell = async row => {
     const downloads = await npmDownloads(row.opens, context)
-    let facts = npmAddedDependency({ downloads, published }, context.now)
+    const unused = row.flags.some(flag => flag.check === 'unimported') || unusedKeys.has(keyOf(row))
+    let facts = npmAddedDependency({ downloads, published, unused }, context.now), missing = false
     if (facts.wanted) {
-      const listed = await npmPublicFacts(row.opens, context)
-      facts = npmAddedDependency({ downloads, listed: listed && { ...listed, private: false }, published }, context.now)
+      const listed = await npmPublicFacts(row.opens, context, unused ? row.range : null)
+      missing = listed === null
+      facts = npmAddedDependency({ downloads, listed: listed && { ...listed, private: false }, published, unused }, context.now)
     }
     const settled = npmSettledDownloads(downloads, context.now)
     const month = npmDownloadMonths(settled).at(-1)
     return { ...row, ...facts.tier === null ? {} : { ...tierOf(facts.tier), ...settled ? month && { month: { total: month.total, from: month.from.toISOString().slice(0, 10) } } : { uncounted: true } },
-      ...facts.created ? { created: facts.created, gap: facts.gap } : {} }
+      ...facts.created ? { created: facts.created, gap: facts.gap } : {}, ...facts.installs ? { installs: facts.installs } : {}, ...missing ? { missing } : {} }
   }
   await Promise.all(Array.from({ length: 4 }, async () => {
     while (next < asked.length && taken < MAX_TOLD_DEPENDENCIES) {
@@ -201,21 +208,60 @@ export async function assessNpm(name, version, { oldVersion = null, fromEmpty =
   const own = npmVersionFindings({ deprecated: facts.deprecated[version], published, minimumReleaseAge, now, known: Boolean(manifest.knownAccounts), scope: npmKnownScope(name),
     provenance: Boolean(manifest.provenance), downloads: counted })
   const was = old === null ? null : facts.versions.get(old).published
-  const added = downloads && dependencies ? await addedDependencies(kept.dependencies.added, [was, published], context, owned) : kept.dependencies.added
-  const assessment = npmAssessmentOf(kept, malware ? [malware, ...own] : own, added)
+  // Those it holds that nothing imports by another spec than the version
+  // compared with's, told by their new spec as an added one nothing imports
+  // is (`respecified`), and an added one nothing imports however it was
+  // flagged, as one moved from another kind of dependency is.
+  const unusedKeys = unusedKeysOf(kept)
+  const respecified = kept.dependencies.changed.filter(row => unusedKeys.has(keyOf(row))).map(row => ({ ...row, range: row.to }))
+  const told = downloads && dependencies ? await addedDependencies([...kept.dependencies.added, ...respecified], [was, published], context, owned, unusedKeys)
+    : [...kept.dependencies.added, ...respecified]
+  const added = told.slice(0, kept.dependencies.added.length)
+  const assessment = npmAssessmentOf(kept, malware ? [malware, ...own] : own, added, told.slice(added.length))
   return { name, version, oldVersion: old, published, ...assessment, score: npmRiskScore(assessment.findings, { published, now, tier: counted ? npmDownloadTier(counted) : null }) }
 }
 
