penthera 1.7.0 → 1.8.0

package/lib/deps/iocs.js

@@ -0,0 +1,74 @@
+/**
+ * Indicators of compromise from rule packs (lib/rules), for `penthera deps`.
+ *
+ *   ioc-package  known-malicious name@version, matched against the lockfile,
+ *                so it works for packages that are not installed
+ *   ioc-host     exfiltration domains and endpoint URLs, matched as literal
+ *                strings in package code and package.json
+ *   ioc-file     files a campaign drops into packages, by path and
+ *                optionally SHA-256
+ *
+ * Literal matching only, no regexes: a pack cannot make this slow.
+ */
+import { createHash } from "node:crypto";
+import { rulesOf } from "../rules/index.js";
+
+/** Build the active IOC set once per scan. Returns null when no pack has IOCs. */
+export function loadIocs() {
+  const pkgRules = rulesOf("ioc-package");
+  const hostRules = rulesOf("ioc-host");
+  const fileRules = rulesOf("ioc-file");
+  if (!pkgRules.length && !hostRules.length && !fileRules.length) return null;
+
+  const byName = new Map();
+  for (const r of pkgRules) {
+    for (const p of r.packages) {
+      const list = byName.get(p.name) || [];
+      list.push({ rule: r, versions: new Set(p.versions) });
+      byName.set(p.name, list);
+    }
+  }
+  const needles = [];
+  for (const r of hostRules) {
+    for (const h of r.hosts) needles.push({ rule: r, value: h, type: "host" });
+    for (const u of r.urls) needles.push({ rule: r, value: u, type: "url" });
+  }
+  const files = fileRules.flatMap((r) => r.files.map((f) => ({ rule: r, ...f })));
+
+  return {
+    /** Lockfile entries that match a known-malicious version. */
+    matchPackage(name, version) {
+      return (byName.get(name) || [])
+        .filter((e) => e.versions.has(version) || e.versions.has("*"))
+        .map((e) => ({ type: "package", value: `${name}@${version}`, rule: e.rule }));
+    },
+    /** Host and URL indicators in one file's text. */
+    scanText(text, file) {
+      const hits = [];
+      for (const n of needles) {
+        const idx = text.indexOf(n.value);
+        if (idx < 0) continue;
+        // A host must stand on its own: evil.example should not fire on notevil.example.
+        if (n.type === "host" && /[a-z0-9-]/i.test(text[idx - 1] || "")) continue;
+        hits.push({ type: n.type, value: n.value, rule: n.rule, file, line: text.slice(0, idx).split("\n").length });
+      }
+      return hits;
+    },
+    /** Dropped-file indicators in a package's file list. */
+    scanFiles(list, source, prefix) {
+      const hits = [];
+      for (const f of files) {
+        const found = list.filter((p) => p === f.path || p.endsWith(`/${f.path}`));
+        for (const p of found) {
+          if (f.sha256) {
+            let digest;
+            try { digest = createHash("sha256").update(source.read(p)).digest("hex"); } catch { continue; }
+            if (digest !== f.sha256) continue;
+          }
+          hits.push({ type: "file", value: f.sha256 ? `${f.path} (sha256 ${f.sha256.slice(0, 12)}…)` : f.path, rule: f.rule, file: `${prefix}${p}`, line: 1 });
+        }
+      }
+      return hits;
+    },
+  };
+}

package/lib/deps/lockfile.js

@@ -8,7 +8,7 @@
  */
 import { readFileSync, existsSync } from "node:fs";
 import { join } from "node:path";
-import { execFileSync } from "node:child_process";
+import { git as safeGit } from "../git.js";
 
 /** Package name from a lockfile v2/v3 key like node_modules/a/node_modules/@s/b. */
 export function nameFromLockPath(key) {
@@ -105,14 +105,9 @@ export function assertSafeRef(ref) {
   return ref;
 }
 
