@vola-trebla/croak 0.0.0-stage → 0.1.0

package/dist/install/pnpm-builds.js

@@ -0,0 +1,111 @@
+import { labelOf } from "../llm/select.js";
+import { stripBom } from "../signals/text.js";
+import { parseYamlDocuments, YamlError } from "./yaml.js";
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** "nx@21.6.4 || 21.6.5" → "nx"; "@s/x@1" → "@s/x". */
+const matcherName = (key) => {
+    const at = key.indexOf("@", key.startsWith("@") ? 1 : 0);
+    return (at === -1 ? key : key.slice(0, at)).trim();
+};
+/** Whether the manifest pins a package manager other than exactly this pnpm version. */
+function pinnedElsewhere(manifest, pnpmVersion) {
+    if (manifest.packageManager !== undefined) {
+        const pin = /^pnpm@(\d+\.\d+\.\d+)(?:\+.*)?$/.exec(String(manifest.packageManager));
+        if (pin?.[1] !== pnpmVersion)
+            return true;
+    }
+    if (isRecord(manifest.devEngines) &&
+        manifest.devEngines.packageManager !== undefined) {
+        const pm = manifest.devEngines.packageManager;
+        if (!isRecord(pm) ||
+            pm.name !== "pnpm" ||
+            String(pm.version ?? "") !== pnpmVersion)
+            return true;
+    }
+    return false;
+}
+export function pnpmBuildPolicy(files, pnpmVersion) {
+    const major = Number(/^(\d+)\./.exec(pnpmVersion)?.[1] ?? Number.NaN);
+    if (!(major >= 10))
+        return undefined;
+    const settings = [];
+    try {
+        if (files.packageJson !== undefined) {
+            const manifest = JSON.parse(stripBom(files.packageJson));
+            // The real install runs the pnpm the project pins (corepack, or pnpm's
+            // own version switching), not necessarily the one croak measured: any
+            // pin but exactly that version, and every script counts (M6 review).
+            if (isRecord(manifest) && pinnedElsewhere(manifest, pnpmVersion))
+                return undefined;
+            if (isRecord(manifest) && isRecord(manifest.pnpm))
+                settings.push(manifest.pnpm);
+        }
+        if (files.workspaceYaml !== undefined)
+            for (const doc of parseYamlDocuments(files.workspaceYaml))
+                if (isRecord(doc))
+                    settings.push(doc);
+    }
+    catch (error) {
+        if (error instanceof SyntaxError || error instanceof YamlError)
+            return undefined;
+        throw error;
+    }
+    const named = new Set();
+    for (const s of settings) {
+        // Anything but an explicit false allows every build (YAML has True, TRUE, …).
+        if (s.dangerouslyAllowAllBuilds !== undefined &&
+            !/^(?:false|False|FALSE)$/.test(String(s.dangerouslyAllowAllBuilds)))
+            return undefined;
+        // A list in a file croak does not read: it could allow anything.
+        if (s.onlyBuiltDependenciesFile !== undefined)
+            return undefined;
+        for (const field of [
+            "onlyBuiltDependencies",
+            "neverBuiltDependencies",
+            "ignoredBuiltDependencies",
+        ]) {
+            const list = s[field];
+            if (Array.isArray(list))
+                for (const item of list)
+                    if (typeof item === "string")
+                        named.add(item);
+        }
+        for (const field of ["allowBuilds", "permissions"])
+            if (isRecord(s[field]))
+                for (const key of Object.keys(s[field]))
+                    named.add(matcherName(key));
+    }
+    // A glob or pattern croak does not expand could name anything.
+    if ([...named].some((name) => /[*?{}[\]!]/.test(name)))
+        return undefined;
+    return (name) => named.has(name);
+}
+const SCRIPT_RULES = new Set([
+    "repo/lifecycle-script",
+    "install/install-script",
+    "install/new-install-script",
+]);
+/**
+ * Warnings about install scripts pnpm will not run become info. Blocks stay:
+ * a malicious script is evidence about the package, and a later
+ * `pnpm approve-builds` would run it.