+// A dependency's key among a version's, by its kind and name.
+const keyOf = row => `${row.kind ?? ''}\0${row.name}`
+
+// The keys of the dependencies a version holds that nothing of it imports
+// (`kept`, npmLastingRisk's: its `held-unused-deps`).
+const unusedKeysOf = kept => new Set((kept.findings.find(({ id }) => id === 'held-unused-deps')?.dependencies ?? []).map(keyOf))
+
+// The dependencies nothing of a version imports (`held-unused-deps`), each
+// graded by what risk tells of its package fresh (`told`, as
+// addedDependencies tells it; new-dependency.js
+// npmUnusedDependencySeverity), with its tier, when its package was first
+// published and the version its spec installs where told: kept from the
+// version compared with where there was one (`compared`) and it named it as
+// the same kind of dependency by the same spec: not one marked new, nor
+// `added` (its kind and name new, as one moved from another kind is), nor
+// `changed` (each said with the spec it had, `was`). The finding as its most severe.
+function unusedGraded(finding, told, compared, { added, changed }) {
+  const facts = new Map(told.map(row => [keyOf(row), row])), was = new Map(changed.map(row => [keyOf(row), row.from]))
+  const anew = new Set(added.map(keyOf))
+  const dependencies = finding.dependencies.map(row => {
+    const of = facts.get(keyOf(row))
+    return { ...row, ...was.has(keyOf(row)) ? { was: was.get(keyOf(row)) } : {}, severity: npmUnusedDependencySeverity(of, compared && !row.added && !anew.has(keyOf(row)) && !was.has(keyOf(row))),
+      ...of?.level ? { tier: of.tier, level: of.level } : {}, ...of?.created ? { created: of.created, gap: of.gap } : {}, ...of?.installs ? { installs: of.installs } : {},
+      ...of?.missing ? { missing: true } : {} }
+  })
+  return { ...finding, severity: SEVERITIES[Math.min(...dependencies.map(row => SEVERITIES.indexOf(row.severity)))], dependencies }
+}
+
 // An assessment of what of it holds whatever the time (`kept`,
 // npmLastingRisk's) and what is told fresh: the open version's own findings
 // (`own`, held.js npmVersionFindings, and its malware), its malware and
 // deprecation first and the rest last, its tier as JSON holds it (tierOf),
-// and its dependencies `added`, as addedDependencies tells them. The managed
+// and its dependencies `added`, as addedDependencies tells them, those it
+// holds by another spec that nothing imports beside them (`respecified`),
+// for its unused dependencies' grades. The managed
 // server's (assessNpm), and a test's of versions it holds.
 const FIRST = new Set(['malware', 'deprecated'])
-export function npmAssessmentOf(kept, own, added = kept.dependencies.added) {
+export function npmAssessmentOf(kept, own, added = kept.dependencies.added, respecified = []) {
   return {
-    findings: [...own.filter(({ id }) => FIRST.has(id)), ...kept.findings,
+    findings: [...own.filter(({ id }) => FIRST.has(id)), ...kept.findings.map(finding => finding.id === 'held-unused-deps'
+      ? unusedGraded(finding, [...added, ...respecified], Boolean(kept.dependencies.held), kept.dependencies) : finding),
       ...own.filter(({ id }) => !FIRST.has(id)).map(finding => finding.id === 'popularity' ? { ...finding, ...tierOf(finding.tier) } : finding)],
     files: kept.files,
     dependencies: { ...kept.dependencies, added },

package/risk/npm/combined.js

@@ -25,12 +25,15 @@ const higher = (a, b) => SEVERITIES[Math.min(SEVERITIES.indexOf(a), SEVERITIES.i
 // scripts added or changed and what each version ran (`flagged`, `was`); a
 // dependency taken from elsewhere than npm's registry anew, its spec before
 // (`was`), or added that nothing imports (`added`). Code kept running beyond
-// itself (`kept-runs-code`) marks nothing, its files held already.
+// itself or reaching for credentials (`kept-runs-code`, `kept-credentials`)
+// marks nothing, its files held already.
 const byPath = (rows, key) => new Map(rows.map(row => [row.path, row[key]]))
 const marked = (held, rows) => ({ ...held, files: held.files.map(row => rows.has(row.path) ? { ...row, added: rows.get(row.path) } : row) })
 const FOLDS = {
   'runs-code': ['held-runs-code', (held, change) => marked(held, byPath(change.files, 'added'))],
   'kept-runs-code': ['held-runs-code', held => held],
+  credentials: ['held-credentials', (held, change) => marked(held, byPath(change.files, 'added'))],
+  'kept-credentials': ['held-credentials', held => held],
   obfuscated: ['held-obfuscated', (held, change) => marked(held, byPath(change.files, 'obfuscation'))],
   'install-scripts': ['held-install-scripts', (held, change) => ({ ...held, flagged: change.flagged, was: [...change.was] })],
   'non-registry-deps': ['held-non-registry-deps', (held, change) => {

package/risk/npm/compare.js

@@ -13,7 +13,7 @@ import { npmHostFinding } from './held.js'
 import { HOST_TAGS, npmHostSeverity, npmHostsTagged } from '../files/hosts.js'
 import { npmBecameUnreadable, npmBinaryCode, npmLargeCode, npmUnreadable } from '../files/readability.js'
 import { SEVERITIES } from '../files/stamps.js'
-import { npmFoundAdded, npmRunsCodeFlags, npmRunsCodeWithout } from '../files/runs-code.js'
+import { CREDENTIAL_TAGS, npmFoundAdded, npmRunsCodeFlags, npmRunsCodeTagged, npmRunsCodeWithout } from '../files/runs-code.js'
 import { npmDependencySpecs } from './dependencies.js'
 import { npmFilesDiff } from './diff.js'
 import { npmInstallScripts } from './install-scripts.js'
@@ -21,7 +21,8 @@ import { npmInstallScriptsChange, npmProvenanceLost, npmPublisherChange } from '
 
