@preventive/triage 1.0.0-alpha.5 → 1.0.0-alpha.50

package/risk/files/script.js

@@ -0,0 +1,118 @@
+// How a script's text is read, for risk's readers of a file
+// (readability.js, runs-code.js, hosts.js): JavaScript's and CSS's strings,
+// regular expressions and comments, set apart from their code, what of their
+// blanks a minifier drops, which files are scripts node runs, and each
+// offset's line.
+
+// Code minified into lines shorter than NPM_LONG_LINE: outside its strings and
+// comments (`/* @__PURE__ */`), its lines average more than anyone writes and
+// next to none of its spaces are ones a minifier drops. Told only in what
+// minifiers write, as GitHub Linguist tells minified files only in JavaScript
+// and CSS, each by its strings and comments (matched in one pass, so that
+// neither starts inside the other, a comment with the spaces around it) and
+// the spaces it can do without.
+export const MINIFIED_AVERAGE = 110
+const MINIFIED_SPACES = .01
+// What a regular expression set aside holds.
+const REGEX = '\uE000'
+const JS = {
+  // A hashbang, the file's first line (`#!/usr/bin/env node`), a comment,
+  // after a byte order mark too, which node's ES module loader drops first.
+  // A string's or template's escape may be a line continuation (`\` before a
+  // line break, CRLF's whole).
+  // Linear on any text: a regular expression's context looked back on only
+  // before a `/`, a comment's leading blanks taken only from where they
+  // start, and what is left open read to where it would end, a string or a
+  // regular expression its line's end, a template or a comment the text's,
+  // rather than tried again from each later quote or slash.
+  // A regular expression first where a value starts (after `=>`, `...`, an operator or a keyword, not a property: `x.default/2`, `this.#in/2`), so a quote in it (`/["']/`) starts no string.
+  stringOrComment: /((?=\/)(?<=(?:^|\.\.\.|[(,=:[!&|?{};>+\-*/%^<~]|(?<![\p{ID_Continue}$.#])(?:await|case|default|delete|do|else|extends|in|instanceof|new|of|return|throw|typeof|void|yield))[ \t]*)\/(?![/*])(?:[^/\\[\n]|\\.|\[(?:[^\]\\\n]|\\.)*(?:\]|(?=\\?$)))+(?:\/[a-z]*|(?=\\?$))|"(?:[^"\\\n]|\\(?:\r\n|[\s\S]))*(?:"|$)|'(?:[^'\\\n]|\\(?:\r\n|[\s\S]))*(?:'|$)|`(?:[^`\\]|\\(?:\r\n|[\s\S]))*(?:`|(?![\s\S])))|(?<![ \t])[ \t]*(?:\/\*[\s\S]*?(?:\*\/|(?![\s\S]))|\/\/.*|(?<![\s\S])\uFEFF?#!.*)[ \t]*/gmu,
+  // Beside punctuation (`a, b`, `x = 1`), not between two words, as
+  // JavaScript tells a word's characters (`return a`, `var π`, `var \u03c0`),
+  droppable: /(?<![\p{ID_Continue}$\\\u200C\u200D])[ \t]+|[ \t]+(?![\p{ID_Continue}$\\\u200C\u200D])/gu,
+  // nor between two `+`, two `-` or two `/` (`a+ +b` is no `a++b`, `a/ /b/`
+  // no comment), nor after a regular expression before a word (`/a/ in b`).
+  needed: (code, index, run) => ('+-/'.includes(code[index - 1]) && code[index + run.length] === code[index - 1])
+    || (code[index - 2] === REGEX && /[\p{ID_Continue}$\\\u200C\u200D]/u.test(code[index + run.length])),
+}
+const CSS = {
+  // No `//` comments, so `url(https://…)` is code.
+  stringOrComment: /("(?:[^"\\\n]|\\.)*"|'(?:[^'\\\n]|\\.)*')|[ \t]*\/\*[\s\S]*?\*\/[ \t]*/gu,
+  // Beside braces, `;`, `,`, `>`, parentheses, after `:` (`a { color: red }`)
+  // and beside a selector's `+` or `~` (`.a + .b`), not those a selector or a
+  // value needs (`.a .b`, `1px solid #fff`, `a :hover`),
+  droppable: /(?<=[{};,:>(])[ \t]+|[ \t]+(?=[{};,>)!])|(?<=[+~])[ \t]+|[ \t]+(?=[+~])/gu,
+  // nor beside `+` or `~` in parentheses (`calc(1px + var(--x))`) or in a
+  // custom property's value, kept for a `calc()` to come (`--gap:1px + 2px`).
