penthera 1.5.0 → 1.6.0

package/lib/hook/index.js

@@ -8,9 +8,11 @@
  *     plus the license policy when penthera.policy.json has one
  *
  * Everything is read from the git index (what will be committed), never the
- * working tree, so a half-staged file is judged by its staged half. Offline,
- * no telemetry. Findings use the standard shape, so ids match a full scan and
- * penthera.suppress.json works here too.
+ * working tree, so a half-staged file is judged by its staged half. That
+ * includes penthera.policy.json and penthera.suppress.json: an unstaged edit
+ * to either cannot loosen the check. Staged symlinks are never followed.
+ * Offline, no telemetry. Findings use the standard shape, so ids match a full
+ * scan and penthera.suppress.json works here too.
  */
 import { execFileSync, spawnSync } from "node:child_process";
 import { existsSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, renameSync, rmSync, unlinkSync, writeFileSync, chmodSync } from "node:fs";
@@ -18,8 +20,8 @@ import { tmpdir } from "node:os";
 import { join, posix, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { findSecretsInText, isSecretScanTarget, maskMatch } from "../whitebox/secrets.js";
-import { loadPolicy } from "../install/policy.js";
-import { loadRepoSuppressions } from "../memory/repo-suppress.js";
+import { loadPolicy, normalizePolicy, POLICY_FILE } from "../install/policy.js";
+import { parseRepoSuppressions, REPO_SUPPRESS_FILE } from "../memory/repo-suppress.js";
 import { findingId } from "../memory/views.js";
 import { fingerprintFinding } from "../audit-loop.js";
 import { globToRegExp, isAtLeast, SEVERITIES } from "./policy.js";
@@ -118,7 +120,12 @@ export function isAgentConfig(path) {
 async function checkAgents(root, staged) {
   const touched = staged.filter(isAgentConfig);
   if (!touched.length) return { findings: [], files: 0 };
-  const all = git(root, ["ls-files", "-z", "--cached"]).split("\0").filter((p) => p && isAgentConfig(p));
+  // Regular files only (mode 100644/100755): a staged symlink would be checked
+  // out as a symlink and the scan would read whatever it points at.
+  const all = git(root, ["ls-files", "-z", "--cached", "--stage"]).split("\0")
+    .map((l) => /^(\d{6}) [0-9a-f]+ \d\t(.*)$/s.exec(l))
+    .filter((m) => m && (m[1] === "100644" || m[1] === "100755") && isAgentConfig(m[2]))
+    .map((m) => m[2]);
   const tmp = realpathSync(mkdtempSync(join(tmpdir(), "penthera-hook-")));
   try {
     const r = spawnSync("git", ["checkout-index", "-z", "--stdin", `--prefix=${tmp}/`], { cwd: root, input: all.join("\0") });
@@ -181,10 +188,29 @@ const bySeverity = (a, b) => SEVERITIES.indexOf(a.severity) - SEVERITIES.indexOf
  * @param {{ policyPath?: string, now?: string }} opts
  * @returns {Promise<{ root, staged, checked, blocking, below, suppressed, blockOn, policyPath, warnings, duration }>}
  */
+/** One file as staged, or null when it is not in the index. */
+function stagedBlob(root, path) {
+  return readStaged(root, [path]).get(path) || null;
+}
+
+/** The policy: an explicit --policy file, else penthera.policy.json as staged, else defaults. */
+function stagedPolicy(root, explicitPath) {
+  if (explicitPath) return loadPolicy(root, explicitPath);
+  const buf = stagedBlob(root, POLICY_FILE);
+  if (!buf) return { policy: normalizePolicy({}), path: null };
+  let raw;
+  try {
+    raw = JSON.parse(buf.toString("utf-8"));
+  } catch (e) {
+    throw new Error(`${POLICY_FILE} (staged): ${e.message}`);
+  }
+  return { policy: normalizePolicy(raw, `${POLICY_FILE} (staged)`), path: join(root, POLICY_FILE) };
+}
+
 export async function runHook(cwd, opts = {}) {
   const started = Date.now();
   const root = repoRoot(cwd);
-  const { policy, path: policyPath } = loadPolicy(root, opts.policyPath || null);
+  const { policy, path: policyPath } = stagedPolicy(root, opts.policyPath || null);
   const { blockOn, checks, ignore } = policy.hook;
   const ignored = ignore.map(globToRegExp);
   const staged = stagedFiles(root).filter((p) => !ignored.some((re) => re.test(p)));
@@ -196,7 +222,14 @@ export async function runHook(cwd, opts = {}) {
   const agents = checks.agents ? await checkAgents(root, staged) : { findings: [], files: 0 };
   const deps = checks.deps ? await checkLockfiles(root, staged, blobs, { licensePolicy: checks.licenses ? policy.licenses : null }) : { findings: [], files: 0 };
 
