@preventive/triage 1.0.0-alpha.5 → 1.0.0-alpha.50

package/risk/files/hosts.js

@@ -0,0 +1,205 @@
+// The hosts a version's code names, and the services malicious packages send
+// what they take to, fetch what they run from or look the machine up with,
+// for a reviewer: the hosts a version's scripts name that the version
+// compared with's named in none of theirs, and the services a file names,
+// under a tag for how much they call for (HOST_TAGS: Exfiltration, Remote,
+// IP lookup), as a file's stamps say (stamps.js).
+//
+// A quick read, not a parse, as runs-code.js reads: a host is a URL's in a
+// script's strings, regular expressions and template literals
+// (JS_STRING_OR_COMMENT), its comments aside, where a link to docs is no host
+// the code calls; an exfiltration host is told in any text but prose and a
+// source map, wherever it is written. A host built as the code runs
+// (`'https://' + name`, `${host}`) goes unseen, so a version without these
+// labels is not one that sends nothing.
+import { NPM_PROSE, SOURCE_MAP } from './readability.js'
+import { JS_STRING_OR_COMMENT, NPM_MAX_FOUND, lineOf, npmIsScript } from './script.js'
+
+// How many hosts a file is told naming at most, the first it names.
+const NPM_MAX_HOSTS = 1000
+
+// A URL's host: a name whose last label is letters (an internationalized
+// one's too, as written or as punycode), or an IPv4 address, after its
+// scheme, as a regular expression may leave its `s` optional (`https?://`),
+// and any user, its case aside; whole, not the start of one built as the code
+// runs (`api.service.com.${tld}`).
+const LABEL = String.raw`[\p{L}\p{N}](?:[\p{L}\p{N}-]*[\p{L}\p{N}])?`
+const URL_HOST = new RegExp(String.raw`\b(?:https?|wss?|ftp)\??:\/\/(?:[^\s/@'"\x60]*@)?(${LABEL}(?:\.${LABEL})+)(?![\p{L}\p{N}-]|\.[\p{L}\p{N}_$-])`, 'giu')
+const NAMED = /\.(?:\p{L}{2,}|xn--[a-z0-9-]+)$/u
+const IPV4 = /^(?:(?:25[0-5]|2[0-4]\d|1?\d?\d)\.){3}(?:25[0-5]|2[0-4]\d|1?\d?\d)$/u
+// Hosts no code calls out to: this machine, the names kept for examples and
+// tests (RFC 2606, RFC 6761) and local networks, and W3C's, whose URLs name
+// XML namespaces.
+const LOCAL = /^(?:localhost|.+\.(?:localhost|local|test|invalid|example|internal)|(?:.+\.)?example\.(?:com|net|org)|127(?:\.\d+){3}|0\.0\.0\.0|(?:.+\.)?w3\.org)$/u
+
+// What a regular expression escapes in a URL, its slashes and dots
+// (`/https:\/\/api\.example\.com/`), as a string may its slashes
+// (`"https:\/\/api.example.com"`, as JSON can be written), read unescaped.
+const ESCAPED = /\\([/.])/gu
+
+// The pages github.com shows of a repository that a person reads, past its
+// owner and name, as links and error messages name them: not its Actions,
+// whose runs' artifacts and logs are downloads of what its workflows made.
+const GITHUB_PAGES = new Set(['issues', 'pull', 'pulls', 'blob', 'tree', 'wiki', 'discussions', 'commit', 'commits', 'compare', 'blame',
+  'security', 'projects', 'labels', 'milestone', 'milestones', 'releases', 'tags', 'graphs', 'network', 'stargazers'])
+// The paths past github.com that name no repository but a page of GitHub's
+// own (`github.com/sponsors/someone`, `github.com/orgs/someone/people`).