-/**
- * git for reading a scanned repo: no fsmonitor, no hooks, no transports.
- * Read-only plumbing only (rev-parse, show, ls-tree).
- */
+/** git for reading a scanned repo (lib/git.js). Read-only plumbing only (rev-parse, show, ls-tree). */
 export function readOnlyGit(dir) {
-  return (args) => execFileSync("git", ["-c", "core.fsmonitor=false", "-c", "core.hooksPath=/dev/null", "-c", "protocol.allow=never", ...args], {
-    cwd: dir, encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"], maxBuffer: 256 * 1024 * 1024, env: { ...process.env, GIT_NO_LAZY_FETCH: "1", GIT_TERMINAL_PROMPT: "0" },
-  });
+  return (args) => safeGit(dir, args);
 }
 
 /**

package/lib/deps/online.js

@@ -14,7 +14,12 @@
  *   - version deprecated.
  */
 import { sourceFromTarball } from "./source.js";
-import { request } from "../../src/utils/http.js";
+import { readBody, readJson, request } from "../../src/utils/http.js";
+
+// Packuments of popular packages run to tens of MB; tarballs are capped by the
+// unpacked-size limit in source.js anyway.
+const MAX_PACKUMENT_BYTES = 128 * 1024 * 1024;
+const MAX_TARBALL_BYTES = 256 * 1024 * 1024;
 
 // Registry calls go through the shared client: same User-Agent, same egress
 // accounting (and refusal under --offline) as every other request.
@@ -35,7 +40,7 @@ export async function fetchPackument(name, { fetchImpl = registryFetch, registry
   try {
     const res = await fetchImpl(url, { headers: { accept: "application/json" }, signal: AbortSignal.timeout(timeout) });
     if (!res.ok) return null;
-    return await res.json();
+    return await readJson(res, { maxBytes: MAX_PACKUMENT_BYTES, timeout });
   } catch {
     return null;
   }
@@ -124,7 +129,7 @@ export async function fetchTarballSource(url, integrity, { fetchImpl = registryF
   try {
     const res = await fetchImpl(url, { signal: AbortSignal.timeout(timeout) });
     if (!res.ok) return null;
-    const buf = Buffer.from(await res.arrayBuffer());
+    const buf = await readBody(res, { maxBytes: MAX_TARBALL_BYTES, timeout, binary: true });
     return sourceFromTarball(buf, integrity, "registry");
   } catch {
     return null;

package/lib/deps/python/capabilities.js

@@ -21,7 +21,8 @@ import {
 } from "../capabilities.js";
 
 const j = (...parts) => parts.join("");
-const MAX_PY_BYTES = 8 * 1024 * 1024;
+// As for npm: a file over this is not read, and the package is then unscanned.
+const MAX_PY_BYTES = 64 * 1024 * 1024;
 const EXFIL_WINDOW = 40;
 const NEAR_WINDOW = 30;
 const PTH_WINDOW = 5;
@@ -318,9 +319,10 @@ const NATIVE_EXT = /\.(?:so(?:\.\d+)*|pyd|dylib|dll)$/i;
 /**
  * Scan a Python package through a source (lib/deps/source.js interface; a
  * source may also expose recordHashes: Map<rel, "sha256=...">).
- * @param {{ files(): string[], read(rel): Buffer, size(rel): number, recordHashes?: Map }} source
+ * @param {{ files(): string[], read(rel): Buffer, size(rel): number, recordHashes?: Map, anomaly?: string, truncated?: boolean }} source
  * @param {{ prefix?: string }} opts
- * @returns same shape as scanPackage() for npm, plus startupHooks and modified
+ * @returns same shape as scanPackage() for npm (including unscanned: why the
+ *   package could not be fully read, else null), plus startupHooks and modified
  */
 export function scanPythonPackage(source, opts = {}) {
   const prefix = opts.prefix || "";
@@ -360,6 +362,16 @@ export function scanPythonPackage(source, opts = {}) {
     if (r.exfil) exfil.push(r.exfil);
   }
 