-  const sup = loadRepoSuppressions(root, { now: opts.now });
+  const supBuf = stagedBlob(root, REPO_SUPPRESS_FILE);
+  const sup = supBuf ? parseRepoSuppressions(supBuf, { now: opts.now }) : { entries: [], warnings: [] };
+  for (const f of [POLICY_FILE, REPO_SUPPRESS_FILE]) {
+    if (f === POLICY_FILE && opts.policyPath) continue;
+    const disk = join(root, f);
+    const staged = f === POLICY_FILE ? policyPath : supBuf;
+    if (existsSync(disk) && !staged) sup.warnings.push(`${f} is not staged, so this check ignores it (git add it to apply it)`);
+  }
   const all = [...secrets, ...agents.findings, ...deps.findings].map((f) => ({ ...f, id: findingId(f) }));
   const suppressed = [];
   const kept = [];

package/lib/install/index.js

@@ -5,16 +5,19 @@
  *      in a temporary copy of package.json / package-lock.json / .npmrc. Not in
  *      place: npm rewrites node_modules/.package-lock.json even in lock-only
  *      mode, and an abort must leave the project byte for byte as it was.
- *   2. Fetch. `npm cache add` puts each new tarball in npm's cache; nothing is
- *      unpacked into node_modules and no package code runs. The deps engine
+ *   2. Fetch. `npm cache add --ignore-scripts` puts each new tarball in npm's
+ *      cache; nothing is unpacked into node_modules and no package code runs
+ *      (git dependencies would run `prepare` here without --ignore-scripts, so
+ *      they are refused unless --allow-non-registry is passed). The deps engine
  *      reads tarballs back from the cache only after verifying them against
  *      the proposed lockfile's integrity (lib/deps/source.js).
  *   3. Diff. lib/deps scans the proposed tree against the current lockfile:
  *      new packages, capabilities gained, install scripts, typosquats.
  *   4. Decide. lib/install/policy.js turns that into deny / needs-approval.
  *   5. Apply (only when allowed). The vetted package.json and lockfile are
- *      written into the project and `npm install` installs exactly that tree,
- *      with `--ignore-scripts` unless the new install scripts were approved.
+ *      written into the project and `npm ci` installs exactly that tree (it
+ *      fails rather than re-resolve), with `--ignore-scripts` unless the new
+ *      install scripts were approved.
  *
  * Penthera makes no network calls here. npm talks to its configured registry
  * (resolve and fetch); that is the one expected egress.
@@ -35,6 +38,8 @@ const LOCKFILES = ["package-lock.json", "npm-shrinkwrap.json"];
 const COPY = ["package.json", ...LOCKFILES, ".npmrc"];
 const QUIET = ["--no-audit", "--no-fund", "--no-update-notifier"];
 const LOCAL_SPEC = /^(file:|link:|portal:|\.{1,2}\/|\/)/;
+// Specs npm resolves outside the registry: git, tarball URLs, hosted-git shorthands.
+const REMOTE_SPEC = /^(?:git\+|git:|github:|gitlab:|bitbucket:|gist:|https?:|ssh:)|^[^@][^/@:]*\/[^/]+$|^[^@]+@(?:git\+|git:|github:|gitlab:|bitbucket:|gist:|https?:|ssh:|file:)|\.(?:tgz|tar\.gz|tar)$/i;
 
 async function npm(args, opts) {
   try {
@@ -45,26 +50,50 @@ async function npm(args, opts) {
   }
 }
 