+ */
+export function applyBuildPolicy(findings, policy) {
+    return findings.map((f) => {
+        const label = labelOf(f.file);
+        if (label === undefined ||
+            f.severity !== "warn" ||
+            !SCRIPT_RULES.has(f.ruleId))
+            return f;
+        const name = label.slice(0, label.lastIndexOf("@"));
+        return policy(name)
+            ? f
+            : {
+                ...f,
+                severity: "info",
+                message: `${f.message} (pnpm will not run it: the project does not allow builds for ${name})`,
+            };
+    });
+}

package/dist/install/pnpm-lockfile.js

@@ -0,0 +1,102 @@
+import { LockfileError } from "./lockfile.js";
+import { REGISTRY } from "./registry.js";
+import { parseYamlDocuments, YamlError } from "./yaml.js";
+/**
+ * pnpm-lock.yaml (lockfile v9: pnpm 9 and later, M6, D38) as the same
+ * LockEntry list the npm lockfile gives, so the rest of croak plan is shared.
+ * Registry packages carry only an integrity hash: the tarball URL is the
+ * public registry's, as pnpm itself derives it (the hook refuses other
+ * registries, D34). Git and tarball resolutions keep their source, so
+ * install/source reports them; local directories are links. pnpm records no
+ * hasInstallScript: install scripts come from the registry manifest and the
+ * tarball instead.
+ */
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+const strings = (value) => Array.isArray(value)
+    ? value.filter((v) => typeof v === "string")
+    : [];
+/** "@scope/name@1.2.3" → ["@scope/name", "1.2.3"]; the version may be a URL or path. */
+function splitKey(key) {
+    const at = key.indexOf("@", key.startsWith("@") ? 1 : 0);
+    if (at <= 0)
+        throw new LockfileError(`package key without a version: ${key}`);
+    return [key.slice(0, at), key.slice(at + 1)];
+}
+/** Strip a snapshot's peer suffix: "react-dom@19.2.0(react@19.3.1)" → "react-dom@19.2.0". */
+const withoutPeers = (key) => {
+    const open = key.indexOf("(");
+    return open === -1 ? key : key.slice(0, open);
+};
+const registryUrl = (name, version) => `${REGISTRY}/${name}/-/${name.slice(name.lastIndexOf("/") + 1)}-${version}.tgz`;
+export function isPnpmLockfile(text) {
+    return /^(?:---\s*\n)?\s*lockfileVersion:\s*['"]?\d/.test(text);
+}
+export function parsePnpmLockfile(text) {
+    let docs;
+    try {
+        docs = parseYamlDocuments(text);
+    }
+    catch (error) {
+        if (error instanceof YamlError)
+            throw new LockfileError(`pnpm-lock.yaml: ${error.message}`);
+        throw error;
+    }
+    const entries = [];
+    for (const doc of docs) {
+        if (!isRecord(doc))
+            throw new LockfileError("pnpm-lock.yaml: a document is not a mapping");
+        const version = doc.lockfileVersion;
+        if (typeof version !== "string" || !/^9\.\d+$/.test(version))
+            throw new LockfileError(`pnpm-lock.yaml version ${String(version)} is not supported: croak reads lockfile v9 (pnpm 9 and later)`);
+        const packages = isRecord(doc.packages) ? doc.packages : {};
+        const snapshots = isRecord(doc.snapshots) ? doc.snapshots : {};
+        // A package is optional only when every snapshot of it is.
+        const optional = new Map();
+        for (const [key, snap] of Object.entries(snapshots)) {
+            const id = withoutPeers(key);
+            const isOptional = isRecord(snap) && snap.optional === "true";
+            optional.set(id, (optional.get(id) ?? true) && isOptional);
+        }
+        for (const [key, raw] of Object.entries(packages)) {
+            if (!isRecord(raw))
+                throw new LockfileError(`pnpm-lock.yaml: package ${key} is not a mapping`);
+            const [name, ref] = splitKey(key);
+            const resolution = isRecord(raw.resolution) ? raw.resolution : {};
+            const integrity = typeof resolution.integrity === "string"
+                ? resolution.integrity
+                : undefined;
+            let resolved;
+            let link = false;
+            if (typeof resolution.directory === "string")
+                link = true;
+            else if (resolution.type === "git" && typeof resolution.repo === "string")
+                resolved = `git+${resolution.repo}#${typeof resolution.commit === "string" ? resolution.commit : ""}`;
+            else if (typeof resolution.tarball === "string")
+                resolved = resolution.tarball;
+            else if (integrity !== undefined)
+                resolved = registryUrl(name, ref);
+            // A git or tarball dependency's "version" is its source, not a semver.
