nativekeel 0.1.6 → 0.1.8

package/README.md

@@ -6,6 +6,8 @@ Health check for React Native and Expo apps. One command, no install, no account
 npx nativekeel
 ```
 
+**What's new in 0.1.8:** known vulnerabilities in the exact dependency versions you ship, passwords that leak into crash reports, databases or AsyncStorage, unsafe WebViews, and setups that build fine but crash at runtime. Tuned on 280+ open-source React Native and Expo apps to keep false alarms out. [All releases →](https://nativekeel.com/changelog)
+
 It answers the questions that decide whether your app can still ship:
 
 - **Is your React Native / Expo version still supported?** React Native supports the latest minor and the two before it.
@@ -15,6 +17,9 @@ It answers the questions that decide whether your app can still ship:
 - **Will the stores accept your next build?** Google Play `targetSdk` and 16 KB page size (it opens your built APK/AAB and checks the alignment of every native library), and the iOS privacy manifest.
 - **Are secrets shipped inside your app?** AWS, Stripe, OpenAI, Anthropic, GitHub, Slack, SendGrid, Twilio, Shopify, Google OAuth keys, private keys and Supabase `service_role` keys (anon keys are fine), plus `.env` values that `react-native-config` or `EXPO_PUBLIC_` compile into the bundle. Server-side folders are reported separately.
 - **Is transport security off?** Cleartext HTTP or `debuggable` in the release Android manifest, `NSAllowsArbitraryLoads` on iOS.
+- **Do you ship known vulnerabilities?** Advisories from the GitHub Advisory Database for the exact versions in your lockfile or `node_modules`. Advisories that only affect Node.js servers are kept, at low severity.
+- **Can someone read your users' data?** Passwords that flow into crash reports, analytics, remote databases or plain AsyncStorage (followed through intermediate variables), WebViews that let page scripts read local files or load HTTP into HTTPS, Android backups that copy tokens.
+- **Will it crash at runtime?** Reanimated without its Babel plugin or `react-native-worklets`, mixed `@react-native-firebase/*` or `@react-navigation/*` majors, a second copy of React or React Native inside a dependency, Kotlin modules that cannot load through the New Architecture interop layer, AppDelegate setups that crash in Release.
 - **Leftovers from old templates?** Flipper, JavaScriptCore instead of Hermes.
 
 ```
@@ -84,7 +89,7 @@ Agencies can put their own name on the HTML report: `npx nativekeel plan --html
 
 ## Why you can run this on private code
 
-- **Your code never leaves your machine.** The only requests are package-name lookups on npm and React Native Directory. `--offline` makes none; a test traps `fetch` to prove it.
+- **Your code never leaves your machine.** The only requests are package-name lookups on npm and React Native Directory, and one request to npm's advisory endpoint with the names and exact versions of your runtime dependencies (what `npm audit` sends). `--offline` makes none; a test traps `fetch` to prove it.
 - **Zero dependencies, no install scripts.** Only Node.js built-ins.
 - **Read-only.** It never changes your project.
 - **Secrets are always masked** in every output.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "nativekeel",
-  "version": "0.1.6",
-  "description": "Health check for React Native apps: version support, New Architecture blockers, unmaintained native modules and leaked secrets.",
+  "version": "0.1.8",
+  "description": "Health check for React Native and Expo apps: upgrade blockers, store deadlines, crash risks, vulnerable dependencies and leaked secrets, with a step-by-step upgrade plan.",
   "type": "module",
   "bin": {
     "nativekeel": "bin/nativekeel.js"
@@ -20,7 +20,13 @@
     "new-architecture",
     "doctor",
     "health-check",
-    "security"
+    "security",
+    "vulnerabilities",
+    "audit",
+    "crash",
+    "upgrade-plan",
+    "google-play",
+    "app-store"
   ],
   "license": "MIT",
   "scripts": {

package/src/analyze.js

@@ -4,6 +4,9 @@ import { cleanVersion, findPackageDir, installedVersion } from './project.js';
 import { createRegistry, fetchJson } from './registry.js';
 import { scanSecrets } from './secrets.js';
 import { nativeChecks } from './native.js';
+import { stabilityChecks } from './stability.js';
+import { vulnerableDependencies, passwordLeaks, webViewRisks, androidBackup } from './security.js';
+import { lockedVersions } from './lockfile.js';
 import { findUnused, filesImportingWith } from './usage.js';
 import { matchKnownIssues, compareVersions } from './known-issues.js';
 import { COMPAT, bestRange, checkCompat } from './compat.js';
@@ -15,6 +18,7 @@ import {
   RECENT_RELEASE_DAYS,
   STALE_RELEASE_DAYS,
   PLAY_TARGET_SDK,
+  RENAMED,
   REPLACEMENTS,
   SUPPORTED_EXPO_MAJORS,
   SUPPORTED_RN_MINORS,
@@ -78,7 +82,7 @@ export function satisfiesExpoRange(version, range) {
 export async function analyze(project, { get, now = new Date(), offline: forcedOffline = false } = {}) {
   // Requests that failed even after retries (rate limits, network): reported, never hidden.
   const net = { failed: 0 };
-  const registry = createRegistry(get || ((url, headers) => fetchJson(url, headers, net)));
+  const registry = createRegistry(get || ((url, headers, body) => fetchJson(url, headers, net, { body })));
   const findings = [];
   const add = (f) => findings.push(f);
 
@@ -263,7 +267,7 @@ export async function analyze(project, { get, now = new Date(), offline: forcedO
     }
     // Only code that has to follow React Native or the OS goes stale; a finished JS utility does not.
     const stale = !dep.unmaintained && !revived && age !== null && age > STALE_RELEASE_DAYS && (native || !!release.rnLink);
-    const alternatives = dir && dir.alternatives && dir.alternatives.length ? dir.alternatives : REPLACEMENTS[name] || [];
+    const alternatives = RENAMED[name] ? [RENAMED[name]] : dir && dir.alternatives && dir.alternatives.length ? dir.alternatives : REPLACEMENTS[name] || [];
     if (noNewArch || dep.unmaintained || stale) {
       const problems = [
         noNewArch && 'no New Architecture support',
@@ -279,7 +283,7 @@ export async function analyze(project, { get, now = new Date(), offline: forcedO
         area: 'dependency',
         title: `${name}: ${problems.join(', ')}`,
         detail: `${why}${alternatives.length ? ` Alternatives: ${alternatives.join(', ')}.` : ''}`,
-        fix: { kind: 'replace-dep', name, native, noNewArch, unmaintained: dep.unmaintained || stale, alternatives },
+        fix: { kind: 'replace-dep', name, native, noNewArch, unmaintained: dep.unmaintained || stale, alternatives, renamedTo: RENAMED[name] || null },
       });
     } else if (revived) {
       add({
@@ -397,6 +401,24 @@ export async function analyze(project, { get, now = new Date(), offline: forcedO
   findings.push(...nativeChecks(project, { rnLatest: rn && rn.latest, now }));
 