+const GITHUB_OWN = new Set(['sponsors', 'orgs', 'apps', 'marketplace', 'features', 'topics', 'collections', 'settings', 'login', 'search', 'explore', 'about'])
+// How a github.com URL (`url`, as written from its scheme on, the punctuation
+// a sentence ends it with aside) is named among a file's hosts, read as fetch
+// reads it (WHATWG URL: a port, a trailing dot, backslashes as slashes, `..`
+// resolved): `github.com` for its home or a person's, a page of GitHub's own
+// (GITHUB_OWN), a page of a repository a person reads (GITHUB_PAGES), a
+// release's page (`releases/tag/v1`, `releases/latest`) but not its assets'
+// (`releases/latest/download/…`), a file's page but not the file raw
+// (`blob/…?raw=true`, any `raw` asked), and a page but not its content in another format, as
+// GitHub serves one by a suffix to its path past a file's (`pull/1.patch`,
+// `commit/….diff`, `commits/main.atom`). Any other (a repository's own URL,
+// which git clones, `raw/…`, `archive/…`, `tarball`, `repo.git`, a path GitHub
+// may add, one read otherwise) leads to whatever a repository holds: named by
+// it (`github.com/owner/repo`, in lower case, as GitHub's names are any), so
+// that it is never taken for one of github.com's links to code and docs
+// (compare.js ALLOWED_HOSTS).
+const FILE_PATHS = new Set(['blob', 'tree', 'blame', 'wiki'])
+const FORMAT = /\.(?:patch|diff|atom)$/iu
+const GIT = /\.git$/iu
+const decoded = part => { try { return decodeURIComponent(part) } catch { return part } }
+function githubNamed(url) {
+  let parsed = null
+  try { parsed = new URL(url.replace(/^(\w+)\?:/u, '$1:').replace(/[)\]}>.,;:!]+$/u, '')) } catch {}
+  if (!parsed) return 'github.com/'
+  // Its path and query decoded, as GitHub routes them (`pull/1%2Epatch`,
+  // `?raw=%31`).
+  const segments = parsed.pathname.split('/').slice(1).map(decoded)
+  if (segments.length > 1 && segments.at(-1) === '') segments.pop()
+  const [owner, repo = '', section, ...rest] = segments
+  const repositoryPage = owner !== '' && repo !== '' && !GIT.test(repo) && GITHUB_PAGES.has(section)
+    && !(section === 'releases' && rest.includes('download')) && !(section === 'blob' && parsed.searchParams.has('raw'))
+    && !(!FILE_PATHS.has(section) && FORMAT.test(segments.at(-1)))
+  const page = parsed.hostname.replace(/\.$/u, '') === 'github.com' && (segments.length === 1 || GITHUB_OWN.has(owner) || repositoryPage)
+  return page ? 'github.com' : `github.com/${owner}/${repo.replace(GIT, '')}`.toLowerCase()
+}
+
+// The hosts a script's strings name, each with the line it is first named on,
+// in the order named, NPM_MAX_HOSTS at most; null for none, or for a file
+// that is no script, by its name or as node runs it (`script`, npmIsScript).
+export function npmHosts(path, text, script = false) {
+  if (!npmIsScript(path, text, script) || !(text.includes('://') || text.includes(':\\/\\/'))) return null
+  const hosts = new Map(), line = lineOf(text)
+  for (const { 1: token, index } of text.matchAll(JS_STRING_OR_COMMENT)) {
+    if (hosts.size >= NPM_MAX_HOSTS) break
+    // Read unescaped, its offsets as near: on the same line but in a template
+    // across lines; a regular expression without its closing slash and flags,
+    // as a string's quote ends its URL (`/https:\/\/github.com\/a\/b\/pull\/1.patch/i`).
+    const body = token?.startsWith('/') ? token.replace(/\/[a-z]*$/u, '') : token
+    const string = body?.includes('\\') ? body.replaceAll(ESCAPED, '$1') : body
+    if (!string?.includes('://')) continue
+    for (const { 1: name, index: at } of string.matchAll(URL_HOST)) {
+      const host = name.toLowerCase()
+      const named = host === 'github.com' ? githubNamed(/^[^\s'"\u0060]*/u.exec(string.slice(at))[0]) : host
+      if (!hosts.has(named) && (NAMED.test(host) || IPV4.test(host)) && !LOCAL.test(host)) hosts.set(named, line(index + at))
+      if (hosts.size >= NPM_MAX_HOSTS) break
+    }
+  }
+  return hosts.size > 0 ? hosts : null
+}
+
+// A host as it is written, under another or not (`m.webhook.site`), then a
+// path on it where only that path is the service (`/api/webhooks`), on its
+// own: not part of a longer name (`notwebhook.site`, `webhook.sites`), a
+// name under another domain (`webhook.site.evil.example`, `webhook.site.рф`),
+// nor another path (`/install.sh`, `/api/webhooks.json`), though a sentence
+// may end after it. Its name first, so a text is searched for that alone.