+            const semver = /^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.+-]+)?$/.test(ref);
+            entries.push({
+                path: `pnpm:${key}`,
+                name,
+                version: semver
+                    ? ref
+                    : typeof raw.version === "string"
+                        ? raw.version
+                        : ref,
+                resolved,
+                integrity,
+                hasInstallScript: raw.requiresBuild === "true",
+                link,
+                dev: false,
+                optional: optional.get(key) ?? false,
+                os: strings(raw.os),
+                cpu: strings(raw.cpu),
+            });
+        }
+    }
+    return entries;
+}

package/dist/install/popular.js

@@ -0,0 +1,177 @@
+/**
+ * Well-known npm package names, for typo-squat checks. Curated by hand from
+ * widely depended-on packages; a name one keystroke away from one of these is
+ * suspicious, the names themselves are not.
+ */
+export const POPULAR_PACKAGES = [
+    "react",
+    "react-dom",
+    "react-router",
+    "react-router-dom",
+    "redux",
+    "react-redux",
+    "next",
+    "vue",
+    "vuex",
+    "vue-router",
+    "nuxt",
+    "svelte",
+    "angular",
+    "preact",
+    "solid-js",
+    "lit",
+    "jquery",
+    "lodash",
+    "lodash-es",
+    "underscore",
+    "ramda",
+    "moment",
+    "dayjs",
+    "date-fns",
+    "luxon",
+    "axios",
+    "node-fetch",
+    "got",
+    "ky",
+    "superagent",
+    "request",
+    "express",
+    "koa",
+    "fastify",
+    "hapi",
+    "hono",
+    "nestjs",
+    "body-parser",
+    "cors",
+    "helmet",
+    "morgan",
+    "cookie-parser",
+    "multer",
+    "passport",
+    "jsonwebtoken",
+    "bcrypt",
+    "bcryptjs",
+    "uuid",
+    "nanoid",
+    "dotenv",
+    "chalk",
+    "commander",
+    "yargs",
+    "inquirer",
+    "ora",
+    "debug",
+    "minimist",
+    "glob",
+    "rimraf",
+    "mkdirp",
+    "fs-extra",
+    "chokidar",
+    "semver",
+    "cross-env",
+    "concurrently",
+    "nodemon",
+    "pm2",
+    "typescript",
+    "tslib",
+    "ts-node",
+    "tsx",
+    "esbuild",
+    "vite",
+    "webpack",
+    "rollup",
+    "parcel",
+    "babel-core",
+    "core-js",
+    "regenerator-runtime",
+    "postcss",
+    "autoprefixer",
+    "tailwindcss",
+    "sass",
+    "less",
+    "styled-components",
+    "classnames",
+    "clsx",
+    "prop-types",
+    "eslint",
+    "prettier",
+    "jest",
+    "mocha",
+    "chai",
+    "sinon",
+    "vitest",
+    "playwright",
+    "puppeteer",
+    "cypress",
+    "supertest",
+    "nock",
+    "mongoose",
+    "mongodb",
+    "mysql",
+    "mysql2",
+    "pg",
+    "sequelize",
+    "typeorm",
+    "prisma",
+    "knex",
+    "redis",
+    "ioredis",
+    "graphql",
+    "apollo-server",
+    "socket.io",
+    "ws",
+    "zod",
+    "yup",
+    "joi",
+    "ajv",
+    "immer",
+    "rxjs",
+    "async",
+    "bluebird",
+    "q",
+    "colors",
+    "picocolors",
+    "kleur",
+    "chalk-template",
+    "execa",
+    "shelljs",
+    "cheerio",
+    "jsdom",
+    "marked",
+    "highlight.js",
+    "prismjs",
+    "sharp",
+    "jimp",
+    "canvas",
+    "pdfkit",
+    "xlsx",
+    "aws-sdk",
+    "firebase",
+    "stripe",
+    "openai",
+    "langchain",
+    "electron",
+    "husky",
+    "lint-staged",
+    "nx",
+    "turbo",
+    "lerna",
+    "yarn",
+    "pnpm",
+    "npm",
+    "node-gyp",
+    "nan",
+    "bindings",
+    "prebuild-install",
+    "jscodeshift",
+    "babel-loader",
+    "css-loader",
+    "style-loader",
+    "html-webpack-plugin",
+    "dotenv-expand",
+    "qs",
+    "form-data",
+    "mime",
+    "mime-types",
+    "iconv-lite",
+    "safe-buffer",
+];

package/dist/install/project.js

@@ -0,0 +1,223 @@
+import { posix } from "node:path";
+import { INSTALL_SCRIPTS, lifecycleScriptWith, } from "../detectors/lifecycle-script.js";