 // What the open version does to its files that calls for a look, as red
 // findings: code that runs beyond itself (runs-code.js), new to a file it
-// adds or changes, the kinds with their lines (`runs-code`); a service under
+// adds or changes, the kinds with their lines (`runs-code`), those reaching
+// for credentials apart (CREDENTIAL_TAGS, `credentials`); a service under
 // one of the hosts' tags new to a file it adds or changes (hosts.js
 // npmExfiltration), a finding a tag a level higher than its own
 // (npmHostSeverity: `exfiltration` and `remote` red, `ip-lookup` orange); a
@@ -33,7 +34,7 @@ import { npmInstallScriptsChange, npmProvenanceLost, npmPublisherChange } from '
 // the one compared with's was text, or no code, or none (npmBinaryCode,
 // `binary-code`). Then in orange what any of its files runs beyond itself that
 // `runs-code` doesn't name, kept from the version compared with
-// (`kept-runs-code`). A renamed file by its old path; one renamed alone,
+// (`kept-runs-code`, `kept-credentials`). A renamed file by its old path; one renamed alone,
 // unchanged, holds what it held. A file become unreadable calls for less
 // where its source map was rebuilt with it (`rebuilt`, rebuiltWithMap), as a
 // build minifies a file and writes its map together, and in a `major`
@@ -51,8 +52,11 @@ function npmFileFindings(base, other, files, major) {
   const exfiltration = gained('exfiltration'), runsCode = gained('runsCode')
   const flagged = new Set(runsCode.flatMap(row => npmRunsCodeFlags(row.added).map(({ name }) => name)))
   const kept = [...bundleFilesAsMap(other).keys()].map(path => ({ path, found: npmRunsCodeWithout(npmVersionFileRisk(other, path).runsCode, flagged) })).filter(row => row.found)
+  // Code that runs beyond itself, or of the kinds reaching for credentials.
+  const ofKinds = (rows, key, of) => rows.map(row => ({ ...row, [key]: of(row[key], CREDENTIAL_TAGS) })).filter(row => row[key])
   return [
-    { id: 'runs-code', severity: 'critical', files: runsCode },
+    { id: 'runs-code', severity: 'critical', files: ofKinds(runsCode, 'added', npmRunsCodeWithout) },
+    { id: 'credentials', severity: 'critical', files: ofKinds(runsCode, 'added', npmRunsCodeTagged) },
     ...[...HOST_TAGS.keys()].map(tag => {
       const rows = exfiltration.map(row => ({ path: row.path, added: npmHostsTagged(row.added, tag) })).filter(row => row.added)
       return { id: npmHostFinding(tag), severity: rows.length > 0 ? npmHostSeverity(tag, rows[0].added, null) : HOST_TAGS.get(tag), files: rows }
@@ -65,7 +69,8 @@ function npmFileFindings(base, other, files, major) {
       .map(row => ({ path: row.path, obfuscation: after(row).readability.obfuscation })) },
     { id: 'binary-code', severity: 'critical', files: touched.filter(row => npmBinaryCode(row.path, after(row).readability) && !npmBinaryCode(row.renamedFrom ?? row.path, before(row)?.readability))
       .map(row => ({ path: row.path, bytes: sizes.get(row.path) })) },
-    { id: 'kept-runs-code', severity: 'high', files: kept },
+    { id: 'kept-runs-code', severity: 'high', files: ofKinds(kept, 'found', npmRunsCodeWithout) },
+    { id: 'kept-credentials', severity: 'high', files: ofKinds(kept, 'found', npmRunsCodeTagged) },
   ].filter(finding => finding.files.length > 0)
 }
 