   // 7. Secrets
+  // Setups that build and then crash at runtime.
+  for (const f of stabilityChecks(project)) add(f);
+
+  // Security beyond leaked keys.
+  for (const f of [...passwordLeaks(project.root), ...webViewRisks(project.root), ...androidBackup(project.root)]) add(f);
+  if (!forcedOffline) {
+    // Exact versions only (installed, else the lockfile): a range would be a guess.
+    const locked = lockedVersions(project.root, project.deps);
+    const exact = {};
+    for (const name of Object.keys(project.deps)) {
+      const v = installedVersion(project.root, name) || locked[name];
+      if (v && /^\d+\.\d+\.\d+/.test(v)) exact[name] = v;
+    }
+    const vulns = await vulnerableDependencies(registry, exact);
+    if (vulns === null) net.failed++;
+    for (const f of vulns || []) add(f);
+  }
+
   for (const s of scanSecrets(project.root)) {
     const value = s.preview ? `Value ${s.preview}. ` : '';
     const where = `${s.file}:${s.line}`;

package/src/lockfile.js

@@ -0,0 +1,125 @@
+import fs from 'node:fs';
+import path from 'node:path';
+
+// Exact versions of direct dependencies, read from the lockfile next to the app or at the
+// workspace root (monorepos). Used where a range from package.json would be a guess, e.g.
+// matching security advisories. Returns { name: version } for the names it could resolve.
+
+const readText = (file) => {
+  try {
+    return fs.readFileSync(file, 'utf8');
+  } catch {
+    return null;
+  }
+};
+
+function findUp(root, names) {
+  let dir = root;
+  while (true) {
+    for (const n of names) {
+      const file = path.join(dir, n);
+      if (fs.existsSync(file)) return file;
+    }
+    const parent = path.dirname(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+}
+
+export function lockedVersions(root, declared) {
+  const file = findUp(root, ['package-lock.json', 'npm-shrinkwrap.json', 'pnpm-lock.yaml', 'yarn.lock']);
+  if (!file) return {};
+  const text = readText(file);
+  if (!text) return {};
+  const rel = path.relative(path.dirname(file), root).split(path.sep).join('/');
+  if (file.endsWith('.json')) return fromNpm(text, rel, declared);
+  if (file.endsWith('pnpm-lock.yaml')) return fromPnpm(text, rel || '.', declared);
+  return fromYarn(text, declared);
+}
+
+function fromNpm(text, rel, declared) {
+  let lock;
+  try {
+    lock = JSON.parse(text);
+  } catch {
+    return {};
+  }
+  const out = {};
+  for (const name of Object.keys(declared)) {
+    const pkgs = lock.packages || {};
+    const hit =
+      (rel && pkgs[`${rel}/node_modules/${name}`]) || pkgs[`node_modules/${name}`] || (lock.dependencies && lock.dependencies[name]);
+    if (hit && hit.version && /^\d/.test(hit.version)) out[name] = hit.version;
+  }
+  return out;
+}
+
+// pnpm-lock.yaml (v6 and v9): importers.<path>.(dependencies|devDependencies).<name>.version
+function fromPnpm(text, importer, declared) {
+  const out = {};
+  const lines = text.split('\n');
+  let inImporters = false;
+  let current = null;
+  let section = null;
+  let pkg = null;
+  for (const line of lines) {
+    if (/^importers:\s*$/.test(line)) {
+      inImporters = true;
+      continue;
+    }
+    if (inImporters && /^\S/.test(line)) {
+      // Next top-level key. pnpm 11 can write several YAML documents, so keep looking.
+      inImporters = false;
+      current = null;
+      continue;
+    }
+    if (!inImporters) continue;
+    const imp = line.match(/^ {2}(\S.*?):\s*$/);
+    if (imp) {
+      current = imp[1].replace(/^['"]|['"]$/g, '');
+      section = null;
+      continue;
+    }
+    if (current !== importer) continue;
+    const sec = line.match(/^ {4}(dependencies|devDependencies|optionalDependencies):\s*$/);
+    if (sec) {
+      section = sec[1];
+      continue;
+    }
+    if (!section) continue;
+    const name = line.match(/^ {6}(\S.*?):\s*$/);
+    if (name) {
+      pkg = name[1].replace(/^['"]|['"]$/g, '');
+      continue;
+    }
+    const ver = line.match(/^ {8}version:\s*['"]?([0-9][^\s('"]*)/);
+    if (ver && pkg && declared[pkg]) out[pkg] = ver[1];
+  }
+  return out;
+}
+
+// yarn.lock v1 ("name@range", name@range:\n  version "x") and berry ("name@npm:range":\n  version: x)
+function fromYarn(text, declared) {
+  const byPattern = {};
+  let patterns = null;
+  for (const line of text.split('\n')) {
+    if (/^\S.*:\s*$/.test(line) && !line.startsWith('#') && !line.startsWith('__metadata')) {
+      patterns = line
+        .replace(/:\s*$/, '')
+        .split(/,\s*/)
+        .map((p) => p.trim().replace(/^"|"$/g, ''));
+      continue;
+    }
+    const ver = line.match(/^\s+version:?\s+"?([0-9][^"\s]*)"?/);
+    if (ver && patterns) {
+      for (const p of patterns) byPattern[p] = ver[1];
+      patterns = null;
+    }
+  }
+  const out = {};
+  for (const [name, range] of Object.entries(declared)) {
+    const v = byPattern[`${name}@${range}`] || byPattern[`${name}@npm:${range}`];
+    if (v) out[name] = v;
+  }
+  return out;
+}

package/src/plan.js

@@ -65,6 +65,9 @@ const WEIGHTS = {
   'patch-version': () => 1,
   'folly-flags': () => 0.25,
   'default-react-host': () => 0.25,
+  crash: () => 1,
+  security: () => 1,
+  'vuln-dep': (f) => (f.severity === 'critical' || f.severity === 'high' ? 1 : 0.25),
 };
 
