@vola-trebla/croak 0.0.0-stage → 0.1.0

package/dist/crypto/der.js

@@ -0,0 +1,136 @@
+/**
+ * Just enough DER to read the build identity Fulcio writes into a signing
+ * certificate (M7, D42). node:crypto verifies certificates but does not expose
+ * custom extensions. Certificates come from the registry, so every length is
+ * checked against the bytes that are there.
+ */
+export class DerError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "DerError";
+    }
+}
+export function readTlv(buf, offset) {
+    const tag = buf[offset];
+    const first = buf[offset + 1];
+    if (tag === undefined || first === undefined)
+        throw new DerError(`truncated element at byte ${offset}`);
+    if ((tag & 0x1f) === 0x1f)
+        throw new DerError(`high tag numbers are not supported (byte ${offset})`);
+    let length = first;
+    let start = offset + 2;
+    if (first & 0x80) {
+        const count = first & 0x7f;
+        if (count === 0)
+            throw new DerError("indefinite length is not DER");
+        if (count > 4)
+            throw new DerError(`length of ${count} bytes is too long`);
+        length = 0;
+        for (let i = 0; i < count; i++) {
+            const byte = buf[start + i];
+            if (byte === undefined)
+                throw new DerError("truncated length");
+            length = length * 256 + byte;
+        }
+        if (length < 0x80 || (count > 1 && length < 256 ** (count - 1)))
+            throw new DerError("length is not in its shortest form");
+        start += count;
+    }
+    const end = start + length;
+    if (end > buf.length)
+        throw new DerError(`element at byte ${offset} runs past the end`);
+    return { tag, start, end };
+}
+/** The elements inside a constructed element, in order. */
+export function children(buf, parent) {
+    const out = [];
+    for (let at = parent.start; at < parent.end;) {
+        const child = readTlv(buf, at);
+        if (child.end > parent.end)
+            throw new DerError(`element at byte ${at} runs past its parent`);
+        out.push(child);
+        at = child.end;
+    }
+    return out;
+}
+function expectTag(tlv, tag, what) {
+    if (tlv === undefined || tlv.tag !== tag)
+        throw new DerError(`expected ${what}`);
+    return tlv;
+}
+function oidOf(buf, tlv) {
+    const bytes = buf.subarray(tlv.start, tlv.end);
+    const first = bytes[0];
+    if (first === undefined)
+        throw new DerError("empty OID");
+    // The first byte packs the first two arcs as 40 * a + b (a is at most 2).
+    const top = Math.min(2, Math.floor(first / 40));
+    const arcs = [top, first - top * 40];
+    let value = 0;
+    for (const byte of bytes.subarray(1)) {
+        value = value * 128 + (byte & 0x7f);
+        if (value > Number.MAX_SAFE_INTEGER)
+            throw new DerError("OID arc too large");
+        if (!(byte & 0x80)) {
+            arcs.push(value);
+            value = 0;
+        }
+    }
+    return arcs.join(".");
+}
+// Fulcio's v2 extensions (1.3.6.1.4.1.57264.1.8 onwards), each a DER UTF8String.
+const FULCIO = "1.3.6.1.4.1.57264.1.";
+const FIELDS = {
+    [`${FULCIO}8`]: "issuer",
+    [`${FULCIO}9`]: "buildSignerUri",
+    [`${FULCIO}11`]: "runnerEnvironment",
+    [`${FULCIO}12`]: "sourceRepositoryUri",
+    [`${FULCIO}13`]: "sourceRepositoryDigest",
+    [`${FULCIO}14`]: "sourceRepositoryRef",
+    [`${FULCIO}15`]: "sourceRepositoryId",
+    [`${FULCIO}18`]: "buildConfigUri",
+};
+const UTF8_STRING = 0x0c;
+const OCTET_STRING = 0x04;
+const SEQUENCE = 0x30;
+const OID = 0x06;
+const EXTENSIONS = 0xa3;
+/**
+ * The build identity in a Fulcio certificate. Reads only; whether the
+ * certificate is genuine is src/crypto/sigstore.ts's job.