-/** npm's version and registry, as npm sees them from the project. */
+/** npm's version and registries (default and @scope:registry), as npm sees them from the project. */
 export async function npmInfo(root, env = process.env) {
-  const [version, registry] = await Promise.all([
+  const [version, config] = await Promise.all([
     npm(["--version"], { cwd: root, env }).then((r) => r.stdout.trim()),
-    npm(["config", "get", "registry"], { cwd: root, env }).then((r) => r.stdout.trim(), () => "the configured npm registry"),
+    npm(["config", "list", "--json"], { cwd: root, env }).then((r) => JSON.parse(r.stdout), () => ({})),
   ]);
+  const registry = typeof config.registry === "string" ? config.registry : "the configured npm registry";
+  const registries = Object.entries(config)
+    .filter(([k, v]) => (k === "registry" || /^@[^:]+:registry$/.test(k)) && typeof v === "string")
+    .map(([, v]) => v);
   const major = parseInt(version, 10) || 0;
   // npm 12 blocks dependency install scripts unless package.json allowScripts lists them.
-  return { version, major, registry, allowScriptsPolicy: major >= 12 };
+  return { version, major, registry, registries, allowScriptsPolicy: major >= 12 };
+}
+
+const origin = (u) => {
+  try {
+    const x = new URL(u);
+    return /^https?:$/.test(x.protocol) ? x.origin : null;
+  } catch {
+    return null;
+  }
+};
+
+/**
+ * Lockfile entries that would come from somewhere other than a configured
+ * registry: git repositories, tarball URLs on other hosts. Their contents are
+ * not what a registry name and version promise, and git ones run `prepare`.
+ */
+export function nonRegistryPackages(pkgs, registries) {
+  const allowed = new Set((registries || []).map(origin).filter(Boolean));
+  return pkgs.filter((p) => p.resolved && !p.link && !allowed.has(origin(p.resolved)));
 }
 
 const key = (p) => `${p.path}@${p.version}#${p.integrity || ""}`;
 const scriptsOf = (s) => (s && Object.keys(s).length ? s : null);
 
 /** The rule ids a change raises (see lib/install/policy.js). */
-function flagsFor(caps, { newScripts, typosquat, unscanned }) {
+function flagsFor(caps, { newScripts, typosquat, unscanned, scriptMismatch }) {
   const flags = [...(caps || [])].filter((id) => id !== "install-scripts");
   if (newScripts) flags.unshift("install-scripts");
   if (typosquat) flags.push("typosquat");
   if (unscanned) flags.push("unscanned");
+  if (scriptMismatch) flags.push("script-mismatch");
   return flags;
 }
 
@@ -89,7 +118,8 @@ export function changesFromDiff(diff, typosquats = [], packages = []) {
       capabilities: a.capabilities || [],
       installScripts: scripts,
       typosquatOf: typo.get(a.name)?.target || null,
-      flags: flagsFor(a.capabilities, { newScripts: !!scripts, typosquat: typo.has(a.name), unscanned: a.capabilities === null }),
+      unscanned: a.unscanned || null,
+      flags: flagsFor(a.capabilities, { newScripts: !!scripts, typosquat: typo.has(a.name), unscanned: a.capabilities === null, scriptMismatch: !!a.scriptMismatch }),
     });
   }
   for (const u of diff.upgraded) {
@@ -109,7 +139,8 @@ export function changesFromDiff(diff, typosquats = [], packages = []) {
       previousInstallScripts: before,
       compared: u.unavailable == null,
       typosquatOf: null,
-      flags: flagsFor(gained, { newScripts, typosquat: false, unscanned: u.unavailable === "new" }),
+      unscanned: u.unscanned || null,
+      flags: flagsFor(gained, { newScripts, typosquat: false, unscanned: u.unavailable === "new" || !!u.unscanned, scriptMismatch: !!u.scriptMismatch }),
     });
   }
   return out;
@@ -143,6 +174,10 @@ export async function planInstall(root, specs, opts = {}) {
   checkProject(root, JSON.parse(readFileSync(pkgPath, "utf-8")));
   const bad = specs.filter((s) => s.startsWith("-") || LOCAL_SPEC.test(s));
   if (bad.length) throw new Error(`Unsupported package spec(s): ${bad.join(", ")}. Pass registry names (name, name@version, name@range).`);
+  const remote = specs.filter((s) => REMOTE_SPEC.test(s));
+  if (remote.length && !opts.allowNonRegistry) {
+    throw new Error(`Non-registry package spec(s): ${remote.join(", ")}. Git and tarball-URL installs bypass the registry's name and version, and git ones run \`prepare\` while being fetched. Pass --allow-non-registry if you mean it.`);
+  }
 