+  // Fail closed, as for npm: a package whose files were not all read is
+  // unscanned, never clean. Every real wheel, sdist or installed distribution
+  // has at least its metadata files, so an empty list means nothing was read.
+  let unscanned = source.anomaly || null;
+  if (!unscanned && files.length === 0) unscanned = "no files could be read for this package";
+  if (!unscanned && source.truncated) unscanned = `the package has more than ${source.maxFiles} files, so some were never read`;
+  if (!unscanned && skipped.length) {
+    unscanned = `${skipped.length} code file(s) over ${MAX_PY_BYTES / 1024 / 1024} MB were not scanned (${skipped.slice(0, 3).join(", ")}${skipped.length > 3 ? ", ..." : ""})`;
+  }
+
   // Module name -> file, for resolving what a .pth or setup.py hook runs.
   const moduleFile = (mod) => [`${mod}.py`, `${mod}/__init__.py`].find((f) => fileSet.has(f)) || null;
   const riskyOf = (f) => (f && fileCaps[f] ? fileCaps[f].filter((c) => RISKY_FOR_INSTALL.includes(c) || c === "shell") : []);
@@ -441,6 +453,7 @@ export function scanPythonPackage(source, opts = {}) {
     exfil,
     filesScanned,
     skipped,
+    unscanned,
     startupHooks,
     modified,
   };

package/lib/deps/python/index.js

@@ -104,11 +104,15 @@ function scanPyTree(pkgs, env, ctx) {
       ctx.cache.set(key, src ? { ...scanPythonPackage(src, { prefix }), source: src.kind } : null);
     }
     const r = ctx.cache.get(key);
+    // Fail closed: a package that could not be fully read has unknown
+    // capabilities (null), not an empty set.
+    const unscanned = r?.unscanned || null;
     return {
       ...p,
       version,
       source: r?.source || null,
-      capabilities: r ? r.capabilities : null,
+      capabilities: r && !unscanned ? r.capabilities : null,
+      unscanned,
       installScripts: r?.installScripts || {},
       installRisk: r?.installRisk || [],
       exfil: r?.exfil || [],

package/lib/deps/python/lockfiles.js

@@ -298,11 +298,17 @@ function parsePipfileLock(text, dir) {
  */
 export function parsePythonInput(text, kind, dir, file = kind) {
   let r;
-  if (kind === "uv.lock") r = parseUvLock(text, dir);
-  else if (kind === "poetry.lock") r = parsePoetryLock(text, dir);
-  else if (kind === "pdm.lock") r = parsePdmLock(text, dir);
-  else if (kind === "Pipfile.lock") r = parsePipfileLock(text, dir);
-  else r = { ...parseRequirements(text, { file, baseDir: dir }), version: null };
+  try {
+    if (kind === "uv.lock") r = parseUvLock(text, dir);
+    else if (kind === "poetry.lock") r = parsePoetryLock(text, dir);
+    else if (kind === "pdm.lock") r = parsePdmLock(text, dir);
+    else if (kind === "Pipfile.lock") r = parsePipfileLock(text, dir);
+    else r = { ...parseRequirements(text, { file, baseDir: dir }), version: null };
+  } catch (e) {
+    // One clear error naming the file, whatever the parser hit (malformed or
+    // hostile input): the tree cannot be read, so nothing is reported clean.
+    throw new Error(`${file} could not be parsed: ${e.message}`);
+  }
   // One entry per name@version (requirements files can repeat a name across -r includes).
   const seen = new Set();
   const packages = r.packages.filter((p) => {

package/lib/deps/python/source.js

@@ -20,11 +20,10 @@ import { join, relative, resolve, sep } from "node:path";
 import { createHash } from "node:crypto";
 import { inflateRawSync, gunzipSync } from "node:zlib";
 import { homedir } from "node:os";
-import { DirSource, MapSource, untar } from "../source.js";
+import { DirSource, MapSource, untar, MAX_FILES } from "../source.js";
 import { normalizeName } from "./lockfiles.js";
 import { recordHash } from "./capabilities.js";
 