+  needed: (code, index, run, depth) => /[+~]/u.test(code[index - 1] + code[index + run.length])
+    && (depth > 0 || /^\s*--[^:]*:/u.test(code.slice(Math.max(...['{', ';', '}'].map(end => code.lastIndexOf(end, index))) + 1, index))),
+}
+// JavaScript's strings and regular expressions (the first group) and its
+// comments, for a reader that sets them aside (runs-code.js, hosts.js).
+export const JS_STRING_OR_COMMENT = JS.stringOrComment
+// A stylesheet's by its name, else JavaScript's for a script by its name, or
+// for any other where node runs it as one (`script`).
+export const minifiable = (path, script = false) => /\.css$/iu.test(path) ? CSS : script || /\.[cm]?js$/iu.test(path) ? JS : null
+// How much of a text is read for how its lines are minified: their average
+// is told by as much of them, and a text of millions of lines is read no
+// further.
+const MINIFIED_READ = 4 * 1024 * 1024
+// Its code's lines' average length where they are minified into short ones,
+// else 0, told by its first MINIFIED_READ characters.
+export function minifiedAverage(whole, { stringOrComment, droppable, needed }) {
+  const text = whole.length > MINIFIED_READ ? whole.slice(0, whole.lastIndexOf('\n', MINIFIED_READ) + 1 || MINIFIED_READ) : whole
+  // Its lines of code alone, as long as what is on them: a comment set aside
+  // leaves nothing but its line breaks, a string or template `""` and its, a
+  // regular expression `/REGEX/`, so the code either side stays apart.
+  const lines = text.replaceAll(stringOrComment, (match, string) => (string === undefined ? '' : string[0] === '/' ? `/${REGEX}/` : '""') + match.replaceAll(/[^\n]/gu, ''))
+    .replaceAll(/^[ \t]+/gmu, '')
+    .split('\n').filter(line => line.trim() !== '')
+  const code = lines.join('\n'), length = code.length - (lines.length - 1)
+  // Counted by character: a run aligning `=` is as many spaces as it is wide.
+  let depth = 0, dropped = 0, scanned = 0
+  for (const { 0: run, index } of code.matchAll(droppable)) {
+    for (; scanned < index; scanned++) depth = Math.max(0, depth + (code[scanned] === '(' ? 1 : code[scanned] === ')' ? -1 : 0))
+    if (!needed(code, index, run, depth)) dropped += run.length
+  }
+  return lines.length > 0 && length > MINIFIED_AVERAGE * lines.length && dropped < MINIFIED_SPACES * length ? Math.round(length / lines.length) : 0
+}
+
+// JavaScript or TypeScript (a declaration file too, which node runs as any
+// other), or a script run by node by its hashbang (`bin/cli`, with no
+// extension), a byte order mark before it or not, as node runs one after it
+// as an ES module (in a `"type": "module"` package).
+const SCRIPT = /\.[cm]?[jt]sx?$/iu
+const NODE_HASHBANG = /^\uFEFF?#!.*\bnode\b/u
+// Whether a file (its path and text) is a script, as SCRIPT and NODE_HASHBANG
+// tell, or as node runs it whatever its name (`script`, npm/files.js
+// npmLoadedScripts).
+export const npmIsScript = (path, text, script = false) => typeof text === 'string' && (script || SCRIPT.test(path) || NODE_HASHBANG.test(text))
+// How many places a file is told doing a thing, the first ones, at most
+// (runs-code.js, hosts.js): a file doing it on millions of lines is told by
+// its first, and what it holds of them kept to a bound however many there
+// are.
+export const NPM_MAX_FOUND = 100
+// Every how many line breaks one is kept where lineOf counts from.
+const LINE_MARK = 1024
+// Each offset in a text as its line: one more than the line breaks before it,
+// counted on from the nearest of every LINE_MARKth, which alone are kept.