   const info = opts.info || await npmInfo(root, env);
   const original = Object.fromEntries(COPY.map((f) => [f, readIfExists(join(root, f))]));
@@ -171,6 +206,10 @@ export async function planInstall(root, specs, opts = {}) {
     }
     const oldKeys = new Set(parseLockfile(JSON.parse(readFileSync(baseLockPath, "utf-8"))).map(key));
     const fresh = parseLockfile(proposedLock).filter((p) => !p.link && p.version && !oldKeys.has(key(p)));
+    const offRegistry = nonRegistryPackages(fresh, info.registries || [info.registry]);
+    if (offRegistry.length && !opts.allowNonRegistry) {
+      throw new Error(`The resolved tree pulls ${offRegistry.length} package(s) from outside the configured registry: ${offRegistry.slice(0, 5).map((p) => `${p.name} (${p.resolved})`).join(", ")}. Nothing was fetched or installed. Pass --allow-non-registry to review them anyway.`);
+    }
 
     // New tarballs go into a private npm cache (npm cache add): nothing is
     // unpacked or run. Private because npm will not reliably say where its own
@@ -182,11 +221,11 @@ export async function planInstall(root, specs, opts = {}) {
     if (toFetch.length) {
       onPhase(`Fetching ${toFetch.length} tarball(s) with npm cache add (nothing is unpacked or run)`);
       const fetchSpecs = [...new Set(toFetch.map((p) => (p.resolved && !/^https?:/.test(p.resolved) ? p.resolved : `${p.name}@${p.version}`)))];
-      await npm(["cache", "add", "--cache", fetchCache, ...(opts.offline ? ["--offline"] : []), ...fetchSpecs], { cwd: tmp, env });
+      await npm(["cache", "add", "--ignore-scripts", ...QUIET, "--cache", fetchCache, ...(opts.offline ? ["--offline"] : []), ...fetchSpecs], { cwd: tmp, env });
     }
 
     onPhase("Comparing capabilities with the current tree (offline, integrity-verified)");
-    const result = await scanDeps(work, { diff: baseLockPath, treeRoot: root, cacheDir: [fetchCache, userCache] });
+    const result = await scanDeps(work, { diff: baseLockPath, treeRoot: root, cacheDir: [fetchCache, userCache], ecosystem: "npm" });
     const changes = changesFromDiff(result.deps.diff, result.deps.typosquats, result.deps.packages);
     const verdict = evaluatePolicy(changes, opts.policy || normalizePolicy({}));
 
@@ -242,8 +281,10 @@ function restore(root, original) {
 
 /**
  * Install the vetted tree. Writes the proposed package.json and lockfile,
- * then runs `npm install` with no package arguments, so npm installs exactly
- * the lockfile that was reviewed. Restores both files if npm fails.
+ * then runs `npm ci`, which installs exactly that lockfile and fails instead
+ * of re-resolving, so what runs is what was reviewed (`npm install` could
+ * resolve something new and only be caught afterwards, once its scripts ran).
+ * Restores both files if npm fails.
  * @param {{ runScripts: boolean, env?: object, stdio?: string, offline?: boolean }} opts
  */
 export async function applyInstall(plan, opts) {
@@ -255,15 +296,15 @@ export async function applyInstall(plan, opts) {
 
   writeFileSync(join(root, "package.json"), pkgJson);
   writeFileSync(join(root, plan.lockName), plan.proposed[plan.lockName]);
-  const args = ["install", ...QUIET, ...(opts.runScripts ? [] : ["--ignore-scripts"]), ...(opts.offline ? ["--offline"] : [])];
+  const args = ["ci", ...QUIET, ...(opts.runScripts ? [] : ["--ignore-scripts"]), ...(opts.offline ? ["--offline"] : [])];
   try {
     await npm(args, { cwd: root, env });
   } catch (e) {
     restore(root, original);
-    throw new Error(`${e.message}\npackage.json and ${plan.lockName} were restored; node_modules may be partly updated (run \`npm ci\` to reset it).`);
+    throw new Error(`${e.message}\npackage.json and ${plan.lockName} were restored; node_modules may be partly updated (run \`npm ci --ignore-scripts\` to reset it).`);
   }
 