 // Routine version bumps are many but cheap next to a React Native, architecture or store
@@ -217,6 +220,15 @@ export function buildPlan(result) {
   }
 
   // Low-severity notes stay in the report; the plan only carries what can break the app.
+  const crashes = byKind('crash');
+  if (crashes.length) {
+    phases.push({
+      title: 'Fix crash risks',
+      why: 'These setups build fine and crash at runtime. They are cheap to fix and every later step is easier to test without them.',
+      steps: crashes.map((c) => c.step),
+    });
+  }
+
   const known = byKind('known-issue').filter((k) => k.severity !== 'low');
   if (known.length) {
     phases.push({
@@ -271,8 +283,15 @@ export function buildPlan(result) {
   for (const a of byKind('ats')) {
     securitySteps.push(`In \`${a.file}\`, set \`NSAllowsArbitraryLoads\` to false and list only the hosts that need HTTP under \`NSExceptionDomains\`.`);
   }
+  for (const f of byKind('security')) securitySteps.push(f.step);
+  const vulns = byKind('vuln-dep').filter((v) => v.severity === 'critical' || v.severity === 'high');
+  for (const v of vulns) {
+    securitySteps.push(`Update \`${v.name}\` ${v.from}${v.to ? ` to ${v.to} or later` : ''}: it has ${v.severity} known vulnerabilities. ${movesWithExpo(v.name) ? 'Expo pins it: the SDK upgrade below moves it.' : 'Check its changelog for breaking changes.'}`);
+  }
+  const minorVulns = byKind('vuln-dep').length - vulns.length;
+  if (minorVulns) securitySteps.push(`${minorVulns} more package${minorVulns === 1 ? ' has' : 's have'} moderate or low advisories: update them with the routine package updates below.`);
   if (securitySteps.length) {
-    phases.push({ title: 'Tighten transport security', why: 'Unencrypted traffic exposes user data on public networks.', steps: securitySteps });
+    phases.push({ title: 'Close security gaps', why: 'Attackers read app bundles, network traffic and logs. These are the ways in this app hands them something.', steps: securitySteps });
   }
 
   const cleanup = [];
@@ -314,6 +333,9 @@ export function buildPlan(result) {
       why: 'These packages decide how far you can upgrade. Swap them while the app still runs on its current version, so every problem has one cause.',
       steps: replace.map((d) => {
         const reason = [d.noNewArch && 'no New Architecture support', d.unmaintained && 'unmaintained'].filter(Boolean).join(', ');
+        if (d.renamedTo) {
+          return `\`${d.name}\` moved to \`${d.renamedTo}\` (same API). \`${pm.remove} ${d.name} && ${pm.add} ${d.renamedTo}\`, then update the imports.`;
+        }
         if (interopPatched.has(d.name) && !d.unmaintained) {
           return `\`${d.name}\` (${reason}, native). The New Architecture step below patches it so it loads; move to a release with a TurboModule spec once one exists.`;
         }
@@ -397,20 +419,33 @@ export function buildPlan(result) {
     let from = rn.from;
     const tracked = result.deps.filter((d) => COMPAT[d.name]);
     const lastRange = {};
-    const steps = upgradeHops(rn.from, rn.to).map((to) => {
+    const lastMajor = {};
+    const hopList = upgradeHops(rn.from, rn.to);
+    // When the New Architecture switch happens on the way, library versions up to that stop
+    // must still run on the legacy architecture (Reanimated 4, for one, does not).
+    const switchAt = deferredArch
+      ? hopList.findIndex((h) => Number(h.split('.')[1]) >= 76 && Number(h.split('.')[1]) < NEW_ARCH_ONLY_MINOR)
+      : -1;
+    const majorOf = (v) => Number(String(v).split('.')[0]);
+    const steps = hopList.map((to, i) => {
       const minor = Number(to.split('.')[1]);
+      const archOn = switchAt < 0 || i > switchAt;
       const bumps = tracked
         .map((d) => {
-          const best = bestRange(d.name, minor, true);
-          // Prefer staying on the installed major when it still supports this hop.
-          const major = d.version ? Number(d.version.split('.')[0]) : null;
-          const same = major !== null && best && Number(best.from.split('.')[0]) !== major ? bestRange(d.name, minor, true, { major }) : null;
+          const best = bestRange(d.name, minor, archOn);
+          // Stay on the major of the previous step (or the installed one) while it still works.
+          const major = lastMajor[d.name] ?? (d.version ? majorOf(d.version) : null);
+          const same = major !== null && best && majorOf(best.from) !== major ? bestRange(d.name, minor, archOn, { major }) : null;
           return { name: d.name, best, same };
         })
         .filter((b) => b.best && (b.same || b.best).range !== lastRange[b.name])
         .map((b) => {
-          lastRange[b.name] = (b.same || b.best).range;
-          return b.same ? `\`${b.name}\` ${b.same.range} (or ${b.best.range}, a major migration)` : `\`${b.name}\` ${b.best.range}`;
+          const chosen = b.same || b.best;
+          const forcedMajor = !b.same && lastMajor[b.name] !== undefined && majorOf(chosen.from) !== lastMajor[b.name];
+          lastRange[b.name] = chosen.range;
+          lastMajor[b.name] = majorOf(chosen.from);
+          if (b.same) return `\`${b.name}\` ${b.same.range} (or ${b.best.range}, a major migration)`;
+          return `\`${b.name}\` ${b.best.range}${forcedMajor ? ' (a major migration: read its migration guide first)' : ''}`;
         });
       const step = `${from} → ${to}: apply the diff from ${UPGRADE_HELPER_URL(from, to)}${bumps.length ? `, move ${bumps.join(' and ')}` : ''}, reinstall pods, build both platforms, commit.`;
       from = to;

package/src/registry.js

@@ -5,10 +5,12 @@ const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 // GET a JSON document. Returns null for "not found" (a package that does not exist is an
 // answer, not an error). Rate limits (429) and server errors are retried with backoff; if the
 // request still fails, `stats.failed` is incremented so the report can say it is incomplete.
-export async function fetchJson(url, headers = {}, stats = null, { retries = 3, wait = sleep } = {}) {
+export async function fetchJson(url, headers = {}, stats = null, { retries = 3, wait = sleep, body = null } = {}) {
   for (let attempt = 0; ; attempt++) {
     try {
-      const res = await fetch(url, { headers: { ...UA, ...headers }, signal: AbortSignal.timeout(30000) });
+      const init = { headers: { ...UA, ...headers }, signal: AbortSignal.timeout(30000) };
+      if (body) Object.assign(init, { method: 'POST', body });
+      const res = await fetch(url, init);
       if (res.ok) return await res.json();
       if (res.status === 404) return null;
       if ((res.status === 429 || res.status >= 500) && attempt < retries) {
@@ -106,6 +108,20 @@ export function createRegistry(get = fetchJson) {
       return out;
     },
 