+ */
+export function fulcioIdentity(certDer) {
+    const cert = expectTag(readTlv(certDer, 0), SEQUENCE, "a certificate");
+    const tbs = expectTag(children(certDer, cert)[0], SEQUENCE, "tbsCertificate");
+    const wrapper = children(certDer, tbs).find((t) => t.tag === EXTENSIONS);
+    const identity = {};
+    if (wrapper !== undefined) {
+        const list = expectTag(children(certDer, wrapper)[0], SEQUENCE, "extensions");
+        const seen = new Set();
+        for (const ext of children(certDer, list)) {
+            const parts = children(certDer, expectTag(ext, SEQUENCE, "an extension"));
+            const oid = oidOf(certDer, expectTag(parts[0], OID, "an extension OID"));
+            if (seen.has(oid))
+                throw new DerError(`extension ${oid} appears twice`);
+            seen.add(oid);
+            const field = FIELDS[oid];
+            if (field === undefined)
+                continue;
+            const octets = expectTag(parts.at(-1), OCTET_STRING, "an extension value");
+            const text = expectTag(readTlv(certDer, octets.start), UTF8_STRING, `a string in ${oid}`);
+            if (text.end !== octets.end)
+                throw new DerError(`trailing bytes in ${oid}`);
+            identity[field] = certDer.subarray(text.start, text.end).toString("utf8");
+        }
+    }
+    return {
+        issuer: identity.issuer,
+        buildSignerUri: identity.buildSignerUri,
+        runnerEnvironment: identity.runnerEnvironment,
+        sourceRepositoryUri: identity.sourceRepositoryUri,
+        sourceRepositoryDigest: identity.sourceRepositoryDigest,
+        sourceRepositoryRef: identity.sourceRepositoryRef,
+        sourceRepositoryId: identity.sourceRepositoryId,
+        buildConfigUri: identity.buildConfigUri,
+    };
+}

package/dist/crypto/fields.js

@@ -0,0 +1,60 @@
+import { verify, X509Certificate } from "node:crypto";
+/**
+ * Reading Sigstore bundles, which come from the registry: every field is
+ * checked for shape before it is used (M7, D43).
+ */
+/** Why a bundle check stopped: it is wrong, or croak cannot tell. */
+export class SigstoreError extends Error {
+    status;
+    constructor(status, message) {
+        super(message);
+        this.name = "SigstoreError";
+        this.status = status;
+    }
+}
+export const invalid = (message) => new SigstoreError("invalid", message);
+export const unverifiable = (message) => new SigstoreError("unverifiable", message);
+export function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** The string at `path` inside `value`; anything else is an invalid bundle. */
+export function str(value, ...path) {
+    let at = value;
+    for (const key of path) {
+        at =
+            Array.isArray(at) && typeof key === "number"
+                ? at[key]
+                : isRecord(at)
+                    ? at[key]
+                    : undefined;
+    }
+    if (typeof at !== "string")
+        throw invalid(`the bundle has no ${path.join(".")}`);
+    return at;
+}
+export function b64(text) {
+    if (!/^[A-Za-z0-9+/]*={0,2}$/.test(text))
+        throw invalid("a bundle field is not base64");
+    return Buffer.from(text, "base64");
+}
+export function certFrom(der, what) {
+    try {
+        return new X509Certificate(der);
+    }
+    catch {
+        throw invalid(`${what} is not a certificate`);
+    }
+}
+/**
+ * A SHA-256 signature check that answers false instead of throwing: keys
+ * and signatures come from the registry, and node:crypto throws on some
+ * (an Ed25519 key with a digest, malformed DER).
+ */
+export function verifies(data, key, signature) {
+    try {
+        return verify("sha256", data, key, signature);
+    }
+    catch {
+        return false;
+    }
+}

package/dist/crypto/registry-signature.js

@@ -0,0 +1,88 @@
+import { createPublicKey, verify } from "node:crypto";
+const p256 = (spkiBase64) => createPublicKey({
+    key: Buffer.from(spkiBase64, "base64"),
+    format: "der",
+    type: "spki",
+});
+/**
+ * registry.npmjs.org/-/npm/v1/keys, pinned 2026-10-31 (D42). Pinned, not
+ * fetched: keys from the same server as the packument would only check the
+ * server against itself. A key croak does not know is "unverifiable", never
+ * a pass.