-const MAX_FILES = 5000;
 // Not part of a local package's source: environments, caches, build output.
 const LOCAL_SKIP = new Set([".venv", "venv", ".tox", ".nox", "__pycache__", ".mypy_cache", ".pytest_cache", "build", "dist", ".eggs"]);
 const MAX_ARCHIVE_BYTES = 512 * 1024 * 1024;
@@ -112,7 +111,10 @@ export class RecordSource {
     const root = resolve(siteDir);
     // Only files inside site-packages: console-script wrappers in bin/ are generated by pip.
     const ok = entries.filter((e) => e.path && !e.path.split(/[\\/]/).includes("..") && resolve(root, e.path).startsWith(root + sep));
-    this._files = [...new Set(ok.map((e) => e.path.replace(/\\/g, "/")))].sort().slice(0, MAX_FILES);
+    const all = [...new Set(ok.map((e) => e.path.replace(/\\/g, "/")))].sort();
+    this.maxFiles = MAX_FILES;
+    this.truncated = all.length > MAX_FILES;
+    this._files = all.slice(0, MAX_FILES);
     this.recordHashes = new Map(ok.filter((e) => e.hash).map((e) => [e.path.replace(/\\/g, "/"), e.hash]));
   }
 
@@ -155,12 +157,18 @@ export function listInstalled(siteDir) {
           .map((p) => ({ path: relative(siteDir, resolve(siteDir, e, p)).split(sep).join("/"), hash: null }));
       } catch { /* no file list */ }
     }
+    let guessTruncated = false;
     if (!record.length) {
       // No file list: fall back to the folder named after the distribution.
       const guess = md.Name.replace(/-/g, "_");
-      if (existsSync(join(siteDir, guess))) record = new DirSource(join(siteDir, guess)).files().map((f) => ({ path: `${guess}/${f}`, hash: null }));
+      if (existsSync(join(siteDir, guess))) {
+        const dir = new DirSource(join(siteDir, guess));
+        record = dir.files().map((f) => ({ path: `${guess}/${f}`, hash: null }));
+        guessTruncated = dir.truncated;
+      }
     }
     const src = new RecordSource(siteDir, record);
+    if (guessTruncated) src.truncated = true;
     for (const f of src.files()) owned.add(f);
     out.push({ name: normalizeName(md.Name), displayName: md.Name, version: md.Version || null, distInfo: e, source: src });
   }
@@ -170,23 +178,44 @@ export function listInstalled(siteDir) {
 