+    // Security advisories for exact versions (the endpoint `npm audit` uses). Sends package
+    // names and versions, nothing else. Returns { name: [advisory] }, or null if it failed.
+    async advisories(versions) {
+      const out = {};
+      const names = Object.keys(versions);
+      for (let i = 0; i < names.length; i += 200) {
+        const chunk = Object.fromEntries(names.slice(i, i + 200).map((n) => [n, [versions[n]]]));
+        const data = await get('https://registry.npmjs.org/-/npm/v1/security/advisories/bulk', { 'Content-Type': 'application/json' }, JSON.stringify(chunk));
+        if (!data) return null;
+        Object.assign(out, data);
+      }
+      return out;
+    },
+
     // Stable versions of a package, newest release line first.
     async releaseLines(name, pick) {
       // The abbreviated "install" document is a fraction of the full packument's size.

package/src/report-html.js

@@ -15,11 +15,19 @@ export function htmlReport(result, { brand = null, plan = null } = {}) {
   const defaultOn = !!result.project.reactNative && Number(result.project.reactNative.split('.')[1]) >= 76;
   const arch = (v) => (v === true ? 'on' : v === false ? 'off' : defaultOn ? 'on (default)' : 'off (default)');
 
+  // Outdated packages are many and alike: one collapsible table instead of a card each.
+  const isBump = (f) => f.id.startsWith('dep-major:');
   const rows = SEVERITIES.flatMap((sev) =>
     result.findings
-      .filter((f) => f.severity === sev)
+      .filter((f) => f.severity === sev && !isBump(f))
       .map((f) => `<li class="f ${sev}"><span class="tag">${sevLabel[sev]}</span><div><strong>${rich(f.title)}</strong><p>${rich(f.detail)}</p></div></li>`),
   ).join('\n');
+  const bumps = result.findings.filter(isBump);
+  const bumpTable = bumps.length
+    ? `<details class="bumps"><summary>${bumps.length} package${bumps.length === 1 ? ' is' : 's are'} a major version behind <span class="muted">(low)</span></summary><table><thead><tr><th>Package</th><th>Installed</th><th>Latest</th><th></th></tr></thead><tbody>${bumps
+        .map((f) => `<tr><td>${esc(f.fix.name)}</td><td>${esc(f.fix.from || '')}</td><td>${esc(f.fix.to || '')}</td><td class="muted">${f.fix.native ? 'native' : ''}</td></tr>`)
+        .join('')}</tbody></table></details>`
+    : '';
 
   const planHtml = plan
     ? `<section><h2>Upgrade plan <small>scope: ${esc(plan.complexity.size)}</small></h2>${plan.phases
@@ -50,6 +58,7 @@ h1{font-size:26px;margin:0 0 4px}h2{font-size:19px;margin:32px 0 12px}h2 small{f
 .stat.critical b{color:var(--critical)}.stat.high b{color:var(--high)}
 .facts{background:var(--card);border:1px solid var(--line);border-radius:10px;padding:12px 16px;margin-top:12px;display:flex;flex-wrap:wrap;gap:6px 24px;font-size:14px}
 ul.list{list-style:none;padding:0;margin:0;display:grid;gap:8px}
+details.bumps{margin-top:8px;background:var(--card);border:1px solid var(--line);border-left:4px solid var(--low);border-radius:8px;padding:10px 14px}details.bumps summary{cursor:pointer;font-weight:600}details.bumps table{width:100%;border-collapse:collapse;margin-top:10px;font-size:14px}details.bumps th,details.bumps td{text-align:left;padding:4px 8px;border-top:1px solid var(--line)}.muted{color:var(--muted);font-weight:400}
 .f{display:flex;gap:12px;background:var(--card);border:1px solid var(--line);border-left:4px solid var(--low);border-radius:8px;padding:10px 14px}
 .f p{margin:2px 0 0;color:var(--muted);font-size:14px}.f strong{overflow-wrap:anywhere}
 .tag{flex:none;font-size:12px;font-weight:600;text-transform:uppercase;letter-spacing:.03em;min-width:64px;padding-top:2px}
@@ -80,7 +89,7 @@ ${p.android && p.android.targetSdk ? `<span>targetSdk <b>${p.android.targetSdk}<
 <span>${result.deps.length} dependencies (${result.deps.filter((d) => d.native).length} native)</span>
 </div>
 <h2>Findings</h2>
-${result.findings.length ? `<ul class="list">${rows}</ul>` : '<p>No issues found.</p>'}
+${result.findings.length ? `${rows ? `<ul class="list">${rows}</ul>` : ''}${bumpTable}` : '<p>No issues found.</p>'}
 ${planHtml}
 <footer>${footer}</footer>
 </main></body></html>

package/src/report-sarif.js

@@ -49,7 +49,7 @@ export function sarifReport(result, { version = '0.0.0' } = {}) {
             ruleId: f.id.split(':')[0],
             level: LEVEL[f.severity],
             message: { text: `${f.title}. ${f.detail}` },
-            locations: [{ physicalLocation: { artifactLocation: { uri: loc.uri }, region: { startLine: loc.line } } }],
+            locations: [{ physicalLocation: { artifactLocation: { uri: toUri(loc.uri) }, region: { startLine: loc.line } } }],
             // Stable across runs so code scanning tracks one alert per finding.
             partialFingerprints: { nativekeelId: f.id },
             properties: { severity: f.severity, area: f.area },
@@ -59,3 +59,8 @@ export function sarifReport(result, { version = '0.0.0' } = {}) {
     ],
   };
 }
+
+// SARIF artifact locations are URIs: encode each path segment (spaces, #, %), keep the slashes.
+function toUri(file) {
+  return file.split(/[\\/]/).map(encodeURIComponent).join('/');
+}