+ */
+export const NPM_REGISTRY_KEYS = [
+    {
+        keyid: "SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA",
+        publicKey: p256("MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE1Olb3zMAFFxXKHiIkQO5cJ3Yhl5i6UPp+IhuteBJbuHcA5UogKo0EWtlWwW6KSaKoTNEYL7JlCQiVnkhBktUgg=="),
+        expires: new Date("2025-01-29T00:00:00.000Z"),
+    },
+    {
+        keyid: "SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U",
+        publicKey: p256("MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEY6Ya7W++7aUPzvMTrezH6Ycx3c+HOKYCcNGybJZSCJq/fd7Qa8uuAKtdIkUQtQiEKERhAmE5lMMJhP8OkDOa2g=="),
+        expires: undefined,
+    },
+];
+function signaturesOf(value) {
+    if (!Array.isArray(value))
+        return [];
+    return value.filter((s) => typeof s === "object" &&
+        s !== null &&
+        typeof s.keyid === "string" &&
+        typeof s.sig === "string");
+}
+const BASE64 = /^[A-Za-z0-9+/]*={0,2}$/;
+function verifies(message, key, sig) {
+    if (sig === "" || !BASE64.test(sig))
+        return false;
+    try {
+        return verify("sha256", message, key, Buffer.from(sig, "base64"));
+    }
+    catch {
+        // Malformed DER is a bad signature, not a crash.
+        return false;
+    }
+}
+/**
+ * Like npm's own check: every signature by a known key must verify, and a
+ * key past its expiry signs nothing published after it. Signatures by keys
+ * croak does not know are skipped while a known one verifies.
+ */
+export function checkRegistrySignature(pkg, keys = NPM_REGISTRY_KEYS) {
+    const signatures = signaturesOf(pkg.signatures);
+    if (signatures.length === 0)
+        return { status: "unsigned" };
+    const message = Buffer.from(`${pkg.name}@${pkg.version}:${pkg.integrity}`);
+    const unknown = [];
+    let valid;
+    for (const { keyid, sig } of signatures) {
+        const key = keys.find((k) => k.keyid === keyid);
+        if (key === undefined) {
+            unknown.push(keyid);
+            continue;
+        }
+        if (key.expires !== undefined) {
+            if (pkg.published === undefined)
+                return {
+                    status: "unverifiable",
+                    reason: `key ${keyid} expired on ${key.expires.toISOString()} and the registry gives no publish time`,
+                };
+            if (pkg.published.getTime() > key.expires.getTime())
+                return {
+                    status: "invalid",
+                    reason: `signed with key ${keyid}, which expired before this version was published`,
+                };
+        }
+        if (!verifies(message, key.publicKey, sig))
+            return {
+                status: "invalid",
+                reason: `the signature by key ${keyid} does not match ${pkg.name}@${pkg.version} and its integrity`,
+            };
+        valid ??= keyid;
+    }
+    return valid !== undefined
+        ? { status: "valid", keyid: valid }
+        : {
+            status: "unverifiable",
+            reason: `signed only with keys croak does not know (${unknown.join(", ")}); a newer croak may know them`,
+        };
+}

package/dist/crypto/rekor.js

@@ -0,0 +1,70 @@
+import { createHash, createPublicKey } from "node:crypto";
+import { b64, certFrom, invalid, isRecord, str, unverifiable, verifies, } from "./fields.js";
+export function rekorLog(spkiBase64) {
+    const der = Buffer.from(spkiBase64, "base64");
+    return {
+        logId: createHash("sha256").update(der).digest("base64"),
+        publicKey: createPublicKey({ key: der, format: "der", type: "spki" }),
+    };
+}
+/**
+ * rekor.sigstore.dev, pinned 2026-10-31 from github.com/sigstore/root-signing
+ * targets/trusted_root.json (D42). Rekor v2 logs (Ed25519, no SET) are not
+ * pinned: their entries are unverifiable (D43).