+export function lineOf(text) {
+  let marks = null
+  return offset => {
+    if (!marks) {
+      marks = []
+      for (let at = text.indexOf('\n'), count = 0; at !== -1; at = text.indexOf('\n', at + 1), count++) if (count % LINE_MARK === 0) marks.push(at)
+    }
+    let high = marks.length, low = 0
+    while (low < high) {
+      const middle = (low + high) >> 1
+      if (marks[middle] < offset) low = middle + 1
+      else high = middle
+    }
+    if (low === 0) return 1
+    let breaks = (low - 1) * LINE_MARK + 1
+    for (let at = text.indexOf('\n', marks[low - 1] + 1); at !== -1 && at < offset; at = text.indexOf('\n', at + 1)) breaks++
+    return breaks + 1
+  }
+}
+

package/risk/files/stamps.js

@@ -0,0 +1,47 @@
+// A file's stamps: what risk reads of one file (the readers beside this), and
+// what of it calls for a look, as a list of files tags it and orders it by:
+// each `{ name, severity }`, its tag's text and how severe it is (SEVERITIES).
+import { READABILITY, npmFileReadability, npmLabelMark, npmLargeCode, npmReadabilityLabels, npmTaggedCategory } from './readability.js'
+import { npmExfiltration, npmHostSeverity, npmHostTags, npmHosts } from './hosts.js'
+import { npmRunsCode, npmRunsCodeFlags } from './runs-code.js'
+
+// How severe a stamp or a finding is, the most first: `critical` red,
+// `high` a warning's orange, `moderate` yellow, `low`, and a `notice`, under
+// a low one.
+export const SEVERITIES = ['critical', 'high', 'moderate', 'low', 'notice']
+
+// A label's mark (readability.js READABILITY) as a severity: a warning's
+// orange, or a notice.
+const severityOf = mark => mark === 'warn' ? 'high' : 'notice'
+
+// A file's stamps, from what was read of it: what its code does beyond
+// itself (runs-code.js npmRunsCodeFlags), a warning's or, for the whole
+// environment read out and publishing, critical; the services it names
+// (hosts.js), a stamp a tag, at the tag's severity (Exfiltration critical,
+// Remote high, IP lookup moderate); a large code file, a notice; an
+// obfuscator's fingerprint, a warning's; and its control characters, long
+// lines and category, by their marks, but for what reads as most files do
+// (UTF-8, ASCII) and a source map.
+function npmStampsOf({ path, bytes, readability, runsCode, exfiltration, script }) {
+  const category = npmTaggedCategory(readability)
+  const listed = category !== 'ascii' && category !== 'map' && READABILITY.get(category).mark
+  return [...npmRunsCodeFlags(runsCode),
+    ...npmHostTags(exfiltration).map(([tag, services]) => ({ name: tag, severity: npmHostSeverity(tag, services) })),
+    ...npmLargeCode(path, bytes, script) ? [{ name: 'Large', severity: 'notice' }] : [],
+    ...readability.obfuscation ? [{ name: 'Obfuscated', severity: 'high' }] : [],
+    ...npmReadabilityLabels(readability).filter(label => label === 'controls' || label === 'long')
+      .map(label => ({ name: READABILITY.get(label).tag, severity: severityOf(npmLabelMark(readability, label)) })),
+    ...listed ? [{ name: READABILITY.get(category).tag, severity: severityOf(listed) }] : []]
+}
+
+// Everything risk reads of a file (`path`, its `text`, null for one that
+// isn't, and its size in `bytes`): how it reads (npmFileReadability), what
+// its code does beyond itself (npmRunsCode), the services it names under the
+// hosts' tags (npmExfiltration) and the hosts its code names (npmHosts), and its
+// `stamps` (npmStampsOf); read as a script where node runs it as one whatever
+// its name (`script`, npm/files.js npmLoadedScripts).
+export function npmFileRisk(path, text, bytes, script = false) {
+  const readability = npmFileReadability(path, text, script)
+  const exfiltration = npmExfiltration(path, text, script), runsCode = npmRunsCode(path, text, script)
+  return { readability, runsCode, exfiltration, hosts: npmHosts(path, text, script), stamps: npmStampsOf({ path, bytes, readability, runsCode, exfiltration, script }) }
+}

package/risk/index.d.ts

@@ -0,0 +1,254 @@
+// Hand-written against index.js; a change to either belongs with the other.
+import type { CacheStore } from '@preventive/upstream/npm.js'
+
+// How severe a stamp or a finding is, the most first: `critical` red, `high`
+// a warning's orange, `moderate` yellow, `low`, and a `notice`.
+export type Severity = 'critical' | 'high' | 'moderate' | 'low' | 'notice'
+
+// The severities, the most severe first.