package/src/rules.js

@@ -70,6 +70,21 @@ export const REPLACEMENTS = {
   'react-native-print': ['expo-print'],
   'react-native-i18n': ['react-native-localize', 'expo-localization'],
   'expo-av': ['expo-audio', 'expo-video'],
+  'react-native-snap-carousel': ['react-native-reanimated-carousel'],
+  'react-native-iphone-x-helper': ['react-native-safe-area-context'],
+  'react-native-slider': ['@react-native-community/slider'],
+  'react-native-datepicker': ['@react-native-community/datetimepicker'],
+};
+
+// Packages that moved to a new name with the same API: swap the package, update the imports.
+export const RENAMED = {
+  '@react-native-community/async-storage': '@react-native-async-storage/async-storage',
+  '@react-native-community/cameraroll': '@react-native-camera-roll/camera-roll',
+  '@react-native-community/masked-view': '@react-native-masked-view/masked-view',
+  '@react-native-community/viewpager': 'react-native-pager-view',
+  '@react-native-community/picker': '@react-native-picker/picker',
+  '@react-native-community/clipboard': '@react-native-clipboard/clipboard',
+  'react-native-netinfo': '@react-native-community/netinfo',
 };
 
 export const UPGRADE_HELPER_URL = (from, to) =>

package/src/security.js

@@ -0,0 +1,259 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { compareVersions } from './known-issues.js';
+
+// Security checks beyond leaked keys: known vulnerabilities in shipped dependencies, passwords
+// that flow into logs or remote writes, unsafe WebView settings, and Android backups.
+
+const SKIP_DIRS = new Set(['node_modules', '.git', 'Pods', 'build', '.gradle', 'DerivedData', '.expo', 'dist', 'coverage', 'vendor', '__tests__', '__mocks__', 'e2e']);
+const JS_EXT = /\.(?:[cm]?[jt]sx?)$/;
+const MAX_FILE_BYTES = 512 * 1024;
+
+function* jsFiles(dir) {
+  let entries;
+  try {
+    entries = fs.readdirSync(dir, { withFileTypes: true });
+  } catch {
+    return;
+  }
+  for (const e of entries) {
+    if (e.isDirectory()) {
+      if (!SKIP_DIRS.has(e.name) && !e.name.startsWith('.')) yield* jsFiles(path.join(dir, e.name));
+    } else if (JS_EXT.test(e.name) && !/\.(test|spec)\./.test(e.name)) {
+      yield path.join(dir, e.name);
+    }
+  }
+}
+
+const read = (file) => {
+  try {
+    return fs.statSync(file).size > MAX_FILE_BYTES ? '' : fs.readFileSync(file, 'utf8');
+  } catch {
+    return '';
+  }
+};
+
+const SERVER_ONLY = /node\.?js|server[- ]side|\bhttp adapter\b|\bssr\b/i;
+const SEVERITY = { critical: 'critical', high: 'high', moderate: 'medium', low: 'low', info: 'low' };
+const RANK = ['low', 'medium', 'high', 'critical'];
+
+// Advisories for the exact versions of runtime dependencies (devDependencies never ship).
+export async function vulnerableDependencies(registry, versions) {
+  const names = Object.keys(versions);
+  if (!names.length) return [];
+  const advisories = await registry.advisories(versions);
+  if (!advisories) return null; // request failed: the caller says the check did not run
+  const findings = [];
+  for (const [name, list] of Object.entries(advisories)) {
+    const version = versions[name];
+    // The endpoint answers for the versions we sent; double-check the range where it is simple.
+    const relevant = list.filter((a) => applies(version, a.vulnerable_versions));
+    if (!relevant.length) continue;
+    // Advisories about Node.js-only code paths (axios' HTTP adapter, server rendering) do not
+    // reach a React Native app: keep them visible, but at low severity.
+    const sevOf = (a) => (SERVER_ONLY.test(a.title || '') ? 'low' : SEVERITY[a.severity] || 'low');
+    const severity = relevant.map(sevOf).sort((a, b) => RANK.indexOf(b) - RANK.indexOf(a))[0];
+    const serverOnly = relevant.filter((a) => SERVER_ONLY.test(a.title || '')).length;
+    const fixedIn = minimumFixed(relevant);
+    const top = relevant
+      .slice()
+      .sort((a, b) => RANK.indexOf(sevOf(b)) - RANK.indexOf(sevOf(a)))
+      .slice(0, 3)
+      .map((a) => `${a.title}${a.url ? ` (${a.url})` : ''}`);
+    findings.push({
+      id: `vuln:${name}`,
+      severity,
+      area: 'security',
+      title: `${name} ${version}: ${relevant.length} known vulnerabilit${relevant.length === 1 ? 'y' : 'ies'}`,
+      detail: `${top.join('; ')}${relevant.length > 3 ? `; and ${relevant.length - 3} more` : ''}. ${fixedIn ? `Fixed in ${fixedIn} or later.` : 'Check the advisories for a fixed version.'}${serverOnly ? ` ${serverOnly} of them concern Node.js/server use only and are counted as low.` : ''} Source: GitHub Advisory Database (via npm).`,
+      fix: { kind: 'vuln-dep', name, from: version, to: fixedIn, severity },
+    });
+  }
+  return findings;
+}
+
+// "<1.2.3", ">=1.0.0 <1.2.3", "<=1.2.2" and "||" lists. Unknown syntax: trust the endpoint.
+function applies(version, range) {