 // ── Archives ──────────────────────────────────────────────────────────────
 
+/** A wheel that could not be parsed unambiguously. Callers fail closed. */
+export class ZipError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ZipError";
+  }
+}
+
 /**
  * Minimal zip reader for wheels: central directory, stored and deflated
- * entries. Paths that climb out are dropped; total size is capped.
- * @returns {Map<string, Buffer>}
+ * entries. Paths that climb out are dropped. Returns Map<path, Buffer>.
+ *
+ * Fails closed. The sizes in the central directory are the archive's own
+ * claim, so each entry is checked against the bytes really there, and the
+ * total is capped on what was actually inflated. A bad record, an entry that
+ * does not fit the archive, a size that does not match its data, encryption,
+ * ZIP64 or an unknown compression method throws ZipError rather than being
+ * skipped: whatever comes after it would otherwise go unread.
  */
-export function unzip(buf) {
+export function unzip(buf, { maxTotal = MAX_UNPACKED_BYTES, maxEntries = MAX_FILES } = {}) {
   const files = new Map();
   let eocd = -1;
   for (let i = buf.length - 22; i >= Math.max(0, buf.length - 65557); i--) {
     if (buf.readUInt32LE(i) === 0x06054b50) { eocd = i; break; }
   }
-  if (eocd === -1) throw new Error("not a zip file");
+  if (eocd === -1) throw new ZipError("not a zip file");
   const count = buf.readUInt16LE(eocd + 10);
+  const cdSize = buf.readUInt32LE(eocd + 12);
   let off = buf.readUInt32LE(eocd + 16);
+  if (count === 0xffff || cdSize === 0xffffffff || off === 0xffffffff) throw new ZipError("ZIP64 archives are not supported");
+  if (buf.readUInt16LE(eocd + 4) !== 0 || buf.readUInt16LE(eocd + 8) !== count) throw new ZipError("multi-disk archive");
+  if (count > maxEntries) throw new ZipError(`more than ${maxEntries} entries`);
+  const cdEnd = off + cdSize;
+  if (cdEnd > eocd) throw new ZipError("central directory outside the archive");
   let total = 0;
-  for (let n = 0; n < count && off + 46 <= buf.length; n++) {
-    if (buf.readUInt32LE(off) !== 0x02014b50) break;
+  for (let n = 0; n < count; n++) {
+    if (off + 46 > cdEnd || buf.readUInt32LE(off) !== 0x02014b50) throw new ZipError(`bad central directory record ${n}`);
+    const flags = buf.readUInt16LE(off + 8);
     const method = buf.readUInt16LE(off + 10);
     const csize = buf.readUInt32LE(off + 20);
     const usize = buf.readUInt32LE(off + 24);
@@ -194,30 +223,51 @@ export function unzip(buf) {
     const extraLen = buf.readUInt16LE(off + 30);
     const commentLen = buf.readUInt16LE(off + 32);
     const local = buf.readUInt32LE(off + 42);
+    if (off + 46 + nameLen + extraLen + commentLen > cdEnd) throw new ZipError(`central directory record ${n} overruns`);
     const name = buf.subarray(off + 46, off + 46 + nameLen).toString("utf-8");
+    const label = JSON.stringify(name);
     off += 46 + nameLen + extraLen + commentLen;
-    if (name.endsWith("/") || files.size >= MAX_FILES) continue;
-    const parts = name.split("/").filter(Boolean);
-    if (parts.includes("..") || name.startsWith("/")) continue;
-    if (buf.readUInt32LE(local) !== 0x04034b50) continue;
+    if (csize === 0xffffffff || usize === 0xffffffff || local === 0xffffffff) throw new ZipError("ZIP64 entries are not supported");
+    if (flags & 1) throw new ZipError(`encrypted entry ${label}`);
+    if (local + 30 > buf.length || buf.readUInt32LE(local) !== 0x04034b50) throw new ZipError(`bad local header for ${label}`);
     const start = local + 30 + buf.readUInt16LE(local + 26) + buf.readUInt16LE(local + 28);
+    if (start + csize > buf.length) throw new ZipError(`entry ${label} runs past the end of the archive`);
+    if (name.endsWith("/")) continue;
     const raw = buf.subarray(start, start + csize);
-    total += usize;
-    if (total > MAX_UNPACKED_BYTES) break;
     let data;
     if (method === 0) data = Buffer.from(raw);
-    else if (method === 8) data = inflateRawSync(raw, { maxOutputLength: Math.max(usize, 1) });
-    else continue;
+    else if (method === 8) {
+      try {
+        // Capped on what really comes out, not on the size the entry claims.
+        data = inflateRawSync(raw, { maxOutputLength: Math.max(1, maxTotal - total) });
+      } catch (e) {
+        throw new ZipError(`entry ${label} could not be inflated within ${maxTotal} bytes (${e.code || e.message})`);
+      }
+    } else throw new ZipError(`unsupported compression method ${method} for ${label}`);
+    if (data.length !== usize) throw new ZipError(`entry ${label} holds ${data.length} bytes, the archive says ${usize}`);
+    total += data.length;
+    if (total > maxTotal) throw new ZipError(`unpacked size over ${maxTotal} bytes`);
+    const parts = name.split("/").filter(Boolean);
+    if (parts.includes("..") || name.startsWith("/")) continue;
     files.set(parts.join("/"), data);
   }
   return files;
 }
 