+ */
+export const REKOR_V1 = rekorLog("MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE2G2Y+2tabdTV5BcGiBIx0a9fAFwrkBbmLSGtks4L3qX6yYY0zufBnhC8Ur/iy55GhWP/9A/bY2LhC30M9+RYtw==");
+const SUPPORTED = ["dsse 0.0.1", "intoto 0.0.2"];
+/** A PEM certificate as Rekor stores it (base64 of the PEM text), as DER. */
+const pemCertDer = (base64Pem) => certFrom(b64(base64Pem), "the logged certificate").raw;
+/**
+ * Verifies the SET over a bundle's log entry and reads what it recorded.
+ * Throws a SigstoreError: invalid when the entry is not what the log
+ * signed, unverifiable for a log, kind or shape croak does not support.
+ */
+export function readLogEntry(entry, log) {
+    const kind = `${str(entry, "kindVersion", "kind")} ${str(entry, "kindVersion", "version")}`;
+    if (!SUPPORTED.includes(kind))
+        throw unverifiable(`a transparency log entry of kind ${kind}`);
+    if (str(entry, "logId", "keyId") !== log.logId)
+        throw unverifiable("logged in a transparency log croak does not know (a newer croak may)");
+    if (!isRecord(entry) || !isRecord(entry.inclusionPromise))
+        throw unverifiable("the log entry has no signed entry timestamp");
+    const set = str(entry, "inclusionPromise", "signedEntryTimestamp");
+    const integratedTime = str(entry, "integratedTime");
+    const logIndex = str(entry, "logIndex");
+    if (!/^\d{1,15}$/.test(integratedTime) || !/^\d{1,15}$/.test(logIndex))
+        throw invalid("the log entry's time or index is not a number");
+    const body = str(entry, "canonicalizedBody");
+    // Rekor signs the canonical JSON of these four fields, keys sorted.
+    const promise = JSON.stringify({
+        body,
+        integratedTime: Number(integratedTime),
+        logID: b64(log.logId).toString("hex"),
+        logIndex: Number(logIndex),
+    });
+    if (!verifies(Buffer.from(promise), log.publicKey, b64(set)))
+        throw invalid("the transparency log's signed timestamp does not verify");
+    let logged;
+    try {
+        logged = JSON.parse(b64(body).toString("utf8"));
+    }
+    catch {
+        throw invalid("the log entry's body is not JSON");
+    }
+    const loggedAt = new Date(Number(integratedTime) * 1000);
+    if (kind === "dsse 0.0.1")
+        return {
+            loggedAt,
+            signature: str(logged, "spec", "signatures", 0, "signature"),
+            certificateDer: pemCertDer(str(logged, "spec", "signatures", 0, "verifier")),
+            payloadHash: str(logged, "spec", "payloadHash", "value"),
+        };
+    // intoto 0.0.2 stores the signature base64-encoded once more.
+    const signer = ["spec", "content", "envelope", "signatures", 0];
+    return {
+        loggedAt,
+        signature: b64(str(logged, ...signer, "sig")).toString("utf8"),
+        certificateDer: pemCertDer(str(logged, ...signer, "publicKey")),
+        payloadHash: str(logged, "spec", "content", "payloadHash", "value"),
+    };
+}

package/dist/crypto/sigstore.js

@@ -0,0 +1,121 @@
+import { createHash } from "node:crypto";
+import { DerError, fulcioIdentity } from "./der.js";
+import { b64, certFrom, invalid, isRecord, SigstoreError, str, unverifiable, verifies, } from "./fields.js";
+import { REKOR_V1, readLogEntry } from "./rekor.js";
+const pinned = (base64) => certFrom(Buffer.from(base64, "base64"), "a pinned Fulcio certificate");
+/**
+ * Sigstore's public-good instance, pinned 2026-10-31 from
+ * github.com/sigstore/root-signing targets/trusted_root.json (D42): the
+ * Fulcio CA valid since 2022-04-13 (npm provenance began in 2023).