+import { MAX_FILE_BYTES, } from "../repo-snapshot.js";
+import { codeSignals, describeSignals, isSuspicious } from "../signals/code.js";
+import { analyzeShell } from "../signals/shell.js";
+import { stripBom } from "../signals/text.js";
+import { isPnpmLockfile } from "./pnpm-lockfile.js";
+import { parseYamlDocuments, YamlError } from "./yaml.js";
+const PNPM_RULE = "repo/pnpmfile";
+/** pnpm also runs the root project's pnpm:devPreinstall before it installs anything. */
+const PNPM_ROOT_SCRIPT = "pnpm:devPreinstall";
+const policies = {
+    npm: lifecycleScriptWith({
+        suspicious: isSuspicious,
+        scripts: INSTALL_SCRIPTS,
+        manifests: "repo",
+    }),
+    pnpm: lifecycleScriptWith({
+        suspicious: isSuspicious,
+        scripts: [...INSTALL_SCRIPTS, PNPM_ROOT_SCRIPT],
+        manifests: "repo",
+    }),
+};
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+const outside = (path) => path === ".." || path.startsWith("../") || path.startsWith("/");
+/**
+ * The workspace members a lockfile installs, as folders relative to the
+ * project (M6 review): npm's `packages` keys outside node_modules, pnpm's
+ * `importers` other than the root. Both package managers run a member's
+ * install scripts on a plain install, as they do the root's.
+ */
+export function workspaceMembers(lockfile) {
+    let keys = [];
+    if (isPnpmLockfile(lockfile)) {
+        const [doc] = parseYamlDocuments(lockfile);
+        if (isRecord(doc) && isRecord(doc.importers))
+            keys = Object.keys(doc.importers);
+    }
+    else {
+        const data = JSON.parse(stripBom(lockfile));
+        if (isRecord(data) && isRecord(data.packages))
+            keys = Object.entries(data.packages)
+                .filter(([key, raw]) => !key.startsWith("node_modules/") &&
+                !key.includes("/node_modules/") &&
+                isRecord(raw) &&
+                raw.resolved === undefined)
+                .map(([key]) => key);
+    }
+    return [
+        ...new Set(keys.map((k) => posix.normalize(k)).filter((k) => k !== ".")),
+    ];
+}
+export function projectScriptFindings(dir, fs, options = {}) {
+    const findings = [];
+    const entries = [];
+    const texts = new Map();
+    const add = (path) => {
+        const at = fs.kind(posix.join(dir, path));
+        if (at === undefined || at.kind === "other")
+            return;
+        if (at.kind === "symlink") {
+            entries.push({ path, kind: "symlink", size: 0 });
+            return;
+        }
+        const oversized = at.size > MAX_FILE_BYTES;
+        entries.push({
+            path,
+            kind: oversized ? "oversized" : "file",
+            size: at.size,
+        });
+        const text = oversized ? undefined : fs.read(posix.join(dir, path));
+        if (text !== undefined)
+            texts.set(path, text);
+    };
+    for (const member of ["", ...(options.members ?? [])]) {
+        if (outside(member)) {
+            findings.push({
+                ruleId: "repo/lifecycle-script",
+                severity: "warn",
+                file: "package.json",
+                message: `the install also runs the install scripts of ${member}, a folder outside the project croak cannot read`,
+            });
+            continue;
+        }
+        const manifestPath = posix.join(member, "package.json");
+        const manifest = fs.read(posix.join(dir, manifestPath));
+        if (manifest === undefined)
+            continue;
+        let scripts = {};
+        try {
+            const data = JSON.parse(stripBom(manifest));
+            if (isRecord(data) && isRecord(data.scripts))
+                scripts = data.scripts;
+        }
+        catch {
+            // The detector reports an unreadable package.json itself.
+        }
+        // Every local file any script runs (install scripts call others via npm run).