-/** Unpack a wheel (zip) or sdist (.tar.gz) into a MapSource. */
+/**
+ * Unpack a wheel (zip) or sdist (.tar.gz) into a MapSource. The bytes are an
+ * artifact the caller chose to scan (matched by hash, or a local path), so one
+ * that cannot be read safely is not "missing": it comes back as a source with
+ * an anomaly and no files, and the scan fails closed.
+ */
 export function sourceFromArtifact(bytes, kind) {
-  if (bytes.readUInt32LE(0) === 0x04034b50) return new MapSource(unzip(bytes), kind);
-  if (bytes[0] === 0x1f && bytes[1] === 0x8b) return new MapSource(untar(gunzipSync(bytes, { maxOutputLength: MAX_UNPACKED_BYTES })), kind);
-  return null;
+  try {
+    if (bytes.length >= 4 && bytes.readUInt32LE(0) === 0x04034b50) return new MapSource(unzip(bytes), kind);
+    if (bytes[0] === 0x1f && bytes[1] === 0x8b) return new MapSource(untar(gunzipSync(bytes, { maxOutputLength: MAX_UNPACKED_BYTES })), kind);
+  } catch (e) {
+    return new MapSource(new Map(), kind, { anomaly: `archive could not be read safely (${e.message})` });
+  }
+  return new MapSource(new Map(), kind, { anomaly: "archive is neither a wheel nor a gzipped sdist" });
 }
 
 // ── pip's HTTP cache ──────────────────────────────────────────────────────
@@ -281,10 +331,9 @@ export function sourceFromPipCache(pkg, dir = pipCacheDir()) {
   for (const bytes of hits) {
     // Re-verify: the cache may have changed since it was indexed.
     if (!wanted.includes(createHash("sha256").update(bytes).digest("hex"))) continue;
-    try {
-      const src = sourceFromArtifact(bytes, "pip-cache");
-      if (src) return src;
-    } catch { /* corrupt artifact */ }
+    // These are the bytes the lockfile pins. If they do not unpack cleanly the
+    // source carries an anomaly, so the package cannot pass as merely uncached.
+    return sourceFromArtifact(bytes, "pip-cache");
   }
   return null;
 }

package/lib/deps/python/toml.js

@@ -5,13 +5,23 @@
  * tables, arrays of tables, dotted keys, basic/literal/multi-line strings,
  * integers, floats, booleans, dates (kept as strings), multi-line arrays and
  * inline tables. Not a validating parser: malformed input yields a best-effort
- * object or throws, never runs anything. Linear in the input size.
+ * object or throws, never runs anything. Linear in the input size. Arrays
+ * and inline tables nest at most MAX_DEPTH deep, so hostile input throws a
+ * TOML error instead of overflowing the stack.
  */
 
+const MAX_DEPTH = 200;
+
 class Reader {
   constructor(src) {
     this.s = src.replace(/\r\n/g, "\n");
     this.i = 0;
+    this.depth = 0;
+  }
+
+  /** Enter a nested array or inline table. */
+  nest() {
+    if (++this.depth > MAX_DEPTH) this.error(`nested deeper than ${MAX_DEPTH} levels`);
   }
 
   peek(n = 0) { return this.s[this.i + n]; }
@@ -123,11 +133,12 @@ class Reader {
   }
 
   array() {
+    this.nest();
     this.i++;
     const out = [];
     for (;;) {
       this.ws(true);
-      if (this.peek() === "]") { this.i++; return out; }
+      if (this.peek() === "]") { this.i++; this.depth--; return out; }
       if (this.eof()) this.error("unterminated array");
       out.push(this.value());
       this.ws(true);
@@ -137,11 +148,12 @@ class Reader {
   }
 
   inlineTable() {
+    this.nest();
     this.i++;
     const out = {};
     for (;;) {
       this.ws(true);
-      if (this.peek() === "}") { this.i++; return out; }
+      if (this.peek() === "}") { this.i++; this.depth--; return out; }
       if (this.eof()) this.error("unterminated inline table");
       const k = this.dottedKey();
       this.ws();

package/lib/deps/source.js

@@ -14,14 +14,22 @@ import { createHash } from "node:crypto";
 import { gunzipSync } from "node:zlib";
 import { homedir } from "node:os";
 