+ */
+export const SIGSTORE_PUBLIC_GOOD = {
+    fulcio: [
+        pinned("MIICGjCCAaGgAwIBAgIUALnViVfnU0brJasmRkHrn/UnfaQwCgYIKoZIzj0EAwMwKjEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MREwDwYDVQQDEwhzaWdzdG9yZTAeFw0yMjA0MTMyMDA2MTVaFw0zMTEwMDUxMzU2NThaMDcxFTATBgNVBAoTDHNpZ3N0b3JlLmRldjEeMBwGA1UEAxMVc2lnc3RvcmUtaW50ZXJtZWRpYXRlMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE8RVS/ysH+NOvuDZyPIZtilgUF9NlarYpAd9HP1vBBH1U5CV77LSS7s0ZiH4nE7Hv7ptS6LvvR/STk798LVgMzLlJ4HeIfF3tHSaexLcYpSASr1kS0N/RgBJz/9jWCiXno3sweTAOBgNVHQ8BAf8EBAMCAQYwEwYDVR0lBAwwCgYIKwYBBQUHAwMwEgYDVR0TAQH/BAgwBgEB/wIBADAdBgNVHQ4EFgQU39Ppz1YkEZb5qNjpKFWixi4YZD8wHwYDVR0jBBgwFoAUWMAeX5FFpWapesyQoZMi0CrFxfowCgYIKoZIzj0EAwMDZwAwZAIwPCsQK4DYiZYDPIaDi5HFKnfxXx6ASSVmERfsynYBiX2X6SJRnZU84/9DZdnFvvxmAjBOt6QpBlc4J/0DxvkTCqpclvziL6BCCPnjdlIB3Pu3BxsPmygUY7Ii2zbdCdliiow="),
+        pinned("MIIB9zCCAXygAwIBAgIUALZNAPFdxHPwjeDloDwyYChAO/4wCgYIKoZIzj0EAwMwKjEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MREwDwYDVQQDEwhzaWdzdG9yZTAeFw0yMTEwMDcxMzU2NTlaFw0zMTEwMDUxMzU2NThaMCoxFTATBgNVBAoTDHNpZ3N0b3JlLmRldjERMA8GA1UEAxMIc2lnc3RvcmUwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAT7XeFT4rb3PQGwS4IajtLk3/OlnpgangaBclYpsYBr5i+4ynB07ceb3LP0OIOZdxexX69c5iVuyJRQ+Hz05yi+UF3uBWAlHpiS5sh0+H2GHE7SXrk1EC5m1Tr19L9gg92jYzBhMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBRYwB5fkUWlZql6zJChkyLQKsXF+jAfBgNVHSMEGDAWgBRYwB5fkUWlZql6zJChkyLQKsXF+jAKBggqhkjOPQQDAwNpADBmAjEAj1nHeXZp+13NWBNa+EDsDP8G1WWg1tCMWP/WHPqpaVo0jhsweNFZgSs0eE7wYI4qAjEA2WB9ot98sIkoF3vZYdd3/VtWB5b9TNMea7Ix/stJ5TfcLLeABLE4BNJOsQ4vnBHJ"),
+    ],
+    rekor: REKOR_V1,
+};
+const CODE_SIGNING = "1.3.6.1.5.5.7.3.3";
+function leafOf(material) {
+    const raw = isRecord(material) && isRecord(material.certificate)
+        ? str(material, "certificate", "rawBytes")
+        : str(material, "x509CertificateChain", "certificates", 0, "rawBytes");
+    return certFrom(b64(raw), "the signing certificate");
+}
+function checkCertificate(leaf, chain, at) {
+    let child = leaf;
+    for (const issuer of chain) {
+        if (!child.checkIssued(issuer) || !child.verify(issuer.publicKey))
+            throw invalid("the signing certificate does not chain to Fulcio");
+        if (at < issuer.validFromDate || at > issuer.validToDate)
+            throw invalid("Fulcio's certificate was not valid when this was logged");
+        child = issuer;
+    }
+    if (leaf.ca)
+        throw invalid("the signing certificate is a CA");
+    if (!(leaf.keyUsage ?? []).includes(CODE_SIGNING))
+        throw invalid("the signing certificate is not for code signing");
+    if (at < leaf.validFromDate || at > leaf.validToDate)
+        throw invalid("it was logged outside the signing certificate's lifetime");
+}
+/** DSSE's pre-authentication encoding: what the envelope signature covers. */
+const pae = (type, payload) => Buffer.concat([
+    Buffer.from(`DSSEv1 ${Buffer.byteLength(type)} ${type} ${payload.length} `),
+    payload,
+]);
+/** A package URL with its escapes undone (npm writes `pkg:npm/%40scope/name@1.0.0`). */
+function purlName(purl) {
+    try {
+        return decodeURIComponent(purl);
+    }
+    catch {
+        throw invalid("the attestation's subject is not a valid package URL");
+    }
+}
+function checkSubject(payload, subject) {
+    let statement;
+    try {
+        statement = JSON.parse(payload.toString("utf8"));
+    }
+    catch {
+        throw invalid("the attested statement is not JSON");