+export const SEVERITIES: readonly Severity[]
+
+// How old a version must be to be trusted unless said: two weeks, in ms.
+export const DEFAULT_MINIMUM_RELEASE_AGE: number
+
+// npm has no such package or version (`package-not-found`,
+// `version-not-found`), a tarball unpacks past risk's bounds
+// (`package-too-large`), npm asked to be asked later (`upstream-busy`, a 429,
+// for a caller to wait on and ask again), or npm couldn't be asked
+// (`upstream-unavailable`), answered past them (`upstream-too-large`) or
+// answered what can't be read (`upstream-invalid`). `message` tells which
+// request and why.
+export class NpmRiskError extends Error {
+  code: string
+}
+
+export interface AssessNpmOptions {
+  // The version to compare with; true for the one of the package's versions
+  // most likely free of what an attack injects, as risk picks it by npm's
+  // document (risk/npm/old-version.js), none where none is below it; without
+  // one, everything of the version is new.
+  oldVersion?: string | true | null
+  // Compare all files with an empty package, for an initial dependency review.
+  fromEmpty?: boolean
+  // Younger than this, in ms, a version is `too-new`; 0 for none, as a
+  // caller's own scopes take. Two weeks unless given.
+  minimumReleaseAge?: number
+  // Whether the package is flagged as few download it (`popularity`); false
+  // for none, as a caller's own scopes take, its downloads then not asked.
+  // True unless given.
+  popularity?: boolean
+  // Where what is read is kept, by type (risk/npm/registry.js and assess.js
+  // name each): `npm/tarballs`, `risk/npm/versions`, `risk/npm/packages`,
+  // `risk/npm/old-versions`, `risk/npm/public`, `risk/npm/downloads`,
+  // `risk/npm/advisories` and `risk/npm/assessments`. One that reads records
+  // of any types at once (`readEach`, each null where none is kept) is read
+  // so where risk reads several together.
+  cache?: (CacheStore & { readEach?(entries: [type: string, key: string][]): Promise<unknown[]> }) | false
+  // Asks for a package's whole document in risk's stead, as the managed
+  // server does within its bounds: null where npm has none for this asker.
+  // `authorized` whether it may be asked with the caller's npm token: the
+  // package assessed, not its dependencies.
+  packument?: (name: string, options: { authorized: boolean; signal: AbortSignal | undefined }) => Promise<Record<string, unknown> | null>
+  // Reads a version's tarball, gzipped, in place of upstream's getTarball, as
+  // the managed server does within its bounds: `version` the one assessed or
+  // `oldVersion`, that one only where its files could change what is found.
+  // What it throws is thrown as it is.
+  tarball?: (name: string, version: string, options: { signal: AbortSignal | undefined }) => Promise<Uint8Array>
+  now?: number
+  signal?: AbortSignal
+  // Whether npm's downloads are asked for: the package's popularity, and its
+  // new dependencies' tiers and ages. True unless given.
+  downloads?: boolean
+  // Whether its new dependencies' tiers and ages are asked for, a request or
+  // two of npm each, where `downloads` is. True unless given.
+  dependencies?: boolean
+  // Whether npm's advisories of the version are asked for, an advisory of
+  // malware naming it a `malware` finding, as its package taken down by npm
+  // is. True unless given.
+  advisories?: boolean
+  // Whether OSV's records of malware in the version are asked for too, where
+  // `advisories` are: false for a private package, whose name OSV is never
+  // to be sent. True unless given.
+  osv?: boolean
+  // Whether a package is the caller's own, as its own scopes take: a new
+  // dependency on one is told no tier nor age, nor is npm asked of it. None
+  // unless given.
+  owned?: (name: string) => boolean | Promise<boolean>
+}
+
+// What calls for a look, by `id`, with what it found beside.
+export interface Finding {
+  id: string
+  severity: Severity
+  [found: string]: unknown
+}
+
+// A stamp on a file, as a list of files tags it.
+export interface Stamp {
+  name: string
+  severity: Severity
+}
+
+export interface FileRisk {
+  stamps: Stamp[]
+  readability: Record<string, unknown>
+  runsCode: Record<string, number[]> | null
+  exfiltration: Record<string, number[]> | null
+  hosts: Record<string, number> | null
+}
+
+export interface DependencyRisk {
+  key: string
+  name: string
+  kind: 'peer' | 'optional' | null
+  range?: string
+  from?: string
+  to?: string
+  opens: string | null
+  flags: { check: string; label: string; tooltip: string }[]
+  tier?: number | null
+  level?: string
+  // Its last whole month's downloads, by what its tier goes by: none where
+  // npm counts none of them.