-  // npm should have installed the reviewed lockfile as is.
+  // npm ci never rewrites the lockfile; check anyway.
   const want = new Set(parseLockfile(JSON.parse(plan.proposed[plan.lockName])).map(key));
   const got = parseLockfile(JSON.parse(readFileSync(join(root, plan.lockName), "utf-8"))).map(key);
   const drift = got.filter((k) => !want.has(k));

package/lib/install/policy.js

@@ -8,8 +8,14 @@
  *   }
  *
  * `deny` and `requireApproval` list capability ids from lib/deps/capabilities.js,
- * plus two of the firewall's own: `typosquat` (a new name close to a popular
- * package) and `unscanned` (a new package whose files could not be read).
+ * plus three of the firewall's own: `typosquat` (a new name close to a popular
+ * package), `unscanned` (a new package whose files could not be read safely)
+ * and `script-mismatch` (the lockfile says the package has an install script
+ * but the scan found none: the scanner and npm disagree about its files).
+ *
+ * Two floors no policy lowers, not even an allow entry: `script-mismatch` is
+ * always denied, and `unscanned` always needs at least an approval. Both mean
+ * Penthera could not see what would run, so "clean" would be a guess.
  * `allow` lists package names or globs (`*` matches any run of characters),
  * optionally pinned to one version with `@x.y.z`; an allowed package passes
  * both lists. A field left out keeps its default; a field given replaces it.
@@ -27,12 +33,17 @@ import { normalizeHookPolicy } from "../hook/policy.js";
 
 export const POLICY_FILE = "penthera.policy.json";
 
-export const RULE_IDS = [...CAPABILITY_ORDER, "typosquat", "unscanned"];
+export const RULE_IDS = [...CAPABILITY_ORDER, "typosquat", "unscanned", "script-mismatch"];
+
+/** Floors the policy cannot lower (see the header). */
+export const ALWAYS_DENY = Object.freeze(["script-mismatch"]);
+export const ALWAYS_APPROVE = Object.freeze(["unscanned"]);
 
 export const RULE_LABELS = {
   ...Object.fromEntries(CAPABILITY_ORDER.map((id) => [id, CAPABILITIES[id].label])),
   typosquat: "looks like a popular package",
   unscanned: "could not be scanned",
+  "script-mismatch": "lockfile lists an install script the scan did not find",
 };
 
 export const DEFAULT_POLICY = Object.freeze({
@@ -115,8 +126,9 @@ export function matchAllow(allow, name, version) {
 export function evaluatePolicy(changes, policy) {
   const items = changes.map((c) => {
     const allowedBy = matchAllow(policy.allow, c.name, c.version);
-    const deny = allowedBy ? [] : c.flags.filter((id) => policy.deny.includes(id));
-    const approval = allowedBy ? [] : c.flags.filter((id) => policy.requireApproval.includes(id) && !deny.includes(id));
+    const deny = c.flags.filter((id) => ALWAYS_DENY.includes(id) || (!allowedBy && policy.deny.includes(id)));
+    const approval = c.flags.filter((id) => !deny.includes(id)
+      && (ALWAYS_APPROVE.includes(id) || (!allowedBy && policy.requireApproval.includes(id))));
     return { ...c, allowedBy, deny, approval };
   });
   const denied = items.filter((i) => i.deny.length);

package/lib/memory/repo-suppress.js

@@ -25,15 +25,23 @@ const MAX_ENTRIES = 500;
  * entries are dropped with a warning, never guessed at.
  */
 export function loadRepoSuppressions(repoPath, { now = new Date().toISOString() } = {}) {
-  const warnings = [];
   const path = join(repoPath, REPO_SUPPRESS_FILE);
-  if (!existsSync(path)) return { entries: [], warnings, path: null };
+  if (!existsSync(path)) return { entries: [], warnings: [], path: null };
   const st = statSync(path);
   if (!st.isFile()) return { entries: [], warnings: [`${REPO_SUPPRESS_FILE} is not a regular file, ignored`], path };
   if (st.size > MAX_BYTES) return { entries: [], warnings: [`${REPO_SUPPRESS_FILE} is larger than 64 KB, ignored`], path };
+  return parseRepoSuppressions(readFileSync(path), { now, path });
+}
 