+const NAME_CHAR = String.raw`[\p{L}\p{N}_-]`
+const host = (name, path = '') => new RegExp(String.raw`(?<!${NAME_CHAR})${name}${path}(?!\.?${NAME_CHAR})`, 'giu')
+// One so like a file's name or code (`transfer.sh`, `file.io`) only as a
+// URL's host: after the `//` that starts its authority (or `\/\/` as JSON can
+// write it), where the URL starts, its scheme as URL_HOST takes one after the
+// text's start, a blank, a quote, `(`, `=`, `,`, `<` or `>`, or without one
+// after a quote, `(`, `=` or `,` (`"//file.io/x"`): not a URL's path, whatever
+// it holds (`https://example.com/a//transfer.sh`, `/http://transfer.sh`); and
+// after any user, not a user itself (`https://transfer.sh@example.com`).
+const inUrl = name => new RegExp(String.raw`(?<=(?:(?:^|[\s'"\x60(=,<>])(?:https?|wss?|ftp)\??:|['"\x60(=,])\\?\/\\?\/(?:[^\s/@'"\x60]*@)?(?:${NAME_CHAR}+\.)*)${name}(?!\.?${NAME_CHAR}|(?::[^\s/@'"\x60]*)?@)`, 'giu')
+// The tags the services go under, each with its severity (stamps.js
+// SEVERITIES), as a change between versions raises it (npmHostSeverity):
+// Exfiltration, `critical` (red), where nothing but catching what is sent
+// has a use for it in a package's code; Remote, `high` (orange), where it
+// could be fine; and IP lookup, `moderate` (yellow), where it usually is.
+export const HOST_TAGS = new Map([['Exfiltration', 'critical'], ['Remote', 'high'], ['IP lookup', 'moderate']])
+const [CATCHER, REMOTE, IP_LOOKUP] = [...HOST_TAGS.keys()].map(tag => ({ tag }))
+// Services malicious packages send what they take to, fetch what they run
+// from, or look the machine up with, each under its tag. Exfiltration's:
+// request catchers, and out-of-band testing hosts (interactsh's, Burp
+// Collaborator's, Canarytokens', DNS logs). Remote's: bot and webhook APIs,
+// paste sites and file drops, tunnels, Pipedream's own API (its endpoints
+// are `pipedream.net`), and the install script of Bun (`bun.sh/install`, now
+// `bun.com/install`), which a worm ran its payload with. And IP lookups.
+export const EXFILTRATION = new Map([
+  ['webhook-site', { ...CATCHER, name: 'webhook.site', pattern: host(String.raw`webhook\.site`) }],
+  ['pipedream', { ...CATCHER, name: 'Pipedream', pattern: host(String.raw`pipedream\.net`) }],
+  ['requestbin', { ...CATCHER, name: 'RequestBin', pattern: host(String.raw`(?:requestbin\.(?:net|com)|requestb\.in)`) }],
+  ['requestcatcher', { ...CATCHER, name: 'Request Catcher', pattern: host(String.raw`requestcatcher\.com`) }],
+  ['requestrepo', { ...CATCHER, name: 'requestrepo', pattern: host(String.raw`requestrepo\.com`) }],
+  ['beeceptor', { ...CATCHER, name: 'Beeceptor', pattern: host(String.raw`beeceptor\.com`) }],
+  ['oast', { ...CATCHER, name: 'OAST', pattern: host(String.raw`(?:interact\.sh|interactsh\.com|oast\.(?:pro|live|site|online|fun|me)|oastify\.com|burpcollaborator\.net)`) }],
+  ['canarytokens', { ...CATCHER, name: 'Canarytokens', pattern: host(String.raw`canarytokens\.(?:com|org)`) }],
+  ['dnslog', { ...CATCHER, name: 'DNSLog', pattern: host(String.raw`dnslog\.cn`) }],
+  ['ceye', { ...CATCHER, name: 'CEYE', pattern: host(String.raw`ceye\.io`) }],
+  ['telegram', { ...REMOTE, name: 'Telegram', pattern: host(String.raw`api\.telegram\.org`) }],