+  month?: { total: number; from: string }
+  // Whether npm counts none of its downloads, as of a package published
+  // the day before; unpopular all the same.
+  uncounted?: true
+  created?: string
+  gap?: number
+  // For one nothing imports, the version its spec installs (registry.js
+  // npmPublicFacts): its package's latest beside it, when it was published,
+  // whether it has install scripts, and whether that was since the version
+  // compared with (`new`).
+  installs?: { version: string; latest: string | null; published: string | null; scripts: boolean; new: boolean }
+  // Where its package was looked up and npm has none of it for anyone.
+  missing?: true
+}
+
+// A version's risk as one number (risk/npm/score.js): what its findings call
+// for (`raised`, each it counts), each by its severity, malware all of it,
+// lowered by its exposure (`lowered`): how long it has been out (`days`)
+// among how many download its package (`tier`, its rank, null past the last
+// or where unknown), `by` the share taken off. Its `level` is named as the
+// findings' severities are: from 75 critical, 50 high, 25 moderate, else low.
+export interface RiskScore {
+  score: number
+  level: 'critical' | 'high' | 'moderate' | 'low'
+  raised: { id: string; severity: Severity }[]
+  lowered?: { days: number; tier: number | null; by: number }
+}
+
+export interface NpmAssessment {
+  name: string
+  version: string
+  // The version compared with, as given or as risk picked it; null for none.
+  oldVersion: string | null
+  published: string | null
+  // A version npm removed, as it removes every one it finds malware in, told
+  // of by its `malware` finding alone, with no files nor dependencies.
+  removed?: true
+  findings: Finding[]
+  files: Record<string, FileRisk>
+  // Against `oldVersion`, each it holds too, flagged against none (`held`).
+  dependencies: { added: DependencyRisk[]; changed: DependencyRisk[]; held?: DependencyRisk[] }
+  score: RiskScore
+}
+
+export function assessNpm(name: string, version: string, options?: AssessNpmOptions): Promise<NpmAssessment>
+
+// Readies, at once, the downloads assessNpm asks of each of these packages
+// that can be, kept in `cache` as it keeps them, so that their assessments
+// ask npm none: those kept within a week, and unscoped ones, asked of npm 128
+// at a time. `ready` is told each once its downloads are kept; the rest (scoped
+// ones, which npm answers only one by one) are left for npmReadyDownload.
+// npm asking to be asked later is thrown as an NpmRiskError
+// (`upstream-busy`), those readied by then told.
+// A cache that reads and writes many at once too (`readMany`, `writeMany`)
+// is read once and written once a lookup.
+export function npmReadyDownloads(names: string[], ready: (name: string) => void, options: { cache: CacheStore & {
+  readMany?(type: string, keys: string[]): Promise<Map<string, unknown>>
+  writeMany?(type: string, entries: [key: string, value: unknown][]): Promise<void>
+}; signal?: AbortSignal; now?: number }): Promise<void>
+
+// Readies the downloads assessNpm asks of a package, asked of npm on their
+// own where they aren't kept; npm asking to be asked later thrown as an
+// NpmRiskError (`upstream-busy`).
+export function npmReadyDownload(name: string, options: { cache: CacheStore; signal?: AbortSignal; now?: number }): Promise<void>
+
+// Whether an advisory is of malware rather than a vulnerability: OSV's of a
+// malicious package (`MAL-…`), or one such a record names (its `aliases`),
+// CWE-506, embedded malicious code, whatever its title, or a title naming
+// malware.
+export function npmMalwareAdvisory(advisory: { id?: string | undefined; aliases?: readonly string[] | undefined; cwe?: readonly string[] | undefined; title?: string | undefined }): boolean
+
+export function npmFileRisk(path: string, text: string | null, bytes?: number, script?: boolean): unknown
+
+// GitHub Actions (actions/), a workflow GitHub can't run thrown as
+// @preventive/lockfile's YamlError. A finding of a workflow's, its `line` from 1; of a reference's own code,
+// with the `file` it is in.
+export interface ActionsFinding extends Finding {
+  line?: number | null
+  file?: string
+}
+
+// What a `uses:` names: an action's or a reusable workflow's, by its `key`,
+// or the repository's own.