+    }
+    const sha512 = subject.integrity
+        .trim()
+        .split(/\s+/)
+        .find((hash) => hash.startsWith("sha512-"));
+    if (sha512 === undefined)
+        throw unverifiable("the registry gives no sha512 to compare");
+    const digest = b64(sha512.slice("sha512-".length)).toString("hex");
+    const want = `pkg:npm/${subject.name}@${subject.version}`;
+    const subjects = isRecord(statement) && Array.isArray(statement.subject)
+        ? statement.subject
+        : [];
+    const match = subjects.some((_s, i) => purlName(str(statement, "subject", i, "name")) === want &&
+        str(statement, "subject", i, "digest", "sha512") === digest);
+    if (!match)
+        throw invalid(`the attestation is not about ${subject.name}@${subject.version} with this tarball`);
+}
+function check(bundle, subject, trust) {
+    const material = isRecord(bundle) ? bundle.verificationMaterial : undefined;
+    const entries = isRecord(material) && Array.isArray(material.tlogEntries)
+        ? material.tlogEntries
+        : [];
+    const logged = readLogEntry(entries[0], trust.rekor);
+    const leaf = leafOf(material);
+    checkCertificate(leaf, trust.fulcio, logged.loggedAt);
+    const type = str(bundle, "dsseEnvelope", "payloadType");
+    if (type !== "application/vnd.in-toto+json")
+        throw invalid(`the envelope carries ${type}, not an in-toto statement`);
+    const payload = b64(str(bundle, "dsseEnvelope", "payload"));
+    const sig = str(bundle, "dsseEnvelope", "signatures", 0, "sig");
+    // Fulcio also certifies Ed25519 keys; npm's are EC. Others are unchecked.
+    const keyType = leaf.publicKey.asymmetricKeyType;
+    if (keyType !== "ec" && keyType !== "rsa")
+        throw unverifiable(`the signing key is ${keyType ?? "of an unknown type"}`);
+    if (!verifies(pae(type, payload), leaf.publicKey, b64(sig)))
+        throw invalid("the envelope's signature does not verify");
+    if (logged.signature !== sig ||
+        !logged.certificateDer.equals(leaf.raw) ||
+        logged.payloadHash !== createHash("sha256").update(payload).digest("hex"))
+        throw invalid("the transparency log entry is for a different signature");
+    checkSubject(payload, subject);
+    return {
+        status: "verified",
+        identity: fulcioIdentity(leaf.raw),
+        loggedAt: logged.loggedAt,
+    };
+}
+/** Verifies an npm provenance bundle (the SLSA one) for this exact tarball. */
+export function verifyProvenance(bundle, subject, trust = SIGSTORE_PUBLIC_GOOD) {
+    try {
+        return check(bundle, subject, trust);
+    }
+    catch (error) {
+        if (error instanceof SigstoreError)
+            return { status: error.status, reason: error.message };
+        if (error instanceof DerError)
+            return { status: "invalid", reason: error.message };
+        throw error;
+    }
+}

package/dist/detectors/git-config.js

@@ -0,0 +1,137 @@
+import { posix } from "node:path";
+import { codeSignals, isSuspicious } from "../signals/code.js";
+import { parseGitConfig } from "../signals/git-config.js";
+import { analyzeShell } from "../signals/shell.js";
+import { isInNodeModules } from "./node-modules-present.js";
+const RULE = "repo/git-config";
+const LFS_FILTER = /^git-lfs (?:clean|smudge|filter-process)(?: -- %f)?$/;
+const NAMED_HELPER = /^[A-Za-z0-9-]+$/;
+const BOOLEAN = new Set([
+    "true",
+    "false",
+    "yes",
+    "no",