+  ['discord', { ...REMOTE, name: 'Discord webhook', pattern: host(String.raw`discord(?:app)?\.com`, String.raw`/api(?:/v\d+)?/webhooks`) }],
+  ['slack', { ...REMOTE, name: 'Slack webhook', pattern: host(String.raw`hooks\.slack\.com`, '/(?:services|workflows|triggers)') }],
+  ['pastebin', { ...REMOTE, name: 'Pastebin', pattern: host(String.raw`pastebin\.com`) }],
+  ['paste-ee', { ...REMOTE, name: 'paste.ee', pattern: host(String.raw`paste\.ee`) }],
+  ['transfer-sh', { ...REMOTE, name: 'transfer.sh', pattern: inUrl(String.raw`transfer\.sh`) }],
+  ['file-io', { ...REMOTE, name: 'file.io', pattern: inUrl(String.raw`file\.io`) }],
+  ['0x0', { ...REMOTE, name: '0x0.st', pattern: host(String.raw`0x0\.st`) }],
+  ['ngrok', { ...REMOTE, name: 'ngrok', pattern: host(String.raw`ngrok(?:-free)?\.(?:io|app|dev)`) }],
+  ['localtunnel', { ...REMOTE, name: 'localtunnel', pattern: host(String.raw`loca\.lt`) }],
+  ['cloudflare-tunnel', { ...REMOTE, name: 'Cloudflare Tunnel', pattern: host(String.raw`trycloudflare\.com`) }],
+  ['serveo', { ...REMOTE, name: 'Serveo', pattern: host(String.raw`serveo\.net`) }],
+  ['pipedream-api', { ...REMOTE, name: 'Pipedream API', pattern: host(String.raw`pipedream\.com`) }],
+  ['bun', { ...REMOTE, name: 'Bun install', pattern: host(String.raw`bun\.(?:sh|com)`, '/install') }],
+  ['ipinfo', { ...IP_LOOKUP, name: 'ipinfo', pattern: host(String.raw`ipinfo\.io`) }],
+  ['ipify', { ...IP_LOOKUP, name: 'ipify', pattern: host(String.raw`ipify\.org`) }],
+  ['ifconfig-me', { ...IP_LOOKUP, name: 'ifconfig.me', pattern: host(String.raw`ifconfig\.me`) }],
+  ['icanhazip', { ...IP_LOOKUP, name: 'icanhazip', pattern: host(String.raw`icanhazip\.com`) }],
+  ['ip-api', { ...IP_LOOKUP, name: 'ip-api', pattern: host(String.raw`ip-api\.com`) }],
+  ['ipapi', { ...IP_LOOKUP, name: 'ipapi', pattern: host(String.raw`ipapi\.com?`) }],
+  ['checkip', { ...IP_LOOKUP, name: 'checkip', pattern: host(String.raw`checkip\.amazonaws\.com`) }],
+])
+// Any of them, as a text may say it: most say none, told at once.
+const SAYS_ANY = new RegExp([...EXFILTRATION.values()].map(({ pattern }) => pattern.source).join('|'), 'iu')
+
+// The services a file names, each with the lines it is named on, the first
+// NPM_MAX_FOUND, in EXFILTRATION's order; null for none, or for prose or a
+// source map by its name that node doesn't run as a script (`script`).
+export function npmExfiltration(path, text, script = false) {
+  if (typeof text !== 'string' || (!script && (NPM_PROSE.test(path) || SOURCE_MAP.test(path))) || !SAYS_ANY.test(text)) return null
+  const found = new Map(), line = lineOf(text)
+  for (const [service, { pattern }] of EXFILTRATION) {
+    const lines = new Set()
+    for (const { index } of text.matchAll(pattern)) if (lines.add(line(index)).size >= NPM_MAX_FOUND) break
+    if (lines.size > 0) found.set(service, [...lines])
+  }
+  return found.size > 0 ? found : null
+}
+
+// The services of `found` under `tag` (HOST_TAGS), in their order; null for
+// none.
+export function npmHostsTagged(found, tag) {
+  const tagged = found && new Map([...found].filter(([service]) => EXFILTRATION.get(service).tag === tag))
+  return tagged?.size > 0 ? tagged : null
+}
+
+// The services a file names (`found`) by their tag, in HOST_TAGS' order:
+// `[tag, services]` each.