+/**
+ * Validate the file's bytes (from disk, or from the git index for the
+ * pre-commit hook). Same rules and result shape as loadRepoSuppressions().
+ */
+export function parseRepoSuppressions(buf, { now = new Date().toISOString(), path = REPO_SUPPRESS_FILE } = {}) {
+  const warnings = [];
+  if (buf.length > MAX_BYTES) return { entries: [], warnings: [`${REPO_SUPPRESS_FILE} is larger than 64 KB, ignored`], path };
   let doc;
-  try { doc = JSON.parse(readFileSync(path, "utf-8")); } catch (e) {
+  try { doc = JSON.parse(buf.toString("utf-8")); } catch (e) {
     return { entries: [], warnings: [`${REPO_SUPPRESS_FILE} is not valid JSON (${e.message}), ignored`], path };
   }
   if (!doc || typeof doc !== "object" || doc.version !== 1 || !Array.isArray(doc.suppress)) {

package/lib/references.json

@@ -127,6 +127,78 @@
     ],
     "attack-chain": [
       "shostack2014threat"
+    ],
+    "dependency-risk": [
+      "ladisa2023sok",
+      "ohm2020backstabber",
+      "zimmermann2019small"
+    ],
+    "license": [
+      "spdxlicenselist"
+    ],
+    "agent-config": [
+      "owasp2025agentic",
+      "owasp2025mcptop10",
+      "greshake2023signed"
+    ],
+    "machine": [
+      "scarfone2008sp800115",
+      "saltzer1975protection"
+    ],
+    "machine-integrity": [
+      "scarfone2008sp800115",
+      "thompson1984reflections"
+    ],
+    "machine-config": [
+      "scarfone2008sp800115",
+      "saltzer1975protection"
+    ],
+    "suspicious-process": [
+      "scarfone2008sp800115"
+    ],
+    "ssh-config": [
+      "scarfone2008sp800115",
+      "saltzer1975protection"
+    ],
+    "rootkit": [
+      "scarfone2008sp800115",
+      "thompson1984reflections"
+    ],
+    "persistence": [
+      "scarfone2008sp800115"
+    ],
+    "network": [
+      "scarfone2008sp800115"
+    ],
+    "system-commands": [
+      "scarfone2008sp800115"
+    ],
+    "suspicious-files": [
+      "scarfone2008sp800115"
+    ],
+    "rkhunter": [
+      "scarfone2008sp800115"
+    ],
+    "permissions": [
+      "scarfone2008sp800115",
+      "saltzer1975protection"
+    ],
+    "malware": [
+      "scarfone2008sp800115"
+    ],
+    "kernel": [
+      "scarfone2008sp800115",
+      "saltzer1975protection"
+    ],
+    "hidden-files": [
+      "scarfone2008sp800115"
+    ],
+    "code-signing": [
+      "scarfone2008sp800115",
+      "thompson1984reflections"
+    ],
+    "browser-extensions": [
+      "scarfone2008sp800115"
     ]
   },
   "sources": {
@@ -369,6 +441,11 @@
       "cite": "MITRE CWE",
       "title": "CWE: Common Weakness Enumeration",
       "url": "https://cwe.mitre.org/"
+    },
+    "spdxlicenselist": {
+      "cite": "SPDX License List",
+      "title": "SPDX License List",
+      "url": "https://spdx.org/licenses/"
     }
   }
 }

package/lib/remediation/index.js

@@ -111,6 +111,15 @@ const RULES = [
     effort: "quick",
     ownerAction: false,
   },
+  {
+    id: "license",
+    match: (f) => f.category === "license",
+    action: "Replace or approve the dependency whose license breaks your policy",
+    why: "A dependency under a license your policy does not allow (strong copyleft such as AGPL in a closed product, or no license at all, which means no rights to use it) is a legal exposure that ships with every release.",
+    fix: "Swap the package for one under an allowed license, or, if legal has reviewed it, add it to `allowPackages` in the `licenses` section of penthera.policy.json with a reason. An UNLICENSED or missing license needs the author to publish one; until then treat it as not usable.",
+    effort: "moderate",
+    ownerAction: true, // a legal call, not a code change
+  },
   {
     id: "dependency-risk",
     match: (f) => f.category === "dependency-risk",