-const MAX_FILES = 5000;
+/**
+ * Most files a package may have. The same as the tarball entry cap, so any
+ * tarball the reader accepts is read whole. A source with more sets
+ * `truncated`, and the scan then fails closed (see scanPackage): files past
+ * the cap were never read, so the package cannot be called clean.
+ */
+export const MAX_FILES = 50_000;
 
 /** Files of an installed package folder. Skips nested node_modules and symlinks. */
 export class DirSource {
-  constructor(dir, { skip } = {}) {
+  constructor(dir, { skip, maxFiles = MAX_FILES } = {}) {
     this.dir = dir;
     this.kind = "installed";
     this.skip = skip || null;
+    this.maxFiles = maxFiles;
+    this.truncated = false;
   }
 
   files() {
@@ -32,13 +40,14 @@ export class DirSource {
       try { entries = readdirSync(d, { withFileTypes: true }); } catch { return; }
       entries.sort((a, b) => a.name.localeCompare(b.name));
       for (const e of entries) {
-        if (out.length >= MAX_FILES) return;
+        if (this.truncated) return;
         const p = join(d, e.name);
         if (e.isSymbolicLink()) continue;
         if (e.isDirectory()) {
           if (e.name === "node_modules" || e.name === ".git" || this.skip?.has(e.name)) continue;
           walk(p);
         } else if (e.isFile()) {
+          if (out.length >= this.maxFiles) { this.truncated = true; return; }
           out.push(relative(this.dir, p).split(sep).join("/"));
         }
       }
@@ -63,15 +72,17 @@ export class DirSource {
  * scanPackage). `oversize` maps files too large to hold to their real size.
  */
 export class MapSource {
-  constructor(map, kind = "npm-cache", { anomaly = null } = {}) {
+  constructor(map, kind = "npm-cache", { anomaly = null, maxFiles = MAX_FILES } = {}) {
     this.map = map;
     this.kind = kind;
     this.anomaly = anomaly;
     this.oversize = map.oversize || new Map();
+    this.truncated = map.size > maxFiles;
+    this.maxFiles = maxFiles;
   }
 
   files() {
-    return [...this.map.keys()].sort().slice(0, MAX_FILES);
+    return [...this.map.keys()].sort().slice(0, this.maxFiles);
   }
 
   size(rel) {
@@ -159,8 +170,10 @@ function parsePax(body) {
  * are listed in map.oversize (path -> size) instead of being copied.
  *
  * Fails closed: a bad checksum, a malformed or impossible size, a truncated
- * entry, or data after the end-of-archive marker throws TarError, so a crafted
- * archive can never show this reader different files than npm extracts.
+ * entry, data after the end-of-archive marker, or a pax global header that
+ * sets size, path or linkpath throws TarError. These are the ways known to
+ * make this reader frame entries differently from npm (node-tar); this is a
+ * small reader, not a proof that the two can never disagree.
  */
 export function untar(buf, { maxTotal = MAX_UNPACKED_BYTES, maxFile = MAX_FILE_BYTES } = {}) {
   const files = new Map();
@@ -200,8 +213,14 @@ export function untar(buf, { maxTotal = MAX_UNPACKED_BYTES, maxFile = MAX_FILE_B
       pax = parsePax(body);
       continue;
     }
-    if (type === "g") { // pax global header: validated, not used
-      parsePax(body);
+    if (type === "g") {
+      // pax global header. node-tar applies its keys to every later entry; this
+      // reader does not, so one that changes how entries are framed or named
+      // is refused rather than read differently from npm.
+      const g = parsePax(body);
+      for (const k of ["size", "path", "linkpath"]) {
+        if (Object.hasOwn(g, k)) throw new TarError(`pax global header sets ${k}`);
+      }
       continue;
     }
     if (type === "L") { // GNU long name