+export const npmHostTags = found => [...HOST_TAGS.keys()].map(tag => [tag, npmHostsTagged(found, tag)]).filter(([, services]) => services)
+
+// How severe a tag's `services` are: its own severity, or with `was` (null for
+// a file that held none), where one of them the file didn't name, a level
+// higher, never past `critical`, as a change between versions calls for more.
+export function npmHostSeverity(tag, services, was) {
+  const levels = [...HOST_TAGS.values()]
+  const at = levels.indexOf(HOST_TAGS.get(tag))
+  return levels[was !== undefined && [...services.keys()].some(service => !was?.has(service)) ? Math.max(0, at - 1) : at]
+}

package/risk/files/readability.js

@@ -0,0 +1,177 @@
+// How a file's text reads, for a reviewer: its category (binary, a source
+// map, code with unexpectedly long lines or an inline map, minified, else
+// ASCII or UTF-8), its control and invisible characters, its longest lines,
+// an obfuscator's fingerprint, a large code file, and a file become
+// unreadable between two versions.
+import { CONTROLS, npmTextEncoding } from './characters.js'
+import { MINIFIED_AVERAGE, minifiable, minifiedAverage } from './script.js'
+
+// Lines longer than anyone writes by hand.
+export const NPM_LONG_LINE = 1000
+// Prose, which wraps where it is read: its long lines are paragraphs. By its
+// extension (text, Markdown and MDX, and the markup GitHub renders a README
+// from: `README.org`, `README.rdoc`), or its name alone (`LICENSE-MIT`,
+// `CHANGES`; a dot in it only a version's, `LICENSE-LGPL2.1`,
+// `CHANGES.2.0`; a prose extension after it is one), not code named alike
+// (`lib/history.js`, `dist/notice.min.js`), which can be minified as any.
+export const NPM_PROSE = /(?:\.(?:md|markdown|mdown|mkdn|mdx|txt|rst|adoc|asciidoc|asc|textile|rdoc|org|creole|mediawiki|wiki|pod)|(?:^|\/)(?:licen[cs]e|copying|notice|authors|contributors|readme|changelog|changes|history)(?:-[^/.]*)?(?:\.\d[^/.]*)*)$/iu
+const SOURCE_MAP_COMMENT = /^\s*(?:\/\/|\/\*)[#@] sourceMappingURL=/u
+// A line that is all one, the map in it as a data: URL, base64 or
+// percent-encoded: not code that writes one.
+const INLINE_SOURCE_MAP = /^\s*(?:\/\/|\/\*)[#@] sourceMappingURL=data:[^\s,]*,[\w+/=%.~-]*\s*(?:\*\/)?\s*$/u
+export const SOURCE_MAP = /\.map$/iu
+const MINIFIED_NAME = /\.min\.[^/.]+$/iu
+// What javascript-obfuscator writes, and next to nothing else: its names,
+// `_0x` and four to six hex digits, OBFUSCATED_NAMES of them or more, or the
+// loop it turns its array of strings with, `while(!![])`, spaced or not.
+const OBFUSCATED_NAME = /(?<![\p{ID_Continue}$])_0x[0-9a-f]{4,6}(?![\p{ID_Continue}$])/gu
+export const OBFUSCATED_NAMES = 20
+const OBFUSCATED_LOOP = /while\s*\(\s*!!\[\]\s*\)/u
+// Names counted before a fingerprint's count stops, reading as that many or
+// more: each is kept to tell it from the others, and a file can hold millions.
+export const OBFUSCATED_COUNTED = 1000
+// A text's obfuscator fingerprint, `{ names, loop }`: how many such names it
+// has, up to OBFUSCATED_COUNTED, and whether it has the loop; null where it
+// has neither enough names nor the loop.
+export function npmObfuscation(text) {
+  const names = new Set()
+  for (const [name] of text.matchAll(OBFUSCATED_NAME)) {
+    names.add(name)
+    if (names.size === OBFUSCATED_COUNTED) break
+  }
+  const loop = OBFUSCATED_LOOP.test(text)
+  return names.size >= OBFUSCATED_NAMES || loop ? { names: names.size, loop } : null
+}
+
+// A code file this large is mostly a bundle, worth a look where a version
+// adds it: JavaScript or TypeScript, not a declaration file, which holds no
+// code that runs, or any file node runs as a script (`script`, npm/files.js
+// npmLoadedScripts).