package/risk/npm/dependencies.js

@@ -108,10 +108,18 @@ const typesStubOf = ({ json, npm }, name, spec) => npm?.name === typesOf(name) &
 // (importsOf); never where its files aren't read. Not a peer dependency,
 // which the package expects whoever installs it to provide, nor types from
 // DefinitelyTyped (`@types/`), imported by another name, where no one else
-// publishes; nor the package a stub of DefinitelyTyped's types of it
-// depends on (typesStubOf), with no code to import it.
+// publishes; nor tslib, TypeScript's helpers, which a package compiled
+// with them inlined names all the same, as a third of popular packages
+// naming a dependency nothing imports do; each where npm installs that
+// package from its registry (installsAs), not another under its name
+// (`"tslib": "npm:other@1"`, a repository); nor the package a stub of
+// DefinitelyTyped's types of it depends on (typesStubOf), with no code to
+// import it.
+const installsAs = (name, spec) => npmRegistrySpec(spec) ? npmAlias(spec)?.name ?? name : null
 export function npmDependencyUnimported(details, { name, kind, range, to }) {
-  if (!details?.json || kind === 'peer' || name.startsWith('@types/') || typesStubOf(details, name, to ?? range)) return false
+  const installs = installsAs(name, to ?? range)
+  if (!details?.json || kind === 'peer' || (name.startsWith('@types/') && installs?.startsWith('@types/')) || (name === 'tslib' && installs === 'tslib')
+    || typesStubOf(details, name, to ?? range)) return false
   const { whole, parts, commands } = importsOf(details)
   return !whole.has(name) && ![...name.slice(1).matchAll(/[-/]/gu)].some(({ index }) => parts.has(name.slice(0, index + 2)))
     && !commands.some(command => commandNames(command, name))

package/risk/npm/diff.js

@@ -1,8 +1,9 @@
 // How two versions' files differ, as Compare's diff has them
 // (ui/view/bundle-compare-diff.js computeBundleDiff), for risk's findings
-// (compare.js): the files the open version adds, and those it changes, a file
-// moved to another path paired with its old one by content, as git diff -M
-// pairs them (@preventive/compare compareTrees).
+// (compare.js): the files the open version adds, and those it changes, a
+// build's content-hashed file paired with the one it replaces by its name
+// (hashedKey), and a file moved to another path with its old one by content,
+// as git diff -M pairs them (@preventive/compare compareTrees).
 import { compareTrees } from '@preventive/compare'
 import { bundleFilesAsMap } from '../../common/bundle-sources.js'
 
@@ -21,6 +22,25 @@ const same = (a, b) => a === b || (a?.format === 'digest' && b?.format === 'dige
 const treeData = (content, at) => typeof content === 'string' ? `\0text\0${content.toWellFormed()}`
   : content?.format === 'digest' ? `\0digest\0${content.digest}` : `\0none\0${at}`
 