+  if (!range) return true;
+  return range.split('||').some((part) => {
+    const conds = part.trim().split(/\s+/).filter(Boolean);
+    return conds.every((c) => {
+      const m = c.match(/^(<=|>=|<|>|=)?(\d+\.\d+\.\d+)/);
+      if (!m) return true;
+      const cmp = compareVersions(version, m[2]);
+      return { '<': cmp < 0, '<=': cmp <= 0, '>': cmp > 0, '>=': cmp >= 0, '=': cmp === 0, undefined: cmp === 0 }[m[1]];
+    });
+  });
+}
+
+function minimumFixed(advisories) {
+  let fixed = null;
+  for (const a of advisories) {
+    const bounds = [...String(a.vulnerable_versions || '').matchAll(/<\s*(\d+\.\d+\.\d+)/g)].map((m) => m[1]);
+    if (!bounds.length) return null; // an advisory without a fixed version
+    const hi = bounds.sort(compareVersions).at(-1);
+    if (!fixed || compareVersions(hi, fixed) > 0) fixed = hi;
+  }
+  return fixed;
+}
+
+// A password (or the variables built from it) passed to a log, crash report, analytics event,
+// remote database write or plain AsyncStorage. Seen in a real app: failed sign-ups were
+// logged to the database as "email-…-password".
+const PASSWORD = /\b(?:password|passwd|pwd|passcode|pin)\b/i;
+const SINKS = [
+  { re: /\b(?:crashlytics\(\)\.(?:log|recordError)|Sentry\.capture\w*|Bugsnag\.notify|captureException|captureMessage|sendCrash|recordError|logEvent|analytics\(\)\.\w+|mixpanel\.\w+|amplitude\.\w+|track)\s*\(/, what: 'crash reports or analytics', severity: 'high' },
+  { re: /\b(?:database\(\)|firestore\(\)|ref\([^)]*\)|collection\([^)]*\)|doc\([^)]*\))[\s\S]{0,80}?\.(?:set|push|update|add)\s*\(/, what: 'a remote database', severity: 'high' },
+  { re: /\bAsyncStorage\.(?:setItem|multiSet|mergeItem)\s*\(/, what: 'unencrypted AsyncStorage', severity: 'medium' },
+  { re: /\bconsole\.(?:log|info|warn|error|debug)\s*\(/, what: 'the device log', severity: 'low' },
+];
+
+export function passwordLeaks(root) {
+  const findings = [];
+  for (const file of jsFiles(root)) {
+    const text = read(file);
+    if (!text || !PASSWORD.test(text)) continue;
+    const lines = text.split('\n');
+    // Taint: identifiers that hold a password, or were built from one.
+    const tainted = new Set();
+    const hits = [];
+    lines.forEach((line, i) => {
+      if (/secureTextEntry|placeholder|label|title|Text>|i18n|\bt\(|localiz/i.test(line)) return;
+      const assign = line.match(/\b(?:const|let|var)\s+(?:\{[^}]*\}|([A-Za-z_$][\w$]*))\s*=(?!=)\s*(.*)/);
+      if (assign && assign[1]) {
+        // The whole right-hand side: objects and calls often span several lines.
+        const rhs = balanced(`${assign[2]}\n${lines.slice(i + 1, i + 12).join('\n')}`);
+        // A call's result (a login response, an encrypted value, a hash) is not the password.
+        // Concatenations and templates that include the password are still the password.
+        const unwrapped = rhs.replace(/^\s*(?:JSON\.stringify|String)\s*\(/, '');
+        const isCallResult = wholeCall(unwrapped);
+        if (!isCallResult && PASSWORD.test(rhs.replace(/['"`][^'"`\n]*['"`]/g, '')) || [...tainted].some((t) => new RegExp(`\\b${t}\\b`).test(rhs))) tainted.add(assign[1]);
+      }
+      for (const sink of SINKS) {
+        if (!sink.re.test(line)) continue;
+        // Exactly the call's arguments, up to the matching parenthesis (they can span lines).
+        const args = callArguments(lines.slice(i, i + 12).join('\n'), sink.re);
+        const direct = /\bpassword\b|\bpasswd\b|\bpwd\b/i.test(args.replace(/['"`][^'"`]*['"`]/g, ''));
+        const viaVar = [...tainted].some((t) => new RegExp(`\\b${t}\\b`).test(args));
+        if (direct || viaVar) hits.push({ line: i + 1, sink });
+      }
+    });
+    const worst = hits.sort((a, b) => RANK.indexOf(b.sink.severity) - RANK.indexOf(a.sink.severity))[0];
+    if (!worst || worst.sink.severity === 'low') continue; // console.log alone: not reported
+    const rel = path.relative(root, file);
+    findings.push({
+      id: `password-leak:${rel}`,
+      severity: worst.sink.severity,
+      area: 'security',
+      title: `A password may be sent to ${worst.sink.what} (${rel}:${worst.line})`,
+      detail: `${hits.length} place${hits.length === 1 ? '' : 's'} in this file pass a password, or a value built from one, to ${[...new Set(hits.map((h) => h.sink.what))].join(', ')}. Anyone with access to those logs or that data can read users' passwords. Log the error code only; never store passwords in AsyncStorage (use the Keychain/Keystore).`,
+      fix: { kind: 'security', step: `In \`${rel}\`, stop passing the password (or values built from it) to ${worst.sink.what}; log only error codes. Then delete the records already written.` },
+    });
+  }
+  return findings;
+}
+
+// From the start of `text` up to the end of the first statement: stops at a newline or ';' once