+export const NPM_LARGE_CODE = 256 * 1024
+const CODE = /\.(?:[cm]?[jt]s|[jt]sx)$/iu
+const DECLARATION = /\.d\.[cm]?ts$/iu
+export const npmLargeCode = (path, bytes, script = false) => typeof bytes === 'number' && bytes >= NPM_LARGE_CODE && (script || (CODE.test(path) && !DECLARATION.test(path)))
+
+// A code file that isn't text (npmFileReadability's `binary`: not UTF-8, or
+// holding a NUL), by its path and how it reads, a declaration file too, or
+// any file node runs as a script (`script`, npm/files.js npmLoadedScripts):
+// no one can read it in review, yet what reads it by its byte order mark can
+// run it, or type with it, as UTF-16 (a browser's classic script, Windows
+// Script Host, TypeScript), and node runs it decoded as UTF-8 whatever it
+// holds past its code (`//` and a byte no UTF-8 has).
+export const npmBinaryCode = (path, readability, script = false) => readability?.category === 'binary' && (script || CODE.test(path))
+
+// A file with a line over UNREADABLE_LINE characters, by how it reads
+// (`now`, npmFileReadability's), `path` its path: an inline source map's line
+// counts for none, and prose and source maps, whose long lines the Long lines
+// tag passes over, never are, but where node runs it as a script (`script`),
+// nor is a file that isn't text. Then one that had no line over SHORT_LINES
+// characters (`was`) and now has one over UNREADABLE_LINE, by how it reads on
+// each side.
+const SHORT_LINES = 200
+const UNREADABLE_LINE = 2000
+export const npmUnreadable = (path, now, script = false) => Boolean(now) && now.category !== 'binary' && (script || (!NPM_PROSE.test(path) && !SOURCE_MAP.test(path)))
+  && now.longest > UNREADABLE_LINE
+export const npmBecameUnreadable = (path, was, now, script = false) => Boolean(was) && was.category !== 'binary' && was.longest <= SHORT_LINES && npmUnreadable(path, now, script)
+
+// How a file reads, as its `category`, the first that holds (READABILITY):
+// binary (no text), map (a source map), long (code with some lines
+// longer than anyone writes), inline-map (code with its source map in it, minified or
+// not), minified (code mostly on long lines, or named .min., or minified
+// into shorter lines: see MINIFIED_AVERAGE), else utf8 or ascii; and
+// whatever it is, the control, bidirectional or invisible characters a text
+// holds (`controls`), found in one pass, which count as a label of their own
+// beside it each, control and invisible (npmReadabilityLabels). Prose is
+// readable whatever its lines' lengths, and an inline source map's line
+// counts for none, nor for how much of the code is on long lines. With
+// npmTextEncoding's `kind` and `controls`, its `longest` line's length and
+// `longLines`, its code's lines' `average` length where it is minified into
+// short ones (strings and comments aside, see MINIFIED_AVERAGE; 0 otherwise),
+// how long its inline map is (`inlineMap`, 0 for none), and its obfuscator
+// fingerprint (`obfuscation`, npmObfuscation's; null for none, and for prose
+// or a source map). One node runs as a script whatever its name (`script`,
+// script.js npmIsScript) is read as code: no prose nor source map.
+export function npmFileReadability(path, text, script = false) {
+  const encoding = npmTextEncoding(text)
+  if (encoding.kind === 'binary') return { ...encoding, category: 'binary', longest: 0, longLines: 0, average: 0, inlineMap: 0, obfuscation: null }
+  let inlineMap = 0, longChars = 0, longLines = 0, longest = 0
+  for (let at = 0; at <= text.length;) {
+    const next = text.indexOf('\n', at)
+    const end = next === -1 ? text.length : next
+    const length = end - at - (text[end - 1] === '\r' ? 1 : 0)
+    if (SOURCE_MAP_COMMENT.test(text.slice(at, at + 64)) && INLINE_SOURCE_MAP.test(text.slice(at, end))) inlineMap += length
+    else {
+      if (length > NPM_LONG_LINE) {
+        longLines++
+        longChars += length
+      }
+      longest = Math.max(longest, length)
+    }
+    at = end + 1
+  }
+  // A source map holds the names and sources of the code it maps, and prose
+  // its examples: neither runs.