+// A build's content-hashed file (`assets/index-CyWAfh-p.js`, Vite's and
+// Rollup's `[name]-[hash]`, webpack's `[name].[contenthash].js`) by its name
+// but its hash, `assets/index\0.js`: a release renames it as its content
+// changes, the same file. Null for a name whose last part before its
+// extension is no hash: 8 to 32 of base64url's characters with a letter, and
+// a digit or a capital, as neither a lowercase word (`index-client.js`,
+// `lodash.debounce.js`) nor a number (a date, `migration-20240101.js`) is. Its hash its last 8 or more such characters, so that chunks named
+// after a module (`vendor-react-DQ4mN2sx.js`) pair each with its own; a
+// longer hash holding a `-` (Rollup's `[hash:16]`) is cut there, so that a
+// rebuild pairs by its content alone, as its parts aren't told from a
+// chunk's name's (`vendor-ui-…`) without it.
+const HASHED_NAME = /^(.+)[-.]([\w-]{8,32})((?:\.[A-Za-z\d]+)+)$/u
+function hashedKey(path) {
+  const at = path.lastIndexOf('/') + 1
+  const [, stem, hash, extension] = HASHED_NAME.exec(path.slice(at)) ?? []
+  if (!hash || !/[A-Za-z]/u.test(hash) || !/[\dA-Z]/u.test(hash)) return null
+  return `${path.slice(0, at)}${stem}\0${extension}`
+}
+
 // `onlyOther`, the files the open version (`other`) adds, `{ path }` each, and
 // `changed`, those it changes, `{ path, modified }`, or moves, `{ path,
 // renamedFrom, modified }`, `modified` whether its content changed too; each
@@ -34,10 +54,26 @@ export function npmFilesDiff(base, other) {
     else if (!same(before.get(path), text)) changed.push({ path, modified: true })
   }
   for (const path of before.keys()) if (!after.has(path)) onlyBase.push(path)
+  // A content-hashed file added where one by the same name but its hash
+  // (hashedKey) is removed, one each, is that file changed, as a build
+  // renames it: what it runs, how it reads and how large it is told against
+  // it, not all of it new.
+  const hashed = paths => Map.groupBy(paths.filter(hashedKey), hashedKey)
+  const moved = new Set(), removed = hashed(onlyBase)
+  for (const [key, paths] of hashed(onlyOther)) {
+    const was = removed.get(key)
+    if (paths.length !== 1 || was?.length !== 1) continue
+    changed.push({ path: paths[0], renamedFrom: was[0], modified: !same(before.get(was[0]), after.get(paths[0])) })
+    moved.add(paths[0])
+  }
+  // The rest by content, against every file removed: one paired by its name
+  // may be another's too, a build's copy of it elsewhere.
   const entries = (paths, files, side) => paths.filter(path => path.isWellFormed()).map((path, at) => ({ name: path, data: treeData(files.get(path), `${side}${at}`) }))
-  const renames = compareTrees(entries(onlyBase, before, 'a'), entries(onlyOther, after, 'b'), { paths: 'keys', renameLimit: RENAME_LIMIT, lines: false })
+  const renames = compareTrees(entries(onlyBase, before, 'a'), entries(onlyOther.filter(path => !moved.has(path)), after, 'b'), { paths: 'keys', renameLimit: RENAME_LIMIT, lines: false })
     .filter(change => change.status === 'renamed')
-  const moved = new Set(renames.map(change => change.new.path))
-  for (const change of renames) changed.push({ path: change.new.path, renamedFrom: change.old.path, modified: change.similarity !== 100 })
+  for (const change of renames) {
+    changed.push({ path: change.new.path, renamedFrom: change.old.path, modified: change.similarity !== 100 })
+    moved.add(change.new.path)
+  }
   return { onlyOther: onlyOther.filter(path => !moved.has(path)).map(path => ({ path })), changed }
 }

package/risk/npm/held.js

@@ -7,6 +7,7 @@ import { npmDownloadTier, npmTierLevel, npmTierLow } from './downloads.js'
 import { npmInstallScripts } from './install-scripts.js'
 import { npmTooNew } from './release.js'
 import { HOST_TAGS, npmHostsTagged } from '../files/hosts.js'
+import { CREDENTIAL_TAGS, npmRunsCodeTagged, npmRunsCodeWithout } from '../files/runs-code.js'
 import { npmVersionFileRisk } from './files.js'
 
 // What npm says of a version and of its package, told fresh as it changes in
@@ -39,7 +40,8 @@ export function npmVersionFindings({ deprecated, published, minimumReleaseAge, n
 // orange, as its files' tags are: the scripts npm runs installing it
 // (install-scripts.js, `held-install-scripts`, `[script, command]` each); and
 // its files, each with what it holds, that run code beyond themselves
-// (`held-runs-code`), name a service under one of the hosts' tags, at the
+// (`held-runs-code`), reach for credentials (runs-code.js CREDENTIAL_TAGS,
+// `held-credentials`), name a service under one of the hosts' tags, at the
 // tag's severity (hosts.js HOST_TAGS: `held-exfiltration` red, `held-remote`
 // orange, `held-ip-lookup` yellow), or bear an obfuscator's fingerprint
 // (`held-obfuscated`).
@@ -49,7 +51,8 @@ export function npmHeldFindings(version) {
   const holding = of => reads.map(({ path, read }) => ({ path, found: of(read) })).filter(row => row.found)
   return [
     ...scripts.length > 0 ? [{ id: 'held-install-scripts', severity: 'high', scripts }] : [],
-    { id: 'held-runs-code', severity: 'high', files: holding(read => read.runsCode) },
+    { id: 'held-runs-code', severity: 'high', files: holding(read => npmRunsCodeWithout(read.runsCode, CREDENTIAL_TAGS)) },
+    { id: 'held-credentials', severity: 'high', files: holding(read => npmRunsCodeTagged(read.runsCode, CREDENTIAL_TAGS)) },
     ...[...HOST_TAGS].map(([tag, severity]) => ({ id: `held-${npmHostFinding(tag)}`, severity, files: holding(read => npmHostsTagged(read.exfiltration, tag)) })),
     { id: 'held-obfuscated', severity: 'high', files: holding(read => read.readability.obfuscation) },
   ].filter(finding => !finding.files || finding.files.length > 0)