+// all brackets opened so far are closed.
+function balanced(text) {
+  let depth = 0;
+  const start = text.search(/\S/);
+  if (start < 0) return '';
+  for (let i = start; i < text.length; i++) {
+    const c = text[i];
+    if ('({['.includes(c)) depth++;
+    else if (')}]'.includes(c)) depth--;
+    else if ((c === '\n' || c === ';') && depth <= 0) return text.slice(start, i);
+  }
+  return text.slice(start);
+}
+
+// True when `text` is a single call expression (`await f(...)`, `a.b(...)`), with nothing but
+// closing brackets or a semicolon after it: e.g. not `a.toString() + password`.
+function wholeCall(text) {
+  const m = text.match(/^\s*(?:await\s+)?(?:new\s+)?[\w$.]+\s*\(/);
+  if (!m) return false;
+  let i = m[0].length;
+  for (;;) {
+    let depth = 1;
+    for (; i < text.length && depth > 0; i++) {
+      if (text[i] === '(') depth++;
+      else if (text[i] === ')') depth--;
+    }
+    // Chained calls (`.then(...)`, `.catch(...)`) keep it a call result.
+    const chain = text.slice(i).match(/^\s*\??\.\s*[\w$]+\s*\(/);
+    if (!chain) break;
+    i += chain[0].length;
+  }
+  return /^[\s);,]*$/.test(text.slice(i));
+}
+
+// Text between the opening parenthesis of the first `re` match and its matching close.
+function callArguments(text, re) {
+  const m = text.match(re);
+  if (!m) return '';
+  let i = m.index + m[0].length;
+  let depth = 1;
+  const start = i;
+  for (; i < text.length && depth > 0; i++) {
+    if (text[i] === '(') depth++;
+    else if (text[i] === ')') depth--;
+  }
+  return text.slice(start, i - 1);
+}
+
+// WebView settings that let page content read local files or mix HTTP into HTTPS pages.
+export function webViewRisks(root) {
+  const findings = [];
+  for (const file of jsFiles(root)) {
+    const text = read(file);
+    if (!text || !/react-native-webview|<WebView\b/.test(text)) continue;
+    const rel = path.relative(root, file);
+    const lineOf = (re) => text.slice(0, text.search(re)).split('\n').length;
+    const universal = /allowUniversalAccessFromFileURLs\s*(?:=\s*\{\s*true\s*\}|(?=[\s/>]))/;
+    const fileAccess = /allowFileAccessFromFileURLs\s*(?:=\s*\{\s*true\s*\}|(?=[\s/>]))/;
+    if (universal.test(text) || fileAccess.test(text)) {
+      const re = universal.test(text) ? universal : fileAccess;
+      findings.push({
+        id: `webview-file-access:${rel}`,
+        severity: 'high',
+        area: 'security',
+        title: `WebView lets page scripts read local files (${rel}:${lineOf(re)})`,
+        detail: 'allowUniversalAccessFromFileURLs / allowFileAccessFromFileURLs let JavaScript in a file:// page read other files and call any origin. Combined with any injected or remote content this exposes app data. Remove them unless you load only your own bundled files.',
+        fix: { kind: 'security', step: `In \`${rel}\`, remove \`allowUniversalAccessFromFileURLs\` / \`allowFileAccessFromFileURLs\` from the WebView.` },
+      });
+    }
+    if (/mixedContentMode\s*=\s*\{?\s*['"]always['"]/.test(text)) {
+      findings.push({
+        id: `webview-mixed-content:${rel}`,
+        severity: 'medium',
+        area: 'security',
+        title: `WebView allows HTTP content inside HTTPS pages (${rel}:${lineOf(/mixedContentMode/)})`,
+        detail: 'mixedContentMode="always" lets insecure scripts and frames load into secure pages on Android, where a network attacker can change them. Use "never", or "compatibility" if a legacy page needs it.',
+        fix: { kind: 'security', step: `In \`${rel}\`, set \`mixedContentMode="never"\`.` },
+      });
+    }
+  }
+  return findings;
+}
+
+// android:allowBackup="true" without backup rules: app data (tokens in SharedPreferences,
+// AsyncStorage, databases) can be copied off the device with adb or restored to another one.
+export function androidBackup(root) {
+  const file = path.join(root, 'android', 'app', 'src', 'main', 'AndroidManifest.xml');
+  const text = read(file);
+  if (!text) return [];
+  const app = text.match(/<application\b[^>]*>/s);
+  if (!app || !/android:allowBackup\s*=\s*"true"/.test(app[0])) return [];
+  if (/android:(?:dataExtractionRules|fullBackupContent)\s*=\s*"@/.test(app[0])) return [];
+  return [
+    {
+      id: 'android-allow-backup',
+      severity: 'medium',
+      area: 'security',
+      title: 'Android backups include all app data (allowBackup="true")',
+      detail: 'Without backup rules, tokens and databases are copied by device and cloud backups and can be restored on another device. The React Native template sets allowBackup="false"; set it back, or add dataExtractionRules that exclude credentials.',
+      fix: { kind: 'security', step: 'Set `android:allowBackup="false"` in `android/app/src/main/AndroidManifest.xml`, or add `dataExtractionRules` that exclude credentials.' },
+    },
+  ];
+}