+  const map = !script && SOURCE_MAP.test(path), prose = !script && NPM_PROSE.test(path)
+  const obfuscation = prose || map ? null : npmObfuscation(text)
+  const read = { ...encoding, longest, longLines, average: 0, inlineMap, obfuscation }
+  if (map) return { ...read, category: 'map' }
+  if (prose) return { ...read, category: inlineMap > 0 ? 'inline-map' : encoding.kind }
+  if (longLines === 0) {
+    // None of its lines longer than MINIFIED_AVERAGE, none of its code's can
+    // average more: told without reading its code.
+    const language = minifiable(path, script)
+    const average = language !== null && longest > MINIFIED_AVERAGE ? minifiedAverage(text, language) : 0
+    return { ...read, average, category: inlineMap > 0 ? 'inline-map' : average > 0 ? 'minified' : encoding.kind }
+  }
+  if (longChars / (text.length - inlineMap) < .5 && !MINIFIED_NAME.test(path)) return { ...read, category: 'long' }
+  return { ...read, category: inlineMap > 0 ? 'inline-map' : 'minified' }
+}
+
+// The category a file's tag shows: for one with long lines, how its text is
+// encoded.
+export const npmTaggedCategory = readability => readability.category === 'long' ? readability.kind : readability.category
+
+// What a file is labelled, in its tags and in the Overview's warning and
+// chips, each finding it: its control characters, its invisible ones
+// (characterLabels) and its long lines, where it holds them, beside its category (how its text is encoded, for one whose long
+// lines are unexpected), but for ASCII or UTF-8, which a file that can't be
+// read as it is counts under as none of them. A minified file's long lines
+// are labelled too, as its inline map's are; prose's and a source map's
+// never are.
+export function npmReadabilityLabels(readability) {
+  const flags = [...characterLabels(readability.controls),
+    ...readability.longLines > 0 && ['long', 'minified', 'inline-map'].includes(readability.category) ? ['long'] : []]
+  const category = npmTaggedCategory(readability)
+  return READABILITY.get(category).mark || flags.length === 0 ? [...flags, category] : flags
+}
+
+// How a label is marked on a file: long lines as a warning where it is
+// otherwise readable, as they are unexpected there, and as a notice in
+// minified code, as minified code is; any other as its category is.
+export const npmLabelMark = (readability, label) => label === 'long' && readability.category !== 'long' ? 'notice' : READABILITY.get(label).mark
+
+// Each category: its name, its tag in a list of files or a file's head (and,
+// `short`, in a file tree, where that is too long), and how it is marked,
+// `warn` for what to look into, `notice` for what can be hard to review by
+// reading it either way.
+export const READABILITY = new Map([
+  ['binary', { name: 'Binary', tag: 'Binary', mark: 'warn' }],
+  ['controls', { name: 'Control chars', tag: 'Controls', mark: 'warn' }],
+  ['invisible', { name: 'Invisible chars', tag: 'Invisible', mark: 'warn' }],
+  ['long', { name: 'Long lines', tag: 'Long lines', mark: 'warn' }],
+  ['minified', { name: 'Minified', tag: 'Minified', short: 'Min', mark: 'notice' }],
+  ['map', { name: 'Source maps', tag: 'Map', mark: 'notice' }],
+  ['inline-map', { name: 'Inline source maps', tag: 'Inline map', mark: 'notice' }],
+  ['utf8', { name: 'UTF-8', tag: 'UTF-8', mark: null }],
+  ['ascii', { name: 'ASCII', tag: 'ASCII', mark: null }],
+])
+
+// The characters a text holds of a label's kind, `controls` (C0, DEL, C1
+// and bidirectional controls) or `invisible`, `[point, times]`, the most
+// found first: those npmTextEncoding found in one pass, told apart by code
+// point. The labels a text's characters take, of those two.
+const CONTROL = new RegExp(CONTROLS.source, 'u')
+export const charactersOf = (controls, label) => [...controls ?? []]
+  .filter(([point]) => CONTROL.test(String.fromCodePoint(point)) === (label === 'controls')).toSorted((a, b) => b[1] - a[1] || a[0] - b[0])
+const characterLabels = controls => controls ? ['controls', 'invisible'].filter(label => charactersOf(controls, label).length > 0) : []
+