package/risk/npm/new-dependency.js

@@ -10,21 +10,51 @@ import { npmDownloadTier, npmSettledDownloads, npmTierLow } from './downloads.js
 // A dependency added, from its package's facts so far: `downloads`, npm's
 // count of them (null where npm counts none, as it counts none of a package's
 // until the day after it was first published, nor any of a private one's);
-// `listed`, once its version list is read, `{ created, private }`, when its
-// first version was published and whether only a token reads it; and
-// `published`, when the version compared with and the open one were. Its
-// `tier` (Infinity, unpopular, where npm counts none of a public package's;
-// null where it can't yet be told), whether its version list is `wanted` to
-// tell more (below the top 20,000, or none counted), and `created`, `gap`
-// where its package is new since the version compared with: when its first
-// version was published, and how long before the open version that was
-// (negative for after, as a name someone took once a release named it).
-export function npmAddedDependency({ downloads, listed = null, published = [] }, now = Date.now()) {
+// `listed`, once its version list is read, `{ created, private, installs? }`,
+// when its first version was published, whether only a token reads it, and
+// the version of it its spec installs (registry.js npmPublicFacts); and
+// `published`, when the version compared with and the open one were; and
+// whether nothing of the version imports it (`unused`). Its `tier`
+// (Infinity, unpopular, where npm counts none of a public package's; null
+// where it can't yet be told), whether its version list is `wanted` to tell
+// more (below the top 20,000, or none counted, or unused whatever its tier,
+// as how new its package is grades it, npmUnusedDependencySeverity),
+// `created`, `gap` where its package is new since the version compared
+// with: when its first version was published, and how long before the open
+// version that was (negative for after, as a name someone took once a
+// release named it); and where told, the version its spec `installs`,
+// `new` where that was published since the version compared with.
+export function npmAddedDependency({ downloads, listed = null, published = [], unused = false }, now = Date.now()) {
   const settled = npmSettledDownloads(downloads, now)
   const counted = settled ? npmDownloadTier(settled) : null
-  const wanted = !settled || (counted !== null && npmTierLow(counted))
+  const wanted = !settled || unused || (counted !== null && npmTierLow(counted))
   const tier = settled ? counted : listed && !listed.private ? Infinity : null
   const [was, open] = published
   const created = wanted && tier !== null && listed?.created && was && open && Date.parse(listed.created) > Date.parse(was) ? listed.created : null
-  return { tier, wanted, created, gap: created ? Date.parse(open) - Date.parse(created) : null }
+  const installs = listed?.installs ? { ...listed.installs, new: Boolean(was && listed.installs.published && Date.parse(listed.installs.published) > Date.parse(was)) } : null
+  return { tier, wanted, created, gap: created ? Date.parse(open) - Date.parse(created) : null, ...installs ? { installs } : {} }
+}
+
+// What a dependency nothing of a version imports calls for (compare.js
+// `unused-deps`), by what risk tells of its package (`told`, its row as
+// assess.js addedDependencies tells it, or none): one kept from the version
+// compared with (`kept`) yellow, as that version, risk's pick of the most
+// likely free of an attack, held it; else red where its package is new
+// since that version (`created`), as plain-crypto-js was to axios 1.14.1,
+// or the version its spec installs (`installs`) is, has install scripts and
+// isn't its package's latest, as an old package's old major line given a
+// release to run them would, where a package still releasing its latest
+// wouldn't; orange where that version has install scripts, as installing an unused
+// dependency runs them and nothing else, or npm has none of its package
+// for anyone (`missing`), as once unpublished or taken down, whatever
+// downloads it still counts; yellow among npm's top 20,000, as
+// a dependency named for another's peer or by a tool's config is (react,
+// typescript, eslint), older and more downloaded than the package naming
+// it; orange past them, or where its package isn't told.
+export function npmUnusedDependencySeverity(told, kept) {
+  if (kept) return 'moderate'
+  const { scripts, new: anew, version, latest } = told?.installs ?? {}
+  if (told?.created || (scripts && anew && version !== latest)) return 'critical'
+  if (scripts || told?.missing) return 'high'
+  return told?.level && !npmTierLow(told.tier ?? Infinity) ? 'moderate' : 'high'
 }