package/lib/retirejs.js

@@ -139,31 +139,83 @@ function extractVersion(text, patterns) {
 
 /**
  * Extract <script src="..."> URLs and inline script blocks from HTML.
+ *
+ * A small tokenizer rather than regexes: the HTML comes from the scanned
+ * target, so tag names match case-insensitively, attributes may use either
+ * quote or none, and a closing tag may carry whitespace or junk before its `>`
+ * (`</script >`, `</SCRIPT foo>`), as browsers accept. This only reads; it
+ * never rewrites or "sanitises" HTML.
  */
 export function extractScripts(html, baseUrl) {
   const scripts = { external: [], inline: [] };
-
-  // External scripts
-  const srcRe = /<script[^>]+src=["']([^"']+)["']/gi;
-  let match;
-  while ((match = srcRe.exec(html))) {
-    let src = match[1];
-    // Resolve relative URLs
-    if (src.startsWith("//")) src = "https:" + src;
-    else if (src.startsWith("/")) src = baseUrl + src;
-    else if (!src.startsWith("http")) src = baseUrl + "/" + src;
-    scripts.external.push(src);
+  const lower = String(html ?? "").toLowerCase();
+  const src0 = String(html ?? "");
+  let pos = 0;
+  while ((pos = lower.indexOf("<script", pos)) !== -1) {
+    const after = lower[pos + 7];
+    // `<scripts>` or `<script-x>` is a different tag.
+    if (after !== undefined && after !== ">" && after !== "/" && !/\s/.test(after)) { pos += 7; continue; }
+    const { attrs, end } = readTag(src0, pos + 7);
+    if (end === -1) break;
+    const src = attrs.src;
+    if (src) {
+      let url = src;
+      if (url.startsWith("//")) url = "https:" + url;
+      else if (url.startsWith("/")) url = baseUrl + url;
+      else if (!url.startsWith("http")) url = baseUrl + "/" + url;
+      scripts.external.push(url);
+    }
+    const close = findScriptClose(lower, end);
+    const body = src0.slice(end, close.start);
+    if (body.trim().length > 10) scripts.inline.push(body);
+    pos = close.end;
   }
+  return scripts;
+}
 
-  // Inline scripts (for version detection)
-  const inlineRe = /<script(?:\s[^>]*)?>([\s\S]*?)<\/script>/gi;
-  while ((match = inlineRe.exec(html))) {
-    if (match[1].trim().length > 10) {
-      scripts.inline.push(match[1]);
+/** Read attributes from just after `<script` to the tag's `>`. */
+function readTag(s, i) {
+  const attrs = Object.create(null);
+  const n = s.length;
+  while (i < n) {
+    while (i < n && (/\s/.test(s[i]) || s[i] === "/")) i++;
+    if (i >= n) return { attrs, end: -1 };
+    if (s[i] === ">") return { attrs, end: i + 1 };
+    let name = "";
+    while (i < n && !/[\s=>/]/.test(s[i])) name += s[i++];
+    while (i < n && /\s/.test(s[i])) i++;
+    let value = "";
+    if (s[i] === "=") {
+      i++;
+      while (i < n && /\s/.test(s[i])) i++;
+      const q = s[i];
+      if (q === '"' || q === "'") {
+        const close = s.indexOf(q, i + 1);
+        if (close === -1) return { attrs, end: -1 };
+        value = s.slice(i + 1, close);
+        i = close + 1;
+      } else {
+        while (i < n && !/[\s>]/.test(s[i])) value += s[i++];
+      }
     }
+    name = name.toLowerCase();
+    if (name && !(name in attrs)) attrs[name] = value;
   }
+  return { attrs, end: -1 };
+}
 
-  return scripts;
+/** Find `</script ...>` (any case, anything up to `>`); unclosed runs to EOF. */
+function findScriptClose(lower, from) {
+  let i = from;
+  while ((i = lower.indexOf("</script", i)) !== -1) {
+    const c = lower[i + 8];
+    if (c === undefined || c === ">" || c === "/" || /\s/.test(c)) {
+      const gt = lower.indexOf(">", i + 8);
+      return { start: i, end: gt === -1 ? lower.length : gt + 1 };
+    }
+    i += 8;
+  }
+  return { start: lower.length, end: lower.length };
 }
 
 // ── Main scanner ─────────────────────────────────────────────────────────