+    "on",
+    "off",
+    "1",
+    "0",
+    "",
+]);
+const MAX_SHOWN = 60;
+const truncate = (text) => text.length > MAX_SHOWN ? `${text.slice(0, MAX_SHOWN)}…` : text;
+/** What git does with a setting, or undefined when the setting runs nothing. */
+function classify({ section, key, value }) {
+    const name = `${section.split(".")[0] ?? ""}.${key}`;
+    if (section === "core" && key === "fsmonitor") {
+        return BOOLEAN.has(value.toLowerCase())
+            ? undefined
+            : { when: "runs on every git status", severity: "block" };
+    }
+    if (section === "core" && key === "sshcommand")
+        return { when: "runs on every fetch and push", severity: "block" };
+    if (section === "core" && ["pager", "editor", "askpass"].includes(key)) {
+        return { when: `runs as git's ${key}`, severity: "block" };
+    }
+    if (name === "sequence.editor" ||
+        name === "gpg.program" ||
+        (section.startsWith("gpg.") && key === "program")) {
+        return { when: "runs during rebase or signing", severity: "block" };
+    }
+    if (name === "diff.external")
+        return { when: "runs on every git diff", severity: "block" };
+    if (section.startsWith("filter.") &&
+        ["clean", "smudge", "process"].includes(key)) {
+        // Git runs filter values through the shell: only the exact LFS command is benign.
+        return LFS_FILTER.test(value)
+            ? { when: "is a Git LFS filter", severity: "info" }
+            : { when: "runs on checkout and add", severity: "block" };
+    }
+    if (name === "credential.helper") {
+        // Only a bare helper name (osxkeychain, store, manager) is benign.
+        return NAMED_HELPER.test(value)
+            ? { when: "is a named credential helper", severity: "info" }
+            : { when: "runs when git asks for credentials", severity: "block" };
+    }
+    if (section.startsWith("submodule.") &&
+        key === "update" &&
+        value.startsWith("!")) {
+        return { when: "runs on git submodule update", severity: "block" };
+    }
+    if (section.startsWith("diff.") &&
+        (key === "textconv" || key === "command")) {
+        return {
+            when: "runs on git diff and git log -p for files mapped in .gitattributes",
+            severity: "block",
+        };
+    }
+    if (section.startsWith("merge.") && key === "driver")
+        return { when: "runs on merges", severity: "block" };
+    if (section === "pager")
+        return { when: `runs as the pager for git ${key}`, severity: "block" };
+    if (section === "core" && key === "gitproxy")
+        return { when: "runs on git:// fetches", severity: "block" };
+    if (section.startsWith("remote.") &&
+        (key === "uploadpack" || key === "receivepack")) {
+        return { when: "runs on fetch or push", severity: "block" };
+    }
+    if ((section.startsWith("difftool.") || section.startsWith("mergetool.")) &&
+        key === "cmd") {
+        return {
+            when: "runs when the diff or merge tool is used",
+            severity: "block",
+        };
+    }
+    if (section === "core" && key === "hookspath")
+        return { when: "moves git hooks to another directory", severity: "warn" };
+    if ((section === "include" || section.startsWith("includeif.")) &&
+        key === "path") {
+        return { when: "pulls in another config file", severity: "warn" };
+    }
+    if (section === "alias" && value.startsWith("!"))