+export type ActionUses = { kind: 'action' | 'workflow'; uses: string; repo: string; path: string; ref: string; pin: 'sha' | 'short-sha' | 'ref' | 'expression'; comment: string | null; key?: string; line?: number | null }
+export type Uses = ActionUses | { kind: 'local'; uses: string; path: string; self?: true; job?: true; line?: number | null }
+
+export interface ScanOptions {
+  // Whose repository it is, as an unpinned `uses:` of its owner's is yellow.
+  owner?: string | null
+  // Its lockfiles' paths, the packages each locks, as npx runs those, by
+  // name and by `name@version`, and those only devDependencies need.
+  lockfiles?: { path: string; names: ReadonlySet<string>; dev?: ReadonlySet<string> }[]
+  // Its own actions' metadata by their directories, and its workflows by
+  // their paths: for where its actions install its packages, else each
+  // counts as installing them anywhere; and for the inputs its actions and
+  // reusable workflows write into their scripts, else each of a reusable
+  // workflow's counts as one.
+  actions?: ReadonlyMap<string, string> | null
+}
+
+export type WorkflowScan = { uses: Uses[]; findings: ActionsFinding[] } | { error: 'workflow-unreadable'; detail: string }
+
+export function scanWorkflow(kind: 'workflow' | 'action', text: string, options?: ScanOptions): WorkflowScan
+// The actions of the repository's own a workflow or an action uses, by
+// their directories, and a Docker action's Dockerfile, from its own.
+export function ownFilesOf(kind: 'workflow' | 'action', text: string): { actions: string[]; dockerfile: string | null }
+// A Dockerfile's findings, each on its line.
+export function dockerfileFindings(text: string): ActionsFinding[]
+// A reference by its key, as a scan names it; null for none.
+export function usesOfKey(key: string): ActionUses | null
+
+// GitHub as the asker can read it; null for none.
+export interface ActionsSource {
+  // Its name now, where it moved, and the repository it forks.
+  repo(name: string): Promise<{ fullName: string; defaultBranch: string; fork?: string | null; archived?: boolean; private?: boolean } | null>
+  // Every tag's commit; null where it has too many to list.
+  tags(name: string): Promise<{ tag: string; oid: string }[] | null>
+  tag(name: string, tag: string): Promise<string | null>
+  branch(name: string, branch: string): Promise<string | null>
+  // Its branches, and whether those are all.
+  branches(name: string): Promise<{ branches: { branch: string; oid: string }[]; complete: boolean }>
+  // Whether `sha` is `base` or in its history; null for no such commit. Of two
+  // commits, it holds for good.
+  contains(name: string, base: string, sha: string): Promise<boolean | null>
+  file(name: string, path: string, commit: string): Promise<string | null>
+}
+
+// A reference resolved: its repository as GitHub has it now, its ref's
+// commit, what the ref is, the tags on the commit, and the keys of the
+// references its code makes; null for none.
+export interface ResolvedAction extends Pick<ActionUses, 'kind' | 'repo' | 'path' | 'ref'> {
+  key: string
+  repository: { fullName: string; private: boolean } | null
+  commit: string | null
+  at: 'sha' | 'tag' | 'branch' | null
+  tags: string[]
+  findings: ActionsFinding[]
+  uses: string[]
+}
+
+export function resolveAction(uses: ActionUses, source: ActionsSource, options?: { owner?: string | null }): Promise<ResolvedAction>
+export function keptSource(source: ActionsSource): ActionsSource

package/risk/index.js

@@ -0,0 +1,11 @@
+// What calls for a look at a package version, or a repository's GitHub
+// Actions, for a reviewer: risk's heuristics, apart from any view of them.
+// See README.md.
+export { assessNpm } from './npm/assess.js'
+export { npmMalwareAdvisory } from './npm/malware.js'
+export { DEFAULT_MINIMUM_RELEASE_AGE } from './npm/release.js'
+export { NpmRiskError, npmReadyDownload, npmReadyDownloads } from './npm/registry.js'
+export { SEVERITIES, npmFileRisk } from './files/stamps.js'
+export { ownFilesOf, scanWorkflow } from './actions/findings.js'
+export { dockerfileFindings, keptSource, resolveAction } from './actions/resolve.js'
+export { usesOfKey } from './actions/uses.js'