+        const files = new Set(["package.json", "binding.gyp"]);
+        for (const command of Object.values(scripts))
+            if (typeof command === "string")
+                for (const file of analyzeShell(command).localFiles) {
+                    const path = posix.normalize(file);
+                    if (!outside(path))
+                        files.add(path);
+                }
+        for (const file of files)
+            add(posix.join(member, file));
+    }
+    const snapshot = { entries, read: (path) => texts.get(path) };
+    return [
+        ...findings,
+        ...policies[options.pnpm === true ? "pnpm" : "npm"](snapshot),
+    ];
+}
+const PNPMFILES = [".pnpmfile.cjs", ".pnpmfile.mjs"];
+/**
+ * Code pnpm runs on every install of the project, scripts or not (M6, D39):
+ * the pnpmfile (`.pnpmfile.cjs`, or the file `pnpmfile:` names in
+ * pnpm-workspace.yaml) and config dependencies, which pnpm installs first and
+ * whose pnpmfiles it loads. A pnpmfile is a warning, a block when its code
+ * reaches the network with secrets or eval; config dependencies are a warning.
+ */
+export function pnpmfileFindings(dir, fs) {
+    const findings = [];
+    let settings = {};
+    const workspace = fs.read(posix.join(dir, "pnpm-workspace.yaml"));
+    if (workspace !== undefined) {
+        try {
+            const [doc] = parseYamlDocuments(workspace);
+            if (isRecord(doc))
+                settings = doc;
+        }
+        catch (error) {
+            if (!(error instanceof YamlError))
+                throw error;
+            findings.push({
+                ruleId: PNPM_RULE,
+                severity: "warn",
+                file: "pnpm-workspace.yaml",
+                message: "pnpm-workspace.yaml cannot be read, so croak cannot tell what pnpm loads on install",
+            });
+        }
+    }
+    // One file or a list of them (M6 review).
+    const listed = Array.isArray(settings.pnpmfile)
+        ? settings.pnpmfile
+        : settings.pnpmfile === undefined
+            ? []
+            : [settings.pnpmfile];
+    const named = listed.map((file) => posix.normalize(String(file)));
+    for (const file of [...new Set([...PNPMFILES, ...named])]) {
+        if (file === ".." || file.startsWith("../") || file.startsWith("/")) {
+            findings.push({
+                ruleId: PNPM_RULE,
+                severity: "warn",
+                file: "pnpm-workspace.yaml",
+                message: `pnpm runs ${file}, a pnpmfile outside the project, on every install`,
+            });
+            continue;
+        }
+        const at = fs.kind(posix.join(dir, file));
+        if (at === undefined)
+            continue;
+        const text = at.kind === "file" && at.size <= MAX_FILE_BYTES
+            ? fs.read(posix.join(dir, file))
+            : undefined;
+        if (text === undefined) {
+            findings.push({
+                ruleId: PNPM_RULE,
+                severity: "warn",
+                file,
+                message: `pnpm runs ${file} on every install, and croak could not read it`,
+            });
+            continue;
+        }
+        const hits = codeSignals(text);
+        const signals = new Set(hits.map((h) => h.signal));
+        findings.push({
+            ruleId: PNPM_RULE,
+            severity: isSuspicious(signals) ? "block" : "warn",
+            file,
+            message: `pnpm runs ${file} on every install${hits.length > 0 ? `: ${describeSignals(hits, file)}` : ""}`,
+        });
+    }
+    // Patches change a dependency's files after croak checked its tarball, its
+    // package.json and install scripts included (M6 review).
+    let manifestSettings;
+    const manifest = fs.read(posix.join(dir, "package.json"));
+    if (manifest !== undefined)
+        try {
+            const data = JSON.parse(stripBom(manifest));
+            if (isRecord(data))
+                manifestSettings = data.pnpm;
+        }
+        catch {
+            // The install itself fails on it; the plan reports the lockfile.