+        return {
+            when: "runs a shell command when the alias is used",
+            severity: "warn",
+        };
+    return undefined;
+}
+function configFindings(repo, path) {
+    return parseGitConfig(repo.read(path) ?? "").flatMap((entry) => {
+        const rule = classify(entry);
+        if (rule === undefined)
+            return [];
+        return [
+            {
+                ruleId: RULE,
+                severity: rule.severity,
+                file: path,
+                line: entry.line,
+                message: `${entry.section}.${entry.key} = \`${truncate(entry.value)}\` ${rule.when}`,
+            },
+        ];
+    });
+}
+function hookFinding(repo, path) {
+    const text = repo.read(path) ?? "";
+    const suspicious = analyzeShell(text).downloadExecute ||
+        isSuspicious(new Set(codeSignals(text).map((s) => s.signal)));
+    return {
+        ruleId: RULE,
+        severity: suspicious ? "block" : "warn",
+        file: path,
+        message: `active git hook ${posix.basename(path)} runs automatically on git operations${suspicious ? " and downloads, executes, or exfiltrates" : ""}`,
+    };
+}
+const isGitConfig = (path) => path === ".git/config" ||
+    path.endsWith("/.git/config") ||
+    posix.basename(path) === ".gitmodules";
+const isActiveHook = (path) => /(?:^|\/)\.git\/hooks\/[^/]+$/.test(path) && !path.endsWith(".sample");
+/** Git settings and hooks that make ordinary git commands run code (e.g. a zip-shipped .git). */
+export const gitConfig = (repo) => repo.entries
+    .filter((e) => e.kind === "file" && !isInNodeModules(e.path))
+    .flatMap((e) => {
+    if (isGitConfig(e.path))
+        return configFindings(repo, e.path);
+    if (isActiveHook(e.path))
+        return [hookFinding(repo, e.path)];
+    return [];
+});

package/dist/detectors/hidden-code.js

@@ -0,0 +1,58 @@
+import { codeSignals } from "../signals/code.js";
+import { hiddenCode } from "../signals/hidden.js";
+import { isInNodeModules } from "./node-modules-present.js";
+const RULE = "repo/hidden-code";
+/** Files a toolchain, IDE, or shell may execute or load. */
+const SCANNED = /\.(?:[cm]?[jt]sx?|json|sh|bash|zsh|py|rb|pl|ps1)$/;
+const MAX_HITS_PER_FILE = 5;
+const SEVERITY_RANK = {
+    info: 0,
+    warn: 1,
+    block: 2,
+};
+const MAX_SHOWN = 60;
+const DESCRIBE = {
+    offscreen: "code hidden offscreen after a long run of whitespace",
+    vertical: "code hidden below hundreds of blank lines",
+    bidi: "Unicode bidi control characters that change how the code reads (Trojan Source)",
+};
+const truncate = (text) => text.length > MAX_SHOWN ? `${text.slice(0, MAX_SHOWN)}…` : text;
+function severityOf(hit, path) {
+    if (hit.kind === "bidi") {
+        // RTL locale files legitimately contain bidi isolates.
+        return path.endsWith(".json") ? "info" : "warn";
+    }
+    return codeSignals(hit.hidden).length > 0 ? "block" : "warn";
+}
+function finding(hit, path, downgradeInstalled) {
+    const signals = [...new Set(codeSignals(hit.hidden).map((s) => s.signal))];
+    const raw = severityOf(hit, path);
+    // In a repo, installed and committed dependencies look the same and
+    // repo/node-modules-present already flags the directory, so content inside
+    // it is at most a warning. In a package, node_modules is bundled code npm runs.
+    const severity = downgradeInstalled && isInNodeModules(path) && raw === "block"
+        ? "warn"
+        : raw;
+    const detail = hit.kind === "bidi" ? "" : `: \`${truncate(hit.hidden)}\``;
+    const using = signals.length > 0 ? ` (uses ${signals.join(", ")})` : "";
+    return {
+        ruleId: RULE,
+        severity,
+        file: path,
+        line: hit.line,
+        message: `${DESCRIBE[hit.kind]} at line ${hit.line}, column ${hit.column}${detail}${using}`,
+    };
+}
+/** Code placed where a human reviewing the file will not see it. */
+export function hiddenCodeWith({ downgradeInstalled, }) {
+    return (repo) => repo.entries
+        .filter((e) => e.kind === "file" && SCANNED.test(e.path))
+        .flatMap((e) => hiddenCode(repo.read(e.path) ?? "")
+        .map((hit) => finding(hit, e.path, downgradeInstalled))
+        // Most severe first, so harmless decoys cannot push the payload past the cap.
+        .sort((a, b) => SEVERITY_RANK[b.severity] - SEVERITY_RANK[a.severity])
+        .slice(0, MAX_HITS_PER_FILE));
+}
+export const hiddenCodeDetector = hiddenCodeWith({
+    downgradeInstalled: true,
+});