package/src/stability.js

@@ -0,0 +1,186 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { cleanVersion, findPackageDir, installedVersion } from './project.js';
+import { filesImportingWith } from './usage.js';
+
+// Static checks for setups that build fine and then crash at runtime. Each one is a known,
+// documented failure, not a style preference.
+
+const readText = (file) => {
+  try {
+    return fs.readFileSync(file, 'utf8');
+  } catch {
+    return null;
+  }
+};
+
+const majorOf = (v) => (v ? Number(String(v).split('.')[0]) : null);
+
+// The app's Babel config, or the workspace root's (monorepos keep babel.config.js at the root).
+// null when none is found: then nothing can be said about plugins.
+function babelConfig(root, pkgJson) {
+  const files = ['babel.config.js', 'babel.config.cjs', 'babel.config.mjs', 'babel.config.json', '.babelrc', '.babelrc.js', '.babelrc.json'];
+  let dir = root;
+  let texts = [];
+  while (true) {
+    texts = files.map((f) => readText(path.join(dir, f))).filter(Boolean);
+    if (texts.length || fs.existsSync(path.join(dir, '.git'))) break;
+    const parent = path.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  root = dir;
+  if (pkgJson.babel) texts.push(JSON.stringify(pkgJson.babel));
+  // Shared config pulled in with require('./config/babel-shared') and the like.
+  for (const t of [...texts]) {
+    for (const m of t.matchAll(/require\(\s*['"](\.{1,2}\/[^'"]+)['"]\s*\)/g)) {
+      const base = path.join(root, m[1]);
+      const text = [base, `${base}.js`, `${base}.cjs`, `${base}.json`].map(readText).find(Boolean);
+      if (text) texts.push(text);
+    }
+  }
+  return texts.length ? texts.join('\n') : null;
+}
+
+export function stabilityChecks(project) {
+  const findings = [];
+  const add = (f) => findings.push(f);
+  const root = project.root;
+  const pkgJson = JSON.parse(readText(path.join(root, 'package.json')) || '{}');
+  const deps = { ...project.devDeps, ...project.deps };
+  const versionOf = (name) => cleanVersion(installedVersion(root, name) || deps[name] || '');
+
+  // Reanimated needs its Babel plugin: without it, worklets are not compiled and the first
+  // animation throws ("Failed to create a worklet" / "Reanimated 2 failed to create a worklet").
+  // babel-preset-expo adds it automatically.
+  if (deps['react-native-reanimated']) {
+    const rea = versionOf('react-native-reanimated');
+    const babel = babelConfig(root, pkgJson);
+    const expoPreset = babel ? /babel-preset-expo/.test(babel) : !!project.expoVersion;
+    const hasPlugin = !babel || /react-native-reanimated\/plugin|react-native-worklets\/plugin/.test(babel);
+    // Reanimated 2 also runs the v1 API, which needs no plugin: only flag it when the app uses
+    // worklet APIs. From 3 on the plugin is always required.
+    const needsPlugin =
+      majorOf(rea) >= 3 ||
+      (majorOf(rea) === 2 && filesImportingWith(root, 'react-native-reanimated', "useSharedValue|useAnimatedStyle|useDerivedValue|useAnimatedScrollHandler|runOnJS|runOnUI|['\"]worklet['\"]").length > 0);
+    if (!expoPreset && !hasPlugin && needsPlugin) {
+      const plugin = majorOf(rea) >= 4 ? 'react-native-worklets/plugin' : 'react-native-reanimated/plugin';
+      add({
+        id: 'crash-reanimated-babel',
+        severity: 'high',
+        area: 'crash',
+        title: `Reanimated ${rea} without its Babel plugin`,
+        detail: `Worklets are compiled by \`${plugin}\`; without it the first animation throws at runtime ("Failed to create a worklet"). Add it as the last entry of \`plugins\` in your Babel config, then restart Metro with \`--reset-cache\`.`,
+        fix: { kind: 'crash', step: `Add \`'${plugin}'\` as the last Babel plugin, then \`npx react-native start --reset-cache\`.` },
+      });
+    }
+    // Reanimated 4 moved worklets into a separate package that must be installed by the app.
+    if (majorOf(rea) >= 4 && !deps['react-native-worklets']) {
+      add({
+        id: 'crash-reanimated-worklets',
+        severity: 'high',
+        area: 'crash',
+        title: `Reanimated ${rea} needs react-native-worklets`,
+        detail: 'Reanimated 4 depends on react-native-worklets as a peer: without it the native build fails or the app crashes on start. Install the version Reanimated\'s compatibility table lists for your React Native version.',
+        fix: { kind: 'crash', step: `Install \`react-native-worklets\` (${project.expoVersion ? '`npx expo install react-native-worklets`' : 'the version that matches Reanimated'}).` },
+      });
+    }
+  }
+
+  // React Native Firebase: every @react-native-firebase/* package must be on the same version.
+  // Mixed versions fail to build or crash on start (native SDK version conflicts).
+  const rnfb = Object.keys(deps).filter((n) => n.startsWith('@react-native-firebase/'));
+  if (rnfb.length > 1) {
+    const versions = Object.fromEntries(rnfb.map((n) => [n, versionOf(n)]).filter(([, v]) => v));
+    const majors = new Set(Object.values(versions).map(majorOf));
+    if (majors.size > 1) {
+      add({
+        id: 'crash-firebase-versions',
+        severity: 'high',
+        area: 'crash',
+        title: 'React Native Firebase packages are on different major versions',
+        detail: `${Object.entries(versions).map(([n, v]) => `${n} ${v}`).join(', ')}. They share one native Firebase SDK and must all be on the same version; mixed majors fail to build or crash at startup.`,
+        fix: { kind: 'crash', step: 'Move every `@react-native-firebase/*` package to the same version (the same as `@react-native-firebase/app`).' },
+      });
+    }
+  }
+
+  // React Navigation: navigators and @react-navigation/native must share a major version.
+  // elements, devtools, web and compat follow their own version numbers.
+  const navOwnVersions = new Set(['@react-navigation/elements', '@react-navigation/devtools', '@react-navigation/web', '@react-navigation/compat']);
+  const nav = Object.keys(deps).filter((n) => n.startsWith('@react-navigation/') && !navOwnVersions.has(n));
+  if (nav.length > 1) {
+    const versions = Object.fromEntries(nav.map((n) => [n, versionOf(n)]).filter(([, v]) => v));
+    const majors = new Set(Object.values(versions).map(majorOf));
+    if (majors.size > 1) {
+      add({
+        id: 'crash-navigation-versions',
+        severity: 'high',
+        area: 'crash',
+        title: 'React Navigation packages are on different major versions',
+        detail: `${Object.entries(versions).map(([n, v]) => `${n} ${v}`).join(', ')}. Navigators from one major do not work with the core of another; this usually crashes on the first navigation ("Couldn't find a navigation context" or undefined functions).`,
+        fix: { kind: 'crash', step: 'Move every `@react-navigation/*` package to the same major version, following its migration guide.' },
+      });
+    }
+  }
+
+  // A second copy of react or react-native inside a dependency: "Invalid hook call" or
+  // duplicate native module registration at runtime.
+  if (project.hasNodeModules) {
+    for (const core of ['react', 'react-native']) {
+      const rootVersion = installedVersion(root, core);
+      const nm = findPackageDir(root, core) ? path.dirname(findPackageDir(root, core)) : null;
+      if (!nm || !rootVersion) continue;
+      const copies = [];
+      // Only runtime dependencies end up in the bundle (Storybook and @types copies do not).
+      const runtime = new Set(Object.keys(project.deps).filter((n) => !n.startsWith('@types/')));
+      for (const dep of listPackages(nm).filter((d) => runtime.has(d))) {
+        const nested = path.join(nm, dep, 'node_modules', core, 'package.json');
+        const text = readText(nested);
+        if (!text) continue;
+        try {
+          const v = JSON.parse(text).version;
+          if (v && v !== rootVersion) copies.push(`${dep} (${v})`);
+        } catch {
+          // unreadable
+        }
+      }
+      if (copies.length) {
+        add({
+          id: `crash-duplicate-${core}`,
+          severity: 'high',
+          area: 'crash',
+          title: `A second copy of ${core} is installed inside ${copies.length === 1 ? 'a dependency' : `${copies.length} dependencies`}`,
+          detail: `${copies.slice(0, 5).join(', ')}${copies.length > 5 ? ', …' : ''}, next to ${core} ${rootVersion}. ${core === 'react' ? 'Two Reacts in one bundle crash with "Invalid hook call".' : 'Two copies of React Native register native modules twice and fail at startup.'} Align the dependency's version or deduplicate (resolutions/overrides).`,
+          fix: { kind: 'crash', step: `Remove the nested ${core} copies: align versions or add an \`overrides\`/\`resolutions\` entry for \`${core}\`, reinstall, and check with \`npm ls ${core}\`.` },
+        });
+      }
+    }
+  }
+
+  return findings;
+}
+
+// Top-level package folder names in a node_modules directory (scoped ones as @scope/name).
+function listPackages(nm) {
+  const out = [];
+  let entries = [];
+  try {
+    entries = fs.readdirSync(nm, { withFileTypes: true });
+  } catch {
+    return out;
+  }
+  for (const e of entries) {
+    if (e.name.startsWith('.')) continue;
+    if (e.name.startsWith('@')) {
+      try {
+        for (const sub of fs.readdirSync(path.join(nm, e.name))) out.push(`${e.name}/${sub}`);
+      } catch {
+        // unreadable scope
+      }
+    } else {
+      out.push(e.name);
+    }
+  }
+  return out;
+}