+        }
+    for (const [where, from] of [
+        ["pnpm-workspace.yaml", settings],
+        ["package.json", manifestSettings],
+    ]) {
+        const patched = isRecord(from) ? from.patchedDependencies : undefined;
+        if (isRecord(patched) && Object.keys(patched).length > 0)
+            findings.push({
+                ruleId: PNPM_RULE,
+                severity: "warn",
+                file: where,
+                message: `pnpm patches dependencies after download, past what croak checked: ${Object.keys(patched).slice(0, 5).join(", ")}`,
+            });
+    }
+    if (isRecord(settings.configDependencies) &&
+        Object.keys(settings.configDependencies).length > 0)
+        findings.push({
+            ruleId: PNPM_RULE,
+            severity: "warn",
+            file: "pnpm-workspace.yaml",
+            message: `pnpm installs config dependencies first and loads their pnpmfiles: ${Object.keys(settings.configDependencies).slice(0, 5).join(", ")}`,
+        });
+    return findings;
+}

package/dist/install/provenance.js

@@ -0,0 +1,77 @@
+/**
+ * The workflow file a build started from, inside its repo and without its
+ * ref: tags change every release, and a renamed repo renames the URI.
+ */
+function workflowOf(identity) {
+    const uri = identity.buildConfigUri?.replace(/@[^@]*$/, "");
+    const repo = `${identity.sourceRepositoryUri ?? ""}/`;
+    return uri?.startsWith(repo) === true ? uri.slice(repo.length) : uri;
+}
+const repoIdOf = (identity) => identity.sourceRepositoryId === undefined
+    ? undefined
+    : `${identity.issuer ?? ""}#${identity.sourceRepositoryId}`;
+/** How this build differs from the previous version's, if it does. */
+function buildChanges(now, before, version) {
+    const changes = [];
+    // Repos get renamed (react now builds from github.com/react/react); the
+    // numeric id survives a rename and changes when a name is re-registered.
+    // An id is only unique at its issuer (GitHub's and GitLab's overlap).
+    const nowId = repoIdOf(now);
+    const beforeId = repoIdOf(before);
+    const otherRepo = nowId !== undefined && beforeId !== undefined
+        ? nowId !== beforeId
+        : now.sourceRepositoryUri !== before.sourceRepositoryUri;
+    if (otherRepo)
+        changes.push(`was built from ${now.sourceRepositoryUri ?? "an unnamed repository"}, not from ${before.sourceRepositoryUri ?? "the repository"}, which built ${version}`);
+    else if (workflowOf(now) !== workflowOf(before))
+        changes.push(`was built by the workflow ${workflowOf(now) ?? "(unnamed)"}, not by ${workflowOf(before) ?? "the workflow"}, which built ${version}`);
+    return changes;
+}
+/**
+ * The version to compare a planned one with: its semver predecessor when that
+ * has provenance, else the newest settled version that does. Comparing only
+ * with the predecessor would let a release without provenance in between
+ * hide another repository's build (M7 review, D45).
+ */
+export function provenanceBaseline(facts) {
+    return facts.previous?.hasProvenance === true
+        ? facts.previous
+        : facts.earlier.find((v) => v.hasProvenance);
+}
+/**
+ * Provenance signals for one planned version (M7, D42). A claim that does
+ * not verify blocks; one croak cannot check warns. A build from another
+ * repository or workflow than the baseline's warns, and blocks with an
+ * install script that is new or changed since the baseline (as in D30).
+ * Provenance never lowers another finding.
+ */
+export function provenanceFindings(change, current, baseline, installCommands) {
+    const file = `${change.entry.name}@${change.entry.version ?? "?"}`;
+    const finding = (severity, message) => ({
+        ruleId: "install/provenance",
+        severity,
+        file,
+        message,
+    });
+    if (current === "missing")
+        return [
+            finding("warn", "is listed with provenance, but the registry served no provenance attestation to check"),
+        ];
+    if (current.status === "invalid")
+        return [
+            finding("block", `claims provenance that does not verify (${current.reason}): the attestation was forged or altered`),
+        ];
+    if (current.status === "unverifiable")
+        return [
+            finding("warn", `has provenance croak cannot check: ${current.reason}`),
+        ];
+    const before = baseline?.provenance;
+    if (baseline === undefined || before === "missing" || before === undefined)
+        return [];
+    if (before.status !== "verified")
+        return [];
+    const newScript = installCommands !== "" && installCommands !== baseline.installCommands;
+    return buildChanges(current.identity, before.identity, baseline.version).map((what) => newScript
+        ? finding("block", `${what}, and adds or changes an install script: the pattern of a hijacked release`)
+        : finding("warn", what));
+}