package/lib/deps/typosquat.js

@@ -2,7 +2,7 @@
  * Typosquat and slopsquat checks for npm and PyPI package names (`penthera deps`).
  *
  * Compares each dependency name against a vendored list of popular package
- * names (lib/deps/popular-packages.json, refreshed at release time by
+ * names (lib/deps/popular-packages.json.gz, refreshed at release time by
  * scripts/refresh-popular-packages.mjs; never fetched at runtime). A name that
  * is one or two edits away from a popular package, but is not itself popular,
  * is worth a second look: that is how `crossenv` (for cross-env) and
@@ -16,20 +16,44 @@
  * near-miss check, plus (with --online) a very young publish date.
  */
 import { readFileSync } from "node:fs";
+import { gunzipSync } from "node:zlib";
+import { rulesOf, rulesGeneration } from "../rules/index.js";
 
 const _popular = {};
-// PyPI's list is lib/deps/popular-pypi.json (scripts/refresh-popular-pypi.mjs).
-const LISTS = { npm: "./popular-packages.json", pypi: "./popular-pypi.json" };
+// PyPI's list is lib/deps/popular-pypi.json.gz (scripts/refresh-popular-pypi.mjs).
+// Both are gzipped JSON: they ship in the npm package, and gzip keeps that
+// within the release size budget without changing what is checked.
+const LISTS = { npm: "./popular-packages.json.gz", pypi: "./popular-pypi.json.gz" };
 
 /** The vendored popular-name list for an ecosystem: { source, names: string[] }. */
 export function loadPopular(ecosystem = "npm") {
   if (!_popular[ecosystem]) {
-    const data = JSON.parse(readFileSync(new URL(LISTS[ecosystem], import.meta.url), "utf-8"));
+    const data = JSON.parse(gunzipSync(readFileSync(new URL(LISTS[ecosystem], import.meta.url))).toString("utf-8"));
     _popular[ecosystem] = { ...data, ecosystem, set: new Set(data.names), rank: new Map(data.names.map((n, i) => [n, i + 1])) };
   }
   return _popular[ecosystem];
 }
 
+let _merged = null;
+let _mergedGen = -1;
+/**
+ * The popular list plus `typosquat-target` names from rule packs, ranked after
+ * the vendored list in pack order. Without pack names this is loadPopular().
+ */
+export function loadTargets() {
+  const base = loadPopular();
+  if (_mergedGen === rulesGeneration()) return _merged;
+  const extra = rulesOf("typosquat-target").flatMap((r) => r.names).filter((n) => !base.set.has(n));
+  if (extra.length === 0) {
+    _merged = base;
+  } else {
+    const names = [...base.names, ...new Set(extra)];
+    _merged = { ...base, names, set: new Set(names), rank: new Map(names.map((n, i) => [n, i + 1])) };
+  }
+  _mergedGen = rulesGeneration();
+  return _merged;
+}
+
 /** Damerau-Levenshtein (optimal string alignment) distance, capped at max+1. */
 export function editDistance(a, b, max = 2) {
   if (a === b) return 0;
@@ -114,7 +138,8 @@ export function checkName(name, popular = loadPopular()) {
  * @param {"npm"|"pypi"} ecosystem
  */
 export function findTyposquats(names, ecosystem = "npm") {
-  const popular = loadPopular(ecosystem);
+  // Pack typosquat targets are npm names.
+  const popular = ecosystem === "npm" ? loadTargets() : loadPopular(ecosystem);
   const out = [];
   for (const name of [...new Set(names)].sort()) {
     const hit = checkName(name, popular);